chore(ci)(deps): bump actions/github-script from 7 to 9 by dependabot[bot] · Pull Request #76 · PatrickFanella/subcults

dependabot · 2026-08-31T09:18:36Z

Bumps actions/github-script from 7 to 9.

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.

Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.

getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.

If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

Add ACTIONS_ORCHESTRATION_ID to user-agent string by @Copilot in actions/github-script#695

ci: use deployment: false for integration test environments by @salmanmkc in actions/github-script#712

feat!: add getOctokit to script context, upgrade @actions/github v9, @octokit/core v7, and related packages by @salmanmkc in actions/github-script#700

New Contributors

@Copilot made their first contribution in actions/github-script#695

Full Changelog: actions/github-script@v8.0.0...v9.0.0

v8.0.0

What's Changed

Update Node.js version support to 24.x by @salmanmkc in actions/github-script#637

README for updating actions/github-script from v7 to v8 by @sneha-krip in actions/github-script#653

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

@salmanmkc made their first contribution in actions/github-script#637

@sneha-krip made their first contribution in actions/github-script#653

Full Changelog: actions/github-script@v7.1.0...v8.0.0

v7.1.0

What's Changed

Upgrade husky to v9 by @benelan in actions/github-script#482

Add workflow file for publishing releases to immutable action package by @Jcambass in actions/github-script#485

Upgrade IA Publish by @Jcambass in actions/github-script#486

Fix workflow status badges by @joshmgross in actions/github-script#497

Update usage of actions/upload-artifact by @joshmgross in actions/github-script#512

Clear up package name confusion by @joshmgross in actions/github-script#514

Update dependencies with npm audit fix by @joshmgross in actions/github-script#515

Specify that the used script is JavaScript by @timotk in actions/github-script#478

chore: Add Dependabot for NPM and Actions by @nschonni in actions/github-script#472

... (truncated)

Commits

3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
ca10bbd fix: use @octokit/core/types import for v7 compatibility
86e48e2 merge: incorporate main branch changes
c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
ff8117e ci: fix user-agent test to handle orchestration ID
81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
3953caf docs: update README examples from @v8 to @v9, add getOctokit docs and v9 brea...
c17d55b ci: add getOctokit integration test job
a047196 test: add getOctokit integration tests via callAsyncFunction
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/github-script](https://github.com/actions/github-script) from 7 to 9. - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@v7...v9) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: '9' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-31T09:18:37Z

Labels

The following labels could not be found: github-actions, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-08-31T09:20:41Z

NPM Vulnerability Scan Results - web

Severity	Count
Critical	3
High	11
Moderate	6
Low	1
Total	21

Click to see details

# npm audit report

@babel/core  <=7.29.0
@babel/core: Arbitrary File Read via sourceMappingURL Comment - https://github.com/advisories/GHSA-4x5r-pxfx-6jf8
fix available via `npm audit fix`
node_modules/@babel/core

@remix-run/router  1.3.0 - 1.23.2
Severity: moderate
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation - https://github.com/advisories/GHSA-2j2x-hqr9-3h42
fix available via `npm audit fix`
node_modules/@remix-run/router
  react-router  6.0.0 - 7.17.0
  Depends on vulnerable versions of @remix-run/router
  node_modules/react-router
    react-router-dom  6.0.0-alpha.0 - 7.17.0
    Depends on vulnerable versions of @remix-run/router
    Depends on vulnerable versions of react-router
    node_modules/react-router-dom

ajv  <6.14.0
Severity: moderate
ajv has ReDoS when using `$data` option - https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
fix available via `npm audit fix`
node_modules/ajv

brace-expansion  <=1.1.17 || 2.0.0 - 2.1.3
Severity: high
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
fix available via `npm audit fix`
node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion
node_modules/brace-expansion

flatted  <=3.4.1
Severity: high
flatted vulnerable to unbounded recursion DoS in parse() revive phase - https://github.com/advisories/GHSA-25h7-pfq9-p65f
Prototype Pollution via parse() in NodeJS flatted - https://github.com/advisories/GHSA-rf6f-7fwh-wjgh
fix available via `npm audit fix`
node_modules/flatted

