{ "history": [ { "added": 0, "commit": "4269e1dc4865647605da6af8f1828e77278106a0", "date": "2026-11-01", "dependencies": 229, "errors": [], "fixable": 15, "go_version": "go1.26.10", "in_binary": { "dependencies": 12, "stdlib": 0, "total": 12 }, "new_vulnerabilities": 0, "osv_confirmed": 20, "osv_only": 2, "ref": "v2.4.9", "release_changed": false, "release_integrity": "verified", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": 6.8, "upgraded": 0, "vulnerabilities": { "Critical": 3, "High": 9, "Low": 3, "Medium": 2, "Negligible": 0, "Unknown": 3 }, "workflow": { "High": 14, "Low": 9, "Medium": 1, "files": 7 } }, { "added": 0, "commit": "4269e1dc4865647605da6af8f1828e77278106a0", "date": "2026-11-02", "dependencies": 229, "errors": [], "fixable": 15, "go_version": "go1.26.10", "in_binary": { "dependencies": 12, "stdlib": 0, "total": 12 }, "kev": 0, "kev_new": 0, "new_vulnerabilities": 0, "osv_confirmed": 20, "osv_only": 2, "ref": "v2.4.9", "release_changed": false, "release_integrity": "immutable", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": 6.8, "scorecard_date": "2026-10-19", "scorecard_note": null, "scorecard_source": "openssf-api", "upgraded": 0, "vulnerabilities": { "Critical": 3, "High": 9, "Low": 3, "Medium": 2, "Negligible": 0, "Unknown": 3 }, "vulnerable_packages": 7, "workflow": { "High": 14, "Low": 9, "Medium": 1, "files": 7 } } ], "latest": { "archived": false, "category": "Cloud Security", "changes": { "added": [], "any": true, "baseline": false, "in_binary_new": [], "in_binary_resolved": [], "integrity_drift": 0, "license_changes": [], "new_vulnerabilities": [], "previous_ref": "v2.4.9", "release_changed": false, "release_integrity": { "from": "verified", "to": "immutable" }, "removed": [], "resolved_vulnerabilities": [], "upgraded": [], "workflow_new": 0, "workflow_resolved": 0 }, "commit": "4269e1dc4865647605da6af8f1828e77278106a0", "compliance": { "overall_score": 55, "standards": { "bsi_tr03183": { "failed_checks": [ "Component Creator", "Distribution Licences", "SHA-512 Hash", "Dependency Relationship", "SBOM Creator Contact" ], "passed": 4, "score": 44, "total": 9 }, "cisa": { "failed_checks": [ "Software Producer", "Dependency Relationship", "License Information", "Component Hash", "SBOM Author" ], "passed": 5, "score": 50, "total": 10 }, "ntia": { "failed_checks": [ "Supplier Name", "Dependency Relationship" ], "passed": 5, "score": 71, "total": 7 } } }, "components": [ { "ecosystem": "github", "licenses": [], "location": ".github/workflows/11-test-acceptance.yaml", "name": "actions/cache", "purl": "pkg:github/actions/cache@v4.3.0", "version": "v4.3.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/01-steampipe-release.yaml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@v5.0.0", "version": "v5.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/11-test-acceptance.yaml", "name": "actions/download-artifact", "purl": "pkg:github/actions/download-artifact@v5.0.0", "version": "v5.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/10-test-lint.yaml", "name": "actions/setup-go", "purl": "pkg:github/actions/setup-go@v5.4.0", "version": "v5.4.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/01-steampipe-release.yaml", "name": "actions/setup-go", "purl": "pkg:github/actions/setup-go@v6.0.0", "version": "v6.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/30-stale.yaml", "name": "actions/stale", "purl": "pkg:github/actions/stale@v10.1.0", "version": "v10.1.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/11-test-acceptance.yaml", "name": "actions/upload-artifact", "purl": "pkg:github/actions/upload-artifact@v4.6.2", "version": "v4.6.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/01-steampipe-release.yaml", "name": "booxmedialtd/ws-action-parse-semver", "purl": "pkg:github/booxmedialtd/ws-action-parse-semver@v1.4.7", "version": "v1.4.7" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/02-steampipe-db-image-build.yaml", "name": "docker/login-action", "purl": "pkg:github/docker/login-action@v3.6.0", "version": "v3.6.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/12-test-post-release-linux-distros.yaml", "name": "docker/setup-buildx-action", "purl": "pkg:github/docker/setup-buildx-action@v3.10.0", "version": "v3.10.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/11-test-acceptance.yaml", "name": "geekyeggo/delete-artifact", "purl": "pkg:github/geekyeggo/delete-artifact@v5.1.0", "version": "v5.1.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/10-test-lint.yaml", "name": "golangci/golangci-lint-action", "purl": "pkg:github/golangci/golangci-lint-action@v9.2.0", "version": "v9.2.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/01-steampipe-release.yaml", "name": "goreleaser/goreleaser-action", "purl": "pkg:github/goreleaser/goreleaser-action@v6.4.0", "version": "v6.4.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/31-add-issues-to-pipeling-issue-tracker.yaml", "name": "turbot/steampipe-workflows/.github/workflows/assign-issue-to-pipeling-issue-tracker.yml", "purl": "pkg:github/turbot/steampipe-workflows@main#.github/workflows/assign-issue-to-pipeling-issue-tracker.yml", "version": "main" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cel.dev/expr", "purl": "pkg:golang/cel.dev/expr@v0.25.2", "version": "v0.25.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go", "purl": "pkg:golang/cloud.google.com/go@v0.123.0", "version": "v0.123.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/auth", "purl": "pkg:golang/cloud.google.com/go/auth@v0.18.2", "version": "v0.18.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/auth/oauth2adapt", "purl": "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", "version": "v0.2.8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/compute/metadata", "purl": "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", "version": "v0.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/iam", "purl": "pkg:golang/cloud.google.com/go/iam@v1.5.3", "version": "v1.5.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/monitoring", "purl": "pkg:golang/cloud.google.com/go/monitoring@v1.24.3", "version": "v1.24.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/storage", "purl": "pkg:golang/cloud.google.com/go/storage@v1.61.3", "version": "v1.61.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/acarl005/stripansi", "purl": "pkg:golang/github.com/acarl005/stripansi@v0.0.0-20180116102854-5a71ef0e047d", "version": "v0.0.0-20180116102854-5a71ef0e047d" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/AdaLogics/go-fuzz-headers", "purl": "pkg:golang/github.com/AdaLogics/go-fuzz-headers@v0.0.0-20240806141605-e8a1dd7889d6", "version": "v0.0.0-20240806141605-e8a1dd7889d6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/agext/levenshtein", "purl": "pkg:golang/github.com/agext/levenshtein@v1.2.3", "version": "v1.2.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/alecthomas/chroma", "purl": "pkg:golang/github.com/alecthomas/chroma@v0.10.0", "version": "v0.10.