{ "history": [ { "added": 0, "commit": "8f7ac015cb51d81992f2ffbe2b0c1451fd05d1c5", "date": "2026-11-01", "dependencies": 181, "errors": [], "fixable": 10, "go_version": "go1.27.1", "in_binary": { "dependencies": 4, "stdlib": 12, "total": 16 }, "new_vulnerabilities": 0, "osv_confirmed": 11, "osv_only": 21, "ref": "v0.71.1", "release_changed": false, "release_integrity": "verified", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": 7.2, "upgraded": 0, "vulnerabilities": { "Critical": 1, "High": 5, "Low": 0, "Medium": 2, "Negligible": 0, "Unknown": 3 }, "workflow": { "High": 0, "Low": 0, "Medium": 0, "files": 3 } }, { "added": 0, "commit": "8f7ac015cb51d81992f2ffbe2b0c1451fd05d1c5", "date": "2026-11-02", "dependencies": 181, "errors": [], "fixable": 10, "go_version": "go1.27.1", "in_binary": { "dependencies": 5, "stdlib": 11, "total": 16 }, "kev": 0, "kev_new": 0, "new_vulnerabilities": 0, "osv_confirmed": 11, "osv_only": 21, "ref": "v0.71.1", "release_changed": false, "release_integrity": "verified", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": 7.2, "scorecard_date": "2026-10-26", "scorecard_note": null, "scorecard_source": "openssf-api", "upgraded": 0, "vulnerabilities": { "Critical": 1, "High": 5, "Low": 0, "Medium": 2, "Negligible": 0, "Unknown": 3 }, "vulnerable_packages": 3, "workflow": { "High": 0, "Low": 0, "Medium": 0, "files": 3 } } ], "latest": { "archived": false, "category": "Policy as Code", "changes": { "added": [], "any": false, "baseline": false, "in_binary_new": [], "in_binary_resolved": [], "integrity_drift": 0, "license_changes": [], "new_vulnerabilities": [], "previous_ref": "v0.71.1", "release_changed": false, "removed": [], "resolved_vulnerabilities": [], "upgraded": [], "workflow_new": 0, "workflow_resolved": 0 }, "commit": "8f7ac015cb51d81992f2ffbe2b0c1451fd05d1c5", "compliance": { "overall_score": 55, "standards": { "bsi_tr03183": { "failed_checks": [ "Component Creator", "Distribution Licences", "SHA-512 Hash", "Dependency Relationship", "SBOM Creator Contact" ], "passed": 4, "score": 44, "total": 9 }, "cisa": { "failed_checks": [ "Software Producer", "Dependency Relationship", "License Information", "Component Hash", "SBOM Author" ], "passed": 5, "score": 50, "total": 10 }, "ntia": { "failed_checks": [ "Supplier Name", "Dependency Relationship" ], "passed": 5, "score": 71, "total": 7 } } }, "components": [ { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yaml", "name": "actions/attest-build-provenance", "purl": "pkg:github/actions/attest-build-provenance@v4.2.2", "version": "v4.2.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/post_merge.yaml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@v5", "version": "v5" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pr.yaml", "name": "actions/setup-go", "purl": "pkg:github/actions/setup-go@v6", "version": "v6" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pr.yaml", "name": "actions/setup-python", "purl": "pkg:github/actions/setup-python@v6", "version": "v6" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yaml", "name": "anchore/sbom-action/download-syft", "purl": "pkg:github/anchore/sbom-action@v0.24.2#download-syft", "version": "v0.24.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pr.yaml", "name": "bats-core/bats-action", "purl": "pkg:github/bats-core/bats-action@4.0.0", "version": "4.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pr.yaml", "name": "cachix/install-nix-action", "purl": "pkg:github/cachix/install-nix-action@v31", "version": "v31" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/post_merge.yaml", "name": "docker/build-push-action", "purl": "pkg:github/docker/build-push-action@v7.4.0", "version": "v7.4.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yaml", "name": "docker/login-action", "purl": "pkg:github/docker/login-action@v3", "version": "v3" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pr.yaml", "name": "golangci/golangci-lint-action", "purl": "pkg:github/golangci/golangci-lint-action@v9", "version": "v9" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yaml", "name": "goreleaser/goreleaser-action", "purl": "pkg:github/goreleaser/goreleaser-action@v7.2.3", "version": "v7.2.3" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pr.yaml", "name": "open-policy-agent/setup-regal", "purl": "pkg:github/open-policy-agent/setup-regal@v2.0.0", "version": "v2.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pr.yaml", "name": "sethvargo/ratchet", "purl": "pkg:github/sethvargo/ratchet@9ca118155b0f79464185703a50da367e111107cd", "version": "9ca118155b0f79464185703a50da367e111107cd" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cel.dev/expr", "purl": "pkg:golang/cel.dev/expr@v0.25.2", "version": "v0.25.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go", "purl": "pkg:golang/cloud.google.com/go@v0.123.0", "version": "v0.123.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/auth", "purl": "pkg:golang/cloud.google.com/go/auth@v0.23.2", "version": "v0.23.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/auth/oauth2adapt", "purl": "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", "version": "v0.2.8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/compute/metadata", "purl": "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", "version": "v0.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/iam", "purl": "pkg:golang/cloud.google.com/go/iam@v1.12.0", "version": "v1.12.