i18next-http-backend  <3.0.5
Severity: moderate
 i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns - https://github.com/advisories/GHSA-q89c-q3h5-w34g
fix available via `npm audit fix`
node_modules/i18next-http-backend

js-yaml  4.0.0 - 4.3.0
Severity: high
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases - https://github.com/advisories/GHSA-h67p-54hq-rp68
js-yaml: YAML merge-key chains can force quadratic CPU consumption - https://github.com/advisories/GHSA-52cp-r559-cp3m
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported - https://github.com/advisories/GHSA-5p4m-2wfm-xmqj
fix available via `npm audit fix`
node_modules/js-yaml

lodash-es  <=4.17.23
Severity: high
lodash vulnerable to Code Injection via `_.template` imports key names - https://github.com/advisories/GHSA-r5fr-rjxr-66jc
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - https://github.com/advisories/GHSA-f23m-r3pf-42rh
fix available via `npm audit fix`
node_modules/lodash-es

minimatch  <=3.1.3 || 9.0.0 - 9.0.6
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix`
node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch
node_modules/minimatch

nanoid  <=3.3.17
Severity: high
nanoid: non-secure generators can loop indefinitely with negative size - https://github.com/advisories/GHSA-28wg-ghj8-5hjv
nanoid: custom generators can loop indefinitely when size is zero - https://github.com/advisories/GHSA-2v37-7h3g-55p8
fix available via `npm audit fix`
node_modules/nanoid

picomatch  <=2.3.1 || 4.0.0 - 4.0.3
Severity: high
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
fix available via `npm audit fix`
node_modules/picomatch
node_modules/rollup-plugin-visualizer/node_modules/picomatch
node_modules/tinyglobby/node_modules/picomatch
node_modules/vite/node_modules/picomatch
node_modules/vitest/node_modules/picomatch

postcss  <=8.5.22
Severity: high
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - https://github.com/advisories/GHSA-qx2v-qp2m-jg93
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments - https://github.com/advisories/GHSA-6g55-p6wh-862q
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset - https://github.com/advisories/GHSA-fxqj-rqcc-2cmp
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure - https://github.com/advisories/GHSA-r28c-9q8g-f849
fix available via `npm audit fix`
node_modules/postcss

protocol-buffers-schema  <3.6.1
Severity: moderate
Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution - https://github.com/advisories/GHSA-j452-xhg8-qg39
fix available via `npm audit fix`
node_modules/protocol-buffers-schema



rollup  4.0.0 - 4.58.0
Severity: high
Rollup 4 has Arbitrary File Write via Path Traversal - https://github.com/advisories/GHSA-mw96-cpmx-2vgc
fix available via `npm audit fix`
node_modules/rollup

vite  7.0.0 - 7.3.3
Severity: high
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling - https://github.com/advisories/GHSA-4w7w-66w2-5vf9
Vite: `server.fs.deny` bypassed with queries - https://github.com/advisories/GHSA-v2wj-q39q-566r
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket - https://github.com/advisories/GHSA-p9ff-h696-f583
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows - https://github.com/advisories/GHSA-v6wh-96g9-6wx3
vite: `server.fs.deny` bypass on Windows alternate paths - https://github.com/advisories/GHSA-fx2h-pf6j-xcff
fix available via `npm audit fix`
node_modules/vite

vitest  4.0.0-beta.1 - 4.1.0-beta.6
Severity: critical
Depends on vulnerable versions of @vitest/ui
When Vitest UI server is listening, arbitrary file can be read and executed - https://github.com/advisories/GHSA-5xrq-8626-4rwp
fix available via `npm audit fix`
node_modules/vitest
  @vitest/coverage-v8  4.0.0-beta.1 - 4.1.0-beta.6
  Depends on vulnerable versions of vitest
  node_modules/@vitest/coverage-v8
  @vitest/ui  4.0.0-beta.1 - 4.1.0-beta.6
  Depends on vulnerable versions of vitest
  node_modules/@vitest/ui

ws  8.0.0 - 8.20.1
Severity: high
ws: Uninitialized memory disclosure - https://github.com/advisories/GHSA-58qx-3vcg-4xpx
ws: Memory exhaustion DoS from tiny fragments and data chunks - https://github.com/advisories/GHSA-96hv-2xvq-fx4p
fix available via `npm audit fix`
node_modules/ws