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/allegro/bigcache/v3", "purl": "pkg:golang/github.com/allegro/bigcache/v3@v3.1.0", "version": "v3.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/apparentlymart/go-cidr", "purl": "pkg:golang/github.com/apparentlymart/go-cidr@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/apparentlymart/go-textseg/v15", "purl": "pkg:golang/github.com/apparentlymart/go-textseg/v15@v15.0.0", "version": "v15.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go", "purl": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.6", "version": "v1.55.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.41.5", "version": "v1.41.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.8", "version": "v1.7.8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/config", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.32.12", "version": "v1.32.12" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/credentials", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.19.12", "version": "v1.19.12" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.20", "version": "v1.18.20" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/internal/configsources", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.21", "version": "v1.4.21" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.21", "version": "v2.7.21" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/internal/ini", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/ini@v1.8.6", "version": "v1.8.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/internal/v4a", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.22", "version": "v1.4.22" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.7", "version": "v1.13.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/checksum@v1.9.13", "version": "v1.9.13" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.21", "version": "v1.13.21" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/s3shared@v1.19.21", "version": "v1.19.21" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/s3", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/s3@v1.97.3", "version": "v1.97.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/signin", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/signin@v1.0.8", "version": "v1.0.8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/sso", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.30.13", "version": "v1.30.13" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.35.17", "version": "v1.35.17" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/sts", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.41.9", "version": "v1.41.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/smithy-go", "purl": "pkg:golang/github.com/aws/smithy-go@v1.24.2", "version": "v1.24.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/beorn7/perks", "purl": "pkg:golang/github.com/beorn7/perks@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/bgentry/go-netrc", "purl": "pkg:golang/github.com/bgentry/go-netrc@v0.0.0-20140422174119-9fd32a8b3d3d", "version": "v0.0.0-20140422174119-9fd32a8b3d3d" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/bgentry/speakeasy", "purl": "pkg:golang/github.com/bgentry/speakeasy@v0.2.0", "version": "v0.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/bmatcuk/doublestar", "purl": "pkg:golang/github.com/bmatcuk/doublestar@v1.3.4", "version": "v1.3.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/briandowns/spinner", "purl": "pkg:golang/github.com/briandowns/spinner@v1.23.2", "version": "v1.23.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/btubbs/datetime", "purl": "pkg:golang/github.com/btubbs/datetime@v0.1.1", "version": "v0.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cenkalti/backoff/v4", "purl": "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0", "version": "v4.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cespare/xxhash/v2", "purl": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", "version": "v2.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cncf/xds/go", "purl": "pkg:golang/github.com/cncf/xds/go@v0.0.0-20260202195803-dba9d589def2", "version": "v0.0.0-20260202195803-dba9d589def2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/containerd", "purl": "pkg:golang/github.com/containerd/containerd@v1.7.35", "version": "v1.7.35" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/errdefs", "purl": "pkg:golang/github.com/containerd/errdefs@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/log", "purl": "pkg:golang/github.com/containerd/log@v0.1.0", "version": "v0.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/platforms", "purl": "pkg:golang/github.com/containerd/platforms@v0.2.1", "version": "v0.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cyphar/filepath-securejoin", "purl": "pkg:golang/github.com/cyphar/filepath-securejoin@v0.6.1", "version": "v0.6.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/danwakefield/fnmatch", "purl": "pkg:golang/github.com/danwakefield/fnmatch@v0.0.0-20160403171240-cbb64ac3d964", "version": "v0.0.0-20160403171240-cbb64ac3d964" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/davecgh/go-spew", "purl": "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", "version": "v1.1.2-0.20180830191138-d8f796af33cc" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/dgraph-io/ristretto", "purl": "pkg:golang/github.com/dgraph-io/ristretto@v0.2.0", "version": "v0.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/dlclark/regexp2", "purl": "pkg:golang/github.com/dlclark/regexp2@v1.11.5", "version": "v1.11.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/dustin/go-humanize", "purl": "pkg:golang/github.com/dustin/go-humanize@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/eko/gocache/lib/v4", "purl": "pkg:golang/github.com/eko/gocache/lib/v4@v4.2.0", "version": "v4.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/eko/gocache/store/bigcache/v4", "purl": "pkg:golang/github.com/eko/gocache/store/bigcache/v4@v4.2.2", "version": "v4.2.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/eko/gocache/store/ristretto/v4", "purl": "pkg:golang/github.com/eko/gocache/store/ristretto/v4@v4.2.2", "version": "v4.2.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/envoyproxy/go-control-plane/envoy", "purl": "pkg:golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0", "version": "v1.37.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/envoyproxy/protoc-gen-validate", "purl": "pkg:golang/github.com/envoyproxy/protoc-gen-validate@v1.3.3", "version": "v1.3.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/fatih/color", "purl": "pkg:golang/github.com/fatih/color@v1.18.0", "version": "v1.18.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/felixge/httpsnoop", "purl": "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", "version": "v1.0.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/fsnotify/fsnotify", "purl": "pkg:golang/github.com/fsnotify/fsnotify@v1.9.0", "version": "v1.