{
  "history": [
    {
      "added": 0,
      "commit": "5eb1d104ef85ff2c905c877eb600e8c1dee33a22",
      "date": "2026-11-01",
      "dependencies": 79,
      "errors": [],
      "fixable": 2,
      "go_version": "go1.27.3",
      "in_binary": {
        "dependencies": 0,
        "stdlib": 0,
        "total": 0
      },
      "new_vulnerabilities": 0,
      "osv_confirmed": 3,
      "osv_only": 0,
      "ref": "v2.30.0",
      "release_changed": false,
      "release_integrity": "verified",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 6.6,
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 0,
        "Low": 0,
        "Medium": 0,
        "Negligible": 0,
        "Unknown": 3
      },
      "workflow": {
        "High": 0,
        "Low": 1,
        "Medium": 0,
        "files": 5
      }
    },
    {
      "added": 0,
      "commit": "5eb1d104ef85ff2c905c877eb600e8c1dee33a22",
      "date": "2026-11-02",
      "dependencies": 79,
      "errors": [],
      "fixable": 2,
      "go_version": "go1.27.3",
      "in_binary": {
        "dependencies": 0,
        "stdlib": 0,
        "total": 0
      },
      "kev": 0,
      "kev_new": 0,
      "new_vulnerabilities": 0,
      "osv_confirmed": 3,
      "osv_only": 0,
      "ref": "v2.30.0",
      "release_changed": false,
      "release_integrity": "signed",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 6.6,
      "scorecard_date": "2026-10-19",
      "scorecard_note": null,
      "scorecard_source": "openssf-api",
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 0,
        "Low": 0,
        "Medium": 0,
        "Negligible": 0,
        "Unknown": 3
      },
      "vulnerable_packages": 2,
      "workflow": {
        "High": 0,
        "Low": 1,
        "Medium": 0,
        "files": 5
      }
    }
  ],
  "latest": {
    "archived": false,
    "category": "Static Application Security Testing (SAST) \u203a Language-specific \u203a Go",
    "changes": {
      "added": [],
      "any": true,
      "baseline": false,
      "in_binary_new": [],
      "in_binary_resolved": [],
      "integrity_drift": 0,
      "license_changes": [],
      "new_vulnerabilities": [],
      "previous_ref": "v2.30.0",
      "release_changed": false,
      "release_integrity": {
        "from": "verified",
        "to": "signed"
      },
      "removed": [],
      "resolved_vulnerabilities": [],
      "upgraded": [],
      "workflow_new": 0,
      "workflow_resolved": 0
    },
    "commit": "5eb1d104ef85ff2c905c877eb600e8c1dee33a22",
    "compliance": {
      "overall_score": 55,
      "standards": {
        "bsi_tr03183": {
          "failed_checks": [
            "Component Creator",
            "Distribution Licences",
            "SHA-512 Hash",
            "Dependency Relationship",
            "SBOM Creator Contact"
          ],
          "passed": 4,
          "score": 44,
          "total": 9
        },
        "cisa": {
          "failed_checks": [
            "Software Producer",
            "Dependency Relationship",
            "License Information",
            "Component Hash",
            "SBOM Author"
          ],
          "passed": 5,
          "score": 50,
          "total": 10
        },
        "ntia": {
          "failed_checks": [
            "Supplier Name",
            "Dependency Relationship"
          ],
          "passed": 5,
          "score": 71,
          "total": 7
        }
      }
    },
    "components": [
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "actions/cache",
        "purl": "pkg:github/actions/cache@v6",
        "version": "v6"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/action-integration.yml",
        "name": "actions/checkout",
        "purl": "pkg:github/actions/checkout@v7",
        "version": "v7"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/action-integration.yml",
        "name": "actions/github-script",
        "purl": "pkg:github/actions/github-script@v9",
        "version": "v9"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "actions/setup-go",
        "purl": "pkg:github/actions/setup-go@v7",
        "version": "v7"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/action-integration.yml",
        "name": "actions/upload-artifact",
        "purl": "pkg:github/actions/upload-artifact@v7",
        "version": "v7"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "ccojocar/barry",
        "purl": "pkg:github/ccojocar/barry@main",
        "version": "main"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "codecov/codecov-action",
        "purl": "pkg:github/codecov/codecov-action@v7",
        "version": "v7"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yml",
        "name": "CycloneDX/gh-gomod-generate-sbom",