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/monitoring", "purl": "pkg:golang/cloud.google.com/go/monitoring@v1.30.0", "version": "v1.30.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/storage", "purl": "pkg:golang/cloud.google.com/go/storage@v1.65.1", "version": "v1.65.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cuelang.org/go", "purl": "pkg:golang/cuelang.org/go@v0.17.1", "version": "v0.17.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/agext/levenshtein", "purl": "pkg:golang/github.com/agext/levenshtein@v1.2.3", "version": "v1.2.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/agnivade/levenshtein", "purl": "pkg:golang/github.com/agnivade/levenshtein@v1.2.1", "version": "v1.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/albertocavalcante/groovy-parser-go", "purl": "pkg:golang/github.com/albertocavalcante/groovy-parser-go@v0.0.0-20260218103838-adf14fa75938", "version": "v0.0.0-20260218103838-adf14fa75938" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/anchore/go-struct-converter", "purl": "pkg:golang/github.com/anchore/go-struct-converter@v0.1.0", "version": "v0.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/apparentlymart/go-textseg/v15", "purl": "pkg:golang/github.com/apparentlymart/go-textseg/v15@v15.0.0", "version": "v15.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.44.0", "version": "v1.44.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.20", "version": "v1.7.20" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/config", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.32.40", "version": "v1.32.40" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/credentials", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.19.39", "version": "v1.19.39" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.40", "version": "v1.18.40" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/internal/configsources", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.40", "version": "v1.4.40" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.40", "version": "v2.7.40" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/internal/v4a", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.41", "version": "v1.4.41" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.19", "version": "v1.13.19" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/checksum@v1.10.0", "version": "v1.10.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.40", "version": "v1.13.40" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/s3shared@v1.19.41", "version": "v1.19.41" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/s3", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/s3@v1.108.0", "version": "v1.108.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/signin", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/signin@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/sso", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.34.0", "version": "v1.34.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.39.0", "version": "v1.39.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/sts", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.46.0", "version": "v1.46.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/smithy-go", "purl": "pkg:golang/github.com/aws/smithy-go@v1.28.1", "version": "v1.28.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/basgys/goxml2json", "purl": "pkg:golang/github.com/basgys/goxml2json@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/bgentry/go-netrc", "purl": "pkg:golang/github.com/bgentry/go-netrc@v0.0.0-20140422174119-9fd32a8b3d3d", "version": "v0.0.0-20140422174119-9fd32a8b3d3d" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/bitly/go-simplejson", "purl": "pkg:golang/github.com/bitly/go-simplejson@v0.5.0", "version": "v0.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/bufbuild/protocompile", "purl": "pkg:golang/github.com/bufbuild/protocompile@v0.6.0", "version": "v0.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/BurntSushi/toml", "purl": "pkg:golang/github.com/BurntSushi/toml@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cespare/xxhash/v2", "purl": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", "version": "v2.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/clipperhouse/displaywidth", "purl": "pkg:golang/github.com/clipperhouse/displaywidth@v0.10.0", "version": "v0.10.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/clipperhouse/uax29/v2", "purl": "pkg:golang/github.com/clipperhouse/uax29/v2@v2.6.0", "version": "v2.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cncf/xds/go", "purl": "pkg:golang/github.com/cncf/xds/go@v0.0.0-20260202195803-dba9d589def2", "version": "v0.0.0-20260202195803-dba9d589def2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cockroachdb/apd/v3", "purl": "pkg:golang/github.com/cockroachdb/apd/v3@v3.2.3", "version": "v3.2.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/typeurl/v2", "purl": "pkg:golang/github.com/containerd/typeurl/v2@v2.3.0", "version": "v2.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/CycloneDX/cyclonedx-go", "purl": "pkg:golang/github.com/CycloneDX/cyclonedx-go@v0.12.0", "version": "v0.12.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/decred/dcrd/dcrec/secp256k1/v4", "purl": "pkg:golang/github.com/decred/dcrd/dcrec/secp256k1/v4@v4.4.1", "version": "v4.4.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/go-units", "purl": "pkg:golang/github.com/docker/go-units@v0.5.0", "version": "v0.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/emicklei/proto", "purl": "pkg:golang/github.com/emicklei/proto@v1.14.3", "version": "v1.14.