{ "history": [ { "added": 0, "commit": "206912e3cf61ba3fed587896e10d4812411e6913", "date": "2026-11-01", "dependencies": 270, "errors": [], "fixable": 10, "go_version": "go1.27.3", "in_binary": { "dependencies": 0, "stdlib": 0, "total": 0 }, "new_vulnerabilities": 0, "osv_confirmed": 12, "osv_only": 0, "ref": "v1.5.5", "release_changed": false, "release_integrity": "verified", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": 8.6, "upgraded": 0, "vulnerabilities": { "Critical": 1, "High": 5, "Low": 0, "Medium": 0, "Negligible": 0, "Unknown": 6 }, "workflow": { "High": 2, "Low": 0, "Medium": 0, "files": 9 } }, { "added": 0, "commit": "206912e3cf61ba3fed587896e10d4812411e6913", "date": "2026-11-02", "dependencies": 270, "errors": [], "fixable": 10, "go_version": "go1.27.3", "in_binary": { "dependencies": 0, "stdlib": 0, "total": 0 }, "kev": 0, "kev_new": 0, "new_vulnerabilities": 0, "osv_confirmed": 12, "osv_only": 0, "ref": "v1.5.5", "release_changed": false, "release_integrity": "signed", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": 8.6, "scorecard_date": "2026-10-31", "scorecard_note": null, "scorecard_source": "openssf-api", "upgraded": 0, "vulnerabilities": { "Critical": 1, "High": 5, "Low": 0, "Medium": 0, "Negligible": 0, "Unknown": 6 }, "vulnerable_packages": 5, "workflow": { "High": 2, "Low": 0, "Medium": 0, "files": 9 } } ], "latest": { "archived": false, "category": "Artifact Signing & Verification", "changes": { "added": [], "any": true, "baseline": false, "in_binary_new": [], "in_binary_resolved": [], "integrity_drift": 0, "license_changes": [], "new_vulnerabilities": [], "previous_ref": "v1.5.5", "release_changed": false, "release_integrity": { "from": "verified", "to": "signed" }, "removed": [], "resolved_vulnerabilities": [], "upgraded": [], "workflow_new": 0, "workflow_resolved": 0 }, "commit": "206912e3cf61ba3fed587896e10d4812411e6913", "compliance": { "overall_score": 55, "standards": { "bsi_tr03183": { "failed_checks": [ "Component Creator", "Distribution Licences", "SHA-512 Hash", "Dependency Relationship", "SBOM Creator Contact" ], "passed": 4, "score": 44, "total": 9 }, "cisa": { "failed_checks": [ "Software Producer", "Dependency Relationship", "License Information", "Component Hash", "SBOM Author" ], "passed": 5, "score": 50, "total": 10 }, "ntia": { "failed_checks": [ "Supplier Name", "Dependency Relationship" ], "passed": 5, "score": 71, "total": 7 } } }, "components": [ { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@v7.0.1", "version": "v7.0.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "actions/setup-go", "purl": "pkg:github/actions/setup-go@v7.0.0", "version": "v7.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/main.yml", "name": "actions/upload-artifact", "purl": "pkg:github/actions/upload-artifact@v7.0.2", "version": "v7.0.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/main.yml", "name": "codecov/codecov-action", "purl": "pkg:github/codecov/codecov-action@v7.1.1", "version": "v7.1.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "docker/login-action", "purl": "pkg:github/docker/login-action@v4.6.0", "version": "v4.6.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql-analysis.yml", "name": "github/codeql-action/analyze", "purl": "pkg:github/github/codeql-action@v4.39.0#analyze", "version": "v4.39.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql-analysis.yml", "name": "github/codeql-action/autobuild", "purl": "pkg:github/github/codeql-action@v4.39.0#autobuild", "version": "v4.39.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql-analysis.yml", "name": "github/codeql-action/init", "purl": "pkg:github/github/codeql-action@v4.39.0#init", "version": "v4.39.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/verify.yml", "name": "golangci/golangci-lint-action", "purl": "pkg:github/golangci/golangci-lint-action@v9.3.0", "version": "v9.3.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/main.yml", "name": "Homebrew/actions/setup-homebrew", "purl": "pkg:github/Homebrew/actions@eb02c69dbabdb66ff183c614f4ce7ab3c077592c#setup-homebrew", "version": "eb02c69dbabdb66ff183c614f4ce7ab3c077592c" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "ko-build/setup-ko", "purl": "pkg:github/ko-build/setup-ko@v0.10", "version": "v0.10" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/depsreview.yml", "name": "sigstore/community/.github/workflows/reusable-dependency-review.yml", "purl": "pkg:github/sigstore/community@9b1b5aca605f92ec5b1bf3681b1e61b3dbc420cc#.github/workflows/reusable-dependency-review.yml", "version": "9b1b5aca605f92ec5b1bf3681b1e61b3dbc420cc" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/cut-release.yml", "name": "sigstore/community/.github/workflows/reusable-release.yml", "purl": "pkg:github/sigstore/community@main#.github/workflows/reusable-release.yml", "version": "main" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/scorecard_action.yml", "name": "sigstore/community/.github/workflows/reusable-scorecard.yml", "purl": "pkg:github/sigstore/community@main#.github/workflows/reusable-scorecard.yml", "version": "main" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "sigstore/cosign-installer", "purl": "pkg:github/sigstore/cosign-installer@v4.1.2", "version": "v4.1.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "al.essio.dev/pkg/shellescape", "purl": "pkg:golang/al.essio.dev/pkg/shellescape@v1.5.1", "version": "v1.5.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cel.dev/expr", "purl": "pkg:golang/cel.dev/expr@v0.25.2", "version": "v0.25.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go", "purl": "pkg:golang/cloud.google.com/go@v0.123.0", "version": "v0.123.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/auth", "purl": "pkg:golang/cloud.google.com/go/auth@v0.24.1-0.20261001053825-dbc26066f70a", "version": "v0.24.1-0.20261001053825-dbc26066f70a" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/auth/oauth2adapt", "purl": "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/compute/metadata", "purl": "pkg:golang/cloud.google.com/go/compute/metadata@v0.10.0", "version": "v0.10.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/iam", "purl": "pkg:golang/cloud.google.com/go/iam@v1.14.0", "version": "v1.14.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/kms", "purl": "pkg:golang/cloud.google.com/go/kms@v1.33.0", "version": "v1.33.