claude
c0f4074a5d
Nineteen of the twenty findings were open, and they lived in an untracked audit.md at the repo root that no next session would have read. The one that is closed, the unauthenticated mavgpud proxy, went out as V-673. The report is now a frozen measurement under docs/evals/, dated and never edited again — including when a finding it names gets fixed. The live state moved to docs/caveats/, one entry per limit, each carrying its Vikunja id and the condition that makes it worth fixing. A caveat with no revisit trigger is a complaint, so every entry has one. Closing a limit deletes its entry rather than editing the measurement that found it. Two directory indexes come with it. docs/CLAUDE.md states the tier rule the repo already followed by convention: living docs corrected in place, evals frozen by date, caveats deleted when fixed. docs/caveats/CLAUDE.md indexes the nineteen by claim and severity, because an index of filenames adds nothing a directory listing does not. Tasks V-675 through V-693 carry the plans. The doc line and the tracker now join in both directions. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ESv8hqNPseYt1CnotZpqDz
848 B
848 B
Dependencies
Go 1.25.5 and x/text 0.14.0 carry 20 reachable advisories [#682]
Costs: govulncheck found 20 reachable advisories, one in x/text and 19 in
the standard library. They include template XSS, parser denial of service and
TLS issues. Reachable traces run through the ONNX embedder's normalization,
mavweb's HTML rendering, email header decoding and the mavgpud proxy. The
vendored toolchain was built 2025-11-26.
Revisit when: now. This is the highest-severity open entry and the fix is
mechanical, so it ages badly for no reason.
Workaround: none.
None of staticcheck, govulncheck or deadcode is installed on this box or
wired into a make target. make audit is a git-grep inventory over loc, todo,
stubs, docs, tests and gaps. Do not read it as a static-analysis gate. That
gate is part of this entry.