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/envoyproxy/go-control-plane/envoy", "purl": "pkg:golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0", "version": "v1.37.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/envoyproxy/protoc-gen-validate", "purl": "pkg:golang/github.com/envoyproxy/protoc-gen-validate@v1.3.3", "version": "v1.3.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/fatih/color", "purl": "pkg:golang/github.com/fatih/color@v1.19.0", "version": "v1.19.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/felixge/httpsnoop", "purl": "pkg:golang/github.com/felixge/httpsnoop@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/fsnotify/fsnotify", "purl": "pkg:golang/github.com/fsnotify/fsnotify@v1.10.1", "version": "v1.10.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-akka/configuration", "purl": "pkg:golang/github.com/go-akka/configuration@v0.0.0-20200606091224-a002c0330665", "version": "v0.0.0-20200606091224-a002c0330665" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-ini/ini", "purl": "pkg:golang/github.com/go-ini/ini@v1.67.0", "version": "v1.67.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-jose/go-jose/v4", "purl": "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", "version": "v4.1.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/logr", "purl": "pkg:golang/github.com/go-logr/logr@v1.4.4", "version": "v1.4.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/stdr", "purl": "pkg:golang/github.com/go-logr/stdr@v1.2.2", "version": "v1.2.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-viper/mapstructure/v2", "purl": "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", "version": "v2.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/gobwas/glob", "purl": "pkg:golang/github.com/gobwas/glob@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/goccy/go-json", "purl": "pkg:golang/github.com/goccy/go-json@v0.10.6", "version": "v0.10.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-cmp", "purl": "pkg:golang/github.com/google/go-cmp@v0.7.0", "version": "v0.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-jsonnet", "purl": "pkg:golang/github.com/google/go-jsonnet@v0.22.0", "version": "v0.22.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/s2a-go", "purl": "pkg:golang/github.com/google/s2a-go@v0.1.9", "version": "v0.1.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/uuid", "purl": "pkg:golang/github.com/google/uuid@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/googleapis/enterprise-certificate-proxy", "purl": "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.20", "version": "v0.3.20" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/googleapis/gax-go/v2", "purl": "pkg:golang/github.com/googleapis/gax-go/v2@v2.24.0", "version": "v2.24.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp", "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp@v1.33.0", "version": "v1.33.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric", "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric@v0.57.0", "version": "v0.57.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping", "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping@v0.57.0", "version": "v0.57.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/aws-sdk-go-base/v2", "purl": "pkg:golang/github.com/hashicorp/aws-sdk-go-base/v2@v2.0.0-beta.74", "version": "v2.0.0-beta.74" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-cleanhttp", "purl": "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", "version": "v0.5.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-getter", "purl": "pkg:golang/github.com/hashicorp/go-getter@v1.8.9", "version": "v1.8.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-version", "purl": "pkg:golang/github.com/hashicorp/go-version@v1.9.0", "version": "v1.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/hcl", "purl": "pkg:golang/github.com/hashicorp/hcl@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/hcl/v2", "purl": "pkg:golang/github.com/hashicorp/hcl/v2@v2.23.0", "version": "v2.23.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hmarr/codeowners", "purl": "pkg:golang/github.com/hmarr/codeowners@v1.2.1", "version": "v1.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/inconshreveable/mousetrap", "purl": "pkg:golang/github.com/inconshreveable/mousetrap@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jstemmer/go-junit-report", "purl": "pkg:golang/github.com/jstemmer/go-junit-report@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/KeisukeYamashita/go-vcl", "purl": "pkg:golang/github.com/KeisukeYamashita/go-vcl@v0.4.0", "version": "v0.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/klauspost/compress", "purl": "pkg:golang/github.com/klauspost/compress@v1.20.0", "version": "v1.20.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/lestrrat-go/blackmagic", "purl": "pkg:golang/github.com/lestrrat-go/blackmagic@v1.0.4", "version": "v1.0.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/lestrrat-go/dsig", "purl": "pkg:golang/github.com/lestrrat-go/dsig@v1.4.0", "version": "v1.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/lestrrat-go/dsig-secp256k1", "purl": "pkg:golang/github.com/lestrrat-go/dsig-secp256k1@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/lestrrat-go/httpcc", "purl": "pkg:golang/github.com/lestrrat-go/httpcc@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/lestrrat-go/httprc/v3", "purl": "pkg:golang/github.com/lestrrat-go/httprc/v3@v3.0.6", "version": "v3.0.