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/longrunning", "purl": "pkg:golang/cloud.google.com/go/longrunning@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/monitoring", "purl": "pkg:golang/cloud.google.com/go/monitoring@v1.30.0", "version": "v1.30.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/profiler", "purl": "pkg:golang/cloud.google.com/go/profiler@v0.7.0", "version": "v0.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/pubsub", "purl": "pkg:golang/cloud.google.com/go/pubsub@v1.51.1", "version": "v1.51.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/pubsub/v2", "purl": "pkg:golang/cloud.google.com/go/pubsub/v2@v2.7.0", "version": "v2.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/storage", "purl": "pkg:golang/cloud.google.com/go/storage@v1.64.0", "version": "v1.64.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "dario.cat/mergo", "purl": "pkg:golang/dario.cat/mergo@v1.0.2", "version": "v1.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "filippo.io/edwards25519", "purl": "pkg:golang/filippo.io/edwards25519@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/AdamKorcz/go-fuzz-headers-1", "purl": "pkg:golang/github.com/AdamKorcz/go-fuzz-headers-1@v0.0.0-20230329111138-12e09aba5ebd", "version": "v0.0.0-20230329111138-12e09aba5ebd" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/AdamKorcz/go-fuzz-headers-1", "purl": "pkg:golang/github.com/AdamKorcz/go-fuzz-headers-1@v0.0.0-20230919221257-8b5d3ce2d11d", "version": "v0.0.0-20230919221257-8b5d3ce2d11d" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/asaskevich/govalidator", "purl": "pkg:golang/github.com/asaskevich/govalidator@v0.0.0-20230301143203-a9d515a09cc2", "version": "v0.0.0-20230301143203-a9d515a09cc2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.3", "version": "v1.47.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.11", "version": "v1.7.11" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/config", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.33.9", "version": "v1.33.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/credentials", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.20.9", "version": "v1.20.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.20.3", "version": "v1.20.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager@v0.2.3", "version": "v0.2.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/internal/configsources", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.5.6", "version": "v1.5.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.8.6", "version": "v2.8.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/internal/v4a", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.5.6", "version": "v1.5.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.21", "version": "v1.13.21" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/checksum@v1.9.18", "version": "v1.9.18" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.14.6", "version": "v1.14.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/s3shared@v1.19.25", "version": "v1.19.25" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/kms", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/kms@v1.61.4", "version": "v1.61.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/s3", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/s3@v1.102.2", "version": "v1.102.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/signin", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/signin@v1.10.4", "version": "v1.10.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/sso", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.38.4", "version": "v1.38.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.43.4", "version": "v1.43.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/sts", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.51.4", "version": "v1.51.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/smithy-go", "purl": "pkg:golang/github.com/aws/smithy-go@v1.28.5", "version": "v1.28.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/azure-sdk-for-go/sdk/azcore", "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.23.1", "version": "v1.23.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/azure-sdk-for-go/sdk/azidentity", "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.14.1", "version": "v1.14.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/azure-sdk-for-go/sdk/internal", "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/internal@v1.12.0", "version": "v1.12.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys", "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys@v1.5.0", "version": "v1.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal", "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/AzureAD/microsoft-authentication-library-for-go", "purl": "pkg:golang/github.com/AzureAD/microsoft-authentication-library-for-go@v1.8.0", "version": "v1.8.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/beorn7/perks", "purl": "pkg:golang/github.com/beorn7/perks@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cavaliergopher/cpio", "purl": "pkg:golang/github.com/cavaliergopher/cpio@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cenkalti/backoff/v4", "purl": "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0", "version": "v4.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cespare/xxhash/v2", "purl": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", "version": "v2.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cloudflare/circl", "purl": "pkg:golang/github.com/cloudflare/circl@v1.6.3", "version": "v1.6.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cncf/xds/go", "purl": "pkg:golang/github.com/cncf/xds/go@v0.0.0-20260202195803-dba9d589def2", "version": "v0.0.0-20260202195803-dba9d589def2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/common-nighthawk/go-figure", "purl": "pkg:golang/github.com/common-nighthawk/go-figure@v0.0.0-20210622060536-734e95fb86be", "version": "v0.0.0-20210622060536-734e95fb86be" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/creack/pty", "purl": "pkg:golang/github.com/creack/pty@v1.1.24", "version": "v1.1.24" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/cyphar/filepath-securejoin", "purl": "pkg:golang/github.com/cyphar/filepath-securejoin@v0.2.4", "version": "v0.2.