[chen21019]

Correction

The final Server scan correctly rejected three GO-2026-5932 occurrences after the authentication and machine-driver upgrades. Their original component releases already carry independently verified OpenPGP-absence dispositions for x/crypto v0.57.0; the Server still referenced only older module versions.

This carries the reviewed disposition into the consumer without weakening the UNKNOWN/fixed-version gate. Before VEX is applied, every affected executable must match its exact reviewed path, module version and binary SHA256. An additional consumer, changed producer payload or new module version stops publication.

Validation

• Eleven coverage/payload tests pass, including unreviewed paths, versions, changed bytes, missing payload rejection and clean scans without findings.
• The original failed-publisher raw report passes against all five original, hash-matched component binaries, without a rebuild or a new scan.
• Authentication and machine-driver original source/symbol analysis and release VEX remain the evidence source. The three UNKNOWN rows are not added to the unfixed LOW/MEDIUM tracker.
• No runtime code, authentication policy, production configuration or database changes.

Normal required checks, final image scanning and deployment QA remain required.