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/gabriel-vasile/mimetype", "purl": "pkg:golang/github.com/gabriel-vasile/mimetype@v1.4.8", "version": "v1.4.8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/gertd/go-pluralize", "purl": "pkg:golang/github.com/gertd/go-pluralize@v0.2.1", "version": "v0.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/ghodss/yaml", "purl": "pkg:golang/github.com/ghodss/yaml@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-git/gcfg", "purl": "pkg:golang/github.com/go-git/gcfg@v1.5.1-0.20230307220236-3a3c6141e376", "version": "v1.5.1-0.20230307220236-3a3c6141e376" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-git/go-billy/v5", "purl": "pkg:golang/github.com/go-git/go-billy/v5@v5.9.0", "version": "v5.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-git/go-git/v5", "purl": "pkg:golang/github.com/go-git/go-git/v5@v5.19.2", "version": "v5.19.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-jose/go-jose/v4", "purl": "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.6", "version": "v4.1.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/logr", "purl": "pkg:golang/github.com/go-logr/logr@v1.4.3", "version": "v1.4.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/stdr", "purl": "pkg:golang/github.com/go-logr/stdr@v1.2.2", "version": "v1.2.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-ole/go-ole", "purl": "pkg:golang/github.com/go-ole/go-ole@v1.3.0", "version": "v1.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-playground/locales", "purl": "pkg:golang/github.com/go-playground/locales@v0.14.1", "version": "v0.14.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-playground/universal-translator", "purl": "pkg:golang/github.com/go-playground/universal-translator@v0.18.1", "version": "v0.18.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-playground/validator/v10", "purl": "pkg:golang/github.com/go-playground/validator/v10@v10.25.0", "version": "v10.25.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-viper/mapstructure/v2", "purl": "pkg:golang/github.com/go-viper/mapstructure/v2@v2.4.0", "version": "v2.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/goccy/go-yaml", "purl": "pkg:golang/github.com/goccy/go-yaml@v1.16.0", "version": "v1.16.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/golang/groupcache", "purl": "pkg:golang/github.com/golang/groupcache@v0.0.0-20241129210726-2c02b8208cf8", "version": "v0.0.0-20241129210726-2c02b8208cf8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/golang/mock", "purl": "pkg:golang/github.com/golang/mock@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/golang/protobuf", "purl": "pkg:golang/github.com/golang/protobuf@v1.5.4", "version": "v1.5.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-cmp", "purl": "pkg:golang/github.com/google/go-cmp@v0.7.0", "version": "v0.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/s2a-go", "purl": "pkg:golang/github.com/google/s2a-go@v0.1.9", "version": "v0.1.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/uuid", "purl": "pkg:golang/github.com/google/uuid@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/googleapis/enterprise-certificate-proxy", "purl": "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.14", "version": "v0.3.14" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/googleapis/gax-go/v2", "purl": "pkg:golang/github.com/googleapis/gax-go/v2@v2.17.0", "version": "v2.17.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp", "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp@v1.33.0", "version": "v1.33.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric", "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric@v0.55.0", "version": "v0.55.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping", "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping@v0.55.0", "version": "v0.55.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/gosuri/uilive", "purl": "pkg:golang/github.com/gosuri/uilive@v0.0.4", "version": "v0.0.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/gosuri/uiprogress", "purl": "pkg:golang/github.com/gosuri/uiprogress@v0.0.1", "version": "v0.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/grpc-ecosystem/grpc-gateway/v2", "purl": "pkg:golang/github.com/grpc-ecosystem/grpc-gateway/v2@v2.27.2", "version": "v2.27.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/aws-sdk-go-base/v2", "purl": "pkg:golang/github.com/hashicorp/aws-sdk-go-base/v2@v2.0.0-beta.72", "version": "v2.0.0-beta.72" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/errwrap", "purl": "pkg:golang/github.com/hashicorp/errwrap@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-cleanhttp", "purl": "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", "version": "v0.5.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-getter", "purl": "pkg:golang/github.com/hashicorp/go-getter@v1.8.6", "version": "v1.8.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-hclog", "purl": "pkg:golang/github.com/hashicorp/go-hclog@v1.6.3", "version": "v1.6.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-multierror", "purl": "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-plugin", "purl": "pkg:golang/github.com/hashicorp/go-plugin@v1.7.0", "version": "v1.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-uuid", "purl": "pkg:golang/github.com/hashicorp/go-uuid@v1.0.3", "version": "v1.0.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-version", "purl": "pkg:golang/github.com/hashicorp/go-version@v1.8.0", "version": "v1.8.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/hcl/v2", "purl": "pkg:golang/github.com/hashicorp/hcl/v2@v2.24.0", "version": "v2.24.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/terraform-registry-address", "purl": "pkg:golang/github.com/hashicorp/terraform-registry-address@v0.2.4", "version": "v0.2.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/terraform-svchost", "purl": "pkg:golang/github.com/hashicorp/terraform-svchost@v0.1.1", "version": "v0.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/yamux", "purl": "pkg:golang/github.com/hashicorp/yamux@v0.1.2", "version": "v0.1.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hokaccha/go-prettyjson", "purl": "pkg:golang/github.com/hokaccha/go-prettyjson@v0.0.0-20211117102719-0474bc63780f", "version": "v0.0.0-20211117102719-0474bc63780f" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/iancoleman/strcase", "purl": "pkg:golang/github.com/iancoleman/strcase@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/inconshreveable/mousetrap", "purl": "pkg:golang/github.com/inconshreveable/mousetrap@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jackc/pgpassfile", "purl": "pkg:golang/github.com/jackc/pgpassfile@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jackc/pgservicefile", "purl": "pkg:golang/github.com/jackc/pgservicefile@v0.0.0-20240606120523-5a60cdf6a761", "version": "v0.0.0-20240606120523-5a60cdf6a761" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jackc/pgx/v5", "purl": "pkg:golang/github.com/jackc/pgx/v5@v5.9.2", "version": "v5.9.