SpIob/deptend-go-test-fixture

View on GitHub…

★ 0Ingested 9/4/2026

Prioritized maintenance missions for this repo.

← All repos

Impact

Ecosystem

Effort

Type

Sort

Critical
Update golang.org/x/crypto to fix a critical vulnerability(GHSA-x527)
Fix: 0.52.06.0/10
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: critical (CVSS 10.0). Reported via GHSA-x527-x647-q7gg (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (10.0) + 0.40 × ecosystem value (0.0) = 6.0
Impact inputs
CVSS: 10.0
Severity: critical
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-x527-x647-q7gg for golang.org/x/crypto
Critical
Update golang.org/x/crypto to fix a critical vulnerability(GHSA-5cgq)
Fix: 0.52.05.5/10
golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: critical (CVSS 9.1). Reported via GHSA-5cgq-3rg8-m6cv (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.1) + 0.40 × ecosystem value (0.0) = 5.5
Impact inputs
CVSS: 9.1
Severity: critical
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-5cgq-3rg8-m6cv for golang.org/x/crypto
Critical
Update golang.org/x/crypto to fix a critical vulnerability(GHSA-rm3j)
Fix: 0.52.05.5/10
golang.org/x/crypto vulnerable to infinite loop on large channel writes golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: critical (CVSS 9.1). Reported via GHSA-rm3j-f69w-wqmq (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.1) + 0.40 × ecosystem value (0.0) = 5.5
Impact inputs
CVSS: 9.1
Severity: critical
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-rm3j-f69w-wqmq for golang.org/x/crypto
Critical
Update golang.org/x/crypto to fix a critical vulnerability(GHSA-89gr)
Fix: 0.52.05.5/10
golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: critical (CVSS 9.1). Reported via GHSA-89gr-r52h-f8rx (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.1) + 0.40 × ecosystem value (0.0) = 5.5
Impact inputs
CVSS: 9.1
Severity: critical
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-89gr-r52h-f8rx for golang.org/x/crypto
Critical
Update golang.org/x/crypto to fix a critical vulnerability(GHSA-vgwf)
Fix: 0.52.05.5/10
golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: critical (CVSS 9.1). Reported via GHSA-vgwf-h737-ff37 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.1) + 0.40 × ecosystem value (0.0) = 5.5
Impact inputs
CVSS: 9.1
Severity: critical
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-vgwf-h737-ff37 for golang.org/x/crypto
Critical
Update golang.org/x/crypto to fix a critical vulnerability(GHSA-f5wc)
Fix: 0.52.05.5/10
golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: critical (CVSS 9.1). Reported via GHSA-f5wc-c3c7-36mc (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.1) + 0.40 × ecosystem value (0.0) = 5.5
Impact inputs
CVSS: 9.1
Severity: critical
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-f5wc-c3c7-36mc for golang.org/x/crypto
Critical
Update golang.org/x/crypto to fix a critical vulnerability(GHSA-jppx)
Fix: 0.52.05.5/10
golang.org/x/crypto doesn't enforce invoking key constraints golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: critical (CVSS 9.1). Reported via GHSA-jppx-rxg9-jmrx (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.1) + 0.40 × ecosystem value (0.0) = 5.5
Impact inputs
CVSS: 9.1
Severity: critical
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-jppx-rxg9-jmrx for golang.org/x/crypto
Critical
Update golang.org/x/crypto to fix a critical vulnerability(GHSA-v778)
Fix: 0.31.05.5/10
Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: critical (CVSS 9.1). Reported via GHSA-v778-237x-gjrc (GHSA).
Upgrade golang.org/x/crypto to 0.31.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.1) + 0.40 × ecosystem value (0.0) = 5.5
Impact inputs
CVSS: 9.1
Severity: critical
Dependency type: production
Advisory age: 631d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-v778-237x-gjrc for golang.org/x/crypto
High
Update golang.org/x/crypto to fix a high vulnerability(GHSA-w879)
Fix: 0.52.04.5/10
golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-w879-237q-wc7r (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (0.0) = 4.5
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-w879-237q-wc7r for golang.org/x/crypto
High
Update golang.org/x/crypto to fix a high vulnerability(GHSA-q4h4)
Fix: 0.52.04.5/10
golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-q4h4-gmj2-qvw2 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (0.0) = 4.5
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-q4h4-gmj2-qvw2 for golang.org/x/crypto
High
Update golang.org/x/crypto to fix a high vulnerability(GHSA-hcg3)
Fix: 0.35.04.5/10
golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-hcg3-q754-cr77 (GHSA).
Upgrade golang.org/x/crypto to 0.35.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (0.0) = 4.5
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 510d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-hcg3-q754-cr77 for golang.org/x/crypto
High
Update golang.org/x/crypto to fix a high vulnerability(GHSA-xhjq)
Fix: 0.0.0-20170330155735-e4e2799dd7aa4.9/10
golang.org/x/crypto/ssh Man-in-the-Middle attack golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: high (CVSS 8.1). Reported via GHSA-xhjq-w7xm-p8qj (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20170330155735-e4e2799dd7aa or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (8.1) + 0.40 × ecosystem value (0.0) = 4.9
Impact inputs
CVSS: 8.1
Severity: high
Dependency type: production
Advisory age: 1304d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-xhjq-w7xm-p8qj for golang.org/x/crypto
High
Update golang.org/x/crypto to fix a high vulnerability(GHSA-gwc9)
Fix: 0.0.0-20211202192323-5770296d904e4.5/10