        "purl": "pkg:github/CycloneDX/gh-gomod-generate-sbom@v2",
        "version": "v2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yml",
        "name": "docker/build-push-action",
        "purl": "pkg:github/docker/build-push-action@v7",
        "version": "v7"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yml",
        "name": "docker/login-action",
        "purl": "pkg:github/docker/login-action@v4",
        "version": "v4"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yml",
        "name": "docker/metadata-action",
        "purl": "pkg:github/docker/metadata-action@v6",
        "version": "v6"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yml",
        "name": "docker/setup-buildx-action",
        "purl": "pkg:github/docker/setup-buildx-action@v4",
        "version": "v4"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yml",
        "name": "docker/setup-qemu-action",
        "purl": "pkg:github/docker/setup-qemu-action@v4",
        "version": "v4"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/action-integration.yml",
        "name": "github/codeql-action/upload-sarif",
        "purl": "pkg:github/github/codeql-action@v4#upload-sarif",
        "version": "v4"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "golangci/golangci-lint-action",
        "purl": "pkg:github/golangci/golangci-lint-action@v9",
        "version": "v9"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yml",
        "name": "goreleaser/goreleaser-action",
        "purl": "pkg:github/goreleaser/goreleaser-action@v7",
        "version": "v7"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "securego/gosec",
        "purl": "pkg:github/securego/gosec@master",
        "version": "master"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/scan.yml",
        "name": "securego/gosec",
        "purl": "pkg:github/securego/gosec@v2.29.0",
        "version": "v2.29.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yml",
        "name": "sigstore/cosign-installer",
        "purl": "pkg:github/sigstore/cosign-installer@v4.1.2",
        "version": "v4.1.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "cloud.google.com/go",
        "purl": "pkg:golang/cloud.google.com/go@v0.123.0",
        "version": "v0.123.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "cloud.google.com/go/auth",
        "purl": "pkg:golang/cloud.google.com/go/auth@v0.24.1",
        "version": "v0.24.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "cloud.google.com/go/compute/metadata",
        "purl": "pkg:golang/cloud.google.com/go/compute/metadata@v0.10.0",
        "version": "v0.10.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/anthropics/anthropic-sdk-go",
        "purl": "pkg:golang/github.com/anthropics/anthropic-sdk-go@v1.82.0",
        "version": "v1.82.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bahlo/generic-list-go",
        "purl": "pkg:golang/github.com/bahlo/generic-list-go@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/buger/jsonparser",
        "purl": "pkg:golang/github.com/buger/jsonparser@v1.6.1",
        "version": "v1.6.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/BurntSushi/toml",
        "purl": "pkg:golang/github.com/BurntSushi/toml@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/ccojocar/zxcvbn-go",
        "purl": "pkg:golang/github.com/ccojocar/zxcvbn-go@v1.0.4",
        "version": "v1.0.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cespare/xxhash/v2",
        "purl": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0",
        "version": "v2.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/coder/websocket",
        "purl": "pkg:golang/github.com/coder/websocket@v1.8.15",
        "version": "v1.8.15"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/felixge/httpsnoop",
        "purl": "pkg:golang/github.com/felixge/httpsnoop@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-logr/logr",
        "purl": "pkg:golang/github.com/go-logr/logr@v1.4.4",
        "version": "v1.4.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-logr/stdr",
        "purl": "pkg:golang/github.com/go-logr/stdr@v1.2.2",
        "version": "v1.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-task/slim-sprig/v3",
        "purl": "pkg:golang/github.com/go-task/slim-sprig/v3@v3.0.0",
        "version": "v3.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/go-cmp",
        "purl": "pkg:golang/github.com/google/go-cmp@v0.7.0",
        "version": "v0.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/pprof",
        "purl": "pkg:golang/github.com/google/pprof@v0.0.0-20261016150608-1facf8f91b50",
        "version": "v0.0.0-20261016150608-1facf8f91b50"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/s2a-go",