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jackc/puddle/v2", "purl": "pkg:golang/github.com/jackc/puddle/v2@v2.2.2", "version": "v2.2.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jbenet/go-context", "purl": "pkg:golang/github.com/jbenet/go-context@v0.0.0-20150711004518-d14ea06fba99", "version": "v0.0.0-20150711004518-d14ea06fba99" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jedib0t/go-pretty/v6", "purl": "pkg:golang/github.com/jedib0t/go-pretty/v6@v6.6.9", "version": "v6.6.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jmespath/go-jmespath", "purl": "pkg:golang/github.com/jmespath/go-jmespath@v0.4.0", "version": "v0.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/karrick/gows", "purl": "pkg:golang/github.com/karrick/gows@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/klauspost/compress", "purl": "pkg:golang/github.com/klauspost/compress@v1.18.7", "version": "v1.18.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/klauspost/cpuid/v2", "purl": "pkg:golang/github.com/klauspost/cpuid/v2@v2.3.0", "version": "v2.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/leodido/go-urn", "purl": "pkg:golang/github.com/leodido/go-urn@v1.4.0", "version": "v1.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/logrusorgru/aurora", "purl": "pkg:golang/github.com/logrusorgru/aurora@v2.0.3%2Bincompatible", "version": "v2.0.3+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Masterminds/semver/v3", "purl": "pkg:golang/github.com/Masterminds/semver/v3@v3.4.0", "version": "v3.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mattn/go-colorable", "purl": "pkg:golang/github.com/mattn/go-colorable@v0.1.14", "version": "v0.1.14" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mattn/go-isatty", "purl": "pkg:golang/github.com/mattn/go-isatty@v0.0.20", "version": "v0.0.20" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mattn/go-runewidth", "purl": "pkg:golang/github.com/mattn/go-runewidth@v0.0.16", "version": "v0.0.16" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mattn/go-tty", "purl": "pkg:golang/github.com/mattn/go-tty@v0.0.7", "version": "v0.0.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/colorstring", "purl": "pkg:golang/github.com/mitchellh/colorstring@v0.0.0-20190213212951-d06e56a500db", "version": "v0.0.0-20190213212951-d06e56a500db" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/go-homedir", "purl": "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/go-wordwrap", "purl": "pkg:golang/github.com/mitchellh/go-wordwrap@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/mapstructure", "purl": "pkg:golang/github.com/mitchellh/mapstructure@v1.5.0", "version": "v1.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/locker", "purl": "pkg:golang/github.com/moby/locker@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/munnerz/goautoneg", "purl": "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", "version": "v0.0.0-20191010083416-a7dc8b61c822" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/oklog/run", "purl": "pkg:golang/github.com/oklog/run@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/olekukonko/tablewriter", "purl": "pkg:golang/github.com/olekukonko/tablewriter@v0.0.5", "version": "v0.0.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/go-digest", "purl": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/image-spec", "purl": "pkg:golang/github.com/opencontainers/image-spec@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pelletier/go-toml/v2", "purl": "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.3", "version": "v2.2.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pjbgf/sha1cd", "purl": "pkg:golang/github.com/pjbgf/sha1cd@v0.6.0", "version": "v0.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pkg/errors", "purl": "pkg:golang/github.com/pkg/errors@v0.9.1", "version": "v0.9.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pkg/term", "purl": "pkg:golang/github.com/pkg/term@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/planetscale/vtprotobuf", "purl": "pkg:golang/github.com/planetscale/vtprotobuf@v0.6.1-0.20240319094008-0393e58bdf10", "version": "v0.6.1-0.20240319094008-0393e58bdf10" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pmezard/go-difflib", "purl": "pkg:golang/github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2", "version": "v1.0.1-0.20181226105442-5d4384ee4fb2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/prometheus/client_golang", "purl": "pkg:golang/github.com/prometheus/client_golang@v1.21.1", "version": "v1.21.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/prometheus/client_model", "purl": "pkg:golang/github.com/prometheus/client_model@v0.6.2", "version": "v0.6.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/prometheus/common", "purl": "pkg:golang/github.com/prometheus/common@v0.63.0", "version": "v0.63.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/prometheus/procfs", "purl": "pkg:golang/github.com/prometheus/procfs@v0.16.0", "version": "v0.16.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/rivo/uniseg", "purl": "pkg:golang/github.com/rivo/uniseg@v0.4.7", "version": "v0.4.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/rs/xid", "purl": "pkg:golang/github.com/rs/xid@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sagikazarmark/locafero", "purl": "pkg:golang/github.com/sagikazarmark/locafero@v0.8.0", "version": "v0.8.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sagikazarmark/slog-shim", "purl": "pkg:golang/github.com/sagikazarmark/slog-shim@v0.1.0", "version": "v0.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sethvargo/go-retry", "purl": "pkg:golang/github.com/sethvargo/go-retry@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/shiena/ansicolor", "purl": "pkg:golang/github.com/shiena/ansicolor@v0.0.0-20230509054315-a9deabde6e02", "version": "v0.0.0-20230509054315-a9deabde6e02" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/shirou/gopsutil", "purl": "pkg:golang/github.com/shirou/gopsutil@v3.21.11%2Bincompatible", "version": "v3.21.11+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sirupsen/logrus", "purl": "pkg:golang/github.com/sirupsen/logrus@v1.9.3", "version": "v1.9.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sourcegraph/conc", "purl": "pkg:golang/github.com/sourcegraph/conc@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/afero", "purl": "pkg:golang/github.com/spf13/afero@v1.15.0", "version": "v1.15.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/cast", "purl": "pkg:golang/github.com/spf13/cast@v1.7.1", "version": "v1.7.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/cobra", "purl": "pkg:golang/github.com/spf13/cobra@v1.10.1", "version": "v1.10.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/pflag", "purl": "pkg:golang/github.com/spf13/pflag@v1.0.9", "version": "v1.0.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/viper", "purl": "pkg:golang/github.com/spf13/viper@v1.20.1", "version": "v1.20.