{ "history": [ { "added": 0, "commit": "26e2f4784ca61353082c32dbd987c25eda086dc9", "date": "2026-11-01", "dependencies": 207, "errors": [], "fixable": 18, "go_version": "go1.26.5", "in_binary": { "dependencies": 10, "stdlib": 21, "total": 31 }, "new_vulnerabilities": 0, "osv_confirmed": 19, "osv_only": 1, "ref": "v3.13.3", "release_changed": false, "release_integrity": "verified", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": null, "upgraded": 0, "vulnerabilities": { "Critical": 1, "High": 11, "Low": 1, "Medium": 3, "Negligible": 0, "Unknown": 3 }, "workflow": { "High": 3, "Low": 0, "Medium": 0, "files": 5 } }, { "added": 0, "commit": "26e2f4784ca61353082c32dbd987c25eda086dc9", "date": "2026-11-02", "dependencies": 166, "errors": [], "fixable": 18, "go_version": "go1.26.5", "in_binary": { "dependencies": 12, "stdlib": 19, "total": 31 }, "kev": 0, "kev_new": 0, "new_vulnerabilities": 0, "osv_confirmed": 19, "osv_only": 0, "ref": "v3.13.3", "release_changed": false, "release_integrity": "verified", "removed": 41, "resolved_vulnerabilities": 0, "scorecard": null, "scorecard_date": null, "scorecard_note": "the project is not in the OpenSSF public dataset; the Scorecard CLI fallback was skipped because this shard's weekly budget was used", "scorecard_source": null, "upgraded": 0, "vulnerabilities": { "Critical": 1, "High": 11, "Low": 1, "Medium": 3, "Negligible": 0, "Unknown": 3 }, "vulnerable_packages": 6, "workflow": { "High": 3, "Low": 0, "Medium": 0, "files": 5 } } ], "latest": { "archived": false, "category": "Secret Management", "changes": { "added": [], "any": true, "baseline": false, "in_binary_new": [], "in_binary_resolved": [], "integrity_drift": 0, "license_changes": [], "new_vulnerabilities": [], "previous_ref": "v3.13.3", "release_changed": false, "removed": [ "bitflags@2.6.0", "cfg-if@1.0.0", "equivalent@1.0.1", "errno@0.3.10", "fastrand@2.3.0", "getrandom@0.3.1", "hashbrown@0.14.3", "indexmap@2.5.0", "itoa@1.0.10", "lazy_static@1.5.0", "libc@0.2.182", "linux-raw-sys@0.12.1", "memchr@2.7.4", "once_cell@1.20.2", "proc-macro2@1.0.107", "quote@1.0.35", "rustix@1.1.4", "ryu@1.0.16", "serde@1.0.229", "serde_core@1.0.229", "serde_derive@1.0.229", "serde_json@1.0.151", "serde_yaml@0.9.34+deprecated", "syn@3.0.2", "tempfile@3.27.0", "unicode-ident@1.0.12", "unsafe-libyaml@0.2.11", "wasi@0.13.3+wasi-0.2.2", "windows-sys@0.59.0", "windows-targets@0.52.6", "windows_aarch64_gnullvm@0.52.6", "windows_aarch64_msvc@0.52.6", "windows_i686_gnu@0.52.6", "windows_i686_gnullvm@0.52.6", "windows_i686_msvc@0.52.6", "windows_x86_64_gnu@0.52.6", "windows_x86_64_gnullvm@0.52.6", "windows_x86_64_msvc@0.52.6", "wit-bindgen-rt@0.33.0", "zmij@1.0.2", "functional-tests@0.1.0" ], "resolved_vulnerabilities": [], "upgraded": [], "workflow_new": 0, "workflow_resolved": 0 }, "commit": "26e2f4784ca61353082c32dbd987c25eda086dc9", "compliance": { "overall_score": 55, "standards": { "bsi_tr03183": { "failed_checks": [ "Component Creator", "Distribution Licences", "SHA-512 Hash", "Dependency Relationship", "SBOM Creator Contact" ], "passed": 4, "score": 44, "total": 9 }, "cisa": { "failed_checks": [ "Software Producer", "Dependency Relationship", "License Information", "Component Hash", "SBOM Author" ], "passed": 5, "score": 50, "total": 10 }, "ntia": { "failed_checks": [ "Supplier Name", "Dependency Relationship" ], "passed": 5, "score": 71, "total": 7 } } }, "components": [ { "ecosystem": "github", "licenses": [], "location": ".github/workflows/cli.yml", "name": "actions/cache", "purl": "pkg:github/actions/cache@v6.1.0", "version": "v6.1.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/cli.yml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@v7.0.0", "version": "v7.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/cli.yml", "name": "actions/download-artifact", "purl": "pkg:github/actions/download-artifact@v8.0.1", "version": "v8.0.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/cli.yml", "name": "actions/setup-go", "purl": "pkg:github/actions/setup-go@v7.0.0", "version": "v7.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/cli.yml", "name": "actions/upload-artifact", "purl": "pkg:github/actions/upload-artifact@v7.0.1", "version": "v7.0.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yml", "name": "anchore/sbom-action/download-syft", "purl": "pkg:github/anchore/sbom-action@v0.24.0#download-syft", "version": "v0.24.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yml", "name": "docker/login-action", "purl": "pkg:github/docker/login-action@v4.4.0", "version": "v4.4.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yml", "name": "docker/setup-buildx-action", "purl": "pkg:github/docker/setup-buildx-action@v4.2.0", "version": "v4.2.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yml", "name": "docker/setup-qemu-action", "purl": "pkg:github/docker/setup-qemu-action@v4.2.0", "version": "v4.2.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql.yml", "name": "github/codeql-action/analyze", "purl": "pkg:github/github/codeql-action@v4.37.1#analyze", "version": "v4.37.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql.yml", "name": "github/codeql-action/init", "purl": "pkg:github/github/codeql-action@v4.37.1#init", "version": "v4.37.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yml", "name": "goreleaser/goreleaser-action", "purl": "pkg:github/goreleaser/goreleaser-action@v7.2.3", "version": "v7.2.3" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/cli.yml", "name": "re-actors/alls-green", "purl": "pkg:github/re-actors/alls-green@v1.2.2", "version": "v1.2.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yml", "name": "sigstore/cosign-installer", "purl": "pkg:github/sigstore/cosign-installer@v4.1.2", "version": "v4.1.