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/danieljoos/wincred", "purl": "pkg:golang/github.com/danieljoos/wincred@v1.2.2", "version": "v1.2.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/DATA-DOG/go-sqlmock", "purl": "pkg:golang/github.com/DATA-DOG/go-sqlmock@v1.5.2", "version": "v1.5.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/DataDog/zstd", "purl": "pkg:golang/github.com/DataDog/zstd@v1.5.5", "version": "v1.5.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/go-units", "purl": "pkg:golang/github.com/docker/go-units@v0.5.0", "version": "v0.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/envoyproxy/go-control-plane/envoy", "purl": "pkg:golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0", "version": "v1.37.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/envoyproxy/protoc-gen-validate", "purl": "pkg:golang/github.com/envoyproxy/protoc-gen-validate@v1.3.3", "version": "v1.3.3" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/fatih/color", "purl": "pkg:golang/github.com/fatih/color@v1.19.0", "version": "v1.19.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/felixge/httpsnoop", "purl": "pkg:golang/github.com/felixge/httpsnoop@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/fsnotify/fsnotify", "purl": "pkg:golang/github.com/fsnotify/fsnotify@v1.10.1", "version": "v1.10.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/fsnotify/fsnotify", "purl": "pkg:golang/github.com/fsnotify/fsnotify@v1.9.0", "version": "v1.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/fxamacker/cbor/v2", "purl": "pkg:golang/github.com/fxamacker/cbor/v2@v2.9.1", "version": "v2.9.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-chi/chi/v5", "purl": "pkg:golang/github.com/go-chi/chi/v5@v5.5.0", "version": "v5.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-jose/go-jose/v4", "purl": "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.5", "version": "v4.1.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/logr", "purl": "pkg:golang/github.com/go-logr/logr@v1.4.4", "version": "v1.4.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/stdr", "purl": "pkg:golang/github.com/go-logr/stdr@v1.2.2", "version": "v1.2.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/analysis", "purl": "pkg:golang/github.com/go-openapi/analysis@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/go-openapi/codescan", "purl": "pkg:golang/github.com/go-openapi/codescan@v0.36.4", "version": "v0.36.4" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/go-openapi/errors", "purl": "pkg:golang/github.com/go-openapi/errors@v0.22.8", "version": "v0.22.8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/errors", "purl": "pkg:golang/github.com/go-openapi/errors@v0.22.9", "version": "v0.22.9" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/go-openapi/inflect", "purl": "pkg:golang/github.com/go-openapi/inflect@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/jsonpointer", "purl": "pkg:golang/github.com/go-openapi/jsonpointer@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/jsonreference", "purl": "pkg:golang/github.com/go-openapi/jsonreference@v1.0.2", "version": "v1.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/loads", "purl": "pkg:golang/github.com/go-openapi/loads@v0.25.3", "version": "v0.25.3" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/go-openapi/runtime", "purl": "pkg:golang/github.com/go-openapi/runtime@v0.33.2", "version": "v0.33.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/runtime", "purl": "pkg:golang/github.com/go-openapi/runtime@v0.33.3", "version": "v0.33.3" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/go-openapi/runtime/server-middleware", "purl": "pkg:golang/github.com/go-openapi/runtime/server-middleware@v0.33.2", "version": "v0.33.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/runtime/server-middleware", "purl": "pkg:golang/github.com/go-openapi/runtime/server-middleware@v0.33.3", "version": "v0.33.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/spec", "purl": "pkg:golang/github.com/go-openapi/spec@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/go-openapi/strfmt", "purl": "pkg:golang/github.com/go-openapi/strfmt@v0.27.2", "version": "v0.27.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/strfmt", "purl": "pkg:golang/github.com/go-openapi/strfmt@v0.27.3", "version": "v0.27.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/cmdutils", "purl": "pkg:golang/github.com/go-openapi/swag/cmdutils@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/conv", "purl": "pkg:golang/github.com/go-openapi/swag/conv@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/fileutils", "purl": "pkg:golang/github.com/go-openapi/swag/fileutils@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/jsonutils", "purl": "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/loading", "purl": "pkg:golang/github.com/go-openapi/swag/loading@v0.29.1", "version": "v0.29.1" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/go-openapi/swag/loading", "purl": "pkg:golang/github.com/go-openapi/swag/loading@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/mangling", "purl": "pkg:golang/github.com/go-openapi/swag/mangling@v0.29.1", "version": "v0.29.1" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/go-openapi/swag/mangling", "purl": "pkg:golang/github.com/go-openapi/swag/mangling@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/netutils", "purl": "pkg:golang/github.com/go-openapi/swag/netutils@v0.27.1", "version": "v0.27.1" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/go-openapi/swag/netutils", "purl": "pkg:golang/github.com/go-openapi/swag/netutils@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/pools", "purl": "pkg:golang/github.com/go-openapi/swag/pools@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/stringutils", "purl": "pkg:golang/github.com/go-openapi/swag/stringutils@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/typeutils", "purl": "pkg:golang/github.com/go-openapi/swag/typeutils@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/yamlutils", "purl": "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.29.1", "version": "v0.29.1" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/go-openapi/swag/yamlutils", "purl": "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/validate", "purl": "pkg:golang/github.com/go-openapi/validate@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-redis/redismock/v9", "purl": "pkg:golang/github.com/go-redis/redismock/v9@v9.2.0", "version": "v9.