#1 Dependency Dashboard

Maintained automatically by Cave. Dismiss false positives with cave deps dismiss.

40 open security alerts

Critical (7)

• golang.org/x/crypto v0.48.0 (Go) — GHSA-vgwf-h737-ff37: golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GHSA-rm3j-f69w-wqmq: golang.org/x/crypto vulnerable to infinite loop on large channel writes — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GHSA-jppx-rxg9-jmrx: golang.org/x/crypto doesn't enforce invoking key constraints — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GHSA-f5wc-c3c7-36mc: golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GHSA-89gr-r52h-f8rx: golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GHSA-5cgq-3rg8-m6cv: golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GHSA-x527-x647-q7gg: golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement — fix: 0.52.0

High (4)

• actions/download-artifact v4 (GitHub Actions) — GHSA-cxww-7g56-2vh6: @actions/download-artifact has an Arbitrary File Write via artifact extraction — fix: 4.1.3
• golang.org/x/crypto v0.48.0 (Go) — GHSA-w879-237q-wc7r: golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GHSA-q4h4-gmj2-qvw2: golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic — fix: 0.52.0
• google.golang.org/grpc v1.81.0 (Go) — GHSA-hrxh-6v49-42gf: gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities — fix: 1.82.1

Moderate (5)

• golang.org/x/crypto v0.48.0 (Go) — GHSA-qpw4-5x99-6vjp: golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GHSA-9m57-25v3-79x9: golang.org/x/crypto: Invoking pathological inputs can lead to client panic — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GHSA-78mq-xcr3-xm33: golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GHSA-45gg-vh54-h5m9: golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions — fix: 0.52.0
• golang.org/x/net v0.51.0 (Go) — GHSA-5cv4-jp36-h3mw: Go Net HTML parser is vulnerable to denial of service — fix: 0.55.0

Unknown (24)

• golang.org/x/crypto v0.48.0 (Go) — GO-2026-5006: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GO-2026-5932: The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
• golang.org/x/crypto v0.48.0 (Go) — GO-2026-5033: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GO-2026-5023: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GO-2026-5021: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GO-2026-5020: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GO-2026-5019: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GO-2026-5018: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GO-2026-5017: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GO-2026-5016: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GO-2026-5015: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GO-2026-5014: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GO-2026-5013: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh — fix: 0.52.0
• golang.org/x/crypto v0.48.0 (Go) — GO-2026-5005: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent — fix: 0.52.0
• golang.org/x/net v0.51.0 (Go) — GO-2026-5942: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage — fix: 0.56.0
• golang.org/x/net v0.51.0 (Go) — GO-2026-5030: Invoking duplicate attributes can cause XSS in golang.org/x/net/html — fix: 0.55.0
• golang.org/x/net v0.51.0 (Go) — GO-2026-5029: Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html — fix: 0.55.0
• golang.org/x/net v0.51.0 (Go) — GO-2026-5028: Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html — fix: 0.55.0
• golang.org/x/net v0.51.0 (Go) — GO-2026-5027: Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html — fix: 0.55.0
• golang.org/x/net v0.51.0 (Go) — GO-2026-5026: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna — fix: 0.55.0
• golang.org/x/net v0.51.0 (Go) — GO-2026-5025: Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html — fix: 0.55.0
• golang.org/x/net v0.51.0 (Go) — GO-2026-4918: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net — fix: 0.53.0
• golang.org/x/sys v0.42.0 (Go) — GO-2026-5024: Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows — fix: 0.44.0
• golang.org/x/text v0.34.0 (Go) — GO-2026-5970: Infinite loop on invalid input in golang.org/x/text — fix: 0.39.0