siderolabs · talos-bot · Sep 3, 2026 · Aug 14, 2026 · Aug 24, 2026 · Aug 24, 2026
diff --git a/.disvulncheck.yaml b/.disvulncheck.yaml
@@ -1,9 +1,6 @@
 ignore_ttl: 168h # 7 days, each entry must be revalidated after this time, and either removed or renewed (with a new date)
 
 ignore:
-  - id: GO-2026-5932
-    reason: No fix available. golang.org/x/crypto/openpgp is imported transitively because Cosign pulls Rekor's legacy rekord/v0.0.1 PGP implementation. Talos verifies Sigstore/X.509 signatures and does not use PGP; Cosign's legacy .sig path is an OCI storage format, not PGP. The reported PCR, error, io.Reader/io.Writer, and DSSE-to-rekord call chains are govulncheck VTA interface/factory false positives.
-    date: 2026-08-24
   - id: GO-2026-4736
     reason: 'gobgp NEXT_HOP DoS (GHSA-4p9m-8gc4-rw2h). The reachable recvMessageloop symbol is real, but the advisory records no fixed version, so govulncheck flags every version. Fix commit osrg/gobgp 583080a7 is an ancestor of pinned commit 2132288c5159, whose source skips ValidateUpdateMsg when parsing has already selected error handling, so it is not affected.'
-    date: 2026-08-24
+    date: 2026-08-31
diff --git a/.gitattributes b/.gitattributes
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
diff --git a/.github/workflows/integration-extensions-libvirt-triggered.yaml b/.github/workflows/integration-extensions-libvirt-triggered.yaml
diff --git a/.github/workflows/integration-misc-2-triggered.yaml b/.github/workflows/integration-misc-2-triggered.yaml
diff --git a/.github/workflows/slack-notify-ci-failure.yaml b/.github/workflows/slack-notify-ci-failure.yaml
diff --git a/.github/workflows/slack-notify.yaml b/.github/workflows/slack-notify.yaml