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-sql-driver/mysql", "purl": "pkg:golang/github.com/go-sql-driver/mysql@v1.10.1", "version": "v1.10.1" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/go-swagger/go-swagger", "purl": "pkg:golang/github.com/go-swagger/go-swagger@v0.36.6", "version": "v0.36.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-viper/mapstructure/v2", "purl": "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", "version": "v2.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/godbus/dbus/v5", "purl": "pkg:golang/github.com/godbus/dbus/v5@v5.1.0", "version": "v5.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/golang-jwt/jwt/v5", "purl": "pkg:golang/github.com/golang-jwt/jwt/v5@v5.3.1", "version": "v5.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/golang/mock", "purl": "pkg:golang/github.com/golang/mock@v1.7.0-rc.1", "version": "v1.7.0-rc.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-cmp", "purl": "pkg:golang/github.com/google/go-cmp@v0.7.0", "version": "v0.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-containerregistry", "purl": "pkg:golang/github.com/google/go-containerregistry@v0.22.1", "version": "v0.22.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/pprof", "purl": "pkg:golang/github.com/google/pprof@v0.0.0-20260604005048-7023385849c0", "version": "v0.0.0-20260604005048-7023385849c0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/rpmpack", "purl": "pkg:golang/github.com/google/rpmpack@v0.7.1", "version": "v0.7.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/s2a-go", "purl": "pkg:golang/github.com/google/s2a-go@v0.1.11", "version": "v0.1.11" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/trillian", "purl": "pkg:golang/github.com/google/trillian@v1.8.0", "version": "v1.8.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/uuid", "purl": "pkg:golang/github.com/google/uuid@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/wire", "purl": "pkg:golang/github.com/google/wire@v0.7.0", "version": "v0.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/googleapis/enterprise-certificate-proxy", "purl": "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.22", "version": "v0.3.22" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/googleapis/gax-go/v2", "purl": "pkg:golang/github.com/googleapis/gax-go/v2@v2.26.2", "version": "v2.26.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp", "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp@v1.34.0", "version": "v1.34.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric", "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric@v0.57.0", "version": "v0.57.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping", "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping@v0.57.0", "version": "v0.57.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/gorilla/handlers", "purl": "pkg:golang/github.com/gorilla/handlers@v1.5.2", "version": "v1.5.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/grpc-ecosystem/go-grpc-middleware/v2", "purl": "pkg:golang/github.com/grpc-ecosystem/go-grpc-middleware/v2@v2.3.4", "version": "v2.3.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/errwrap", "purl": "pkg:golang/github.com/hashicorp/errwrap@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-cleanhttp", "purl": "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", "version": "v0.5.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-multierror", "purl": "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-retryablehttp", "purl": "pkg:golang/github.com/hashicorp/go-retryablehttp@v0.7.8", "version": "v0.7.8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-rootcerts", "purl": "pkg:golang/github.com/hashicorp/go-rootcerts@v1.0.2", "version": "v1.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-secure-stdlib/parseutil", "purl": "pkg:golang/github.com/hashicorp/go-secure-stdlib/parseutil@v0.2.0", "version": "v0.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-secure-stdlib/strutil", "purl": "pkg:golang/github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2", "version": "v0.1.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-sockaddr", "purl": "pkg:golang/github.com/hashicorp/go-sockaddr@v1.0.7", "version": "v1.0.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/hcl", "purl": "pkg:golang/github.com/hashicorp/hcl@v1.0.1-vault-7", "version": "v1.0.1-vault-7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/vault/api", "purl": "pkg:golang/github.com/hashicorp/vault/api@v1.23.0", "version": "v1.23.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/howeyc/gopass", "purl": "pkg:golang/github.com/howeyc/gopass@v0.0.0-20210920133722-c8aef6fb66ef", "version": "v0.0.0-20210920133722-c8aef6fb66ef" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/huandu/xstrings", "purl": "pkg:golang/github.com/huandu/xstrings@v1.5.0", "version": "v1.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/in-toto/attestation", "purl": "pkg:golang/github.com/in-toto/attestation@v1.1.2", "version": "v1.1.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/in-toto/in-toto-golang", "purl": "pkg:golang/github.com/in-toto/in-toto-golang@v0.11.0", "version": "v0.11.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/inconshreveable/mousetrap", "purl": "pkg:golang/github.com/inconshreveable/mousetrap@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jedisct1/go-minisign", "purl": "pkg:golang/github.com/jedisct1/go-minisign@v0.0.0-20211028175153-1c139d1cc84b", "version": "v0.0.0-20211028175153-1c139d1cc84b" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jellydator/ttlcache/v3", "purl": "pkg:golang/github.com/jellydator/ttlcache/v3@v3.4.1", "version": "v3.4.1" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/jessevdk/go-flags", "purl": "pkg:golang/github.com/jessevdk/go-flags@v1.6.1", "version": "v1.6.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jmoiron/sqlx", "purl": "pkg:golang/github.com/jmoiron/sqlx@v1.4.0", "version": "v1.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/klauspost/compress", "purl": "pkg:golang/github.com/klauspost/compress@v1.19.2", "version": "v1.19.