x/crypto/ssh vulnerable to panic via malformed packets golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-gwc9-m7rh-j2ww (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20211202192323-5770296d904e or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (0.0) = 4.5
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 1458d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-gwc9-m7rh-j2ww for golang.org/x/crypto
High
Update golang.org/x/crypto to fix a high vulnerability(GHSA-3vm4)
Fix: 0.0.0-20201216223049-8b5274cf687f4.5/10
golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-3vm4-22fp-5rfm (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20201216223049-8b5274cf687f or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (0.0) = 4.5
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 1563d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-3vm4-22fp-5rfm for golang.org/x/crypto
High
Update golang.org/x/crypto to fix a high vulnerability(GHSA-8c26)
Fix: 0.0.0-20220314234659-1baeb1ce4c0b4.5/10
golang.org/x/crypto/ssh Denial of service via crafted Signer golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-8c26-wmh5-6g9v (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20220314234659-1baeb1ce4c0b or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (0.0) = 4.5
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 1630d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-8c26-wmh5-6g9v for golang.org/x/crypto
High
Update golang.org/x/crypto to fix a high vulnerability(GHSA-cjjc)
Fix: 0.0.0-20200124225646-8b5121be2f684.5/10
Helm uses crypto package vulnerable to panic from malformed X.509 certificate golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-cjjc-xp8v-855w (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20200124225646-8b5121be2f68 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (0.0) = 4.5
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 1898d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-cjjc-xp8v-855w for golang.org/x/crypto
High
Update golang.org/x/crypto to fix a high vulnerability(GHSA-ffhg)
Fix: 0.0.0-20200220183623-bac4c82f69754.5/10
Improper Verification of Cryptographic Signature in golang.org/x/crypto golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-ffhg-7mh4-33c4 (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20200220183623-bac4c82f6975 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (0.0) = 4.5
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 1934d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-ffhg-7mh4-33c4 for golang.org/x/crypto
Medium
Update golang.org/x/crypto to fix a medium vulnerability(GHSA-qpw4)
Fix: 0.52.03.9/10
golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: medium (CVSS 6.5). Reported via GHSA-qpw4-5x99-6vjp (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (6.5) + 0.40 × ecosystem value (0.0) = 3.9
Impact inputs
CVSS: 6.5
Severity: medium
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-qpw4-5x99-6vjp for golang.org/x/crypto
Medium
Update golang.org/x/crypto to fix a medium vulnerability(GHSA-45gg)
Fix: 0.52.03.8/10
golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: medium (CVSS 6.3). Reported via GHSA-45gg-vh54-h5m9 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (6.3) + 0.40 × ecosystem value (0.0) = 3.8
Impact inputs
CVSS: 6.3
Severity: medium
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-45gg-vh54-h5m9 for golang.org/x/crypto
Medium
Update golang.org/x/crypto to fix a medium vulnerability(GHSA-45x7)
Fix: 0.17.03.5/10
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: medium (CVSS 5.9). Reported via GHSA-45x7-px36-x8w8 (GHSA).
Upgrade golang.org/x/crypto to 0.17.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.9) + 0.40 × ecosystem value (0.0) = 3.5
Impact inputs
CVSS: 5.9
Severity: medium
Dependency type: production
Advisory age: 990d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-45x7-px36-x8w8 for golang.org/x/crypto
Medium
Update golang.org/x/crypto to fix a medium vulnerability(GHSA-x3jr)
Fix: 0.0.0-20190424203555-c05e17bb3b2d3.5/10
Golang/x/crypto message forgery vulnerability golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: medium (CVSS 5.9). Reported via GHSA-x3jr-pf6g-c48f (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20190424203555-c05e17bb3b2d or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.9) + 0.40 × ecosystem value (0.0) = 3.5
Impact inputs
CVSS: 5.9
Severity: medium
Dependency type: production
Advisory age: 1563d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-x3jr-pf6g-c48f for golang.org/x/crypto
Medium
Update golang.org/x/crypto to fix a medium vulnerability(GHSA-r5c5)
Fix: 0.0.0-20190320223903-b7391e95e5763.5/10
golang.org/x/crypto/salsa20/salsa uses insufficiently random values golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: medium (CVSS 5.9). Reported via GHSA-r5c5-pr8j-pfp7 (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20190320223903-b7391e95e576 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.9) + 0.40 × ecosystem value (0.0) = 3.5
Impact inputs
CVSS: 5.9
Severity: medium
Dependency type: production
Advisory age: 1563d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-r5c5-pr8j-pfp7 for golang.org/x/crypto
Medium
Update golang.org/x/crypto to fix a medium vulnerability(GHSA-78mq)
Fix: 0.52.03.2/10
golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-78mq-xcr3-xm33 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.3) + 0.40 × ecosystem value (0.0) = 3.2
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-78mq-xcr3-xm33 for golang.org/x/crypto
Medium
Update golang.org/x/crypto to fix a medium vulnerability(GHSA-9m57)
Fix: 0.52.03.2/10
golang.org/x/crypto: Invoking pathological inputs can lead to client panic golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-9m57-25v3-79x9 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.3) + 0.40 × ecosystem value (0.0) = 3.2