        "purl": "pkg:golang/github.com/google/s2a-go@v0.1.11",
        "version": "v0.1.11"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/uuid",
        "purl": "pkg:golang/github.com/google/uuid@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/googleapis/enterprise-certificate-proxy",
        "purl": "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.23",
        "version": "v0.3.23"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/googleapis/gax-go/v2",
        "purl": "pkg:golang/github.com/googleapis/gax-go/v2@v2.26.2",
        "version": "v2.26.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gookit/color",
        "purl": "pkg:golang/github.com/gookit/color@v1.6.3",
        "version": "v1.6.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gorilla/websocket",
        "purl": "pkg:golang/github.com/gorilla/websocket@v1.5.3",
        "version": "v1.5.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/invopop/jsonschema",
        "purl": "pkg:golang/github.com/invopop/jsonschema@v0.14.0",
        "version": "v0.14.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/lib/pq",
        "purl": "pkg:golang/github.com/lib/pq@v1.12.3",
        "version": "v1.12.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/Masterminds/semver/v3",
        "purl": "pkg:golang/github.com/Masterminds/semver/v3@v3.5.0",
        "version": "v3.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mozilla/tls-observatory",
        "purl": "pkg:golang/github.com/mozilla/tls-observatory@v0.0.0-20250923143331-eef96233227e",
        "version": "v0.0.0-20250923143331-eef96233227e"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/onsi/ginkgo/v2",
        "purl": "pkg:golang/github.com/onsi/ginkgo/v2@v2.33.1",
        "version": "v2.33.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/onsi/gomega",
        "purl": "pkg:golang/github.com/onsi/gomega@v1.44.0",
        "version": "v1.44.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/openai/openai-go/v3",
        "purl": "pkg:golang/github.com/openai/openai-go/v3@v3.82.0",
        "version": "v3.82.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/pb33f/go-yaml",
        "purl": "pkg:golang/github.com/pb33f/go-yaml@v0.1.1",
        "version": "v0.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/pb33f/ordered-map/v2",
        "purl": "pkg:golang/github.com/pb33f/ordered-map/v2@v2.3.2",
        "version": "v2.3.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/santhosh-tekuri/jsonschema/v6",
        "purl": "pkg:golang/github.com/santhosh-tekuri/jsonschema/v6@v6.0.3",
        "version": "v6.0.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/standard-webhooks/standard-webhooks/libraries",
        "purl": "pkg:golang/github.com/standard-webhooks/standard-webhooks/libraries@v0.0.1",
        "version": "v0.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/stretchr/objx",
        "purl": "pkg:golang/github.com/stretchr/objx@v0.8.0",
        "version": "v0.8.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/stretchr/testify",
        "purl": "pkg:golang/github.com/stretchr/testify@v1.12.1",
        "version": "v1.12.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tidwall/gjson",
        "purl": "pkg:golang/github.com/tidwall/gjson@v1.20.0",
        "version": "v1.20.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tidwall/match",
        "purl": "pkg:golang/github.com/tidwall/match@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tidwall/pretty",
        "purl": "pkg:golang/github.com/tidwall/pretty@v1.2.2",
        "version": "v1.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tidwall/sjson",
        "purl": "pkg:golang/github.com/tidwall/sjson@v1.2.5",
        "version": "v1.2.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/xo/terminfo",
        "purl": "pkg:golang/github.com/xo/terminfo@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/auto/sdk",
        "purl": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1",
        "version": "v1.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
        "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.72.0",
        "version": "v0.72.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/otel",
        "purl": "pkg:golang/go.opentelemetry.io/otel@v1.47.0",
        "version": "v1.47.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/otel/log",
        "purl": "pkg:golang/go.opentelemetry.io/otel/log@v1.47.0",
        "version": "v1.47.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/otel/metric",
        "purl": "pkg:golang/go.opentelemetry.io/otel/metric@v1.47.0",
        "version": "v1.47.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/otel/trace",
        "purl": "pkg:golang/go.opentelemetry.io/otel/trace@v1.47.0",
        "version": "v1.47.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.yaml.in/yaml/v3",
        "purl": "pkg:golang/go.yaml.in/yaml/v3@v3.0.5",
        "version": "v3.0.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/crypto",
        "purl": "pkg:golang/golang.org/x/crypto@v0.58.0",
        "version": "v0.58.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/mod",
        "purl": "pkg:golang/golang.org/x/mod@v0.42.0",
        "version": "v0.42.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/net",
        "purl": "pkg:golang/golang.org/x/net@v0.61.0",
        "version": "v0.61.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/sync",
        "purl": "pkg:golang/golang.org/x/sync@v0.24.0",
        "version": "v0.24.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/sys",
        "purl": "pkg:golang/golang.org/x/sys@v0.49.0",
        "version": "v0.49.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/text",
        "purl": "pkg:golang/golang.org/x/text@v0.43.0",
        "version": "v0.43.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/tools",
        "purl": "pkg:golang/golang.org/x/tools@v0.52.0",
        "version": "v0.52.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/api",
        "purl": "pkg:golang/google.golang.org/api@v0.304.0",
        "version": "v0.304.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/genai",
        "purl": "pkg:golang/google.golang.org/genai@v1.75.0",
        "version": "v1.75.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/genproto/googleapis/rpc",
        "purl": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20261012220534-4341edf3f941",
        "version": "v0.0.0-20261012220534-4341edf3f941"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/grpc",
        "purl": "pkg:golang/google.golang.org/grpc@v1.84.0",
        "version": "v1.84.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/protobuf",
        "purl": "pkg:golang/google.golang.org/protobuf@v1.36.12",
        "version": "v1.36.12"
      },
      {
        "ecosystem": "unknown",
        "licenses": [],
        "location": ".github/workflows/action-integration.yml",
        "name": "./",
        "purl": "",
        "version": "UNKNOWN"
      }
    ],
    "description": "Find security issues in Go source code",
    "errors": [],
    "go_binary": {
      "asset": "gosec_2.30.0_linux_amd64.tar.gz",
      "binary": "gosec",
      "db": "https://vuln.go.dev",
      "db_last_modified": "2026-10-27T21:16:18Z",
      "findings": [
        {
          "aliases": [],
          "epss": null,
          "fixed_version": "",
          "id": "GO-2026-5932",
          "kev": null,
          "level": "module",
          "module": "golang.org/x/crypto",
          "summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues",
          "version": "v0.58.0"
        },
        {
          "aliases": [
            "CVE-2026-78661"
          ],
          "epss": {
            "cve": "CVE-2026-78661",
            "percentile": 0.08063,
            "score": 0.00185
          },
          "fixed_version": "v0.62.0",
          "id": "GO-2026-6860",
          "kev": null,
          "level": "module",
          "module": "golang.org/x/net",
          "summary": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net",
          "version": "v0.61.0"
        },
        {
          "aliases": [
            "CVE-2026-97045"
          ],
          "epss": {
            "cve": "CVE-2026-97045",
            "percentile": 0.10117,
            "score": 0.00202
          },
          "fixed_version": "v0.62.0",
          "id": "GO-2026-6866",
          "kev": null,
          "level": "module",
          "module": "golang.org/x/net",
          "summary": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net",
          "version": "v0.61.0"
        }
      ],
      "go_version": "go1.27.3",
      "main_module": "github.com/securego/gosec/v2"
    },
    "id": "securego__gosec",
    "manifests": [
      ".github/workflows/action-integration.yml",
      ".github/workflows/ci.yml",
      ".github/workflows/release.yml",
      ".github/workflows/scan.yml",
      "action.yml",
      "go.mod",
      "go.sum"
    ],
    "name": "gosec",
    "osv": {
      "advisories": 3,
      "available": true,
      "confirmed": 3,
      "osv_only": [],
      "warning": null
    },
    "ref": "v2.30.0",
    "ref_kind": "release",
    "release_integrity": {
      "asset": "gosec_2.30.0_linux_amd64.tar.gz",
      "assets": 19,
      "build_provenance": null,
      "checksums_published": true,
      "digest_matches_github": true,
      "immutable_release": true,
      "methods": [
        {
          "covers": "asset",