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/klauspost/pgzip", "purl": "pkg:golang/github.com/klauspost/pgzip@v1.2.6", "version": "v1.2.6" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/kr/pretty", "purl": "pkg:golang/github.com/kr/pretty@v0.3.1", "version": "v0.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/kr/text", "purl": "pkg:golang/github.com/kr/text@v0.2.0", "version": "v0.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/kylelemons/godebug", "purl": "pkg:golang/github.com/kylelemons/godebug@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/Masterminds/goutils", "purl": "pkg:golang/github.com/Masterminds/goutils@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/Masterminds/semver/v3", "purl": "pkg:golang/github.com/Masterminds/semver/v3@v3.5.0", "version": "v3.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/Masterminds/sprig/v3", "purl": "pkg:golang/github.com/Masterminds/sprig/v3@v3.3.0", "version": "v3.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/mattn/go-colorable", "purl": "pkg:golang/github.com/mattn/go-colorable@v0.1.15", "version": "v0.1.15" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/mattn/go-isatty", "purl": "pkg:golang/github.com/mattn/go-isatty@v0.0.24", "version": "v0.0.24" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mattn/go-sqlite3", "purl": "pkg:golang/github.com/mattn/go-sqlite3@v1.14.24", "version": "v1.14.24" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/mitchellh/copystructure", "purl": "pkg:golang/github.com/mitchellh/copystructure@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/go-homedir", "purl": "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/mapstructure", "purl": "pkg:golang/github.com/mitchellh/mapstructure@v1.5.0", "version": "v1.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/mitchellh/reflectwalk", "purl": "pkg:golang/github.com/mitchellh/reflectwalk@v1.0.2", "version": "v1.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/munnerz/goautoneg", "purl": "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", "version": "v0.0.0-20191010083416-a7dc8b61c822" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/natefinch/atomic", "purl": "pkg:golang/github.com/natefinch/atomic@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/oklog/ulid/v2", "purl": "pkg:golang/github.com/oklog/ulid/v2@v2.1.2", "version": "v2.1.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/go-digest", "purl": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pelletier/go-toml/v2", "purl": "pkg:golang/github.com/pelletier/go-toml/v2@v2.4.3", "version": "v2.4.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pkg/browser", "purl": "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", "version": "v0.0.0-20240102092130-5ac0b6a4141c" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pkg/errors", "purl": "pkg:golang/github.com/pkg/errors@v0.9.1", "version": "v0.9.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/planetscale/vtprotobuf", "purl": "pkg:golang/github.com/planetscale/vtprotobuf@v0.6.1-0.20240319094008-0393e58bdf10", "version": "v0.6.1-0.20240319094008-0393e58bdf10" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/prometheus/client_golang", "purl": "pkg:golang/github.com/prometheus/client_golang@v1.24.1", "version": "v1.24.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/prometheus/client_model", "purl": "pkg:golang/github.com/prometheus/client_model@v0.6.3", "version": "v0.6.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/prometheus/common", "purl": "pkg:golang/github.com/prometheus/common@v0.70.1", "version": "v0.70.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/prometheus/procfs", "purl": "pkg:golang/github.com/prometheus/procfs@v0.21.1", "version": "v0.21.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/ProtonMail/go-crypto", "purl": "pkg:golang/github.com/ProtonMail/go-crypto@v1.4.1", "version": "v1.4.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/redis/go-redis/v9", "purl": "pkg:golang/github.com/redis/go-redis/v9@v9.22.0", "version": "v9.22.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/rogpeppe/go-internal", "purl": "pkg:golang/github.com/rogpeppe/go-internal@v1.16.0", "version": "v1.16.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/rs/cors", "purl": "pkg:golang/github.com/rs/cors@v1.11.1", "version": "v1.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/ryanuber/go-glob", "purl": "pkg:golang/github.com/ryanuber/go-glob@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sagikazarmark/locafero", "purl": "pkg:golang/github.com/sagikazarmark/locafero@v0.11.0", "version": "v0.11.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/sagikazarmark/locafero", "purl": "pkg:golang/github.com/sagikazarmark/locafero@v0.12.0", "version": "v0.12.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sassoftware/go-rpmutils", "purl": "pkg:golang/github.com/sassoftware/go-rpmutils@v0.4.0", "version": "v0.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sassoftware/relic/v8", "purl": "pkg:golang/github.com/sassoftware/relic/v8@v8.2.0", "version": "v8.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/secure-systems-lab/go-securesystemslib", "purl": "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.11.1", "version": "v0.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/shibumi/go-pathspec", "purl": "pkg:golang/github.com/shibumi/go-pathspec@v1.3.0", "version": "v1.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/shopspring/decimal", "purl": "pkg:golang/github.com/shopspring/decimal@v1.4.0", "version": "v1.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/protobuf-specs", "purl": "pkg:golang/github.com/sigstore/protobuf-specs@v0.5.2", "version": "v0.5.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/sigstore", "purl": "pkg:golang/github.com/sigstore/sigstore@v1.11.1", "version": "v1.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/sigstore/pkg/signature/kms/aws", "purl": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/aws@v1.11.1", "version": "v1.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/sigstore/pkg/signature/kms/azure", "purl": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/azure@v1.11.1", "version": "v1.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/sigstore/pkg/signature/kms/gcp", "purl": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/gcp@v1.11.1", "version": "v1.