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-9m57-25v3-79x9 for golang.org/x/crypto
Medium
Update golang.org/x/crypto to fix a medium vulnerability(GHSA-f6x5)
Fix: 0.45.03.2/10
golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-f6x5-jh6r-wrfv (GHSA).
Upgrade golang.org/x/crypto to 0.45.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.3) + 0.40 × ecosystem value (0.0) = 3.2
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: production
Advisory age: 288d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-f6x5-jh6r-wrfv for golang.org/x/crypto
Medium
Update golang.org/x/crypto to fix a medium vulnerability(GHSA-j5w8)
Fix: 0.45.03.2/10
golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-j5w8-q4qc-rx2x (GHSA).
Upgrade golang.org/x/crypto to 0.45.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.3) + 0.40 × ecosystem value (0.0) = 3.2
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: production
Advisory age: 288d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-j5w8-q4qc-rx2x for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)
Fix: 0.56.00.6/10
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-6354 (OSV).
Upgrade golang.org/x/crypto to 0.56.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-6354 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)
Fix: 0.56.00.6/10
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-6355 (OSV).
Upgrade golang.org/x/crypto to 0.56.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-6355 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)
Fix: 0.55.00.6/10
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-6303 (OSV).
Upgrade golang.org/x/crypto to 0.55.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 6d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-6303 for golang.org/x/crypto
Unknown
Unknown vulnerability in golang.org/x/crypto has no fix yet(GO-2026)
0.6/10
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-5932 (OSV).
No fixed version has been published yet for GO-2026-5932 — track the advisory and revisit once one lands.
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 58d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5932 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)
Fix: 0.52.00.6/10
Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-5005 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 105d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5005 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)
Fix: 0.52.00.6/10
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-5006 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 105d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5006 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)
Fix: 0.52.00.6/10
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-5013 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 105d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5013 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)
Fix: 0.52.00.6/10
Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-5014 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 105d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5014 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)
Fix: 0.52.00.6/10
Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-5015 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 105d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5015 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)
Fix: 0.52.00.6/10
Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-5016 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 105d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5016 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)
Fix: 0.52.00.6/10
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-5017 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 105d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5017 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)
Fix: 0.52.00.6/10
Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-5018 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 105d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5018 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)
Fix: 0.52.00.6/10
Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-5019 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 105d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5019 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)
Fix: 0.52.00.6/10
Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-5020 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 105d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5020 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)
Fix: 0.52.00.6/10
Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-5021 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 105d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5021 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)
Fix: 0.52.00.6/10
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-5023 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 105d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5023 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)
Fix: 0.52.00.6/10
Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2026-5033 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 105d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5033 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2025)
Fix: 0.45.00.6/10
Unbounded memory consumption in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2025-4134 (OSV).
