7 Commits (a50328c191fc5115c244f28fbcc7e786bba9bd16)

Author	SHA1	Message	Date
hc-github-team-consul-core	ac57f563b1	Backport of ci(security-scanner): add support for Red Hat UBI images and fix typo into release/1.20.x (#21913) ... * backport of commit 8237ce01fe * backport of commit f7dc68f1c8 * backport of commit 5610471f0e --------- Co-authored-by: dduzgun-security <deniz.duzgun@hashicorp.com> Co-authored-by: Deniz Onur Duzgun <59659739+dduzgun-security@users.noreply.github.com>	3 weeks ago
Deniz Onur Duzgun	1a62917ad1	security: triage vendor alerts (#21716) ... * security: triage vendor alerts * add wildcard to vendor	3 months ago
Deniz Onur Duzgun	574f53d176	security: enable go stdlib scans (#20905) ... * security: enable go stdlib scans * security: enable go stdlib binary scan * Fix formating	6 months ago
Michael Zalimeni	86b0818c1f	[NET-8601] security: upgrade vault/api to remove go-jose.v2 (#20910) ... security: upgrade vault/api to remove go-jose.v2 This dependency has an open vulnerability (GO-2024-2631), and is no longer needed by the latest `vault/api`. This is a follow-up to the upgrade of `go-jose/v3` in this repository to make all our dependencies consolidate on v3. Also remove the recently added security scan triage block for GO-2024-2631, which was added due to incorrect reports that `go-jose/v3@3.0.3` was impacted; in reality, is was this indirect client dependency (not impacted by CVE) that the scanner was flagging. A bug report has been filed to address the incorrect reporting.	7 months ago
Michael Zalimeni	159fcfb2fa	security: ignore test and internal tool modules (#20963)	8 months ago
Michael Zalimeni	cc959dcdf4	security: triage false positive for go-jose/v3 (#20901) ... Per https://osv.dev/vulnerability/GO-2024-2631 this vulnerability is not present in the version currently used (go-jose/v3@3.0.3).	8 months ago
Michael Zalimeni	d0bc091a60	[NET-6969] security: Re-enable Go Module + secrets security scans for release branches (#19978) ... * security: re-enable security scan release block This was previously disabled due to an unresolved false-positive CVE. Re-enabling both secrets and OSV + Go Modules scanning, which per our current scan results should not be a blocker to future releases. * security: run security scans on main and release branches	11 months ago