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spiffe/go-spiffe/v2", "purl": "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.7.0", "version": "v2.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/stevenle/topsort", "purl": "pkg:golang/github.com/stevenle/topsort@v0.2.0", "version": "v0.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/stretchr/testify", "purl": "pkg:golang/github.com/stretchr/testify@v1.11.1", "version": "v1.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/subosito/gotenv", "purl": "pkg:golang/github.com/subosito/gotenv@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/thediveo/enumflag/v2", "purl": "pkg:golang/github.com/thediveo/enumflag/v2@v2.0.7", "version": "v2.0.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tklauser/go-sysconf", "purl": "pkg:golang/github.com/tklauser/go-sysconf@v0.3.15", "version": "v0.3.15" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tklauser/numcpus", "purl": "pkg:golang/github.com/tklauser/numcpus@v0.10.0", "version": "v0.10.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tkrajina/go-reflector", "purl": "pkg:golang/github.com/tkrajina/go-reflector@v0.5.8", "version": "v0.5.8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/turbot/go-kit", "purl": "pkg:golang/github.com/turbot/go-kit@v1.3.0", "version": "v1.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/turbot/go-prompt", "purl": "pkg:golang/github.com/turbot/go-prompt@v0.2.6-steampipe.0.0.20221028122246-eb118ec58d50", "version": "v0.2.6-steampipe.0.0.20221028122246-eb118ec58d50" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/turbot/pipe-fittings/v2", "purl": "pkg:golang/github.com/turbot/pipe-fittings/v2@v2.9.1", "version": "v2.9.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/turbot/pipes-sdk-go", "purl": "pkg:golang/github.com/turbot/pipes-sdk-go@v0.12.1", "version": "v0.12.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/turbot/steampipe-plugin-sdk/v5", "purl": "pkg:golang/github.com/turbot/steampipe-plugin-sdk/v5@v5.14.0", "version": "v5.14.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/turbot/terraform-components", "purl": "pkg:golang/github.com/turbot/terraform-components@v0.0.0-20250114051614-04b806a9cbed", "version": "v0.0.0-20250114051614-04b806a9cbed" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/ulikunitz/xz", "purl": "pkg:golang/github.com/ulikunitz/xz@v0.5.15", "version": "v0.5.15" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/xlab/treeprint", "purl": "pkg:golang/github.com/xlab/treeprint@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/yusufpapurcu/wmi", "purl": "pkg:golang/github.com/yusufpapurcu/wmi@v1.2.4", "version": "v1.2.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/zclconf/go-cty", "purl": "pkg:golang/github.com/zclconf/go-cty@v1.16.3", "version": "v1.16.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/zclconf/go-cty-yaml", "purl": "pkg:golang/github.com/zclconf/go-cty-yaml@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/auto/sdk", "purl": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", "version": "v1.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/contrib/detectors/gcp", "purl": "pkg:golang/go.opentelemetry.io/contrib/detectors/gcp@v1.44.0", "version": "v1.44.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc", "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.63.0", "version": "v0.63.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp", "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.61.0", "version": "v0.61.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel", "purl": "pkg:golang/go.opentelemetry.io/otel@v1.44.0", "version": "v1.44.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc", "purl": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc@v1.35.0", "version": "v1.35.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace", "purl": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.35.0", "version": "v1.35.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc", "purl": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.35.0", "version": "v1.35.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/metric", "purl": "pkg:golang/go.opentelemetry.io/otel/metric@v1.44.0", "version": "v1.44.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/sdk", "purl": "pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0", "version": "v1.44.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/sdk/metric", "purl": "pkg:golang/go.opentelemetry.io/otel/sdk/metric@v1.44.0", "version": "v1.44.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/trace", "purl": "pkg:golang/go.opentelemetry.io/otel/trace@v1.44.0", "version": "v1.44.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/proto/otlp", "purl": "pkg:golang/go.opentelemetry.io/proto/otlp@v1.9.0", "version": "v1.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.uber.org/goleak", "purl": "pkg:golang/go.uber.org/goleak@v1.3.0", "version": "v1.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.uber.org/mock", "purl": "pkg:golang/go.uber.org/mock@v0.4.0", "version": "v0.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.uber.org/multierr", "purl": "pkg:golang/go.uber.org/multierr@v1.11.0", "version": "v1.11.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/crypto", "purl": "pkg:golang/golang.org/x/crypto@v0.55.0", "version": "v0.55.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/exp", "purl": "pkg:golang/golang.org/x/exp@v0.0.0-20260410095643-746e56fc9e2f", "version": "v0.0.0-20260410095643-746e56fc9e2f" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/mod", "purl": "pkg:golang/golang.org/x/mod@v0.38.0", "version": "v0.38.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/net", "purl": "pkg:golang/golang.org/x/net@v0.58.0", "version": "v0.58.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/oauth2", "purl": "pkg:golang/golang.org/x/oauth2@v0.36.0", "version": "v0.36.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sync", "purl": "pkg:golang/golang.org/x/sync@v0.22.0", "version": "v0.22.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sys", "purl": "pkg:golang/golang.org/x/sys@v0.47.0", "version": "v0.47.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/term", "purl": "pkg:golang/golang.org/x/term@v0.45.0", "version": "v0.45.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text@v0.41.0", "version": "v0.41.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/time", "purl": "pkg:golang/golang.org/x/time@v0.15.0", "version": "v0.15.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/tools", "purl": "pkg:golang/golang.org/x/tools@v0.48.0", "version": "v0.48.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/api", "purl": "pkg:golang/google.golang.org/api@v0.271.0", "version": "v0.271.