SpIob/deptend-go-test-fixture

View on GitHub…

Prioritized maintenance missions for this repo.

← All repos

Impact

Ecosystem

Effort

Sort

CriticalGo
Update golang.org/x/crypto to fix a critical vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
5.4/10
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: critical. Source: GHSA-x527-x647-q7gg (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.0) = 5.4
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-x527-x647-q7gg for golang.org/x/crypto
CriticalGo
Update golang.org/x/crypto to fix a critical vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
5.4/10
golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: critical. Source: GHSA-5cgq-3rg8-m6cv (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.0) = 5.4
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-5cgq-3rg8-m6cv for golang.org/x/crypto
CriticalGo
Update golang.org/x/crypto to fix a critical vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
5.4/10
golang.org/x/crypto vulnerable to infinite loop on large channel writes Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: critical. Source: GHSA-rm3j-f69w-wqmq (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.0) = 5.4
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-rm3j-f69w-wqmq for golang.org/x/crypto
CriticalGo
Update golang.org/x/crypto to fix a critical vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
5.4/10
golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: critical. Source: GHSA-89gr-r52h-f8rx (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.0) = 5.4
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-89gr-r52h-f8rx for golang.org/x/crypto
CriticalGo
Update golang.org/x/crypto to fix a critical vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
5.4/10
golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: critical. Source: GHSA-vgwf-h737-ff37 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.0) = 5.4
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-vgwf-h737-ff37 for golang.org/x/crypto
CriticalGo
Update golang.org/x/crypto to fix a critical vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
5.4/10
golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: critical. Source: GHSA-f5wc-c3c7-36mc (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.0) = 5.4
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-f5wc-c3c7-36mc for golang.org/x/crypto
CriticalGo
Update golang.org/x/crypto to fix a critical vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
5.4/10
golang.org/x/crypto doesn't enforce invoking key constraints Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: critical. Source: GHSA-jppx-rxg9-jmrx (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.0) = 5.4
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-jppx-rxg9-jmrx for golang.org/x/crypto
CriticalGo
Update golang.org/x/crypto to fix a critical vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
5.4/10
Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: critical. Source: GHSA-v778-237x-gjrc (GHSA).
Upgrade golang.org/x/crypto to 0.31.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.0) = 5.4
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 592d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-v778-237x-gjrc for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-w879-237q-wc7r (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-w879-237q-wc7r for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-q4h4-gmj2-qvw2 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-q4h4-gmj2-qvw2 for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-hcg3-q754-cr77 (GHSA).
Upgrade golang.org/x/crypto to 0.35.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 470d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-hcg3-q754-cr77 for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
golang.org/x/crypto/ssh Man-in-the-Middle attack Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-xhjq-w7xm-p8qj (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20170330155735-e4e2799dd7aa or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 1265d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-xhjq-w7xm-p8qj for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
x/crypto/ssh vulnerable to panic via malformed packets Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-gwc9-m7rh-j2ww (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20211202192323-5770296d904e or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 1419d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-gwc9-m7rh-j2ww for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-3vm4-22fp-5rfm (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20201216223049-8b5274cf687f or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 1524d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-3vm4-22fp-5rfm for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
golang.org/x/crypto/ssh Denial of service via crafted Signer Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-8c26-wmh5-6g9v (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20220314234659-1baeb1ce4c0b or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 1591d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-8c26-wmh5-6g9v for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
Helm uses crypto package vulnerable to panic from malformed X.509 certificate Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-cjjc-xp8v-855w (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20200124225646-8b5121be2f68 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 1859d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-cjjc-xp8v-855w for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
Improper Verification of Cryptographic Signature in golang.org/x/crypto Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-ffhg-7mh4-33c4 (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20200220183623-bac4c82f6975 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 1895d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-ffhg-7mh4-33c4 for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-qpw4-5x99-6vjp (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-qpw4-5x99-6vjp for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-78mq-xcr3-xm33 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-78mq-xcr3-xm33 for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-45gg-vh54-h5m9 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-45gg-vh54-h5m9 for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
golang.org/x/crypto: Invoking pathological inputs can lead to client panic Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-9m57-25v3-79x9 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-9m57-25v3-79x9 for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-f6x5-jh6r-wrfv (GHSA).
Upgrade golang.org/x/crypto to 0.45.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 249d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-f6x5-jh6r-wrfv for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-j5w8-q4qc-rx2x (GHSA).
Upgrade golang.org/x/crypto to 0.45.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 249d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-j5w8-q4qc-rx2x for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-45x7-px36-x8w8 (GHSA).
Upgrade golang.org/x/crypto to 0.17.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 951d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-45x7-px36-x8w8 for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
Golang/x/crypto message forgery vulnerability Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-x3jr-pf6g-c48f (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20190424203555-c05e17bb3b2d or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 1524d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-x3jr-pf6g-c48f for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