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yml", "name": "slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml", "purl": "pkg:github/slsa-framework/slsa-github-generator@v2.1.0#.github/workflows/generator_container_slsa3.yml", "version": "v2.1.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yml", "name": "slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml", "purl": "pkg:github/slsa-framework/slsa-github-generator@v2.1.0#.github/workflows/generator_generic_slsa3.yml", "version": "v2.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cel.dev/expr", "purl": "pkg:golang/cel.dev/expr@v0.25.2", "version": "v0.25.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go", "purl": "pkg:golang/cloud.google.com/go@v0.123.0", "version": "v0.123.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/auth", "purl": "pkg:golang/cloud.google.com/go/auth@v0.22.0", "version": "v0.22.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/auth/oauth2adapt", "purl": "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", "version": "v0.2.8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/compute/metadata", "purl": "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", "version": "v0.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/iam", "purl": "pkg:golang/cloud.google.com/go/iam@v1.12.0", "version": "v1.12.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/kms", "purl": "pkg:golang/cloud.google.com/go/kms@v1.32.0", "version": "v1.32.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/longrunning", "purl": "pkg:golang/cloud.google.com/go/longrunning@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/monitoring", "purl": "pkg:golang/cloud.google.com/go/monitoring@v1.30.0", "version": "v1.30.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/storage", "purl": "pkg:golang/cloud.google.com/go/storage@v1.63.1", "version": "v1.63.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "dario.cat/mergo", "purl": "pkg:golang/dario.cat/mergo@v1.0.2", "version": "v1.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "filippo.io/age", "purl": "pkg:golang/filippo.io/age@v1.3.1", "version": "v1.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "filippo.io/edwards25519", "purl": "pkg:golang/filippo.io/edwards25519@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "filippo.io/hpke", "purl": "pkg:golang/filippo.io/hpke@v0.4.0", "version": "v0.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.1", "version": "v1.42.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.14", "version": "v1.7.14" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/config", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.32.30", "version": "v1.32.30" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/credentials", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.19.29", "version": "v1.19.29" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.30", "version": "v1.18.30" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/feature/s3/manager", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/s3/manager@v1.22.34", "version": "v1.22.34" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/internal/configsources", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.30", "version": "v1.4.30" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.30", "version": "v2.7.30" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/internal/v4a", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.31", "version": "v1.4.31" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.13", "version": "v1.13.13" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/checksum@v1.9.23", "version": "v1.9.23" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.30", "version": "v1.13.30" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/s3shared@v1.19.31", "version": "v1.19.31" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/kms", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/kms@v1.54.1", "version": "v1.54.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/s3", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/s3@v1.105.2", "version": "v1.105.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/signin", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/signin@v1.4.1", "version": "v1.4.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/sso", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.32.1", "version": "v1.32.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.37.1", "version": "v1.37.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/sts", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.44.1", "version": "v1.44.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/smithy-go", "purl": "pkg:golang/github.com/aws/smithy-go@v1.27.4", "version": "v1.27.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/azure-sdk-for-go/sdk/azcore", "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.22.0", "version": "v1.22.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/azure-sdk-for-go/sdk/azidentity", "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.14.0", "version": "v1.14.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/azure-sdk-for-go/sdk/internal", "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/internal@v1.12.0", "version": "v1.12.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys", "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys@v1.5.0", "version": "v1.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal", "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/go-ansiterm", "purl": "pkg:golang/github.com/Azure/go-ansiterm@v0.0.0-20250102033503-faa5f7b0171c", "version": "v0.0.0-20250102033503-faa5f7b0171c" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/AzureAD/microsoft-authentication-library-for-go", "purl": "pkg:golang/github.com/AzureAD/microsoft-authentication-library-for-go@v1.7.2", "version": "v1.7.