Upgrade golang.org/x/crypto to 0.45.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 288d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2025-4134 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2025)
Fix: 0.45.00.6/10
Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2025-4135 (OSV).
Upgrade golang.org/x/crypto to 0.45.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 288d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2025-4135 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2025)
Fix: 0.43.00.6/10
Potential denial of service in golang.org/x/crypto/ssh/agent golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2025-4116 (OSV).
Upgrade golang.org/x/crypto to 0.43.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 294d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2025-4116 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2025)
Fix: 0.35.00.6/10
Potential denial of service in golang.org/x/crypto golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2025-3487 (OSV).
Upgrade golang.org/x/crypto to 0.35.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 555d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2025-3487 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2024)
Fix: 0.31.00.6/10
Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2024-3321 (OSV).
Upgrade golang.org/x/crypto to 0.31.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 631d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2024-3321 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2024)
Fix: 0.0.0-20220525230936-793ad666bf5e0.6/10
Limited directory traversal vulnerability on Windows in golang.org/x/crypto golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2024-2961 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20220525230936-793ad666bf5e or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 793d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2024-2961 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2023)
Fix: 0.17.00.6/10
Man-in-the-middle attacker can compromise integrity of secure channel in golang.org/x/crypto golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2023-2402 (OSV).
Upgrade golang.org/x/crypto to 0.17.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 990d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2023-2402 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2023)
Fix: 0.0.0-20190424203555-c05e17bb3b2d0.6/10
Misleading message verification in golang.org/x/crypto/openpgp/clearsign golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2023-1992 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20190424203555-c05e17bb3b2d or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1107d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2023-1992 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2022)
Fix: 0.0.0-20211202192323-5770296d904e0.6/10
Panic on malformed packets in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2022-0968 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20211202192323-5770296d904e or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1452d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2022-0968 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2022)
Fix: 0.0.0-20200124225646-8b5121be2f680.6/10
Panic in certificate parsing in crypto/x509 and golang.org/x/crypto/cryptobyte golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2022-0229 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20200124225646-8b5121be2f68 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1520d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2022-0229 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2022)
Fix: 0.0.0-20190320223903-b7391e95e5760.6/10
Insufficiently random values in golang.org/x/crypto/salsa20 golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2022-0209 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20190320223903-b7391e95e576 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1525d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2022-0209 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2021)
Fix: 0.0.0-20220314234659-1baeb1ce4c0b0.6/10
Denial of service via crafted Signer in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2021-0356 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20220314234659-1baeb1ce4c0b or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1592d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2021-0356 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2021)
Fix: 0.0.0-20201216223049-8b5274cf687f0.6/10
Panic on crafted authentication request message in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2021-0227 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20201216223049-8b5274cf687f or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1659d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2021-0227 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2020)
Fix: 0.0.0-20200220183623-bac4c82f69750.6/10
Panic due to improper verification of cryptographic signatures in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2020-0012 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20200220183623-bac4c82f6975 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1968d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2020-0012 for golang.org/x/crypto
Unknown
Update golang.org/x/crypto to fix an unknown vulnerability(GO-2020)
Fix: 0.0.0-20170330155735-e4e2799dd7aa0.6/10
Man-in-the-middle attack in golang.org/x/crypto/ssh golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: unknown. Reported via GO-2020-0013 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20170330155735-e4e2799dd7aa or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1968d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2020-0013 for golang.org/x/crypto

