source/github: go-github v39 pulls in unmaintained golang.org/x/crypto/openpgp (GO-2026-5932) #1410

Summary

The GitHub source driver (source/github) pins github.com/google/go-github/v39, which transitively pulls golang.org/x/crypto/openpgp into the build graph. That package is the subject of GO-2026-5932:

The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.

The advisory is module-level with no fixed version and no specific vulnerable symbol, so govulncheck reports it for anyone whose build imports it — including every downstream user who enables the github source driver. It cannot be cleared by avoiding a code path; the package has to leave the module graph.

Where it comes from

source/github/github.go imports github.com/google/go-github/v39/github. go-github v39 references golang.org/x/crypto/openpgp in its commit-signature verification code (google/go-github#2317). The source driver only calls the repository-contents API (Repositories.GetContents / DownloadContents) and never touches the signing path, but govulncheck still surfaces the finding because openpgp is present in the build.

Impact

• Downstream services that run govulncheck (e.g. as a CI gate) fail on GO-2026-5932 purely by importing the github source driver.
• There is no suppression that isn't a policy exception, since the advisory has no fixed version.