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/blang/semver", "purl": "pkg:golang/github.com/blang/semver@v3.5.1%2Bincompatible", "version": "v3.5.1+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cenkalti/backoff/v4", "purl": "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0", "version": "v4.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cespare/xxhash/v2", "purl": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", "version": "v2.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cloudflare/circl", "purl": "pkg:golang/github.com/cloudflare/circl@v1.6.4", "version": "v1.6.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cncf/xds/go", "purl": "pkg:golang/github.com/cncf/xds/go@v0.0.0-20260202195803-dba9d589def2", "version": "v0.0.0-20260202195803-dba9d589def2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/continuity", "purl": "pkg:golang/github.com/containerd/continuity@v0.5.0", "version": "v0.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/errdefs", "purl": "pkg:golang/github.com/containerd/errdefs@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/errdefs/pkg", "purl": "pkg:golang/github.com/containerd/errdefs/pkg@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cpuguy83/go-md2man/v2", "purl": "pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.7", "version": "v2.0.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/davecgh/go-spew", "purl": "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", "version": "v1.1.2-0.20180830191138-d8f796af33cc" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/distribution/reference", "purl": "pkg:golang/github.com/distribution/reference@v0.6.0", "version": "v0.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/cli", "purl": "pkg:golang/github.com/docker/cli@v29.6.2%2Bincompatible", "version": "v29.6.2+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/go-connections", "purl": "pkg:golang/github.com/docker/go-connections@v0.7.0", "version": "v0.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/go-units", "purl": "pkg:golang/github.com/docker/go-units@v0.5.0", "version": "v0.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/envoyproxy/go-control-plane/envoy", "purl": "pkg:golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0", "version": "v1.37.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/envoyproxy/protoc-gen-validate", "purl": "pkg:golang/github.com/envoyproxy/protoc-gen-validate@v1.3.3", "version": "v1.3.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/fatih/color", "purl": "pkg:golang/github.com/fatih/color@v1.19.0", "version": "v1.19.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/felixge/httpsnoop", "purl": "pkg:golang/github.com/felixge/httpsnoop@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/getsops/gopgagent", "purl": "pkg:golang/github.com/getsops/gopgagent@v0.0.0-20241224165529-7044f28e491e", "version": "v0.0.0-20241224165529-7044f28e491e" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-jose/go-jose/v4", "purl": "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", "version": "v4.1.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/logr", "purl": "pkg:golang/github.com/go-logr/logr@v1.4.3", "version": "v1.4.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/stdr", "purl": "pkg:golang/github.com/go-logr/stdr@v1.2.2", "version": "v1.2.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-viper/mapstructure/v2", "purl": "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", "version": "v2.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/goccy/go-yaml", "purl": "pkg:golang/github.com/goccy/go-yaml@v1.19.2", "version": "v1.19.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/golang-jwt/jwt/v5", "purl": "pkg:golang/github.com/golang-jwt/jwt/v5@v5.3.1", "version": "v5.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-cmp", "purl": "pkg:golang/github.com/google/go-cmp@v0.7.0", "version": "v0.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/s2a-go", "purl": "pkg:golang/github.com/google/s2a-go@v0.1.9", "version": "v0.1.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/shlex", "purl": "pkg:golang/github.com/google/shlex@v0.0.0-20191202100458-e7afc7fbc510", "version": "v0.0.0-20191202100458-e7afc7fbc510" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/uuid", "purl": "pkg:golang/github.com/google/uuid@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/googleapis/enterprise-certificate-proxy", "purl": "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.18", "version": "v0.3.18" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/googleapis/gax-go/v2", "purl": "pkg:golang/github.com/googleapis/gax-go/v2@v2.23.0", "version": "v2.23.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp", "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp@v1.34.0", "version": "v1.34.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric", "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric@v0.58.0", "version": "v0.58.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping", "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping@v0.58.0", "version": "v0.58.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/goware/prefixer", "purl": "pkg:golang/github.com/goware/prefixer@v0.0.0-20160118172347-395022866408", "version": "v0.0.0-20160118172347-395022866408" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/errwrap", "purl": "pkg:golang/github.com/hashicorp/errwrap@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-cleanhttp", "purl": "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", "version": "v0.5.