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/lestrrat-go/jwx/v3", "purl": "pkg:golang/github.com/lestrrat-go/jwx/v3@v3.3.0", "version": "v3.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/lestrrat-go/option/v2", "purl": "pkg:golang/github.com/lestrrat-go/option/v2@v2.0.0", "version": "v2.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/logrusorgru/aurora", "purl": "pkg:golang/github.com/logrusorgru/aurora@v2.0.3%2Bincompatible", "version": "v2.0.3+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/magiconair/properties", "purl": "pkg:golang/github.com/magiconair/properties@v1.18.12", "version": "v1.18.12" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mattn/go-colorable", "purl": "pkg:golang/github.com/mattn/go-colorable@v0.1.14", "version": "v0.1.14" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mattn/go-isatty", "purl": "pkg:golang/github.com/mattn/go-isatty@v0.0.20", "version": "v0.0.20" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mattn/go-runewidth", "purl": "pkg:golang/github.com/mattn/go-runewidth@v0.0.19", "version": "v0.0.19" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/go-homedir", "purl": "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/go-wordwrap", "purl": "pkg:golang/github.com/mitchellh/go-wordwrap@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/buildkit", "purl": "pkg:golang/github.com/moby/buildkit@v0.33.1", "version": "v0.33.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/docker-image-spec", "purl": "pkg:golang/github.com/moby/docker-image-spec@v1.3.1", "version": "v1.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/muhammadmuzzammil1998/jsonc", "purl": "pkg:golang/github.com/muhammadmuzzammil1998/jsonc@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/olekukonko/cat", "purl": "pkg:golang/github.com/olekukonko/cat@v0.0.0-20250911104152-50322a0618f6", "version": "v0.0.0-20250911104152-50322a0618f6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/olekukonko/errors", "purl": "pkg:golang/github.com/olekukonko/errors@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/olekukonko/ll", "purl": "pkg:golang/github.com/olekukonko/ll@v0.1.6", "version": "v0.1.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/olekukonko/tablewriter", "purl": "pkg:golang/github.com/olekukonko/tablewriter@v1.1.5", "version": "v1.1.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/open-policy-agent/opa", "purl": "pkg:golang/github.com/open-policy-agent/opa@v1.21.1", "version": "v1.21.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/go-digest", "purl": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/image-spec", "purl": "pkg:golang/github.com/opencontainers/image-spec@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/owenrumney/go-sarif/v2", "purl": "pkg:golang/github.com/owenrumney/go-sarif/v2@v2.3.3", "version": "v2.3.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pelletier/go-toml/v2", "purl": "pkg:golang/github.com/pelletier/go-toml/v2@v2.4.3", "version": "v2.4.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pkg/errors", "purl": "pkg:golang/github.com/pkg/errors@v0.9.1", "version": "v0.9.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/planetscale/vtprotobuf", "purl": "pkg:golang/github.com/planetscale/vtprotobuf@v0.6.1-0.20240319094008-0393e58bdf10", "version": "v0.6.1-0.20240319094008-0393e58bdf10" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/protocolbuffers/txtpbfmt", "purl": "pkg:golang/github.com/protocolbuffers/txtpbfmt@v0.0.0-20260420112717-c39628bde8b5", "version": "v0.0.0-20260420112717-c39628bde8b5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/rcrowley/go-metrics", "purl": "pkg:golang/github.com/rcrowley/go-metrics@v0.0.0-20250401214520-65e299d6c5c9", "version": "v0.0.0-20250401214520-65e299d6c5c9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sagikazarmark/locafero", "purl": "pkg:golang/github.com/sagikazarmark/locafero@v0.11.0", "version": "v0.11.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/segmentio/asm", "purl": "pkg:golang/github.com/segmentio/asm@v1.2.1", "version": "v1.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/shteou/go-ignore", "purl": "pkg:golang/github.com/shteou/go-ignore@v0.3.1", "version": "v0.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sirupsen/logrus", "purl": "pkg:golang/github.com/sirupsen/logrus@v1.10.2", "version": "v1.10.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sourcegraph/conc", "purl": "pkg:golang/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", "version": "v0.3.1-0.20240121214520-5f936abd7ae8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spdx/tools-golang", "purl": "pkg:golang/github.com/spdx/tools-golang@v0.5.7", "version": "v0.5.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/afero", "purl": "pkg:golang/github.com/spf13/afero@v1.15.0", "version": "v1.15.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/cast", "purl": "pkg:golang/github.com/spf13/cast@v1.10.0", "version": "v1.10.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/cobra", "purl": "pkg:golang/github.com/spf13/cobra@v1.10.2", "version": "v1.10.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/pflag", "purl": "pkg:golang/github.com/spf13/pflag@v1.0.10", "version": "v1.0.10" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/viper", "purl": "pkg:golang/github.com/spf13/viper@v1.21.0", "version": "v1.21.