Missions

Update golang.org/x/crypto to fix a critical vulnerability(GHSA-x527)

Update golang.org/x/crypto to fix a critical vulnerability(GHSA-5cgq)

Update golang.org/x/crypto to fix a critical vulnerability(GHSA-rm3j)

Update golang.org/x/crypto to fix a critical vulnerability(GHSA-89gr)

Update golang.org/x/crypto to fix a critical vulnerability(GHSA-vgwf)

Update golang.org/x/crypto to fix a critical vulnerability(GHSA-f5wc)

Update golang.org/x/crypto to fix a critical vulnerability(GHSA-jppx)

Update golang.org/x/crypto to fix a critical vulnerability(GHSA-v778)

Update golang.org/x/crypto to fix a high vulnerability(GHSA-w879)

Update golang.org/x/crypto to fix a high vulnerability(GHSA-q4h4)

Update golang.org/x/crypto to fix a high vulnerability(GHSA-hcg3)

Update golang.org/x/crypto to fix a high vulnerability(GHSA-xhjq)

Update golang.org/x/crypto to fix a high vulnerability(GHSA-gwc9)

Update golang.org/x/crypto to fix a high vulnerability(GHSA-3vm4)

Update golang.org/x/crypto to fix a high vulnerability(GHSA-8c26)

Update golang.org/x/crypto to fix a high vulnerability(GHSA-cjjc)

Update golang.org/x/crypto to fix a high vulnerability(GHSA-ffhg)

Update golang.org/x/crypto to fix a medium vulnerability(GHSA-qpw4)

Update golang.org/x/crypto to fix a medium vulnerability(GHSA-45gg)

Update golang.org/x/crypto to fix a medium vulnerability(GHSA-45x7)

Update golang.org/x/crypto to fix a medium vulnerability(GHSA-x3jr)

Update golang.org/x/crypto to fix a medium vulnerability(GHSA-r5c5)

Update golang.org/x/crypto to fix a medium vulnerability(GHSA-78mq)

Update golang.org/x/crypto to fix a medium vulnerability(GHSA-9m57)

Update golang.org/x/crypto to fix a medium vulnerability(GHSA-f6x5)

Update golang.org/x/crypto to fix a medium vulnerability(GHSA-j5w8)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)

Unknown vulnerability in golang.org/x/crypto has no fix yet(GO-2026)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2026)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2025)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2025)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2025)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2025)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2024)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2024)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2023)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2023)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2022)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2022)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2022)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2021)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2021)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2020)

Update golang.org/x/crypto to fix an unknown vulnerability(GO-2020)