21 vulnerabilities (1 low, 6 moderate, 11 high, 3 critical)

To address all issues, run:
  npm audit fix

github-actions · 2026-08-31T09:23:32Z

Docker Image Scan Results - Dockerfile.frontend

Image: subcults-frontend:scan

Severity	Count
Critical	0
High	2
Medium	5
Low	3
Total	10

Click to see details


Report Summary

┌────────────────────────────────────────┬────────┬─────────────────┬─────────┐
│                 Target                 │  Type  │ Vulnerabilities │ Secrets │
├────────────────────────────────────────┼────────┼─────────────────┼─────────┤
│ subcults-frontend:scan (alpine 3.19.9) │ alpine │       10        │    -    │
└────────────────────────────────────────┴────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.74/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


subcults-frontend:scan (alpine 3.19.9)
======================================
Total: 10 (LOW: 3, MEDIUM: 5, HIGH: 2, CRITICAL: 0)

┌───────────────┬────────────────┬──────────┬────────┬──────────────────────┬──────────────────────┬──────────────────────────────────────────────────────────────┐
│    Library    │ Vulnerability  │ Severity │ Status │  Installed Version   │    Fixed Version     │                            Title                             │
├───────────────┼────────────────┼──────────┼────────┼──────────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ busybox       │ CVE-2024-58251 │ MEDIUM   │ fixed  │ 1.36.1-r20           │ 1.36.1-r21           │ In netstat in BusyBox through 1.37.0, local users can launch │
│               │                │          │        │                      │                      │ of networ...                                                 │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2024-58251                   │
│               ├────────────────┼──────────┤        │                      │                      ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2025-46394 │ LOW      │        │                      │                      │ In tar in BusyBox through 1.37.0, a TAR archive can have     │
│               │                │          │        │                      │                      │ filenames...                                                 │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2025-46394                   │
├───────────────┼────────────────┼──────────┤        │                      │                      ├──────────────────────────────────────────────────────────────┤
│ busybox-binsh │ CVE-2024-58251 │ MEDIUM   │        │                      │                      │ In netstat in BusyBox through 1.37.0, local users can launch │
│               │                │          │        │                      │                      │ of networ...                                                 │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2024-58251                   │
│               ├────────────────┼──────────┤        │                      │                      ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2025-46394 │ LOW      │        │                      │                      │ In tar in BusyBox through 1.37.0, a TAR archive can have     │
│               │                │          │        │                      │                      │ filenames...                                                 │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2025-46394                   │
├───────────────┼────────────────┼──────────┤        ├──────────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ musl          │ CVE-2026-40200 │ HIGH     │        │ 1.2.4_git20230717-r5 │ 1.2.4_git20230717-r6 │ musl: musl libc: Arbitrary code execution and denial of      │
│               │                │          │        │                      │                      │ service via stack-based...                                   │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2026-40200                   │
│               ├────────────────┼──────────┤        │                      │                      ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2026-6042  │ MEDIUM   │        │                      │                      │ musl libc: GB18030 4-byte Decoder: musl libc: Denial of      │
│               │                │          │        │                      │                      │ Service via inefficient...                                   │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2026-6042                    │
├───────────────┼────────────────┼──────────┤        │                      │                      ├──────────────────────────────────────────────────────────────┤
│ musl-utils    │ CVE-2026-40200 │ HIGH     │        │                      │                      │ musl: musl libc: Arbitrary code execution and denial of      │
│               │                │          │        │                      │                      │ service via stack-based...                                   │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2026-40200                   │
│               ├────────────────┼──────────┤        │                      │                      ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2026-6042  │ MEDIUM   │        │                      │                      │ musl libc: GB18030 4-byte Decoder: musl libc: Denial of      │
│               │                │          │        │                      │                      │ Service via inefficient...                                   │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2026-6042                    │
├───────────────┼────────────────┤          │        ├──────────────────────┼──────────────────────┼──────────────────────────────────────────────────────────────┤
│ ssl_client    │ CVE-2024-58251 │          │        │ 1.36.1-r20           │ 1.36.1-r21           │ In netstat in BusyBox through 1.37.0, local users can launch │
│               │                │          │        │                      │                      │ of networ...                                                 │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2024-58251                   │
│               ├────────────────┼──────────┤        │                      │                      ├──────────────────────────────────────────────────────────────┤
│               │ CVE-2025-46394 │ LOW      │        │                      │                      │ In tar in BusyBox through 1.37.0, a TAR archive can have     │
│               │                │          │        │                      │                      │ filenames...                                                 │
│               │                │          │        │                      │                      │ https://avd.aquasec.com/nvd/cve-2025-46394                   │
└───────────────┴────────────────┴──────────┴────────┴──────────────────────┴──────────────────────┴──────────────────────────────────────────────────────────────┘