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spiffe/go-spiffe/v2", "purl": "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.7.0", "version": "v2.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/subosito/gotenv", "purl": "pkg:golang/github.com/subosito/gotenv@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tchap/go-patricia/v2", "purl": "pkg:golang/github.com/tchap/go-patricia/v2@v2.3.3", "version": "v2.3.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tmccombs/hcl2json", "purl": "pkg:golang/github.com/tmccombs/hcl2json@v0.6.7", "version": "v0.6.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tonistiigi/go-csvvalue", "purl": "pkg:golang/github.com/tonistiigi/go-csvvalue@v0.0.0-20240814133006-030d3b2625d0", "version": "v0.0.0-20240814133006-030d3b2625d0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tufanbarisyildirim/gonginx", "purl": "pkg:golang/github.com/tufanbarisyildirim/gonginx@v0.0.0-20260220081509-8e17ce617db3", "version": "v0.0.0-20260220081509-8e17ce617db3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tzrikka/xdg", "purl": "pkg:golang/github.com/tzrikka/xdg@v1.3.2", "version": "v1.3.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/ulikunitz/xz", "purl": "pkg:golang/github.com/ulikunitz/xz@v0.5.16", "version": "v0.5.16" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/valyala/fastjson", "purl": "pkg:golang/github.com/valyala/fastjson@v1.6.10", "version": "v1.6.10" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/vektah/gqlparser/v2", "purl": "pkg:golang/github.com/vektah/gqlparser/v2@v2.5.37", "version": "v2.5.37" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/xeipuuv/gojsonpointer", "purl": "pkg:golang/github.com/xeipuuv/gojsonpointer@v0.0.0-20190905194746-02993c407bfb", "version": "v0.0.0-20190905194746-02993c407bfb" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/xeipuuv/gojsonreference", "purl": "pkg:golang/github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415", "version": "v0.0.0-20180127040603-bd5ef7bd5415" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/yashtewari/glob-intersection", "purl": "pkg:golang/github.com/yashtewari/glob-intersection@v0.2.0", "version": "v0.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/zclconf/go-cty", "purl": "pkg:golang/github.com/zclconf/go-cty@v1.16.2", "version": "v1.16.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/auto/sdk", "purl": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", "version": "v1.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/contrib/detectors/gcp", "purl": "pkg:golang/go.opentelemetry.io/contrib/detectors/gcp@v1.44.0", "version": "v1.44.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc", "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.70.0", "version": "v0.70.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp", "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.71.0", "version": "v0.71.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel", "purl": "pkg:golang/go.opentelemetry.io/otel@v1.46.0", "version": "v1.46.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/metric", "purl": "pkg:golang/go.opentelemetry.io/otel/metric@v1.46.0", "version": "v1.46.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/sdk", "purl": "pkg:golang/go.opentelemetry.io/otel/sdk@v1.46.0", "version": "v1.46.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/sdk/metric", "purl": "pkg:golang/go.opentelemetry.io/otel/sdk/metric@v1.46.0", "version": "v1.46.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/trace", "purl": "pkg:golang/go.opentelemetry.io/otel/trace@v1.46.0", "version": "v1.46.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.yaml.in/yaml/v2", "purl": "pkg:golang/go.yaml.in/yaml/v2@v2.4.4", "version": "v2.4.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.yaml.in/yaml/v3", "purl": "pkg:golang/go.yaml.in/yaml/v3@v3.0.5", "version": "v3.0.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/crypto", "purl": "pkg:golang/golang.org/x/crypto@v0.56.0", "version": "v0.56.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/exp", "purl": "pkg:golang/golang.org/x/exp@v0.0.0-20260603202125-055de637280b", "version": "v0.0.0-20260603202125-055de637280b" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/mod", "purl": "pkg:golang/golang.org/x/mod@v0.41.0", "version": "v0.41.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/net", "purl": "pkg:golang/golang.org/x/net@v0.58.0", "version": "v0.58.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/oauth2", "purl": "pkg:golang/golang.org/x/oauth2@v0.36.0", "version": "v0.36.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sync", "purl": "pkg:golang/golang.org/x/sync@v0.23.0", "version": "v0.23.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sys", "purl": "pkg:golang/golang.org/x/sys@v0.48.0", "version": "v0.48.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text@v0.42.0", "version": "v0.42.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/time", "purl": "pkg:golang/golang.org/x/time@v0.16.0", "version": "v0.16.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/tools", "purl": "pkg:golang/golang.org/x/tools@v0.49.0", "version": "v0.49.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/api", "purl": "pkg:golang/google.golang.org/api@v0.294.0", "version": "v0.294.