Please report security issues privately via GitHub's private vulnerability reporting (this repo's Security tab → Report a vulnerability). Do not open public issues for security problems.
govulncheck ./... (source-reachability lens) is the source of truth and runs
against every release. The advisories below have no upstream fix and are
reachable only through build/install tooling — never the deployed runtime
(/manager run) components:
- github.com/containerd/containerd — pulled transitively by the Helm client
used only in the
pre-install/pre-deletechart hooks. No patched release. - golang.org/x/crypto — pulled by NATS
nkeys(curve25519) for transport auth. No patched release.
Dependabot reports against the whole dependency graph, not reachability, so it
lists these until upstream ships fixes. The grouped Dependabot config in
.github/dependabot.yml opens a PR automatically when a fix lands.