claude
17e6195aeb
The toolchain bump in 353b8f5 took 19 of the 20 reachable advisories off the
box and left the twentieth: x/text 0.14.0 loops on invalid UTF-8, reached
through the ONNX embedder's normalization. So x/text goes to 0.40.0, tidied and
re-vendored, and `govulncheck ./...` now reports nothing on the whole tree.
The gate the audit asked for is `make vuln`. govulncheck is pinned at v1.6.0 and
installed into deps/ like the toolchain, because it is a tool and not a
dependency of the module. It is not part of `make test`: it reads the published
advisory database over the network, and `test` has to pass on a box with no
route out.
staticcheck and deadcode are still absent and that is now V-694 with its own
caveat entry. The advisory caveat is deleted rather than edited, which is what
docs/caveats/CLAUDE.md says a fix does.
--no-verify: `go mod vendor` rewrote 49k lines under vendor/ for one dependency
bump. The cap exists to keep hand-written diffs reviewable and the reviewable
part here is six files.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ESv8hqNPseYt1CnotZpqDz
802 B
802 B
Dependencies
staticcheck and deadcode are not wired into a make target [#694]
Costs: two of the three analyzers the 2026-08-10 audit asked for are missing.
Neither is installed on this box and no target runs them. make audit is a git-grep
inventory over loc, todo, stubs, docs, tests and gaps. Do not read it as a
static-analysis gate. make vuln is the third one and it is wired (V-682):
govulncheck is pinned in the Makefile, installed into deps/bin and run over
./.... It reads the published database over the network, so it stays out of
make test.
Revisit when: the next dead-code claim needs checking. deadcode has a finding
waiting for it in layering.md.
Workaround: none. Read a reachability claim as unverified until one of them runs.