github-actions · 2026-08-31T09:24:27Z

Docker Image Scan Results - Dockerfile.api

Image: subcults-api:scan

Severity	Count
Critical	1
High	41
Medium	23
Low	1
Total	66

Click to see details


Report Summary

┌───────────────────────────────────┬──────────┬─────────────────┬─────────┐
│              Target               │   Type   │ Vulnerabilities │ Secrets │
├───────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ subcults-api:scan (alpine 3.21.7) │  alpine  │        0        │    -    │
├───────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ app/api                           │ gobinary │       66        │    -    │
└───────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.74/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


app/api (gobinary)
==================
Total: 66 (LOW: 1, MEDIUM: 23, HIGH: 41, CRITICAL: 1)

┌──────────────────────────────────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬──────────────────────────────┬──────────────────────────────────────────────────────────────┐
│                           Library                            │    Vulnerability    │ Severity │ Status │ Installed Version │        Fixed Version         │                            Title                             │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream        │ GHSA-xmrv-pmrh-hhx2 │ MEDIUM   │ fixed  │ v1.7.4            │ 1.7.8                        │ Denial of Service due to Panic in AWS SDK for Go v2...       │
│                                                              │                     │          │        │                   │                              │ https://github.com/advisories/GHSA-xmrv-pmrh-hhx2            │
├──────────────────────────────────────────────────────────────┤                     │          │        ├───────────────────┼──────────────────────────────┤                                                              │
│ github.com/aws/aws-sdk-go-v2/service/s3                      │                     │          │        │ v1.95.1           │ 1.97.3                       │                                                              │
│                                                              │                     │          │        │                   │                              │                                                              │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/go-jose/go-jose/v3                                │ CVE-2026-34986      │ HIGH     │        │ v3.0.4            │ 3.0.5                        │ github.com/go-jose/go-jose/v3:                               │
│                                                              │                     │          │        │                   │                              │ github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service    │
│                                                              │                     │          │        │                   │                              │ via crafted JSON Web Encryption...                           │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-34986                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/google/cel-go                                     │ GHSA-gcjh-h69q-9w9g │ MEDIUM   │        │ v0.26.1           │ 0.29.0                       │ cel-go: JSON Private Fields Exposed via NativeTypes and      │
│                                                              │                     │          │        │                   │                              │ ParseStructTag                                               │
│                                                              │                     │          │        │                   │                              │ https://github.com/advisories/GHSA-gcjh-h69q-9w9g            │
├──────────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/pion/dtls/v3                                      │ CVE-2026-26014      │          │        │ v3.0.7            │ 3.1.1, 3.0.11                │ github.com/pion/dtls: Pion DTLS uses random nonce generation │
│                                                              │                     │          │        │                   │                              │ with AES GCM ciphers risks...                                │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-26014                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-54908      │          │        │                   │ 3.1.4                        │ Pion DTLS is a Go implementation of Datagram Transport Layer │
│                                                              │                     │          │        │                   │                              │ Security. ......                                             │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-54908                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/pion/stun/v3                                      │ CVE-2026-54909      │          │        │ v3.0.1            │ 3.1.5                        │ pion/stun is a Go implementation of STUN. Prior to 3.1.3,    │
│                                                              │                     │          │        │                   │                              │ XORMappedAdd ......                                          │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-54909                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel                                     │ CVE-2026-29181      │ HIGH     │        │ v1.38.0           │ 1.41.0                       │ github.com/open-telemetry/opentelemetry-go:                  │
│                                                              │                     │          │        │                   │                              │ OpenTelemetry-Go: Denial of Service via crafted multi-value  │
│                                                              │                     │          │        │                   │                              │ baggage headers                                              │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-29181                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptrace- │ CVE-2026-39882      │ MEDIUM   │        │ v1.24.0           │ 1.43.0                       │ github.com/open-telemetry/opentelemetry-go: golang:          │
│ http                                                         │                     │          │        │                   │                              │ OpenTelemetry-Go: Memory exhaustion via uncapped HTTP        │
│                                                              │                     │          │        │                   │                              │ response body reading                                        │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39882                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel/sdk                                 │ CVE-2026-24051      │ HIGH     │        │ v1.38.0           │ 1.40.0                       │ opentelemetry-go: OpenTelemetry-Go Affected by Arbitrary     │
│                                                              │                     │          │        │                   │                              │ Code Execution via PATH Hijacking                            │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-24051                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39883      │          │        │                   │ 1.43.0                       │ github.com/open-telemetry/opentelemetry-go:                  │
│                                                              │                     │          │        │                   │                              │ OpenTelemetry-Go: Arbitrary code execution via PATH          │
