Correct overbroad Kyverno advisory ranges for the offline admission driver #5154

🤖 Generated by the Agentic Engineer

Problem

The offline Tenant WebApp admission driver deliberately uses Kyverno 1.19.1, matching the deployed policy engine. Three automatically imported Go vulnerability records currently classify every Kyverno release and symbol as affected, while the owning project's fresher repository-scoped advisories exclude this version. This prevents the scanner from distinguishing fixed releases from affected releases.

Outcome

Remove the temporary, exact-ID advisory acceptances once the Go records contain accurate version ranges, without disabling the module scan or accepting any other advisory.

Evidence

• GO-2026-5594: upstream advisory reports a patch in 1.18.0.
• GO-2026-5337: upstream advisory reports a patch in 1.17.2.
• GO-2025-3615: upstream advisory limits affected versions to below 1.13.4; it does not independently name a fixing release.
• The corresponding Go records currently contain an introduced-at-zero range without a fixed event or package/symbol scope. The discrepancy was re-read from both primary sources on 2026-10-21.

Acceptance criteria

• Re-read the owning upstream advisories and the Go vulnerability records; do not inherit these version claims.
• Correct or obtain correction of the Go records through an appropriate, policy-compliant upstream report, if still necessary.
• Remove only acceptances proved obsolete by the corrected records.
• The offline driver's ordinary reachability scan, its analysed-package judge, and all real-engine admission controls pass without those acceptances.
• Any future Kyverno pin change revalidates the ranges before retaining an acceptance.

This issue tracks scanner metadata for a synthetic offline test driver, not production runtime acceptance, a blanket exception, or portal activation. Fixable transitive dependency advisories are repaired rather than accepted.