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto", "purl": "pkg:golang/google.golang.org/genproto@v0.0.0-20260715232425-e75dac1f907d", "version": "v0.0.0-20260715232425-e75dac1f907d" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto/googleapis/api", "purl": "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20260819154853-08b0e4226688", "version": "v0.0.0-20260819154853-08b0e4226688" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto/googleapis/rpc", "purl": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260819154853-08b0e4226688", "version": "v0.0.0-20260819154853-08b0e4226688" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/grpc", "purl": "pkg:golang/google.golang.org/grpc@v1.83.2", "version": "v1.83.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/protobuf", "purl": "pkg:golang/google.golang.org/protobuf@v1.36.12", "version": "v1.36.12" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "olympos.io/encoding/edn", "purl": "pkg:golang/olympos.io/encoding/edn@v0.0.0-20201019073823-d3554ca0b0a3", "version": "v0.0.0-20201019073823-d3554ca0b0a3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "oras.land/oras-go/v2", "purl": "pkg:golang/oras.land/oras-go/v2@v2.6.2", "version": "v2.6.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "sigs.k8s.io/yaml", "purl": "pkg:golang/sigs.k8s.io/yaml@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "pypi", "licenses": [], "location": "requirements.txt", "name": "mkdocs", "purl": "pkg:pypi/mkdocs@1.6.1", "version": "1.6.1" }, { "ecosystem": "pypi", "licenses": [], "location": "requirements.txt", "name": "mkdocs-material", "purl": "pkg:pypi/mkdocs-material@9.7.7", "version": "9.7.7" }, { "ecosystem": "pypi", "licenses": [], "location": "requirements-dev.txt", "name": "pre-commit", "purl": "pkg:pypi/pre-commit@4.1.0", "version": "4.1.0" } ], "description": "Test configuration files against OPA policies", "errors": [], "go_binary": { "asset": "conftest_0.71.1_Linux_x86_64.tar.gz", "binary": "conftest", "db": "https://vuln.go.dev", "db_last_modified": "2026-10-27T21:16:18Z", "findings": [ { "aliases": [ "CVE-2026-94448" ], "epss": { "cve": "CVE-2026-94448", "percentile": 0.21475, "score": 0.00289 }, "fixed_version": "v1.27.2", "id": "GO-2026-6599", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Reset context tracking on consecutive template expressions in html/template", "version": "v1.27.1" }, { "aliases": [ "CVE-2026-97030" ], "epss": { "cve": "CVE-2026-97030", "percentile": 0.21475, "score": 0.00289 }, "fixed_version": "v1.27.2", "id": "GO-2026-6600", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Recognize yield as regexp preceder keyword in html/template", "version": "v1.27.1" }, { "aliases": [ "CVE-2026-78659" ], "epss": { "cve": "CVE-2026-78659", "percentile": 0.50082, "score": 0.00627 }, "fixed_version": "v1.27.2", "id": "GO-2026-6603", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http", "version": "v1.27.1" }, { "aliases": [ "CVE-2026-56866" ], "epss": { "cve": "CVE-2026-56866", "percentile": 0.40968, "score": 0.00473 }, "fixed_version": "v1.27.2", "id": "GO-2026-6605", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/1 client connection desynchronization after CONNECT rejection in net/http", "version": "v1.27.1" }, { "aliases": [ "CVE-2026-97031" ], "epss": { "cve": "CVE-2026-97031", "percentile": 0.44095, "score": 0.00519 }, "fixed_version": "v1.27.2", "id": "GO-2026-6607", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Reject malformed ECH outer extension references in crypto/tls", "version": "v1.27.1" }, { "aliases": [ "CVE-2026-94440" ], "epss": { "cve": "CVE-2026-94440", "percentile": 0.4362, "score": 0.00511 }, "fixed_version": "v1.27.2", "id": "GO-2026-6608", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart", "version": "v1.27.1" }, { "aliases": [ "CVE-2026-78667" ], "epss": { "cve": "CVE-2026-78667", "percentile": 0.41455, "score": 0.0048 }, "fixed_version": "v1.27.2", "id": "GO-2026-6609", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Lack of limit on size of parsed Range headers in net/http", "version": "v1.27.1" }, { "aliases": [ "CVE-2026-78660" ], "epss": { "cve": "CVE-2026-78660", "percentile": 0.36838, "score": 0.00425 }, "fixed_version": "v1.27.2", "id": "GO-2026-6610", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 transport accepts malformed framing-related headers in net/http", "version": "v1.27.1" }, { "aliases": [ "CVE-2026-78669" ], "epss": { "cve": "CVE-2026-78669", "percentile": 0.49426, "score": 0.00614 }, "fixed_version": "v1.27.2", "id": "GO-2026-6611", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption from repeated initial window changes in net/http", "version": "v1.27.1" }, { "aliases": [ "CVE-2026-94439" ], "epss": { "cve": "CVE-2026-94439", "percentile": 0.35772, "score": 0.00414 }, "fixed_version": "v1.27.2", "id": "GO-2026-6613", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http", "version": "v1.27.1" }, { "aliases": [ "CVE-2026-111943" ], "epss": { "cve": "CVE-2026-111943", "percentile": 0.33793, "score": 0.00396 }, "fixed_version": "v1.27.3", "id": "GO-2026-6809", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Distrust compromised intermediate certificates in crypto/x509", "version": "v1.27.1" }, { "aliases": [], "epss": null, "fixed_version": "", "id": "GO-2026-5932", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "version": "v0.56.0" }, { "aliases": [ "CVE-2026-78663" ], "epss": { "cve": "CVE-2026-78663", "percentile": 0.49813, "score": 0.00622 }, "fixed_version": "v0.60.0", "id": "GO-2026-6612", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Double flow control refund on HTTP/2 server streams in