│                                                              │                     │          │        │                   │                              │ hijacking on BSD/Solaris                                     │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39883                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto                                          │ CVE-2026-39828      │          │        │ v0.45.0           │ 0.52.0                       │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh:            │
│                                                              │                     │          │        │                   │                              │ Unauthorized command execution via discarded SSH permissions │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39828                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39829      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of  │
│                                                              │                     │          │        │                   │                              │ Service via crafted public key with excessive parameters...  │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39829                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39830      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of  │
│                                                              │                     │          │        │                   │                              │ Service via resource leak from unsolicited SSH responses...  │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39830                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39831      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security   │
│                                                              │                     │          │        │                   │                              │ key bypass due to missing user presence check                │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39831                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39832      │          │        │                   │                              │ golang.org/x/crypto/ssh/agent:                               │
│                                                              │                     │          │        │                   │                              │ golang.org/x/crypto/ssh/agent: Security bypass due to        │
│                                                              │                     │          │        │                   │                              │ improper handling of key restrictions                        │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39832                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39835      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh:    │
│                                                              │                     │          │        │                   │                              │ Denial of Service via crafted SSH certificate                │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39835                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42508      │          │        │                   │                              │ golang.org/x/crypto/ssh/knownhosts: golang:                  │
│                                                              │                     │          │        │                   │                              │ golang.org/x/crypto/ssh/knownhosts: Revocation bypass via    │
│                                                              │                     │          │        │                   │                              │ unchecked SignatureKey                                       │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42508                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-46595      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh:            │
│                                                              │                     │          │        │                   │                              │ Authorization bypass due to skipped source-address           │
│                                                              │                     │          │        │                   │                              │ validation                                                   │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-46595                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-46597      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of  │
│                                                              │                     │          │        │                   │                              │ Service via crafted AES-GCM packet decoder inputs            │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-46597                   │
│                                                              ├─────────────────────┼──────────┤        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39827      │ MEDIUM   │        │                   │                              │ golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh:    │
│                                                              │                     │          │        │                   │                              │ Denial of Service via repeated rejected channel openings     │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39827                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39833      │          │        │                   │                              │ golang.org/x/crypto/ssh/agent:                               │
│                                                              │                     │          │        │                   │                              │ golang.org/x/crypto/ssh/agent: Security bypass due to        │
│                                                              │                     │          │        │                   │                              │ unenforced key confirmation                                  │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39833                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39834      │          │        │                   │                              │ golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh:    │
│                                                              │                     │          │        │                   │                              │ Denial of Service due to integer overflow in SSH...          │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39834                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-46598      │          │        │                   │                              │ golang.org/x/crypto/ssh/agent: golang:                       │
│                                                              │                     │          │        │                   │                              │ golang.org/x/crypto/ssh/agent: Denial of Service via         │
│                                                              │                     │          │        │                   │                              │ malformed input                                              │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-46598                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/mod                                             │ CVE-2026-56864      │ HIGH     │        │ v0.30.0           │ 0.40.0                       │ A malicious GOSUMDB was capable of serving arbitrary module  │
