[teemow]

Problem

govulncheck -mode=binary reports GO-2026-5932 in every beekeeper release binary (v0.126.0, v0.127.0, v0.127.1-rc.1 alike): golang.org/x/crypto/openpgp is unmaintained with no fixed version, and internal/update reaches it through github.com/creativeprojects/go-selfupdate v1.6.0, whose PGPValidator imports it unconditionally, although beekeeper verifies cosign bundles and never a PGP signature.

#931 also states that no CI job runs nancy. That premise is wrong: the architect orb's go-build job runs nancy on every PR and tag (its go-test command's step "Check if dependencies have known security vulnerabilities", nancy 2.1.0 from the architect 8.6.0 image). The v0.127.0 tag pipeline's go-build job audited 149 dependencies, 0 vulnerable, 0 ignored. nancy reads Sonatype's OSS Index, which carries no Go vulnerability database id, so a .nancy-ignore entry for GO-2026-5932 would match nothing; the advisory is made to go away instead.

Renovate's bump of selfupdate-cosign to v0.3.4 (#887) is red for the same reason: v0.3.4 imports the Giant Swarm go-selfupdate line, and the two module paths meet in internal/update (cannot use up (*creativeprojects/go-selfupdate.Updater) as *giantswarm/go-selfupdate.Updater value in argument to selfupdatecosign.Install).

Root cause

beekeeper imports upstream go-selfupdate directly, while the Giant Swarm CLIs take the github.com/giantswarm/go-selfupdate line, which carries the one patch upstream holds for its v2 (creativeprojects/go-selfupdate#58): PGPValidator on github.com/ProtonMail/go-crypto/openpgp, the maintained fork the advisory recommends.

Solution

• internal/update imports github.com/giantswarm/go-selfupdate v1.6.2 and github.com/giantswarm/selfupdate-cosign v0.3.4, which imports the same line. go mod tidy drops creativeprojects/go-selfupdate and adds ProtonMail/go-crypto v1.4.1 and cloudflare/circl v1.6.3. go list -deps ./... lists no golang.org/x/crypto/openpgp package any more. Supersedes #887.
• .nancy-ignore: the five entries matched nothing (pgx is v5.11.0, not the v5.8.0 they name; otlptrace is replaced to v1.46.0, not v1.44.0; goleveldb is no longer in the module graph; the CI summary shows 0 ignored) and are removed. A new finding gets its own time-boxed entry with an issue, as before.

Acceptance criteria

• This PR's go-build job runs nancy green.
• govulncheck -mode=binary on the linux/amd64 binary of the release this merge cuts reports no GO-2026-5932.

Closes #931

Written by an agent.