          "detail": "signed with the project's own key; the public key is not checked",
          "method": "cosign",
          "status": "key-signature"
        },
        {
          "detail": "GitHub attests the file is unchanged since the release was published",
          "method": "github-immutable-release",
          "status": "verified"
        }
      ],
      "provenance_published": false,
      "sbom_published": false,
      "signature": "key-unchecked",
      "signatures_published": true,
      "signer": null,
      "verdict": "signed"
    },
    "released_at": "2026-10-23T09:22:19Z",
    "repository": "securego/gosec",
    "sbomlyze_diff": {
      "added": 0,
      "changed": 0,
      "drift": {},
      "findings": [
        "0 version changes among 90 shared packages \u2014 no actual upgrades",
        "Core system packages stable: golang (59), github (25) unchanged"
      ],
      "removed": 0
    },
    "scanned_at": "2026-11-02T03:08:34+00:00",
    "scorecard": {
      "checks": [
        {
          "name": "Dangerous-Workflow",
          "reason": "dangerous workflow patterns detected",
          "score": 0
        },
        {
          "name": "Fuzzing",
          "reason": "project is not fuzzed",
          "score": 0
        },
        {
          "name": "Security-Policy",
          "reason": "security policy file not detected",
          "score": 0
        },
        {
          "name": "CII-Best-Practices",
          "reason": "badge detected: Passing",
          "score": 5
        },
        {
          "name": "Pinned-Dependencies",
          "reason": "dependency not pinned by hash detected -- score normalized to 7",
          "score": 7
        },
        {
          "name": "Signed-Releases",
          "reason": "5 out of the last 5 releases have a total of 5 signed artifacts.",
          "score": 8
        },
        {
          "name": "Token-Permissions",
          "reason": "detected GitHub workflow tokens with excessive permissions",
          "score": 8
        },
        {
          "name": "Code-Review",
          "reason": "Found 23/25 approved changesets -- score normalized to 9",
          "score": 9
        },
        {
          "name": "Binary-Artifacts",
          "reason": "no binaries found in the repo",
          "score": 10
        },
        {
          "name": "License",
          "reason": "license file detected",
          "score": 10
        },
        {
          "name": "Maintained",
          "reason": "30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10",
          "score": 10
        },
        {
          "name": "Packaging",
          "reason": "packaging workflow detected",
          "score": 10
        },
        {
          "name": "SAST",
          "reason": "SAST tool is run on all commits",
          "score": 10
        },
        {
          "name": "Branch-Protection",
          "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
          "score": -1
        }
      ],
      "date": "2026-10-19",
      "score": 6.6,
      "source": "openssf-api",
      "version": "v5.6.0"
    },
    "vulnerabilities": [
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": null,
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-5932",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Unknown",
        "summary": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained f",
        "url": "https://go.dev/issue/44226",
        "version": "v0.58.0"
      },
      {
        "aliases": [
          "CVE-2026-78661"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78661",
          "percentile": 0.08063,
          "score": 0.00185
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.62.0"
        ],
        "id": "GO-2026-6860",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Unknown",
        "summary": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") cau",
        "url": "https://go.dev/cl/849365",
        "version": "v0.61.0"
      },
      {
        "aliases": [
          "CVE-2026-97045"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-97045",
          "percentile": 0.10117,
          "score": 0.00202
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.62.0"
        ],
        "id": "GO-2026-6866",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Unknown",
        "summary": "In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> f",
        "url": "https://go.dev/cl/855121",
        "version": "v0.61.0"
      }
    ],
    "workflow_audit": {
      "files": 5,
      "findings": [
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/action-integration.yml",
          "line": 25,
          "note": "this step",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        }
      ]
    }
  },
  "updated": "2026-11-02"
}