Merge remote-tracking branch 'remotes/from/ce/main'

Author: hc-github-team-secure-vault-core

.github/workflows/changelog-checker.yml

@@ -16,6 +16,10 @@ jobs:
     # If there  a `pr/no-changelog` label we ignore this check
     if: "!contains(github.event.pull_request.labels.*.name, 'pr/no-changelog')"
     runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-22.04-x64"]') }}
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.release/security-scan.hcl

@@ -10,17 +10,21 @@ binary {
   triage {
     suppress {
       vulnerabilities = [
-        "GO-2022-0635", // github.com/aws/aws-sdk-go@v1.x
+        // GO-2022-0635 is valid. We will remove this when the ongoing migration
+        // to github.com/aws/aws-sdk-go/v2 has been completed.
+        "GO-2022-0635",
         // GO-2026-5932 appears to be a false positive as it only relates to
         // golang.org/x/crypto/openpgp, which is not in use in the project.
         // https://pkg.go.dev/vuln/GO-2026-5932
         "GO-2026-5932",
-        // GO-2026-5856 and GO-2026-4970 appear to be false positives as we're
-        // currently on Go >= 1.26.5 and >= 1.25.12 and these were fixed in
-        // those versions
-        // https://pkg.go.dev/vuln/GO-2026-5856
-        // https://pkg.go.dev/vuln/GO-2026-4970
-        "GO-2026-5856", "GO-2026-4970",
+        // GO-2026-5298 appears to be a false positive as the associated
+        // Github Security Advisory shows that v0.6.1 contains the fix.
+        // The issue has been reported but the advisory has not been updated
+        // yet.
+        // https://pkg.go.dev/vuln/GO-2026-5298
+        // https://github.com/google/go-attestation/security/advisories/GHSA-9r4w-jg96-92mv
+        // https://github.com/golang/vulndb/issues/5795
+        "GO-2026-5298",
       ]
     }
   }
@@ -37,22 +41,21 @@ container {
   triage {
     suppress {
       vulnerabilities = [
-        "GO-2022-0635", // github.com/aws/aws-sdk-go@v1.x
-        // This appears to be a false positive. Busybox >= 1.34 is unaffected
-        // https://security.alpinelinux.org/vuln/CVE-2021-42376
-        // For some reason the OSV entry for fixed is 0 when it should be 1.34:
-        // https://osv.dev/vulnerability/ALPINE-CVE-2021-42376
-        "ALPINE-CVE-2021-42376", "CVE-2021-42374",
+        // GO-2022-0635 is valid. We will remove this when the ongoing migration
+        // to github.com/aws/aws-sdk-go/v2 has been completed.
+        "GO-2022-0635",
         // GO-2026-5932 appears to be a false positive as it only relates to
         // golang.org/x/crypto/openpgp, which is not in use in the project.
         // https://pkg.go.dev/vuln/GO-2026-5932
         "GO-2026-5932",
-        // GO-2026-5856 and GO-2026-4970 appear to be false positives as we're
-        // currently on Go >= 1.26.5 and >= 1.25.12 and these were fixed in
-        // those versions
-        // https://pkg.go.dev/vuln/GO-2026-5856
-        // https://pkg.go.dev/vuln/GO-2026-4970
-        "GO-2026-5856", "GO-2026-4970",
+        // GO-2026-5298 appears to be a false positive as the associated
+        // Github Security Advisory shows that v0.6.1 contains the fix.
+        // The issue has been reported but the advisory has not been updated
+        // yet.
+        // https://pkg.go.dev/vuln/GO-2026-5298
+        // https://github.com/google/go-attestation/security/advisories/GHSA-9r4w-jg96-92mv
+        // https://github.com/golang/vulndb/issues/5795
+        "GO-2026-5298",
       ]
 
       // The OSV scanner will trip on several packages that are included in the