│                                                              │                     │          │        │                   │                              │ content no ......                                            │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56864                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56865      │          │        │                   │                              │ golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog:    │
│                                                              │                     │          │        │                   │                              │ Supply chain compromise via transparency log tile            │
│                                                              │                     │          │        │                   │                              │ verification bypass                                          │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56865                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net                                             │ CVE-2026-25681      │          │        │ v0.47.0           │ 0.55.0                       │ golang.org/x/net/html: golang.org/x/net/html: Arbitrary code │
│                                                              │                     │          │        │                   │                              │ execution via Cross-Site Scripting                           │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-25681                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-27136      │          │        │                   │                              │ golang.org/x/net/html: golang: golang.org/x/net/html:        │
│                                                              │                     │          │        │                   │                              │ Cross-Site Scripting via HTML parsing bypass                 │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-27136                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-33814      │          │        │                   │ 0.53.0                       │ net/http/internal/http2: golang: golang.org/x/net: Go        │
│                                                              │                     │          │        │                   │                              │ HTTP/2: Denial of Service via malformed                      │
│                                                              │                     │          │        │                   │                              │ SETTINGS_MAX_FRAME_SIZE frame...                             │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33814                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39821      │          │        │                   │ 0.55.0                       │ golang.org/x/net/idna: golang: net/http:                     │
│                                                              │                     │          │        │                   │                              │ golang.org/x/net/idna: Privilege escalation via incorrect    │
│                                                              │                     │          │        │                   │                              │ Punycode label processing                                    │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39821                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-46600      │          │        │                   │ 0.56.0                       │ golang.org/x/net/dns/dnsmessage:                             │
│                                                              │                     │          │        │                   │                              │ golang.org/x/net/dns/dnsmessage: Denial of Service via       │
│                                                              │                     │          │        │                   │                              │ invalid DNS record parsing                                   │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-46600                   │
│                                                              ├─────────────────────┼──────────┤        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-25680      │ MEDIUM   │        │                   │ 0.55.0                       │ golang.org/x/net/html: golang.org/x/net/html: Denial of      │
│                                                              │                     │          │        │                   │                              │ Service due to excessive HTML parsing                        │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-25680                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42502      │          │        │                   │                              │ golang.org/x/net/html: golang: golang.org/x/net/html:        │
│                                                              │                     │          │        │                   │                              │ Cross-Site Scripting via unexpected HTML tree rendering      │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42502                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42506      │          │        │                   │                              │ golang.org/x/net/html: golang.org/x/net/html: Cross-Site     │
│                                                              │                     │          │        │                   │                              │ Scripting (XSS) via arbitrary HTML parsing                   │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42506                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/text                                            │ CVE-2026-56852      │ HIGH     │        │ v0.31.0           │ 0.39.0                       │ golang.org/x/text: golang.org/x/text: Denial of Service via  │
│                                                              │                     │          │        │                   │                              │ invalid UTF-8 input                                          │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56852                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ google.golang.org/grpc                                       │ CVE-2026-33186      │ CRITICAL │        │ v1.77.0           │ 1.79.3                       │ google.golang.org/grpc/grpc-go:                              │
│                                                              │                     │          │        │                   │                              │ google.golang.org/grpc/authz: gRPC-Go: Authorization bypass  │
│                                                              │                     │          │        │                   │                              │ due to improper HTTP/2 path validation                       │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33186                   │
│                                                              ├─────────────────────┼──────────┤        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ GHSA-hrxh-6v49-42gf │ HIGH     │        │                   │ 1.82.1                       │ gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities                 │
│                                                              │                     │          │        │                   │                              │ https://github.com/advisories/GHSA-hrxh-6v49-42gf            │
├──────────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib                                                       │ CVE-2026-25679      │          │        │ v1.24.13          │ 1.25.8, 1.26.1               │ net/url: Incorrect parsing of IPv6 host literals in net/url  │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-25679                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-27145      │          │        │                   │ 1.25.11, 1.26.4              │ crypto/x509: golang: golang crypto/x509: Denial of Service   │