net/http", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-97032" ], "epss": { "cve": "CVE-2026-97032", "percentile": 0.42154, "score": 0.0049 }, "fixed_version": "v0.60.0", "id": "GO-2026-6617", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "HTTP/2 server crash due to HPACK encoder race in net/http", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-78661" ], "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fixed_version": "v0.62.0", "id": "GO-2026-6860", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-97045" ], "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fixed_version": "v0.62.0", "id": "GO-2026-6866", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net", "version": "v0.58.0" } ], "go_version": "go1.27.1", "main_module": "" }, "id": "open-policy-agent__conftest", "manifests": [ ".github/workflows/post_merge.yaml", ".github/workflows/pr.yaml", ".github/workflows/release.yaml", "go.mod", "go.sum", "requirements-dev.txt", "requirements.txt" ], "name": "conftest", "osv": { "advisories": 32, "available": true, "confirmed": 11, "osv_only": [ { "ecosystem": "PyPI", "ids": [ "CVE-2026-22701", "GHSA-qmgc-5h2g-mvrw", "PYSEC-2026-1374" ], "package": "filelock", "score": "5.3", "severity": "Medium", "version": "3.19.1" }, { "ecosystem": "PyPI", "ids": [ "CVE-2025-68146", "GHSA-w853-jp5j-5j7f", "PYSEC-2026-1375" ], "package": "filelock", "score": "6.3", "severity": "Medium", "version": "3.19.1" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-112909", "GHSA-69hj-f68j-2879" ], "package": "filelock", "score": "6.1", "severity": "Medium", "version": "3.19.1" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-112910", "GHSA-8mx5-7m5m-r77g" ], "package": "filelock", "score": "5.3", "severity": "Medium", "version": "3.19.1" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113718", "CVE-2026-113718", "GHSA-394h-qwmc-48pf" ], "package": "virtualenv", "score": "7.1", "severity": "High", "version": "21.9.1" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113724", "CVE-2026-113724", "GHSA-43mp-35q3-x3fq" ], "package": "virtualenv", "score": "4.5", "severity": "Medium", "version": "21.9.1" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113714", "CVE-2026-113714", "GHSA-494p-63j8-28p3" ], "package": "virtualenv", "score": "2.3", "severity": "Low", "version": "21.9.1" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113721", "CVE-2026-113721", "GHSA-558c-9hv2-4prj" ], "package": "virtualenv", "score": "4.5", "severity": "Medium", "version": "21.9.1" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113726", "CVE-2026-113726", "GHSA-5vjq-rrrf-7h2q" ], "package": "virtualenv", "score": "7.8", "severity": "High", "version": "21.9.1" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113723", "CVE-2026-113723", "GHSA-6w3r-xr62-4xcp" ], "package": "virtualenv", "score": "7.1", "severity": "High", "version": "21.9.1" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113776", "CVE-2026-113776", "GHSA-8rjx-v5ww-45pp" ], "package": "virtualenv", "score": "7.8", "severity": "High", "version": "21.9.1" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113732", "CVE-2026-113732", "GHSA-c947-3pg5-gm8q" ], "package": "virtualenv", "score": "7.8", "severity": "High", "version": "21.9.1" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113722", "CVE-2026-113722", "GHSA-c978-59m8-c77v" ], "package": "virtualenv", "score": "7.8", "severity": "High", "version": "21.9.1" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113716", "CVE-2026-113716", "GHSA-cw65-gx24-rc82" ], "package": "virtualenv", "score": "4.5", "severity": "Medium", "version": "21.9.1" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113717", "CVE-2026-113717", "GHSA-cx28-75q4-x26q" ], "package": "virtualenv", "score": "2.3", "severity": "Low", "version": "21.9.1" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113720", "CVE-2026-113720", "GHSA-fc2g-4w5p-6whm" ], "package": "virtualenv", "score": "4.4", "severity": "Medium", "version": "21.9.1" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113719", "CVE-2026-113719", "GHSA-hhxq-47xx-j5xx" ], "package": "virtualenv", "score": "4.5", "severity": "Medium", "version": "21.9.1" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113715", "CVE-2026-113715", "GHSA-qmx5-4p3x-wvqf" ], "package": "virtualenv", "score": "2.0", "severity": "Low", "version": "21.9.1" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113725", "CVE-2026-113725", "GHSA-vxj4-q4g9-crj7" ], "package": "virtualenv", "score": "7.8", "severity": "High", "version": "21.9.1" }, { "ecosystem": "PyPI", "ids": [ "GHSA-6q48-6c7w-9gw2", "PYSEC-2026-4320" ], "package": "certifi", "score": "9.1", "severity": "Critical", "version": "2026.7.22" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-45409", "GHSA-65pc-fj4g-8rjx", "PYSEC-2026-215" ], "package": "idna", "score": "6.9", "severity": "Medium", "version": "3.9.0" } ], "warning": null }, "ref": "v0.71.1", "ref_kind": "release", "release_integrity": { "asset": "conftest_0.71.1_Linux_x86_64.tar.gz", "assets": 25, "build_provenance": "verified", "checksums_published": true, "digest_matches_github": true, "immutable_release": null, "methods": [ { "method": "github-attestation", "predicates": [ "https://slsa.dev/provenance/v1" ], "status": "verified" } ], "provenance_published": false, "sbom_published": true, "signature": null, "signatures_published": false, "signer": null, "verdict": "verified" }, "released_at": "2026-10-06T04:53:53Z", "repository": "open-policy-agent/conftest", "sbomlyze_diff": { "added": 