docs(security): CVE multi-scanner report refresh after v2.31.0

[cursor]

Summary

Post-merge refresh of the multi-scanner CVE automation after PR #61 (v2.31.0 — speedict→sqlite3, Python 3.13+).

Scanner coverage

Ran Trivy, Grype, Syft, osv-scanner, Dockle, and Dive. Snyk and Docker Scout were skipped (missing SNYK_TOKEN / Docker Hub login).

Easy pyproject.toml fixes

None. Full OSV sweep of 141 locked PyPI packages found only diskcache==5.6.3 (CVE-2025-69872 / GHSA-w8v5-vhqr-4h9v / PYSEC-2026-2447), and PyPI still has no patched release.

Artifacts

• security/reports/cve-report.html — consolidated scanner status
• security/reports/human-review.html — FIX/IGNORE recommendations with rationale (all IGNORE for current findings)
• security/vex/fastworkflow.openvex.json — re-verified OpenVEX for diskcache (version 3)

Proxy image note

Dockle/Dive/Trivy-image used python:3.13-slim-bookworm (aligned with the new runtime floor). Distro CVEs there are not product findings — this repo ships as a PyPI package and has no first-party Dockerfile.

Test plan

• Syft SBOM from poetry.lock
• Trivy/Grype with OpenVEX → 0 open Python vulns
• osv-scanner confirms single unfixed diskcache advisory
• Dockle + Dive against proxy image
• Optional: re-run with SNYK_TOKEN / docker login when credentials are available

  

Summary by Sourcery

Add refreshed CVE multi-scanner security reports and documentation for the current dependency graph and runtime floor.

Enhancements:

• Update the tracked OpenVEX file to reflect the latest assessment of the diskcache advisory and current scanner results.

Documentation:

• Document the purpose and contents of the HTML security reports and related machine-readable artifacts.

Chores:

• Add consolidated CVE report and human-review HTML artifacts capturing scanner status, findings, and FIX/IGNORE decisions, including proxy image notes aligned with Python 3.13.

[sourcery-ai]

Reviewer's Guide

This PR refreshes the multi-scanner CVE automation outputs after v2.31.0, updating the OpenVEX file and adding tracked HTML reports and documentation for security scan artifacts, without changing runtime code or dependencies.

Flow diagram for updated multi-scanner CVE automation reports

flowchart TD
  Developer[Developer] --> Make_security_scan[make security-scan]
  Make_security_scan --> Syft[Syft]
  Make_security_scan --> Trivy[Trivy]
  Make_security_scan --> Grype[Grype]
  Make_security_scan --> Osv_scanner[osv-scanner]
  Make_security_scan --> Dockle[Dockle]
  Make_security_scan --> Dive[Dive]

  Syft --> Security_reports_dir[security-reports/ JSON+SBOM]
  Trivy --> Security_reports_dir
  Grype --> Security_reports_dir
  Osv_scanner --> Security_reports_dir
  Dockle --> Security_reports_dir
  Dive --> Security_reports_dir

  Make_security_scan --> Openvex_file[security/vex/fastworkflow.openvex.json]
  Openvex_file --> Trivy
  Openvex_file --> Grype

  Make_security_scan --> Cve_report_html[security/reports/cve-report.html]
  Make_security_scan --> Human_review_html[security/reports/human-review.html]

  Security_reports_dir -.gitignored artifacts.-> Developer
  Cve_report_html --> Developer
  Human_review_html --> Developer

Loading

File-Level Changes

Change	Details	Files
Add a consolidated multi-scanner CVE status HTML report for fastWorkflow.	Introduce a styled HTML dashboard summarizing scanner runs, Python/package findings, and proxy-image CVEs. Document scanner coverage (Syft, Trivy, Grype, osv-scanner, pip-audit, Dockle, Dive) including skipped tools and OpenVEX effects. Expose key metrics such as advisory counts, fixability via pyproject.toml, and proxy-image High/Critical distro CVEs. Link machine-readable outputs and OpenVEX usage from within the report.	security/reports/cve-report.html
Add a human-review HTML report that records FIX/IGNORE decisions and rationale for security findings.	Create a structured HTML report listing vulnerabilities that need human review, each with FIX/IGNORE recommendation badges. Capture detailed rationale for treating diskcache pickle deserialization and proxy-image OS CVEs as IGNORE (not product or no fix available). Summarize the outcome of the pyproject.toml "easy fix" sweep and prior dependency floor work. Note optional future actions (enabling Snyk/Scout, introducing a first-party Dockerfile) without making code changes now.	security/reports/human-review.html
Update OpenVEX metadata to re-verify diskcache and align with the latest scan context.	Refresh OpenVEX statements for the diskcache advisory, keeping it marked as not_affected with justification that vulnerable code cannot be controlled by an adversary. Ensure the VEX file version and context align with the post-v2.31.0 dependency graph and scanner runs.	security/vex/fastworkflow.openvex.json
Document tracked HTML reports and machine-readable security artifacts.	Add a README explaining the purpose of the HTML reports and where machine-readable JSON/SBOM artifacts are written. Clarify that HTML reports are tracked while security-reports/ JSON outputs are gitignored and produced via make security-scan. Point to the location of OpenVEX acceptances for fastWorkflow.	security/reports/README.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.