docs(security): refresh CVE reports after v3.1.0

[cursor]

Summary

• Re-ran the multi-scanner CVE suite (Trivy, Grype, Syft, osv-scanner, Dockle, Dive; Snyk/Scout skipped for missing auth) against poetry.lock after PR feat: v3.1.0 — lazy conversation labeling, off process shutdown (#65) #66 / v3.1.0.
• Only product finding remains diskcache==5.6.3 (CVE-2025-69872 / GHSA-w8v5-vhqr-4h9v); PyPI still has no patched release, so no pyproject.toml bumps were possible.
• Bumped OpenVEX to version 5 and refreshed tracked HTML reports under security/reports/.

Reports

• security/reports/cve-report.html — consolidated scanner status
• security/reports/human-review.html — FIX/IGNORE recommendations with rationale (all IGNORE for diskcache + proxy-image findings)
• security/vex/fastworkflow.openvex.json — accepted not_affected for diskcache

Test plan

• Syft SBOM from poetry.lock (141 packages)
• osv-scanner / Trivy / Grype agree on single MEDIUM diskcache finding with no fixed version
• Trivy + Grype with OpenVEX report 0 open lockfile vulns
• Dockle + Dive + Trivy image on proxy python:3.13-slim-bookworm (non-product)
• Confirmed diskcache latest on PyPI is still 5.6.3

  

Summary by Sourcery

Refresh security reporting artifacts after v3.1.0 by re-running the multi-scanner CVE suite and updating human-reviewed vulnerability rationale and VEX status.

Documentation:

• Add HTML CVE summary report documenting current scanner coverage, Python/package findings, and proxy-image vulnerabilities.
• Add HTML human-review report capturing FIX/IGNORE decisions and rationale for DiskCache and proxy image findings.
• Document the purpose and layout of tracked security reports in security/reports/README.md.

Chores:

• Update OpenVEX metadata in security/vex/fastworkflow.openvex.json to record DiskCache as not affected and align scanner suppression with the latest review.

[sourcery-ai]

Reviewer's Guide

This PR refreshes the security documentation by regenerating multi-scanner CVE outputs post v3.1.0, adding two structured HTML reports for scanner results and human review, and updating the OpenVEX manifest to mark the remaining diskcache advisory as not_affected, with a short README explaining the report layout and artifacts.

Flow diagram for refreshed multi-scanner CVE reporting and OpenVEX handling

flowchart LR
  A[make_security_scan] --> B[Syft_Trivy_Grype_osv_scanner_Dockle_Dive]
  B --> C[security-reports_JSON_SBOM]
  C --> D[cve-report_html]
  C --> E[human-review_html]
  F[fastworkflow_openvex_json_v5] --> B
  F --> E
  D --> G[Security_docs_consumers]
  E --> G

Loading

File-Level Changes

Change	Details	Files
Refresh and update OpenVEX manifest to reflect current diskcache vulnerability handling.	Increment OpenVEX document version to 5 and update metadata as needed Record diskcache CVE-2025-69872 / GHSA-w8v5-vhqr-4h9v as not_affected with justification vulnerable_code_cannot_be_controlled_by_adversary Align OpenVEX content with the latest multi-scanner outputs so Trivy/Grype report 0 open lockfile vulns	security/vex/fastworkflow.openvex.json
Add consolidated multi-scanner CVE status HTML report generated from the latest security scan run.	Create styled HTML page summarizing scanner run status, key KPIs, and Python/poetry.lock findings Document which tools ran successfully vs skipped with rationale (e.g., missing SNYK_TOKEN, Docker Hub auth, pip-audit environment issues) Capture single remaining diskcache advisory, its detection sources, and OpenVEX interaction Include proxy image High/Critical findings section explicitly marked as non-product, plus notes on additional non-product language package CVEs Describe locations of machine-readable artifacts and VEX/human-review files	security/reports/cve-report.html
Add human-review HTML report documenting FIX/IGNORE decisions for non-trivially-fixable vulnerabilities.	Create structured HTML listing each finding that requires human judgment and mark them as IGNORE with rationale Provide detailed justification for ignoring diskcache unsafe pickle CVE given threat model and absence of patched release Explain why proxy image OS CVEs and Dockle configuration findings are treated as non-product issues tied to a stand-in base image Summarize that no dependencies can be bumped via pyproject.toml for remediation in this cycle and outline optional future hardening steps	security/reports/human-review.html
Document the purpose and layout of tracked security HTML reports and associated artifacts.	Add README describing cve-report.html and human-review.html roles Clarify that JSON/SBOM outputs are written to a gitignored security-reports/ directory via make security-scan Note that OpenVEX acceptances are stored under the VEX manifest path	security/reports/README.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.