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/sigstore/pkg/signature/kms/hashivault", "purl": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/hashivault@v1.11.1", "version": "v1.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/SladkyCitron/slogcolor", "purl": "pkg:golang/github.com/SladkyCitron/slogcolor@v1.9.0", "version": "v1.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sourcegraph/conc", "purl": "pkg:golang/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", "version": "v0.3.1-0.20240121214520-5f936abd7ae8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/afero", "purl": "pkg:golang/github.com/spf13/afero@v1.15.0", "version": "v1.15.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/cast", "purl": "pkg:golang/github.com/spf13/cast@v1.10.0", "version": "v1.10.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/cobra", "purl": "pkg:golang/github.com/spf13/cobra@v1.10.2", "version": "v1.10.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/pflag", "purl": "pkg:golang/github.com/spf13/pflag@v1.0.10", "version": "v1.0.10" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/viper", "purl": "pkg:golang/github.com/spf13/viper@v1.21.0", "version": "v1.21.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spiffe/go-spiffe/v2", "purl": "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.8.1", "version": "v2.8.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/stretchr/testify", "purl": "pkg:golang/github.com/stretchr/testify@v1.12.1", "version": "v1.12.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/subosito/gotenv", "purl": "pkg:golang/github.com/subosito/gotenv@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/theupdateframework/go-tuf", "purl": "pkg:golang/github.com/theupdateframework/go-tuf@v0.7.0", "version": "v0.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tink-crypto/tink-go-awskms/v3", "purl": "pkg:golang/github.com/tink-crypto/tink-go-awskms/v3@v3.0.0", "version": "v3.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tink-crypto/tink-go-gcpkms/v2", "purl": "pkg:golang/github.com/tink-crypto/tink-go-gcpkms/v2@v2.4.0", "version": "v2.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tink-crypto/tink-go/v2", "purl": "pkg:golang/github.com/tink-crypto/tink-go/v2@v2.9.0", "version": "v2.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "github.com/toqueteos/webbrowser", "purl": "pkg:golang/github.com/toqueteos/webbrowser@v1.2.1", "version": "v1.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/transparency-dev/merkle", "purl": "pkg:golang/github.com/transparency-dev/merkle@v0.0.2", "version": "v0.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/ulikunitz/xz", "purl": "pkg:golang/github.com/ulikunitz/xz@v0.5.15", "version": "v0.5.15" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/veraison/go-cose", "purl": "pkg:golang/github.com/veraison/go-cose@v1.3.0", "version": "v1.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/x448/float16", "purl": "pkg:golang/github.com/x448/float16@v0.8.4", "version": "v0.8.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/xi2/xz", "purl": "pkg:golang/github.com/xi2/xz@v0.0.0-20171230120015-48954b6210f8", "version": "v0.0.0-20171230120015-48954b6210f8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/youmark/pkcs8", "purl": "pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78", "version": "v0.0.0-20240726163527-a2c0da244d78" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/zalando/go-keyring", "purl": "pkg:golang/github.com/zalando/go-keyring@v0.2.6", "version": "v0.2.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opencensus.io", "purl": "pkg:golang/go.opencensus.io@v0.24.0", "version": "v0.24.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/auto/sdk", "purl": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", "version": "v1.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/contrib/detectors/gcp", "purl": "pkg:golang/go.opentelemetry.io/contrib/detectors/gcp@v1.44.0", "version": "v1.44.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc", "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.68.0", "version": "v0.68.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp", "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.69.0", "version": "v0.69.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel", "purl": "pkg:golang/go.opentelemetry.io/otel@v1.46.0", "version": "v1.46.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/metric", "purl": "pkg:golang/go.opentelemetry.io/otel/metric@v1.46.0", "version": "v1.46.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/sdk", "purl": "pkg:golang/go.opentelemetry.io/otel/sdk@v1.46.0", "version": "v1.46.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/sdk/metric", "purl": "pkg:golang/go.opentelemetry.io/otel/sdk/metric@v1.46.0", "version": "v1.46.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/trace", "purl": "pkg:golang/go.opentelemetry.io/otel/trace@v1.46.0", "version": "v1.46.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.step.sm/crypto", "purl": "pkg:golang/go.step.sm/crypto@v0.91.0", "version": "v0.91.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.uber.org/atomic", "purl": "pkg:golang/go.uber.org/atomic@v1.11.0", "version": "v1.11.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.uber.org/goleak", "purl": "pkg:golang/go.uber.org/goleak@v1.3.0", "version": "v1.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.uber.org/multierr", "purl": "pkg:golang/go.uber.org/multierr@v1.11.0", "version": "v1.11.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.uber.org/zap", "purl": "pkg:golang/go.uber.org/zap@v1.28.0", "version": "v1.28.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.yaml.in/yaml/v2", "purl": "pkg:golang/go.yaml.in/yaml/v2@v2.4.4", "version": "v2.4.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.yaml.in/yaml/v3", "purl": "pkg:golang/go.yaml.in/yaml/v3@v3.0.5", "version": "v3.0.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gocloud.dev", "purl": "pkg:golang/gocloud.dev@v0.46.0", "version": "v0.46.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "golang.org/x/crypto", "purl": "pkg:golang/golang.org/x/crypto@v0.57.0", "version": "v0.57.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/crypto", "purl": "pkg:golang/golang.org/x/crypto@v0.58.0", "version": "v0.58.