golang.org/x/crypto/salsa20/salsa uses insufficiently random values Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-r5c5-pr8j-pfp7 (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20190320223903-b7391e95e576 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 1524d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-r5c5-pr8j-pfp7 for golang.org/x/crypto
UnknownGo
Unknown vulnerability in golang.org/x/crypto has no fix yet
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5932 (OSV).
No fixed version has been published yet for GO-2026-5932. Track upstream for a fix.
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 19d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5932 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5005 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5005 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5006 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5006 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5013 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5013 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5014 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5014 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5015 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5015 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5016 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5016 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5017 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5017 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5018 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5018 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5019 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5019 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5020 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5020 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5021 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5021 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5023 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5023 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5033 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5033 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Unbounded memory consumption in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2025-4134 (OSV).
Upgrade golang.org/x/crypto to 0.45.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 249d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2025-4134 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2025-4135 (OSV).
Upgrade golang.org/x/crypto to 0.45.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 249d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2025-4135 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Potential denial of service in golang.org/x/crypto/ssh/agent Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2025-4116 (OSV).
Upgrade golang.org/x/crypto to 0.43.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 255d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2025-4116 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Potential denial of service in golang.org/x/crypto Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2025-3487 (OSV).
Upgrade golang.org/x/crypto to 0.35.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 515d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2025-3487 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2024-3321 (OSV).
Upgrade golang.org/x/crypto to 0.31.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 592d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2024-3321 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Limited directory traversal vulnerability on Windows in golang.org/x/crypto Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2024-2961 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20220525230936-793ad666bf5e or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 754d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2024-2961 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Man-in-the-middle attacker can compromise integrity of secure channel in golang.org/x/crypto Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2023-2402 (OSV).
Upgrade golang.org/x/crypto to 0.17.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 951d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2023-2402 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Misleading message verification in golang.org/x/crypto/openpgp/clearsign Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2023-1992 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20190424203555-c05e17bb3b2d or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1068d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2023-1992 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Panic on malformed packets in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2022-0968 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20211202192323-5770296d904e or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1412d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2022-0968 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Panic in certificate parsing in crypto/x509 and golang.org/x/crypto/cryptobyte Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2022-0229 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20200124225646-8b5121be2f68 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1481d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2022-0229 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Insufficiently random values in golang.org/x/crypto/salsa20 Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2022-0209 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20190320223903-b7391e95e576 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1486d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2022-0209 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Denial of service via crafted Signer in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2021-0356 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20220314234659-1baeb1ce4c0b or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1553d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2021-0356 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Panic on crafted authentication request message in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2021-0227 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20201216223049-8b5274cf687f or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1620d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2021-0227 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Panic due to improper verification of cryptographic signatures in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2020-0012 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20200220183623-bac4c82f6975 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1929d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2020-0012 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Man-in-the-middle attack in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2020-0013 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20170330155735-e4e2799dd7aa or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1929d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2020-0013 for golang.org/x/crypto

Update golang.org/x/crypto to fix a critical vulnerability

Update golang.org/x/crypto to fix a critical vulnerability

Update golang.org/x/crypto to fix a critical vulnerability

Update golang.org/x/crypto to fix a critical vulnerability

Update golang.org/x/crypto to fix a critical vulnerability

Update golang.org/x/crypto to fix a critical vulnerability

Update golang.org/x/crypto to fix a critical vulnerability

Update golang.org/x/crypto to fix a critical vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Unknown vulnerability in golang.org/x/crypto has no fix yet

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability