chore: regenerate fixture results for Trivy DB update

[andrzej-janczak]

Summary

• Regenerates all results.xml fixture files to match the current Trivy vulnerability DB
• Fixes failing plugins_test CI on the dependabot/go_modules/golang.org/x/mod-0.36.0 PR (and on master if it hasn't been fixed there yet)
• Adds scripts/regenerate_fixtures.py for future DB updates

Root cause

The Trivy DB is downloaded fresh on every CI run. Since the fixtures were last generated:

• CVE descriptions changed (e.g. CVE-2024-24790, CVE-2024-36039 have different text in the DB)
• New CVEs added: axios CVE-2026-42038, CVE-2026-42039, CVE-2026-42041, CVE-2026-42042
• CVE-2025-61730 (golang stdlib, medium) no longer reported by the current DB

The golang.org/x/mod version bump is unrelated — only go.mod/go.sum changed in the dependabot branch.

Test plan

• CI plugins_test passes on this branch
• No source code changes — fixture data only

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request updates several test fixture XML files with new vulnerability descriptions and formatting, bumps Go dependencies in go.mod, and introduces a Python script to automate fixture regeneration. The review feedback recommends making the script more robust by resolving paths relative to the script's location and using POSIX-compliant paths to prevent compatibility issues on Windows when running Docker.

[codacy-production]

Not up to standards ⛔

🔴 Issues 2 critical · 1 high · 4 medium · 2 minor

Alerts:
⚠ 7 issues (≤ 1 issue of at least medium severity)
⚠ 7 issues (≤ 0 issues of at least minor severity)

Results:
9 new issues

Category	Results
Security	1 minor (1 false positive) 1 high (1 false positive) 2 critical (2 false positives) 3 medium (3 false positives)
CodeStyle	1 minor
Complexity	1 medium

View in Codacy

🟢 Metrics 26 complexity · 0 duplication

Metric	Results
Complexity	26
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR fails to meet quality standards primarily due to the introduction of a high-complexity, uncovered script (scripts/regenerate_fixtures.py) and the use of a Go version (1.25.8) that is vulnerable to critical security issues (CVE-2026-39826, CVE-2026-39823, CVE-2026-39825).

While the automation of fixture regeneration is beneficial, the current implementation of the script is fragile—using string concatenation for XML and failing to flush temporary files before subprocess execution. Furthermore, there is a contradiction in the logic regarding CVE-2025-61730, which the description claims is removed but remains present in the code changes. Missing unit tests for the script's parsing and deterministic sorting must be addressed before merging.

About this PR

• The PR description states that CVE-2025-61730 is no longer reported, yet it remains included in the diff for 'pattern-vulnerability-medium/results.xml'. Please verify if the fixture regeneration was successful or if the description needs updating.
• The regeneration script relies on the 'codacy-trivy:latest' docker image. Using a fixed version or digest would ensure more deterministic fixture generation over time and prevent unexpected breakage if the latest image changes.

1 comment outside of the diff

go.mod

_{line 3 🔴 HIGH RISK}
Update the Go version to 1.25.10 to address critical security vulnerabilities in the standard library (CVE-2026-39826, CVE-2026-39823, CVE-2026-39825) affecting html/template escaping and URL/ReverseProxy handling.

Test suggestions

• The regeneration script correctly extracts pattern IDs from patterns.xml files
• The regeneration script correctly maps pattern levels to Checkstyle severities
• The regeneration script handles XML special characters escaping in vulnerability messages
• The regeneration script produces deterministic output by sorting issues by filename and line
• Unit tests for run_tool to ensure correct .codacyrc generation (missing coverage)

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. The regeneration script correctly extracts pattern IDs from patterns.xml files
2. The regeneration script correctly maps pattern levels to Checkstyle severities
3. The regeneration script handles XML special characters escaping in vulnerability messages
4. The regeneration script produces deterministic output by sorting issues by filename and line
5. Unit tests for run_tool to ensure correct .codacyrc generation (missing coverage)

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[stefanvacareanu7]

The tests are passing, good to go