HttpFeed - cleanup event filtering

[DamianZaremba]

• Structure received/skipped metrics
• Add parse failure metric

---

This is part 3 of 6 in a stack made with GitButler:

•  6  getCbData - refactor logic #103
•  5  Db - refactor logic #105
•  4  Metrics - always enable & seed known labels #102
•  3  HttpFeed - cleanup event filtering #104 👈
•  2  Action - set last contribution time #101
•  1  fetchRevisionData - add basic retry #99

[github-actions]

Trivy Security Scan

cnb/lifecycle/launcher

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	v1.26.2	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822	os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	1.26.2	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822	os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	1.26.2	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822	os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header