[Security Scan] 2026-W28

[github-actions]

Weekly Supply Chain Security Scan

• Run date: 2026-07-06 05:46:27 UTC
• Trigger: schedule
• Workflow run: https://github.com/unidoc/unisupply/actions/runs/28770541825

Risk Summary

• Risk level: HIGH
• Risk score: 51
• govulncheck exit code: 0 (3 = call-graph-reachable vulnerability)
• Stale dependencies (>90 days): false

Top Findings

See the workflow run for full SARIF (gosec) and JSON (govulncheck, unisupply) output.
The gosec findings are also visible under Security → Code scanning.

Stale Dependencies

Direct dependencies with available updates

(none)

Dependencies older than 90 days

(none)

---

Closure guidance

Close this issue only after the underlying findings are actioned (e.g.
dependency bumps merged, vulnerabilities resolved, annotations added). Closing
the issue does not silence future scans — a fresh issue is filed each ISO week.