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/mod", "purl": "pkg:golang/golang.org/x/mod@v0.41.0", "version": "v0.41.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "golang.org/x/net", "purl": "pkg:golang/golang.org/x/net@v0.59.0", "version": "v0.59.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/net", "purl": "pkg:golang/golang.org/x/net@v0.61.0", "version": "v0.61.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/oauth2", "purl": "pkg:golang/golang.org/x/oauth2@v0.37.0", "version": "v0.37.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "golang.org/x/sync", "purl": "pkg:golang/golang.org/x/sync@v0.23.0", "version": "v0.23.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sync", "purl": "pkg:golang/golang.org/x/sync@v0.24.0", "version": "v0.24.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "golang.org/x/sys", "purl": "pkg:golang/golang.org/x/sys@v0.48.0", "version": "v0.48.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sys", "purl": "pkg:golang/golang.org/x/sys@v0.49.0", "version": "v0.49.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/term", "purl": "pkg:golang/golang.org/x/term@v0.47.0", "version": "v0.47.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text@v0.42.0", "version": "v0.42.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text@v0.43.0", "version": "v0.43.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/time", "purl": "pkg:golang/golang.org/x/time@v0.16.0", "version": "v0.16.0" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "golang.org/x/tools", "purl": "pkg:golang/golang.org/x/tools@v0.50.0", "version": "v0.50.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/xerrors", "purl": "pkg:golang/golang.org/x/xerrors@v0.0.0-20240903120638-7835f813f4da", "version": "v0.0.0-20240903120638-7835f813f4da" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/api", "purl": "pkg:golang/google.golang.org/api@v0.301.0", "version": "v0.301.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto", "purl": "pkg:golang/google.golang.org/genproto@v0.0.0-20260715232425-e75dac1f907d", "version": "v0.0.0-20260715232425-e75dac1f907d" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto/googleapis/api", "purl": "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20260803160001-6ac0973c030d", "version": "v0.0.0-20260803160001-6ac0973c030d" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto/googleapis/rpc", "purl": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260928230214-8a89bd6388cc", "version": "v0.0.0-20260928230214-8a89bd6388cc" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/grpc", "purl": "pkg:golang/google.golang.org/grpc@v1.84.0", "version": "v1.84.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/protobuf", "purl": "pkg:golang/google.golang.org/protobuf@v1.36.12", "version": "v1.36.12" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/ini.v1", "purl": "pkg:golang/gopkg.in/ini.v1@v1.67.3", "version": "v1.67.3" }, { "ecosystem": "golang", "licenses": [], "location": "hack/tools/go.mod", "name": "gopkg.in/yaml.v2", "purl": "pkg:golang/gopkg.in/yaml.v2@v2.4.0", "version": "v2.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/yaml.v3", "purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.1", "version": "v3.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "k8s.io/klog/v2", "purl": "pkg:golang/k8s.io/klog/v2@v2.140.0", "version": "v2.140.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "sigs.k8s.io/release-utils", "purl": "pkg:golang/sigs.k8s.io/release-utils@v0.12.5", "version": "v0.12.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "sigs.k8s.io/yaml", "purl": "pkg:golang/sigs.k8s.io/yaml@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "software.sslmate.com/src/go-pkcs12", "purl": "pkg:golang/software.sslmate.com/src/go-pkcs12@v0.5.0", "version": "v0.5.0" } ], "description": "Record signed artifacts in a tamper-resistant transparency log", "errors": [], "go_binary": { "asset": "rekor-cli-linux-amd64", "binary": "rekor-cli-linux-amd64", "db": "https://vuln.go.dev", "db_last_modified": "2026-10-27T21:16:18Z", "findings": [ { "aliases": [], "epss": null, "fixed_version": "", "id": "GO-2026-5932", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-78661" ], "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fixed_version": "v0.62.0", "id": "GO-2026-6860", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net", "version": "v0.61.0" }, { "aliases": [ "CVE-2026-97045" ], "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fixed_version": "v0.62.0", "id": "GO-2026-6866", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net", "version": "v0.61.0" } ], "go_version": "go1.27.3", "main_module": "github.com/sigstore/rekor" }, "id": "sigstore__rekor", "manifests": [ ".github/workflows/build.yml", ".github/workflows/codeql-analysis.yml", ".github/workflows/cut-release.yml", ".github/workflows/depsreview.yml", ".github/workflows/fuzz.yml", ".github/workflows/main.yml", ".github/workflows/scorecard_action.yml", ".github/workflows/validate-release.yml", ".github/workflows/verify.yml", "go.mod", "go.sum", "hack/tools/go.mod", "hack/tools/go.sum" ], "name": "rekor", "osv": { "advisories": 12, "available": true, "confirmed": 12, "osv_only": [], "warning": null }, "ref": "v1.5.5", "ref_kind": "release", "release_integrity": { "asset": "rekor-cli-linux-amd64", "assets": 56, "build_provenance": null, "checksums_published": true, "digest_matches_github": true, "immutable_release": true, "methods": [ { "covers": "asset", "detail": "valid Sigstore signature from an identity outside this repository's GitHub workflows", "method": "cosign", "signer": "email:keyless@projectsigstore.iam.gserviceaccount.com", "status": "signed-other-identity" }, { "detail": "GitHub attests the file is unchanged since the release was published", "method": "github-immutable-release", "status": "verified" } ], "provenance_published": false, "sbom_published": true, "signature": "other-identity", "signatures_published": true, "signer": "email:keyless@projectsigstore.iam.gserviceaccount.com", "verdict": "signed" }, "released_at": "2026-10-21T00:03:28Z", "repository": "sigstore/rekor", "sbomlyze_diff": { "added": 0, "changed": 0, "drift": {}, "findings": [ "0 version changes among 315 shared packages \u2014 no actual upgrades", "Core system packages stable: golang (279), github (25), file (11) unchanged" ], "removed": 0 }, "scanned_at": "2026-11-02T03:08:00+00:00", "scorecard": { "checks": [ { "name": "CII-Best-Practices", "reason": "no effort to earn an OpenSSF best practices badge detected", "score": 0 }, { "name": "Vulnerabilities", "reason": "9 existing vulnerabilities detected", "score": 1 }, { "name": "Binary-Artifacts", "reason": "binaries present in source code", "score": 7 }, { "name": "Signed-Releases", "reason": "5 out of the last 5 releases have a total of 5 signed artifacts.", "score": 8 }, { "name": "Pinned-Dependencies", "reason": "dependency not pinned by hash detected -- score normalized to 9", "score": 9 }, { "name": "CI-Tests", "reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10", "score": 10 }, { "name": "Code-Review", "reason": "all changesets reviewed", "score": 10 }, { "name": "Contributors", "reason": "project has 41 contributing companies or organizations", "score": 10 }, { "name": "Dangerous-Workflow", "reason": "no dangerous workflow patterns detected", "score": 10 }, { "name": "Dependency-Update-Tool", "reason": "update tool detected", "score": 10 }, { "name": "Fuzzing", "reason": "project is fuzzed", "score": 10 }, { "name": "License", "reason": "license file detected", "score": 10 }, { "name": "Maintained", "reason": "30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10", "score": 10 }, { "name": "Packaging", "reason": "packaging workflow detected", "score": 10 }, { "name": "SAST", "reason": "SAST tool is run on all commits", "score": 10 }, { "name": "Security-Policy", "reason": "security policy file detected", "score": 10 }, { "name": "Token-Permissions", "reason": "GitHub workflow tokens follow principle of least privilege", "score": 10 }, { "name": "Branch-Protection", "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md", "score": -1 } ], "date": "2026-10-31", "score": 8.6, "source": "openssf-api", "version": "v5.6.0" }, "vulnerabilities": [ { "aliases": [ "CVE-2026-78663" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78663", "percentile": 0.49813, "score": 0.00622 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6612", "in_binary": "vulnerable code not in binary", "kev": null, "location": "hack/tools/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Critical", "summary": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configure", "url": "https://go.dev/cl/847187", "version": "v0.59.0" }, { "aliases": [ "CVE-2026-116587" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-116587", "percentile": 0.3048, "score": 0.00366 }, "fix_state": "fixed", "fixed_in": [ "4.1.6" ], "id": "GHSA-mgcc-cww5-fp2q", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/go-jose/go-jose/v4", "severity": "High", "summary": "Go JOSE: DoS when parsing JWKs that contain RSA keys", "url": "https://github.com/advisories/GHSA-mgcc-cww5-fp2q", "version": "v4.1.5" }, { "aliases": [ "CVE-2026-78659" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78659", "percentile": 0.50082, "score": 0.00627 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6603", "in_binary": "vulnerable code not in binary", "kev": null, "location": "hack/tools/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"", "url": "https://go.dev/cl/847185", "version": "v0.59.0" }, { "aliases": [ "CVE-2026-78660" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78660", "percentile": 0.36838, "score": 0.00425 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6610", "in_binary": "vulnerable code not in binary", "kev": null, "location": "hack/tools/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a re", "url": "https://go.dev/cl/835145", "version": "v0.59.0" }, { "aliases": [ "CVE-2026-78669" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78669", "percentile": 0.49426, "score": 0.00614 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6611", "in_binary": "vulnerable code not in binary", "kev": null, "location": "hack/tools/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "url": "https://go.dev/cl/847186", "version": "v0.59.0" }, { "aliases": [ "CVE-2026-97032" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97032", "percentile": 0.42154, "score": 0.0049 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6617", "in_binary": "vulnerable code not in binary", "kev": null, "location": "hack/tools/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the ot", "url": "https://go.dev/cl/847188", "version": "v0.59.0" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5932", "in_binary": "module in binary", "kev": null, "location": "hack/tools/go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Unknown", "summary": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained f", "url": "https://go.dev/issue/44226", "version": "v0.57.0" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5932", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Unknown", "summary": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained f", "url": "https://go.dev/issue/44226", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-78661" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6860", "in_binary": "module in binary", "kev": null, "location": "hack/tools/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\") cau", "url": "https://go.dev/cl/849365", "version": "v0.59.0" }, { "aliases": [ "CVE-2026-78661" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6860", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\") cau", "url": "https://go.dev/cl/849365", "version": "v0.61.0" }, { "aliases": [ "CVE-2026-97045" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6866", "in_binary": "module in binary", "kev": null, "location": "hack/tools/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or f", "url": "https://go.dev/cl/855121", "version": "v0.59.0" }, { "aliases": [ "CVE-2026-97045" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6866", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or f", "url": "https://go.dev/cl/855121", "version": "v0.61.0" } ], "workflow_audit": { "files": 9, "findings": [ { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/cut-release.yml", "line": 24, "note": "this job", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/scorecard_action.yml", "line": 17, "note": "this job", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" } ] } }, "updated": "2026-11-02" }