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto", "purl": "pkg:golang/google.golang.org/genproto@v0.0.0-20260128011058-8636f8732409", "version": "v0.0.0-20260128011058-8636f8732409" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto/googleapis/api", "purl": "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20260526163538-3dc84a4a5aaa", "version": "v0.0.0-20260526163538-3dc84a4a5aaa" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto/googleapis/rpc", "purl": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260526163538-3dc84a4a5aaa", "version": "v0.0.0-20260526163538-3dc84a4a5aaa" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/grpc", "purl": "pkg:golang/google.golang.org/grpc@v1.83.2", "version": "v1.83.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/protobuf", "purl": "pkg:golang/google.golang.org/protobuf@v1.36.11", "version": "v1.36.11" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/warnings.v0", "purl": "pkg:golang/gopkg.in/warnings.v0@v0.1.2", "version": "v0.1.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/yaml.v2", "purl": "pkg:golang/gopkg.in/yaml.v2@v2.4.0", "version": "v2.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/yaml.v3", "purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.1", "version": "v3.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "oras.land/oras-go/v2", "purl": "pkg:golang/oras.land/oras-go/v2@v2.6.2", "version": "v2.6.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "sigs.k8s.io/yaml", "purl": "pkg:golang/sigs.k8s.io/yaml@v1.4.0", "version": "v1.4.0" } ], "description": "Query cloud resources using SQL", "errors": [], "go_binary": { "asset": "steampipe_linux_amd64.tar.gz", "binary": "steampipe", "db": "https://vuln.go.dev", "db_last_modified": "2026-10-27T21:16:18Z", "findings": [ { "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ], "epss": { "cve": "CVE-2020-8912", "percentile": 0.14036, "score": 0.00231 }, "fixed_version": "", "id": "GO-2022-0635", "kev": null, "level": "symbol", "module": "github.com/aws/aws-sdk-go", "summary": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "version": "v1.55.6" }, { "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ], "epss": { "cve": "CVE-2020-8911", "percentile": 0.28235, "score": 0.00346 }, "fixed_version": "", "id": "GO-2022-0646", "kev": null, "level": "symbol", "module": "github.com/aws/aws-sdk-go", "summary": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "version": "v1.55.6" }, { "aliases": [], "epss": null, "fixed_version": "", "id": "GO-2026-5932", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "version": "v0.55.0" }, { "aliases": [ "CVE-2026-78662" ], "epss": { "cve": "CVE-2026-78662", "percentile": 0.37388, "score": 0.00431 }, "fixed_version": "v0.56.0", "id": "GO-2026-6354", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh", "version": "v0.55.0" }, { "aliases": [ "CVE-2026-56855" ], "epss": { "cve": "CVE-2026-56855", "percentile": 0.42867, "score": 0.005 }, "fixed_version": "v0.56.0", "id": "GO-2026-6355", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh", "version": "v0.55.0" }, { "aliases": [ "CVE-2026-78659" ], "epss": { "cve": "CVE-2026-78659", "percentile": 0.50082, "score": 0.00627 }, "fixed_version": "v0.60.0", "id": "GO-2026-6603", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-78660" ], "epss": { "cve": "CVE-2026-78660", "percentile": 0.36838, "score": 0.00425 }, "fixed_version": "v0.60.0", "id": "GO-2026-6610", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "HTTP/2 transport accepts malformed framing-related headers in net/http", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-78669" ], "epss": { "cve": "CVE-2026-78669", "percentile": 0.49426, "score": 0.00614 }, "fixed_version": "v0.60.0", "id": "GO-2026-6611", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Excessive CPU consumption from repeated initial window changes in net/http", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-78663" ], "epss": { "cve": "CVE-2026-78663", "percentile": 0.49813, "score": 0.00622 }, "fixed_version": "v0.60.0", "id": "GO-2026-6612", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Double flow control refund on HTTP/2 server streams in net/http", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-97032" ], "epss": { "cve": "CVE-2026-97032", "percentile": 0.42154, "score": 0.0049 }, "fixed_version": "v0.60.0", "id": "GO-2026-6617", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "HTTP/2 server crash due to HPACK encoder race in net/http", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-78661" ], "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fixed_version": "v0.62.0", "id": "GO-2026-6860", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-97045" ], "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fixed_version": "v0.62.0", "id": "GO-2026-6866", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-53492", "GHSA-33vj-92qq-66hc" ], "epss": { "cve": "CVE-2026-53492", "percentile": 0.28922, "score": 0.00353 }, "fixed_version": "", "id": "GO-2026-5064", "kev": null, "level": "module", "module": "github.com/containerd/containerd", "summary": "containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd", "version": "v1.7.35" }, { "aliases": [ "CVE-2026-50195", "GHSA-cvxm-645q-p574" ], "epss": { "cve": "CVE-2026-50195", "percentile": 0.23133, "score": 0.00303 }, "fixed_version": "", "id": "GO-2026-5338", "kev": null, "level": "module", "module": "github.com/containerd/containerd", "summary": "containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd", "version": "v1.7.35" }, { "aliases": [ "CVE-2026-53489", "GHSA-rgh6-rfwx-v388" ], "epss": { "cve": "CVE-2026-53489", "percentile": 0.06876, "score": 0.00174 }, "fixed_version": "", "id": "GO-2026-5622", "kev": null, "level": "module", "module": "github.com/containerd/containerd", "summary": "Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd", "version": "v1.7.35" }, { "aliases": [ "CVE-2026-53493", "GHSA-pg57-6jwg-q645" ], "epss": { "cve": "CVE-2026-53493", "percentile": 0.29375, "score": 0.00356 }, "fixed_version": "v1.7.36", "id": "GO-2026-6597", "kev": null, "level": "module", "module": "github.com/containerd/containerd", "summary": "Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd", "version": "v1.7.35" }, { "aliases": [ "CVE-2026-95837", "GHSA-p7v4-vr35-mj6f" ], "epss": { "cve": "CVE-2026-95837", "percentile": 0.011, "score": 0.00106 }, "fixed_version": "", "id": "GO-2026-6791", "kev": null, "level": "module", "module": "github.com/containerd/containerd", "summary": "containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd", "version": "v1.7.35" }, { "aliases": [ "CVE-2026-81870", "GHSA-8wmf-6v46-5gfg" ], "epss": { "cve": "CVE-2026-81870", "percentile": 0.18557, "score": 0.00266 }, "fixed_version": "v1.45.0", "id": "GO-2026-6505", "kev": null, "level": "module", "module": "go.opentelemetry.io/otel/exporters/otlp/otlptrace", "summary": "OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace", "version": "v1.35.0" } ], "go_version": "go1.26.10", "main_module": "github.com/turbot/steampipe/v2" }, "id": "turbot__steampipe", "manifests": [ ".github/workflows/01-steampipe-release.yaml", ".github/workflows/02-steampipe-db-image-build.yaml", ".github/workflows/10-test-lint.yaml", ".github/workflows/11-test-acceptance.yaml", ".github/workflows/12-test-post-release-linux-distros.yaml", ".github/workflows/30-stale.yaml", ".github/workflows/31-add-issues-to-pipeling-issue-tracker.yaml", "go.mod", "go.sum" ], "name": "steampipe", "osv": { "advisories": 