nancy flags grpc v1.84.0 for CVE-2026-84445 (a false range match) #214

Problem

nancy (Sonatype OSS Index) flags google.golang.org/grpc@v1.84.0 for CVE-2026-84445 (CVSS 8.7), and the scan fails go-build. That failure stopped the v1.7.0 tag pipeline: the release has no image and no chart.

GitHub's advisory GHSA-2v4p-qf9q-27wj lists the patched versions as 1.82.2, 1.83.2 and the 1.84/1.85 dev lines from 2026-08-25. 1.84.0 was released on 2026-09-17, after that fix, so it is not affected, and no newer grpc release exists to bump to. The vulnerable path is also xDS servers (xds.NewGRPCServer), which model-manager does not use.

Proposed solution

A time-boxed .nancy-ignore entry for CVE-2026-84445 on grpc v1.84.0 that points at this issue, as agent-manager (giantswarm/agent-manager#84) and gitops-commit (giantswarm/gitops-commit#17) did. Remove it once OSS Index corrects the range, or once grpc v1.84.1 or later lands through Renovate.

Acceptance criteria

• The v1.7.0 successor release publishes the image and the chart.
• The ignore entry carries until= and is removed when the index or a newer grpc makes it redundant.