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-multierror", "purl": "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-retryablehttp", "purl": "pkg:golang/github.com/hashicorp/go-retryablehttp@v0.7.8", "version": "v0.7.8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-rootcerts", "purl": "pkg:golang/github.com/hashicorp/go-rootcerts@v1.0.2", "version": "v1.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-secure-stdlib/parseutil", "purl": "pkg:golang/github.com/hashicorp/go-secure-stdlib/parseutil@v0.2.0", "version": "v0.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-secure-stdlib/strutil", "purl": "pkg:golang/github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2", "version": "v0.1.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-sockaddr", "purl": "pkg:golang/github.com/hashicorp/go-sockaddr@v1.0.7", "version": "v1.0.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/hcl", "purl": "pkg:golang/github.com/hashicorp/hcl@v1.0.1-vault-7", "version": "v1.0.1-vault-7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/vault/api", "purl": "pkg:golang/github.com/hashicorp/vault/api@v1.23.0", "version": "v1.23.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/huaweicloud/huaweicloud-sdk-go-v3", "purl": "pkg:golang/github.com/huaweicloud/huaweicloud-sdk-go-v3@v0.1.207", "version": "v0.1.207" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/json-iterator/go", "purl": "pkg:golang/github.com/json-iterator/go@v1.1.13-0.20220915233716-71ac16282d12", "version": "v1.1.13-0.20220915233716-71ac16282d12" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/kylelemons/godebug", "purl": "pkg:golang/github.com/kylelemons/godebug@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/lib/pq", "purl": "pkg:golang/github.com/lib/pq@v1.12.3", "version": "v1.12.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mattn/go-colorable", "purl": "pkg:golang/github.com/mattn/go-colorable@v0.1.15", "version": "v0.1.15" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mattn/go-isatty", "purl": "pkg:golang/github.com/mattn/go-isatty@v0.0.23", "version": "v0.0.23" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Microsoft/go-winio", "purl": "pkg:golang/github.com/Microsoft/go-winio@v0.6.2", "version": "v0.6.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/go-homedir", "purl": "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/go-wordwrap", "purl": "pkg:golang/github.com/mitchellh/go-wordwrap@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/mapstructure", "purl": "pkg:golang/github.com/mitchellh/mapstructure@v1.5.0", "version": "v1.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/docker-image-spec", "purl": "pkg:golang/github.com/moby/docker-image-spec@v1.3.1", "version": "v1.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/moby/api", "purl": "pkg:golang/github.com/moby/moby/api@v1.55.0", "version": "v1.55.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/moby/client", "purl": "pkg:golang/github.com/moby/moby/client@v0.5.0", "version": "v0.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/sys/user", "purl": "pkg:golang/github.com/moby/sys/user@v0.4.1", "version": "v0.4.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/term", "purl": "pkg:golang/github.com/moby/term@v0.5.2", "version": "v0.5.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/modern-go/concurrent", "purl": "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", "version": "v0.0.0-20180306012644-bacd9c7ef1dd" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/modern-go/reflect2", "purl": "pkg:golang/github.com/modern-go/reflect2@v1.0.2", "version": "v1.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Nvveen/Gotty", "purl": "pkg:golang/github.com/Nvveen/Gotty@v0.0.0-20120604004816-cd527374f1e5", "version": "v0.0.0-20120604004816-cd527374f1e5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/go-digest", "purl": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/image-spec", "purl": "pkg:golang/github.com/opencontainers/image-spec@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/runc", "purl": "pkg:golang/github.com/opencontainers/runc@v1.3.6", "version": "v1.3.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/ory/dockertest/v3", "purl": "pkg:golang/github.com/ory/dockertest/v3@v3.12.0", "version": "v3.12.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pkg/browser", "purl": "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", "version": "v0.0.0-20240102092130-5ac0b6a4141c" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pkg/errors", "purl": "pkg:golang/github.com/pkg/errors@v0.9.1", "version": "v0.9.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/planetscale/vtprotobuf", "purl": "pkg:golang/github.com/planetscale/vtprotobuf@v0.6.1-0.20240319094008-0393e58bdf10", "version": "v0.6.1-0.20240319094008-0393e58bdf10" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pmezard/go-difflib", "purl": "pkg:golang/github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2", "version": "v1.0.1-0.20181226105442-5d4384ee4fb2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/ProtonMail/go-crypto", "purl": "pkg:golang/github.com/ProtonMail/go-crypto@v1.4.1", "version": "v1.4.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/russross/blackfriday/v2", "purl": "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0", "version": "v2.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/ryanuber/go-glob", "purl": "pkg:golang/github.com/ryanuber/go-glob@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sirupsen/logrus", "purl": "pkg:golang/github.com/sirupsen/logrus@v1.9.4", "version": "v1.9.