docs(security): CVE multi-scanner report refresh after v3.0.1

[cursor]

Summary

Post-merge refresh of the multi-scanner CVE automation after PR #63 (v3.0.0 / v3.0.1).

Scanner coverage

Ran Trivy, Grype, Syft, osv-scanner, Dockle, and Dive. Snyk and Docker Scout were skipped (missing SNYK_TOKEN / Docker Hub login). pip-audit was skipped in this environment (no usable venv/ensurepip); OSV/Trivy/Grype cover the same graph.

Easy pyproject.toml fixes

None. Full OSV sweep of 141 locked PyPI packages found only diskcache==5.6.3 (CVE-2025-69872 / GHSA-w8v5-vhqr-4h9v / PYSEC-2026-2447), and PyPI still has no patched release.

Artifacts

• security/reports/cve-report.html — consolidated scanner status
• security/reports/human-review.html — FIX/IGNORE recommendations with rationale (all IGNORE for current findings)
• security/vex/fastworkflow.openvex.json — re-verified OpenVEX for diskcache (version 4)

Proxy image note

Dockle/Dive/Trivy-image used python:3.13-slim-bookworm (aligned with the Python 3.13+ runtime floor). Distro CVEs there are not product findings — this repo ships as a PyPI package and has no first-party Dockerfile.

Test plan

• Syft SBOM from poetry.lock
• Trivy/Grype with OpenVEX → 0 open Python vulns
• osv-scanner confirms single unfixed diskcache advisory
• Dockle + Dive against proxy image
• Optional: re-run with SNYK_TOKEN / docker login when credentials are available

  

Summary by Sourcery

Refresh CVE automation artifacts and reporting for the fastWorkflow v3.0.x release.

New Features:

• Add a consolidated HTML CVE report summarizing multi-scanner results and proxy image findings.
• Add a human-review HTML report documenting FIX/IGNORE decisions and security rationale for outstanding vulnerabilities.

Enhancements:

• Update the tracked OpenVEX file to reflect the latest assessment of the diskcache advisory and scanner behavior.

Documentation:

• Add README documentation for the security reports directory, explaining the purpose of HTML reports, machine-readable artifacts, and OpenVEX location.

[cursor]

CVE automation assessment

This PR lands the post-#63 scanner refresh only (docs + OpenVEX). No dependency pin changes were possible.

Product graph: OSV/Trivy/Grype agree on a single MEDIUM finding (diskcache pickle RCE). No fixed version exists; OpenVEX v4 keeps it not_affected for supported deployments (DSPy cache dir not attacker-writable).

Human-review HTML: all recommendations are IGNORE (diskcache accepted via VEX; proxy-image Dockle/OS CVEs out of product scope).

Gaps to close later: configure SNYK_TOKEN and Docker Hub login for Scout; optional first-party Dockerfile if image CVEs should enter product backlog.

View PR

  

_{Sent by Cursor Automation: Untitled}

[sourcery-ai]

Reviewer's Guide

This PR refreshes the CVE multi-scanner automation outputs after v3.0.1, adding human-readable HTML reports, documenting scanner coverage and findings, and updating the OpenVEX file to reflect the current diskcache advisory status and proxy-image CVEs.

Flow diagram for updated CVE multi-scanner reporting pipeline

flowchart TD
  dev[Developer runs make security-scan]
  cmd[make security-scan]
  scanners[Security scanners
  Syft / Trivy / Grype /
osv-scanner / Dockle / Dive]
  json[Machine-readable outputs
  security-reports/ *.json]
  html_cve[cve-report.html
  consolidated scanner status]
  html_hr[human-review.html
  FIX/IGNORE rationale]
  vex[fastworkflow.openvex.json
  OpenVEX acceptances]

  dev --> cmd --> scanners --> json
  json --> html_cve
  json --> html_hr
  json --> vex
  vex --> html_cve
  vex --> html_hr

Loading

File-Level Changes

Change	Details	Files
Add a consolidated CVE scanner status HTML report for the project.	Introduce a styled HTML dashboard summarizing Python advisories, OpenVEX impact, and proxy-image CVEs. Document the execution status and notes for Syft, Trivy, Grype, osv-scanner, pip-audit, Snyk, Docker Scout, Dockle, and Dive. Describe pre-VEX Python findings and explain the effect of the OpenVEX file on Trivy/Grype results. Clarify that proxy-image CVEs from the python:3.13-slim-bookworm base are not product vulnerabilities.	security/reports/cve-report.html
Add a human-review HTML report with FIX/IGNORE recommendations and rationale for security findings.	Summarize the diskcache advisory, why it cannot be remediated via pyproject.toml, and justify an IGNORE decision under OpenVEX. Explain why OS-level CVEs on the proxy container image and Dockle CIS findings are treated as non-product and marked IGNORE. Record that no dependencies in the locked graph currently have fixable versions, so no pyproject.toml changes are made. Outline optional future actions such as enabling Snyk/Docker Scout and adding a first-party Dockerfile if image hardening becomes in-scope.	security/reports/human-review.html
Document the purpose and location of the security HTML reports and supporting artifacts.	Add a README explaining the roles of the CVE report and human-review HTML files. Clarify that machine-readable JSON/SBOM artifacts are generated locally into a gitignored directory via the security-scan make target. Reference the OpenVEX file as the canonical location for vulnerability acceptances.	security/reports/README.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.