0, "changed": 0, "drift": {}, "findings": [ "0 version changes among 191 shared packages \u2014 no actual upgrades", "Core system packages stable: golang (165), github (17) unchanged" ], "removed": 0 }, "scanned_at": "2026-11-02T03:07:28+00:00", "scorecard": { "checks": [ { "name": "CII-Best-Practices", "reason": "no effort to earn an OpenSSF best practices badge detected", "score": 0 }, { "name": "Fuzzing", "reason": "project is not fuzzed", "score": 0 }, { "name": "Signed-Releases", "reason": "Project has not signed or included provenance with any releases.", "score": 0 }, { "name": "Branch-Protection", "reason": "branch protection is not maximal on development and all release branches", "score": 4 }, { "name": "Pinned-Dependencies", "reason": "dependency not pinned by hash detected -- score normalized to 6", "score": 6 }, { "name": "SAST", "reason": "SAST tool is not run on all commits -- score normalized to 7", "score": 7 }, { "name": "License", "reason": "license file detected", "score": 9 }, { "name": "Security-Policy", "reason": "security policy file detected", "score": 9 }, { "name": "Binary-Artifacts", "reason": "no binaries found in the repo", "score": 10 }, { "name": "Code-Review", "reason": "all changesets reviewed", "score": 10 }, { "name": "Dangerous-Workflow", "reason": "no dangerous workflow patterns detected", "score": 10 }, { "name": "Maintained", "reason": "30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10", "score": 10 }, { "name": "Packaging", "reason": "packaging workflow detected", "score": 10 }, { "name": "Token-Permissions", "reason": "GitHub workflow tokens follow principle of least privilege", "score": 10 } ], "date": "2026-10-26", "score": 7.2, "source": "openssf-api", "version": "v5.6.0" }, "vulnerabilities": [ { "aliases": [ "CVE-2026-78663" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78663", "percentile": 0.49813, "score": 0.00622 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6612", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Critical", "summary": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configure", "url": "https://go.dev/cl/847187", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-116587" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-116587", "percentile": 0.3048, "score": 0.00366 }, "fix_state": "fixed", "fixed_in": [ "4.1.6" ], "id": "GHSA-mgcc-cww5-fp2q", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/go-jose/go-jose/v4", "severity": "High", "summary": "Go JOSE: DoS when parsing JWKs that contain RSA keys", "url": "https://github.com/advisories/GHSA-mgcc-cww5-fp2q", "version": "v4.1.4" }, { "aliases": [ "CVE-2026-78659" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78659", "percentile": 0.50082, "score": 0.00627 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6603", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"", "url": "https://go.dev/cl/847185", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-78660" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78660", "percentile": 0.36838, "score": 0.00425 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6610", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a re", "url": "https://go.dev/cl/835145", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-78669" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78669", "percentile": 0.49426, "score": 0.00614 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6611", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "url": "https://go.dev/cl/847186", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-97032" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97032", "percentile": 0.42154, "score": 0.0049 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6617", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the ot", "url": "https://go.dev/cl/847188", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-116585" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-116585", "percentile": 0.18368, "score": 0.00264 }, "fix_state": "fixed", "fixed_in": [ "4.1.5" ], "id": "GHSA-4w3g-jfj2-cw2q", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/go-jose/go-jose/v4", "severity": "Medium", "summary": "Go JOSE: Panic during CBC-HMAC processing", "url": "https://github.com/advisories/GHSA-4w3g-jfj2-cw2q", "version": "v4.1.4" }, { "aliases": [ "CVE-2026-116586" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-116586", "percentile": 0.21769, "score": 0.00292 }, "fix_state": "fixed", "fixed_in": [ "4.1.5" ], "id": "GHSA-vvm8-gf78-28g4", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/go-jose/go-jose/v4", "severity": "Medium", "summary": "Go JOSE: Panics in JSON parsing", "url": "https://github.com/advisories/GHSA-vvm8-gf78-28g4", "version": "v4.1.4" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5932", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Unknown", "summary": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained f", "url": "https://go.dev/issue/44226", "version": "v0.56.0" }, { "aliases": [ "CVE-2026-78661" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6860", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\") cau", "url": "https://go.dev/cl/849365", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-97045" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6866", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or f", "url": "https://go.dev/cl/855121", "version": "v0.58.0" } ], "workflow_audit": { "files": 3, "findings": [] } }, "updated": "2026-11-02" }