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spiffe/go-spiffe/v2", "purl": "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.8.1", "version": "v2.8.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/stretchr/testify", "purl": "pkg:golang/github.com/stretchr/testify@v1.11.1", "version": "v1.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tjfoc/gmsm", "purl": "pkg:golang/github.com/tjfoc/gmsm@v1.4.1", "version": "v1.4.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/urfave/cli", "purl": "pkg:golang/github.com/urfave/cli@v1.22.17", "version": "v1.22.17" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/xeipuuv/gojsonpointer", "purl": "pkg:golang/github.com/xeipuuv/gojsonpointer@v0.0.0-20190905194746-02993c407bfb", "version": "v0.0.0-20190905194746-02993c407bfb" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/xeipuuv/gojsonreference", "purl": "pkg:golang/github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415", "version": "v0.0.0-20180127040603-bd5ef7bd5415" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/xeipuuv/gojsonschema", "purl": "pkg:golang/github.com/xeipuuv/gojsonschema@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.mongodb.org/mongo-driver", "purl": "pkg:golang/go.mongodb.org/mongo-driver@v1.17.9", "version": "v1.17.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/auto/sdk", "purl": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", "version": "v1.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/contrib/detectors/gcp", "purl": "pkg:golang/go.opentelemetry.io/contrib/detectors/gcp@v1.44.0", "version": "v1.44.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc", "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.69.0", "version": "v0.69.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp", "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.69.0", "version": "v0.69.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel", "purl": "pkg:golang/go.opentelemetry.io/otel@v1.44.0", "version": "v1.44.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/metric", "purl": "pkg:golang/go.opentelemetry.io/otel/metric@v1.44.0", "version": "v1.44.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/sdk", "purl": "pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0", "version": "v1.44.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/sdk/metric", "purl": "pkg:golang/go.opentelemetry.io/otel/sdk/metric@v1.44.0", "version": "v1.44.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/trace", "purl": "pkg:golang/go.opentelemetry.io/otel/trace@v1.44.0", "version": "v1.44.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.yaml.in/yaml/v3", "purl": "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", "version": "v3.0.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/crypto", "purl": "pkg:golang/golang.org/x/crypto@v0.54.0", "version": "v0.54.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/net", "purl": "pkg:golang/golang.org/x/net@v0.57.0", "version": "v0.57.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/oauth2", "purl": "pkg:golang/golang.org/x/oauth2@v0.36.0", "version": "v0.36.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sync", "purl": "pkg:golang/golang.org/x/sync@v0.22.0", "version": "v0.22.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sys", "purl": "pkg:golang/golang.org/x/sys@v0.47.0", "version": "v0.47.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/term", "purl": "pkg:golang/golang.org/x/term@v0.45.0", "version": "v0.45.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text@v0.40.0", "version": "v0.40.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/time", "purl": "pkg:golang/golang.org/x/time@v0.15.0", "version": "v0.15.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/api", "purl": "pkg:golang/google.golang.org/api@v0.289.0", "version": "v0.289.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto", "purl": "pkg:golang/google.golang.org/genproto@v0.0.0-20260720171339-e059f2f05d78", "version": "v0.0.0-20260720171339-e059f2f05d78" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto/googleapis/api", "purl": "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20260720171339-e059f2f05d78", "version": "v0.0.0-20260720171339-e059f2f05d78" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto/googleapis/rpc", "purl": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260720171339-e059f2f05d78", "version": "v0.0.0-20260720171339-e059f2f05d78" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/grpc", "purl": "pkg:golang/google.golang.org/grpc@v1.82.1", "version": "v1.82.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/protobuf", "purl": "pkg:golang/google.golang.org/protobuf@v1.36.11", "version": "v1.36.11" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/ini.v1", "purl": "pkg:golang/gopkg.in/ini.v1@v1.67.3", "version": "v1.67.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/yaml.v3", "purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.1", "version": "v3.0.1" } ], "description": "Encrypt structured files while preserving editor workflows", "errors": [], "go_binary": { "asset": "sops-v3.13.3.linux.amd64", "binary": "sops-v3.13.3.linux.amd64", "db": "https://vuln.go.dev", "db_last_modified": "2026-10-27T21:16:18Z", "findings": [ { "aliases": [ "CVE-2026-39821" ], "epss": { "cve": "CVE-2026-39821", "percentile": 0.78915, "score": 0.01834 }, "fixed_version": "v1.26.6", "id": "GO-2026-5026", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-46600" ], "epss": { "cve": "CVE-2026-46600", "percentile": 0.45991, "score": 0.00549 }, "fixed_version": "v1.26.6", "id": "GO-2026-5942", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-33818" ], "epss": { "cve": "CVE-2026-33818", "percentile": 