22, "available": true, "confirmed": 20, "osv_only": [ { "ecosystem": "Go", "ids": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw", "GO-2022-0635" ], "package": "github.com/aws/aws-sdk-go", "score": "", "severity": "Unknown", "version": "1.55.6" }, { "ecosystem": "Go", "ids": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9", "GO-2022-0646" ], "package": "github.com/aws/aws-sdk-go", "score": "", "severity": "Unknown", "version": "1.55.6" } ], "warning": null }, "ref": "v2.4.9", "ref_kind": "release", "release_integrity": { "asset": "steampipe_linux_amd64.tar.gz", "assets": 9, "build_provenance": null, "checksums_published": true, "digest_matches_github": true, "immutable_release": true, "methods": [ { "detail": "GitHub attests the file is unchanged since the release was published", "method": "github-immutable-release", "status": "verified" } ], "provenance_published": false, "sbom_published": false, "signature": null, "signatures_published": false, "signer": null, "verdict": "immutable" }, "released_at": "2026-11-01T12:48:24Z", "repository": "turbot/steampipe", "sbomlyze_diff": { "added": 0, "changed": 0, "drift": {}, "findings": [ "0 version changes among 243 shared packages \u2014 no actual upgrades", "Core system packages stable: golang (215), github (20) unchanged" ], "removed": 0 }, "scanned_at": "2026-11-02T03:08:06+00:00", "scorecard": { "checks": [ { "name": "CII-Best-Practices", "reason": "no effort to earn an OpenSSF best practices badge detected", "score": 0 }, { "name": "Fuzzing", "reason": "project is not fuzzed", "score": 0 }, { "name": "Signed-Releases", "reason": "Project has not signed or included provenance with any releases.", "score": 0 }, { "name": "Token-Permissions", "reason": "detected GitHub workflow tokens with excessive permissions", "score": 0 }, { "name": "Pinned-Dependencies", "reason": "dependency not pinned by hash detected -- score normalized to 8", "score": 8 }, { "name": "Code-Review", "reason": "Found 22/23 approved changesets -- score normalized to 9", "score": 9 }, { "name": "SAST", "reason": "SAST tool is not run on all commits -- score normalized to 9", "score": 9 }, { "name": "Binary-Artifacts", "reason": "no binaries found in the repo", "score": 10 }, { "name": "Dangerous-Workflow", "reason": "no dangerous workflow patterns detected", "score": 10 }, { "name": "License", "reason": "license file detected", "score": 10 }, { "name": "Maintained", "reason": "27 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10", "score": 10 }, { "name": "Packaging", "reason": "packaging workflow detected", "score": 10 }, { "name": "Security-Policy", "reason": "security policy file detected", "score": 10 }, { "name": "Branch-Protection", "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md", "score": -1 } ], "date": "2026-10-19", "score": 6.8, "source": "openssf-api", "version": "v5.6.0" }, "vulnerabilities": [ { "aliases": [ "CVE-2026-53492", "GHSA-33vj-92qq-66hc" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-53492", "percentile": 0.28922, "score": 0.00353 }, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5064", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/containerd/containerd", "severity": "Critical", "summary": "containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd", "url": "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc", "version": "v1.7.35" }, { "aliases": [ "CVE-2026-50195", "GHSA-cvxm-645q-p574" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-50195", "percentile": 0.23133, "score": 0.00303 }, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5338", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/containerd/containerd", "severity": "Critical", "summary": "containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd", "url": "https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574", "version": "v1.7.35" }, { "aliases": [ "CVE-2026-78663" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78663", "percentile": 0.49813, "score": 0.00622 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6612", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Critical", "summary": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configure", "url": "https://go.dev/cl/847187", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-95837", "GHSA-p7v4-vr35-mj6f" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-95837", "percentile": 0.011, "score": 0.00106 }, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-6791", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/containerd/containerd", "severity": "High", "summary": "containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd", "url": "https://github.com/containerd/containerd/security/advisories/GHSA-p7v4-vr35-mj6f", "version": "v1.7.35" }, { "aliases": [ "CVE-2026-78662" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78662", "percentile": 0.37388, "score": 0.00431 }, "fix_state": "fixed", "fixed_in": [ "0.56.0" ], "id": "GO-2026-6354", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket", "url": "https://go.dev/issue/81316", "version": "v0.55.0" }, { "aliases": [ "CVE-2026-56855" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56855", "percentile": 0.42867, "score": 0.005 }, "fix_state": "fixed", "fixed_in": [ "0.56.0" ], "id": "GO-2026-6355", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection d", "url": "https://go.dev/issue/81317", "version": "v0.55.0" }, { "aliases": [ "CVE-2026-56865" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56865", "percentile": 0.02533, "score": 0.00129 }, "fix_state": "fixed", "fixed_in": [ "0.40.0" ], "id": "GO-2026-6179", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/mod", "severity": "High", "summary": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that canno", "url": "https://go.dev/issue/80744", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-56864" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56864", "percentile": 0.22506, "score": 0.00298 }, "fix_state": "fixed", "fixed_in": [ "0.40.0" ], "id": "GO-2026-6180", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/mod", "severity": "High", "summary": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you", "url": "https://go.dev/issue/80745", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-78659" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78659", "percentile": 0.50082, "score": 0.00627 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6603", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"", "url": "https://go.dev/cl/847185", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-78660" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78660", "percentile": 0.36838, "score": 0.00425 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6610", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a