│                                                              │                     │          │        │                   │                              │ via excessive processing of DNS...                           │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-27145                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32280      │          │        │                   │ 1.25.9, 1.26.2               │ crypto/x509: crypto/tls: golang: Go: Denial of Service       │
│                                                              │                     │          │        │                   │                              │ vulnerability in certificate chain building...               │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32280                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32281      │          │        │                   │                              │ crypto/x509: golang: Go crypto/x509: Denial of Service via   │
│                                                              │                     │          │        │                   │                              │ inefficient certificate chain validation...                  │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32281                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32283      │          │        │                   │                              │ crypto/tls: golang: Go crypto/tls: Denial of Service via     │
│                                                              │                     │          │        │                   │                              │ multiple TLS 1.3 key...                                      │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32283                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-33811      │          │        │                   │ 1.25.10, 1.26.3              │ net: golang: Go net package: Denial of Service via long      │
│                                                              │                     │          │        │                   │                              │ CNAME response...                                            │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33811                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-33814      │          │        │                   │                              │ net/http/internal/http2: golang: golang.org/x/net: Go        │
│                                                              │                     │          │        │                   │                              │ HTTP/2: Denial of Service via malformed                      │
│                                                              │                     │          │        │                   │                              │ SETTINGS_MAX_FRAME_SIZE frame...                             │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33814                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-33818      │          │        │                   │ 1.25.13, 1.26.6, 1.27.0-rc.3 │ encoding/asn1: golang: Go encoding/asn1: Denial of Service   │
│                                                              │                     │          │        │                   │                              │ via excessive recursion in Unmarshal...                      │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-33818                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39820      │          │        │                   │ 1.25.10, 1.26.3              │ net/mail: golang: Go net/mail: Denial of Service via crafted │
│                                                              │                     │          │        │                   │                              │ email inputs                                                 │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39820                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39821      │          │        │                   │ 1.25.13, 1.26.6, 1.27.0-rc.3 │ golang.org/x/net/idna: golang: net/http:                     │
│                                                              │                     │          │        │                   │                              │ golang.org/x/net/idna: Privilege escalation via incorrect    │
│                                                              │                     │          │        │                   │                              │ Punycode label processing                                    │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39821                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39822      │          │        │                   │ 1.25.12, 1.26.5, 1.27.0-rc.2 │ golang: Go os.Root: Symlink following vulnerability allows   │
│                                                              │                     │          │        │                   │                              │ directory traversal                                          │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39822                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39836      │          │        │                   │ 1.25.10, 1.26.3              │ net: golang: Go net package: Denial of Service via NUL byte  │
│                                                              │                     │          │        │                   │                              │ in...                                                        │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39836                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42499      │          │        │                   │                              │ net/mail: golang: net/mail: Denial of Service via            │
│                                                              │                     │          │        │                   │                              │ pathological email address parsing                           │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42499                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42504      │          │        │                   │ 1.25.11, 1.26.4              │ mime: golang: Golang MIME: Denial of Service via             │
│                                                              │                     │          │        │                   │                              │ maliciously-crafted MIME header                              │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42504                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56853      │          │        │                   │ 1.25.13, 1.26.6, 1.27.0-rc.3 │ net/http: golang: Go net/http: Unencrypted HTTP/2            │
│                                                              │                     │          │        │                   │                              │ connections vulnerable to Denial of Service...               │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56853                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56858      │          │        │                   │                              │ html/template: golang: Go html/template: Cross-Site          │
│                                                              │                     │          │        │                   │                              │ Scripting via pathological input                             │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56858                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56859      │          │        │                   │                              │ encoding/xml: golang: Go: Denial of Service via XML decoding │