0.47077, "score": 0.00568 }, "fixed_version": "v1.26.6", "id": "GO-2026-5972", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Enforce maximum recursion depth in encoding/asn1", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-56859" ], "epss": { "cve": "CVE-2026-56859", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.26.6", "id": "GO-2026-6088", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Add recursion depth guard during decode in encoding/xml", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-56853" ], "epss": { "cve": "CVE-2026-56853", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.26.6", "id": "GO-2026-6089", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-56862" ], "epss": { "cve": "CVE-2026-56862", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.26.6", "id": "GO-2026-6090", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Limit handshake messages we are willing to accept post-handshake in crypto/tls", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-56858" ], "epss": { "cve": "CVE-2026-56858", "percentile": 0.23831, "score": 0.0031 }, "fixed_version": "v1.26.6", "id": "GO-2026-6091", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Fix Javascript regexp context tracking in html/template", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-56860" ], "epss": { "cve": "CVE-2026-56860", "percentile": 0.46041, "score": 0.0055 }, "fixed_version": "v1.26.6", "id": "GO-2026-6218", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Avoid quadratic complexity in resolvePath in net/url", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-94448" ], "epss": { "cve": "CVE-2026-94448", "percentile": 0.21475, "score": 0.00289 }, "fixed_version": "v1.26.9", "id": "GO-2026-6599", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Reset context tracking on consecutive template expressions in html/template", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-97030" ], "epss": { "cve": "CVE-2026-97030", "percentile": 0.21475, "score": 0.00289 }, "fixed_version": "v1.26.9", "id": "GO-2026-6600", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Recognize yield as regexp preceder keyword in html/template", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-78659" ], "epss": { "cve": "CVE-2026-78659", "percentile": 0.50082, "score": 0.00627 }, "fixed_version": "v1.26.9", "id": "GO-2026-6603", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-56866" ], "epss": { "cve": "CVE-2026-56866", "percentile": 0.40968, "score": 0.00473 }, "fixed_version": "v1.26.9", "id": "GO-2026-6605", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/1 client connection desynchronization after CONNECT rejection in net/http", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-97031" ], "epss": { "cve": "CVE-2026-97031", "percentile": 0.44095, "score": 0.00519 }, "fixed_version": "v1.26.9", "id": "GO-2026-6607", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Reject malformed ECH outer extension references in crypto/tls", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-94440" ], "epss": { "cve": "CVE-2026-94440", "percentile": 0.4362, "score": 0.00511 }, "fixed_version": "v1.26.9", "id": "GO-2026-6608", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-78667" ], "epss": { "cve": "CVE-2026-78667", "percentile": 0.41455, "score": 0.0048 }, "fixed_version": "v1.26.9", "id": "GO-2026-6609", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Lack of limit on size of parsed Range headers in net/http", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-78660" ], "epss": { "cve": "CVE-2026-78660", "percentile": 0.36838, "score": 0.00425 }, "fixed_version": "v1.26.9", "id": "GO-2026-6610", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 transport accepts malformed framing-related headers in net/http", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-78669" ], "epss": { "cve": "CVE-2026-78669", "percentile": 0.49426, "score": 0.00614 }, "fixed_version": "v1.26.9", "id": "GO-2026-6611", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption from repeated initial window changes in net/http", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-94439" ], "epss": { "cve": "CVE-2026-94439", "percentile": 0.35772, "score": 0.00414 }, "fixed_version": "v1.26.9", "id": "GO-2026-6613", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http", "version": "v1.26.5" }, { "aliases": [ "CVE-2026-111943" ], "epss": { "cve": "CVE-2026-111943", "percentile": 0.33793, "score": 0.00396 }, "fixed_version": "v1.26.10", "id": "GO-2026-6809", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Distrust compromised intermediate certificates in crypto/x509", "version": "v1.26.5" }, { "aliases": [], "epss": null, "fixed_version": "", "id": "GO-2026-5932", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "version": "v0.54.0" }, { "aliases": [ "CVE-2026-56854" ], "epss": { "cve": "CVE-2026-56854", "percentile": 0.38024, "score": 0.00437 }, "fixed_version": "v0.55.0", "id": "GO-2026-6303", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh", "version": "v0.54.0" }, { "aliases": [ "CVE-2026-78662" ], "epss": { "cve": "CVE-2026-78662", "percentile": 0.37388, "score": 0.00431 }, "fixed_version": "v0.56.0", "id": "GO-2026-6354", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh", "version": "v0.54.0" }, { "aliases": [ "CVE-2026-56855" ], "epss": { "cve": "CVE-2026-56855", "percentile": 0.42867, "score": 0.005 }, "fixed_version": "v0.56.0", "id": "GO-2026-6355", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh", "version": "v0.54.0" }, { "aliases": [ "CVE-2026-78663" ], "epss": { "cve": "CVE-2026-78663", "percentile": 0.49813, "score": 0.00622 }, "fixed_version": "v0.60.0", "id": "GO-2026-6612", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Double flow control refund on HTTP/2 server streams in net/http", "version": "v0.57.0" }, { "aliases": [ "CVE-2026-97032" ], "epss": { "cve": "CVE-2026-97032", "percentile": 0.42154, "score": 0.0049 }, "fixed_version": "v0.60.0", "id": "GO-2026-6617", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "HTTP/2 server crash due to HPACK encoder race in net/http", "version": "v0.57.0" }, { "aliases": [ "CVE-2026-78661" ], "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fixed_version": "v0.62.0", "id": "GO-2026-6860", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net", "version": "v0.57.0" }, { "aliases": [ "CVE-2026-97045" ], "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fixed_version": "v0.62.0", "id": "GO-2026-6866", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net", "version": "v0.57.0" }, { "aliases": [ "CVE-2026-56851" ], "epss": { "cve": "CVE-2026-56851", "percentile": 0.40313, "score": 0.00466 }, "fixed_version": "v0.41.0", "id": "GO-2026-6629", "kev": null, "level": "symbol", "module": "golang.org/x/text", "summary": "Panic parsing crafted input in x/text/secure/precis in golang.org/x/text", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-84304", "GHSA-vp52-pcj8-j9qc" ], "epss": { "cve": "CVE-2026-84304", "percentile": 0.49152, "score": 0.00609 }, "fixed_version": "v1.83.1", "id": "GO-2026-6348", "kev": null, "level": "symbol", "module": "google.golang.org/grpc", "summary": "Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc", "version": "v1.82.1" }, { "aliases": [ "CVE-2026-84303", "GHSA-qc2q-p7wx-3px3" ], "epss": { "cve": "CVE-2026-84303", "percentile": 0.23991, "score": 0.00311 }, "fixed_version": "v1.83.1", "id": "GO-2026-6441", "kev": null, "level": "symbol", "module": "google.golang.org/grpc", "summary": "Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc", "version": "v1.82.1" }, { "aliases": [ "CVE-2026-84445", "GHSA-2v4p-qf9q-27wj" ], "epss": { "cve": "CVE-2026-84445", "percentile": 0.5072, "score": 0.00641 }, "fixed_version": "v1.82.2", "id": "GO-2026-6443", "kev": null, "level": "symbol", "module": "google.golang.org/grpc", "summary": "Server panic via missing authority or Host headers in google.golang.org/grpc", "version": "v1.82.1" }, { "aliases": [ "CVE-2026-81870", "GHSA-8wmf-6v46-5gfg" ], "epss": { "cve": "CVE-2026-81870", "percentile": 0.18557, "score": 0.00266 }, "fixed_version": "v1.45.0", "id": "GO-2026-6505", "kev": null, "level": "module", "module": "go.opentelemetry.io/otel/sdk", "summary": "OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace", "version": "v1.44.0" } ], "go_version": "go1.26.5", "main_module": "github.com/getsops/sops/v3" }, "id": "getsops__sops", "manifests": [ ".github/workflows/cli.yml", ".github/workflows/codeql.yml", ".github/workflows/docs.yml", ".github/workflows/linters.yml", ".github/workflows/release.yml", "go.mod", "go.sum" ], "name": "sops", "osv": { "advisories": 19, "available": true, "confirmed": 19, "osv_only": [], "warning": null }, "ref": "v3.13.3", "ref_kind": "release", "release_integrity": { "asset": "sops-v3.13.3.linux.amd64", "assets": 21, "build_provenance": "verified", "checksums_published": true, "digest_matches_github": true, "immutable_release": null, "methods": [ { "error": "", "method": "slsa-verifier", "status": "verified" } ], "provenance_published": true, "sbom_published": true, "signature": null, "signatures_published": true, "signer": null, "verdict": "verified" }, "released_at": "2026-07-23T05:27:57Z", "repository": "getsops/sops", "sbomlyze_diff": { "added": 0, "changed": 0, "drift": {}, "findings": [ "Attack surface: -42 packages (-19.2%)", "cargo ecosystem entirely removed (40 \u2192 0 packages)", "library ecosystem entirely removed (1 \u2192 0 packages)", "0 version changes among 177 shared packages \u2014 no actual upgrades", "Core system packages stable: golang (150), github (21) unchanged" ], "html": "sbomlyze-diff.html", "removed": 42 }, "scanned_at": "2026-11-02T03:07:15+00:00", "scorecard": null, "scorecard_note": "the project is not in the OpenSSF public dataset; the Scorecard CLI fallback was skipped because this shard's weekly budget was used", "vulnerabilities": [ { "aliases": [ "CVE-2026-78663" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78663", "percentile": 0.49813, "score": 0.00622 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6612", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Critical", "summary": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configure", "url": "https://go.dev/cl/847187", "version": "v0.57.0" }, { "aliases": [ "CVE-2026-116587" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-116587", "percentile": 0.3048, "score": 0.00366 }, "fix_state": "fixed", "fixed_in": [ "4.1.6" ], "id": "GHSA-mgcc-cww5-fp2q", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/go-jose/go-jose/v4", "severity": "High", "summary": "Go JOSE: DoS when parsing JWKs that contain RSA keys", "url": "https://github.com/advisories/GHSA-mgcc-cww5-fp2q", "version": "v4.1.4" }, { "aliases": [ "CVE-2026-56854" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56854", "percentile": 0.38024, "score": 0.00437 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-6303", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthC", "url": "https://go.dev/issue/80213", "version": "v0.54.0" }, { "aliases": [ "CVE-2026-78662" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78662", "percentile": 0.37388, "score": 0.00431 }, "fix_state": "fixed", "fixed_in": [ "0.56.0" ], "id": "GO-2026-6354", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket", "url": "https://go.dev/issue/81316", "version": "v0.54.0" }, { "aliases": [ "CVE-2026-56855" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56855", "percentile": 0.42867, "score": 0.005 }, "fix_state": "fixed", "fixed_in": [ "0.56.0" ], "id": "GO-2026-6355", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection d", "url": "https://go.dev/issue/81317", "version": "v0.54.0" }, { "aliases": [ "CVE-2026-78659" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78659", "percentile": 0.50082, "score": 0.00627 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6603", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"", "url": "https://go.dev/cl/847185", "version": "v0.57.0" }, { "aliases": [ "CVE-2026-78660" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78660", "percentile": 0.36838, "score": 0.00425 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6610", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a re", "url": "https://go.dev/cl/835145", "version": "v0.57.0" }, { "aliases": [ "CVE-2026-78669" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78669", "percentile": 0.49426, "score": 0.00614 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6611", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "url": "https://go.dev/cl/847186", "version": "v0.57.0" }, { "aliases": [ "CVE-2026-97032" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97032", "percentile": 0.42154, "score": 0.0049 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6617", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the ot", "url": "https://go.dev/cl/847188", "version": "v0.57.0" }, { "aliases": [ "CVE-2026-56851" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56851", "percentile": 0.40313, "score": 0.00466 }, "fix_state": "fixed", "fixed_in": [ "0.41.0" ], "id": "GO-2026-6629", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/text", "severity": "High", "summary": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.", "url": "https://go.dev/cl/793360", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-84445" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-84445", "percentile": 0.5072, "score": 0.00641 }, "fix_state": "fixed", "fixed_in": [ "1.82.2" ], "id": "GHSA-2v4p-qf9q-27wj", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "High", "summary": "gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers", "url": "https://github.com/advisories/GHSA-2v4p-qf9q-27wj", "version": "v1.82.1" }, { "aliases": [ "CVE-2026-84304" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-84304", "percentile": 0.49152, "score": 0.00609 }, "fix_state": "fixed", "fixed_in": [ "1.83.1" ], "id": "GHSA-vp52-pcj8-j9qc", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "High", "summary": "gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation", "url": "https://github.com/advisories/GHSA-vp52-pcj8-j9qc", "version": "v1.82.1" }, { "aliases": [ "CVE-2026-116585" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-116585", "percentile": 0.18368, "score": 0.00264 }, "fix_state": "fixed", "fixed_in": [ "4.1.5" ], "id": "GHSA-4w3g-jfj2-cw2q", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/go-jose/go-jose/v4", "severity": "Medium", "summary": "Go JOSE: Panic during CBC-HMAC processing", "url": "https://github.com/advisories/GHSA-4w3g-jfj2-cw2q", "version": "v4.1.4" }, { "aliases": [ "CVE-2026-116586" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-116586", "percentile": 0.21769, "score": 0.00292 }, "fix_state": "fixed", "fixed_in": [ "4.1.5" ], "id": "GHSA-vvm8-gf78-28g4", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/go-jose/go-jose/v4", "severity": "Medium", "summary": "Go JOSE: Panics in JSON parsing", "url": "https://github.com/advisories/GHSA-vvm8-gf78-28g4", "version": "v4.1.4" }, { "aliases": [ "CVE-2026-84303" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-84303", "percentile": 0.23991, "score": 0.00311 }, "fix_state": "fixed", "fixed_in": [ "1.83.1" ], "id": "GHSA-qc2q-p7wx-3px3", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "Medium", "summary": "gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion", "url": "https://github.com/advisories/GHSA-qc2q-p7wx-3px3", "version": "v1.82.1" }, { "aliases": [ "CVE-2026-81870" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-81870", "percentile": 0.18557, "score": 0.00266 }, "fix_state": "fixed", "fixed_in": [ "1.45.0" ], "id": "GHSA-8wmf-6v46-5gfg", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "go.opentelemetry.io/otel/sdk", "severity": "Low", "summary": "OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs", "url": "https://github.com/advisories/GHSA-8wmf-6v46-5gfg", "version": "v1.44.0" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5932", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Unknown", "summary": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained f", "url": "https://go.dev/issue/44226", "version": "v0.54.0" }, { "aliases": [ "CVE-2026-78661" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6860", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\") cau", "url": "https://go.dev/cl/849365", "version": "v0.57.0" }, { "aliases": [ "CVE-2026-97045" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6866", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or f", "url": "https://go.dev/cl/855121", "version": "v0.57.0" } ], "workflow_audit": { "files": 5, "findings": [ { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/release.yml", "line": 164, "note": "this job", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/release.yml", "line": 178, "note": "this job", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/release.yml", "line": 197, "note": "this job", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" } ] } }, "updated": "2026-11-02" }