re", "url": "https://go.dev/cl/835145", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-78669" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78669", "percentile": 0.49426, "score": 0.00614 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6611", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "url": "https://go.dev/cl/847186", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-97032" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97032", "percentile": 0.42154, "score": 0.0049 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6617", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the ot", "url": "https://go.dev/cl/847188", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-53493" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-53493", "percentile": 0.29375, "score": 0.00356 }, "fix_state": "fixed", "fixed_in": [ "1.7.36" ], "id": "GHSA-pg57-6jwg-q645", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/containerd/containerd", "severity": "Medium", "summary": "Containerd has image-pull DoS via crafted OCI index graph amplification", "url": "https://github.com/advisories/GHSA-pg57-6jwg-q645", "version": "v1.7.35" }, { "aliases": [ "CVE-2026-53489", "GHSA-rgh6-rfwx-v388" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-53489", "percentile": 0.06876, "score": 0.00174 }, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5622", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/containerd/containerd", "severity": "Medium", "summary": "Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd", "url": "https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388", "version": "v1.7.35" }, { "aliases": [ "CVE-2026-81870" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-81870", "percentile": 0.18557, "score": 0.00266 }, "fix_state": "fixed", "fixed_in": [ "1.45.0" ], "id": "GHSA-8wmf-6v46-5gfg", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace", "severity": "Low", "summary": "OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs", "url": "https://github.com/advisories/GHSA-8wmf-6v46-5gfg", "version": "v1.35.0" }, { "aliases": [ "CVE-2026-81870" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-81870", "percentile": 0.18557, "score": 0.00266 }, "fix_state": "fixed", "fixed_in": [ "1.45.0" ], "id": "GHSA-8wmf-6v46-5gfg", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc", "severity": "Low", "summary": "OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs", "url": "https://github.com/advisories/GHSA-8wmf-6v46-5gfg", "version": "v1.35.0" }, { "aliases": [ "CVE-2026-81870" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-81870", "percentile": 0.18557, "score": 0.00266 }, "fix_state": "fixed", "fixed_in": [ "1.45.0" ], "id": "GHSA-8wmf-6v46-5gfg", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "go.opentelemetry.io/otel/sdk", "severity": "Low", "summary": "OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs", "url": "https://github.com/advisories/GHSA-8wmf-6v46-5gfg", "version": "v1.44.0" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5932", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Unknown", "summary": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained f", "url": "https://go.dev/issue/44226", "version": "v0.55.0" }, { "aliases": [ "CVE-2026-78661" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6860", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\") cau", "url": "https://go.dev/cl/849365", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-97045" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6866", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or f", "url": "https://go.dev/cl/855121", "version": "v0.58.0" } ], "workflow_audit": { "files": 7, "findings": [ { "confidence": "High", "description": "overly broad permissions", "file": ".github/workflows/01-steampipe-release.yaml", "line": 25, "note": "contents: write is overly broad at the workflow level", "rule": "excessive-permissions", "severity": "High", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/01-steampipe-release.yaml", "line": 44, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/01-steampipe-release.yaml", "line": 95, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/01-steampipe-release.yaml", "line": 95, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/01-steampipe-release.yaml", "line": 95, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/01-steampipe-release.yaml", "line": 95, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/01-steampipe-release.yaml", "line": 95, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/01-steampipe-release.yaml", "line": 139, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/01-steampipe-release.yaml", "line": 185, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/01-steampipe-release.yaml", "line": 220, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/01-steampipe-release.yaml", "line": 253, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/01-steampipe-release.yaml", "line": 276, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/01-steampipe-release.yaml", "line": 287, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/31-add-issues-to-pipeling-issue-tracker.yaml", "line": 11, "note": "this job", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "secrets unconditionally inherited by called workflow", "file": ".github/workflows/31-add-issues-to-pipeling-issue-tracker.yaml", "line": 12, "note": "this reusable workflow", "rule": "secrets-inherit", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#secrets-inherit" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/01-steampipe-release.yaml", "line": 247, "note": "this step", "rule": "template-injection", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/12-test-post-release-linux-distros.yaml", "line": 30, "note": "this step", "rule": "template-injection", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/12-test-post-release-linux-distros.yaml", "line": 76, "note": "this step", "rule": "template-injection", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/12-test-post-release-linux-distros.yaml", "line": 122, "note": "this step", "rule": "template-injection", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/12-test-post-release-linux-distros.yaml", "line": 168, "note": "this step", "rule": "template-injection", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/12-test-post-release-linux-distros.yaml", "line": 214, "note": "this step", "rule": "template-injection", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/12-test-post-release-linux-distros.yaml", "line": 266, "note": "this step", "rule": "template-injection", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/12-test-post-release-linux-distros.yaml", "line": 266, "note": "this step", "rule": "template-injection", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/12-test-post-release-linux-distros.yaml", "line": 266, "note": "this step", "rule": "template-injection", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#template-injection" } ] } }, "updated": "2026-11-02" }