│                                                              │                     │          │        │                   │                              │ recursion depth issue...                                     │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56859                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56860      │          │        │                   │                              │ net/url: golang: golang net/url: Denial of Service from      │
│                                                              │                     │          │        │                   │                              │ quadratic complexity in path...                              │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56860                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-56862      │          │        │                   │                              │ crypto/tls: golang: Golang crypto/tls: Denial of Service via │
│                                                              │                     │          │        │                   │                              │ indefinite KeyUpdate messages                                │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56862                   │
│                                                              ├─────────────────────┼──────────┤        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-27142      │ MEDIUM   │        │                   │ 1.25.8, 1.26.1               │ html/template: URLs in meta content attribute actions are    │
│                                                              │                     │          │        │                   │                              │ not escaped in html/template...                              │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-27142                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32282      │          │        │                   │ 1.25.9, 1.26.2               │ golang: internal/syscall/unix: Root.Chmod can follow         │
│                                                              │                     │          │        │                   │                              │ symlinks out of the root                                     │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32282                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32288      │          │        │                   │                              │ archive/tar: golang: Go's archive/tar package: Denial of     │
│                                                              │                     │          │        │                   │                              │ Service via maliciously-crafted archive                      │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32288                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-32289      │          │        │                   │                              │ html/template: golang: html/template: Cross-Site Scripting   │
│                                                              │                     │          │        │                   │                              │ (XSS) via improper context and brace depth...                │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-32289                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39823      │          │        │                   │ 1.25.10, 1.26.3              │ html/template: golang: Go html/template: Cross-Site          │
│                                                              │                     │          │        │                   │                              │ Scripting via improper URL escaping in meta...               │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39823                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39825      │          │        │                   │                              │ net/http/httputil: golang: net/http/httputil: ReverseProxy   │
│                                                              │                     │          │        │                   │                              │ forwards hidden query parameters, potentially bypassing      │
│                                                              │                     │          │        │                   │                              │ security controls...                                         │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39825                   │
│                                                              ├─────────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-39826      │          │        │                   │                              │ html/template: golang: html/template: Cross-site scripting   │
│                                                              │                     │          │        │                   │                              │ due to incorrect script tag escaping                         │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39826                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42505      │          │        │                   │ 1.25.12, 1.26.5, 1.27.0-rc.2 │ crypto/tls: golang: Go crypto/tls: Information disclosure in │
│                                                              │                     │          │        │                   │                              │ Encrypted Client Hello                                       │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42505                   │
│                                                              ├─────────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-42507      │          │        │                   │ 1.25.11, 1.26.4              │ net/textproto: golang: Golang net/textproto: Misleading      │
│                                                              │                     │          │        │                   │                              │ error messages via input injection                           │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42507                   │
│                                                              ├─────────────────────┼──────────┤        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2026-27139      │ LOW      │        │                   │ 1.25.8, 1.26.1               │ os: FileInfo can escape from a Root in golang os module      │
│                                                              │                     │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-27139                   │
└──────────────────────────────────────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────┴──────────────────────────────────────────────────────────────┘

dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026

Navigation Menu

chore(ci)(deps): bump actions/github-script from 7 to 9 - #76

chore(ci)(deps): bump actions/github-script from 7 to 9#76
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/github-script-9

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 31, 2026

v9.0.0

What's Changed

New Contributors

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

New Contributors

v7.1.0

What's Changed

Uh oh!

dependabot Bot commented on behalf of github Aug 31, 2026

Labels

Uh oh!

github-actions Bot commented Aug 31, 2026

NPM Vulnerability Scan Results - web

Uh oh!

github-actions Bot commented Aug 31, 2026

Docker Image Scan Results - Dockerfile.frontend

Uh oh!

github-actions Bot commented Aug 31, 2026

Docker Image Scan Results - Dockerfile.api

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants