@fabasoad/sarif-to-slack 0.2.5 → 1.1.0

package/test-data/sarif/osv-scanner-container.sarif

@@ -0,0 +1,2278 @@
+{
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
+  "version": "2.1.0",
+  "runs": [
+    {
+      "addresses": [],
+      "artifacts": [
+        {
+          "length": -1,
+          "location": {
+            "index": -1,
+            "uri": "file:///usr/bin/tflint"
+          },
+          "parentIndex": -1,
+          "roles": []
+        },
+        {
+          "length": -1,
+          "location": {
+            "index": -1,
+            "uri": "file:///usr/local/bin/terraform"
+          },
+          "parentIndex": -1,
+          "roles": []
+        },
+        {
+          "length": -1,
+          "location": {
+            "index": -1,
+            "uri": "file:///root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/guava-30.1-jre-sources.jar"
+          },
+          "parentIndex": -1,
+          "roles": []
+        },
+        {
+          "length": -1,
+          "location": {
+            "index": -1,
+            "uri": "file:///root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/guava-30.1-jre.jar"
+          },
+          "parentIndex": -1,
+          "roles": []
+        },
+        {
+          "length": -1,
+          "location": {
+            "index": -1,
+            "uri": "file:///root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.19.6/protobuf-java-3.19.6.jar"
+          },
+          "parentIndex": -1,
+          "roles": []
+        },
+        {
+          "length": -1,
+          "location": {
+            "index": -1,
+            "uri": "file:///root/.cache/coursier/v1/https/repo1.maven.org/maven2/org/apache/commons/commons-lang3/3.14.0/commons-lang3-3.14.0.jar"
+          },
+          "parentIndex": -1,
+          "roles": []
+        },
+        {
+          "length": -1,
+          "location": {
+            "index": -1,
+            "uri": "file:///usr/local/bin/actionlint"
+          },
+          "parentIndex": -1,
+          "roles": []
+        }
+      ],
+      "graphs": [],
+      "invocations": [],
+      "language": "en-US",
+      "logicalLocations": [],
+      "newlineSequences": [
+        "\r\n",
+        "\n"
+      ],
+      "policies": [],
+      "redactionTokens": [],
+      "results": [
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'github.com/cloudflare/circl@1.3.7' is vulnerable to 'CVE-2025-8556' (also known as 'GO-2025-3754', 'GHSA-2x5j-vhc8-9cwm')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-8556",
+          "ruleIndex": 0,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/local/bin/terraform"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'github.com/cloudflare/circl@1.4.0' is vulnerable to 'CVE-2025-8556' (also known as 'GO-2025-3754', 'GHSA-2x5j-vhc8-9cwm')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-8556",
+          "ruleIndex": 0,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/guava-30.1-jre-sources.jar"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'com.google.guava:guava@30.1-jre' is vulnerable to 'CVE-2020-8908' (also known as 'CGA-7rjh-334q-pq8g', 'GHSA-5mg8-w23w-74h3')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2020-8908",
+          "ruleIndex": 1,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/guava-30.1-jre.jar"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'com.google.guava:guava@30.1-jre' is vulnerable to 'CVE-2020-8908' (also known as 'CGA-7rjh-334q-pq8g', 'GHSA-5mg8-w23w-74h3')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2020-8908",
+          "ruleIndex": 1,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'golang.org/x/oauth2@0.20.0' is vulnerable to 'CVE-2025-22868' (also known as 'GO-2025-3488', 'GHSA-6v2p-p543-phr9')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-22868",
+          "ruleIndex": 2,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.19.6/protobuf-java-3.19.6.jar"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'com.google.protobuf:protobuf-java@3.19.6' is vulnerable to 'CVE-2024-7254' (also known as 'GHSA-735f-pc8j-v9w8')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-7254",
+          "ruleIndex": 3,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/guava-30.1-jre-sources.jar"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'com.google.guava:guava@30.1-jre' is vulnerable to 'CVE-2023-2976' (also known as 'CGA-g8pm-vcpp-9jxq', 'GHSA-7g45-4rm6-3mm3')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2023-2976",
+          "ruleIndex": 4,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/guava-30.1-jre.jar"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'com.google.guava:guava@30.1-jre' is vulnerable to 'CVE-2023-2976' (also known as 'CGA-g8pm-vcpp-9jxq', 'GHSA-7g45-4rm6-3mm3')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2023-2976",
+          "ruleIndex": 4,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'golang.org/x/crypto@0.23.0' is vulnerable to 'CVE-2025-22869' (also known as 'GO-2025-3487', 'GHSA-hcg3-q754-cr77')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-22869",
+          "ruleIndex": 5,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///root/.cache/coursier/v1/https/repo1.maven.org/maven2/org/apache/commons/commons-lang3/3.14.0/commons-lang3-3.14.0.jar"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'org.apache.commons:commons-lang3@3.14.0' is vulnerable to 'CVE-2025-48924' (also known as 'GHSA-j288-q9x7-2f5v')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-48924",
+          "ruleIndex": 6,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'golang.org/x/net@0.25.0' is vulnerable to 'CVE-2025-22870' (also known as 'GO-2025-3503', 'GHSA-qxp5-gwg8-xv66')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-22870",
+          "ruleIndex": 7,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'golang.org/x/crypto@0.23.0' is vulnerable to 'CVE-2024-45337' (also known as 'GO-2024-3321', 'GHSA-v778-237x-gjrc')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-45337",
+          "ruleIndex": 8,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'golang.org/x/net@0.25.0' is vulnerable to 'CVE-2025-22872' (also known as 'GO-2025-3595', 'GHSA-vvgc-356p-c3xw')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-22872",
+          "ruleIndex": 9,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'github.com/hashicorp/go-getter@1.7.4' is vulnerable to 'CVE-2024-6257' (also known as 'GO-2024-2948', 'GHSA-xfhp-jf8p-mh5w')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-6257",
+          "ruleIndex": 10,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'github.com/aws/aws-sdk-go@1.44.122' is vulnerable to 'CVE-2020-8912' (also known as 'GO-2022-0635', 'GHSA-7f33-f4f5-xwgw')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2020-8912",
+          "ruleIndex": 11,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/local/bin/terraform"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'github.com/aws/aws-sdk-go@1.44.122' is vulnerable to 'CVE-2020-8912' (also known as 'GO-2022-0635', 'GHSA-7f33-f4f5-xwgw')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2020-8912",
+          "ruleIndex": 11,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'github.com/aws/aws-sdk-go@1.44.122' is vulnerable to 'CVE-2020-8911' (also known as 'GO-2022-0646', 'GHSA-f5pg-7wfw-84q9')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2020-8911",
+          "ruleIndex": 12,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/local/bin/terraform"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'github.com/aws/aws-sdk-go@1.44.122' is vulnerable to 'CVE-2020-8911' (also known as 'GO-2022-0646', 'GHSA-f5pg-7wfw-84q9')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2020-8911",
+          "ruleIndex": 12,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'github.com/hashicorp/go-getter@1.7.4' is vulnerable to 'CVE-2024-6257' (also known as 'GO-2024-2948', 'GHSA-xfhp-jf8p-mh5w')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-6257",
+          "ruleIndex": 10,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.22.5' is vulnerable to 'CVE-2024-34155' (also known as 'BIT-golang-2024-34155', 'GO-2024-3105')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-34155",
+          "ruleIndex": 13,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.22.5' is vulnerable to 'CVE-2024-34156' (also known as 'BIT-golang-2024-34156', 'GO-2024-3106')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-34156",
+          "ruleIndex": 14,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.22.5' is vulnerable to 'CVE-2024-34158' (also known as 'BIT-golang-2024-34158', 'GO-2024-3107')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-34158",
+          "ruleIndex": 15,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'golang.org/x/crypto@0.23.0' is vulnerable to 'CVE-2024-45337' (also known as 'GO-2024-3321', 'GHSA-v778-237x-gjrc')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-45337",
+          "ruleIndex": 8,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'golang.org/x/net@0.25.0' is vulnerable to 'CVE-2024-45338' (also known as 'GO-2024-3333', 'GHSA-w32m-9786-jp63')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-45338",
+          "ruleIndex": 16,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.22.5' is vulnerable to 'CVE-2024-45341' (also known as 'BIT-golang-2024-45341', 'GO-2025-3373')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-45341",
+          "ruleIndex": 17,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/local/bin/actionlint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.23.4' is vulnerable to 'CVE-2024-45341' (also known as 'BIT-golang-2024-45341', 'GO-2025-3373')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-45341",
+          "ruleIndex": 17,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.22.5' is vulnerable to 'CVE-2024-45336' (also known as 'BIT-golang-2024-45336', 'GO-2025-3420')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-45336",
+          "ruleIndex": 18,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/local/bin/actionlint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.23.4' is vulnerable to 'CVE-2024-45336' (also known as 'BIT-golang-2024-45336', 'GO-2025-3420')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2024-45336",
+          "ruleIndex": 18,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.22.5' is vulnerable to 'CVE-2025-22866' (also known as 'BIT-golang-2025-22866', 'GO-2025-3447')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-22866",
+          "ruleIndex": 19,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/local/bin/actionlint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.23.4' is vulnerable to 'CVE-2025-22866' (also known as 'BIT-golang-2025-22866', 'GO-2025-3447')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-22866",
+          "ruleIndex": 19,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'golang.org/x/crypto@0.23.0' is vulnerable to 'CVE-2025-22869' (also known as 'GO-2025-3487', 'GHSA-hcg3-q754-cr77')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-22869",
+          "ruleIndex": 5,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'golang.org/x/oauth2@0.20.0' is vulnerable to 'CVE-2025-22868' (also known as 'GO-2025-3488', 'GHSA-6v2p-p543-phr9')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-22868",
+          "ruleIndex": 2,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'golang.org/x/net@0.25.0' is vulnerable to 'CVE-2025-22870' (also known as 'GO-2025-3503', 'GHSA-qxp5-gwg8-xv66')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-22870",
+          "ruleIndex": 7,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.22.5' is vulnerable to 'CVE-2025-22871' (also known as 'BIT-golang-2025-22871', 'GO-2025-3563')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-22871",
+          "ruleIndex": 20,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/local/bin/actionlint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.23.4' is vulnerable to 'CVE-2025-22871' (also known as 'BIT-golang-2025-22871', 'GO-2025-3563')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-22871",
+          "ruleIndex": 20,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'golang.org/x/net@0.25.0' is vulnerable to 'CVE-2025-22872' (also known as 'GO-2025-3595', 'GHSA-vvgc-356p-c3xw')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-22872",
+          "ruleIndex": 9,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/local/bin/terraform"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.24.2' is vulnerable to 'CVE-2025-22874' (also known as 'BIT-golang-2025-22874', 'GO-2025-3749')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-22874",
+          "ruleIndex": 21,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.22.5' is vulnerable to 'CVE-2025-0913' (also known as 'BIT-golang-2025-0913', 'GO-2025-3750')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-0913",
+          "ruleIndex": 22,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/local/bin/actionlint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.23.4' is vulnerable to 'CVE-2025-0913' (also known as 'BIT-golang-2025-0913', 'GO-2025-3750')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-0913",
+          "ruleIndex": 22,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/local/bin/terraform"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.24.2' is vulnerable to 'CVE-2025-0913' (also known as 'BIT-golang-2025-0913', 'GO-2025-3750')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-0913",
+          "ruleIndex": 22,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.22.5' is vulnerable to 'CVE-2025-4673' (also known as 'BIT-golang-2025-4673', 'GO-2025-3751')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-4673",
+          "ruleIndex": 23,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/local/bin/actionlint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.23.4' is vulnerable to 'CVE-2025-4673' (also known as 'BIT-golang-2025-4673', 'GO-2025-3751')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-4673",
+          "ruleIndex": 23,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/local/bin/terraform"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.24.2' is vulnerable to 'CVE-2025-4673' (also known as 'BIT-golang-2025-4673', 'GO-2025-3751')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-4673",
+          "ruleIndex": 23,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'github.com/cloudflare/circl@1.3.7' is vulnerable to 'CVE-2025-8556' (also known as 'GO-2025-3754', 'GHSA-2x5j-vhc8-9cwm')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-8556",
+          "ruleIndex": 0,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/local/bin/terraform"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'github.com/cloudflare/circl@1.4.0' is vulnerable to 'CVE-2025-8556' (also known as 'GO-2025-3754', 'GHSA-2x5j-vhc8-9cwm')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-8556",
+          "ruleIndex": 0,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/bin/tflint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.22.5' is vulnerable to 'CVE-2025-47907' (also known as 'GO-2025-3849')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-47907",
+          "ruleIndex": 24,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/local/bin/actionlint"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.23.4' is vulnerable to 'CVE-2025-47907' (also known as 'GO-2025-3849')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-47907",
+          "ruleIndex": 24,
+          "stacks": [],
+          "taxa": []
+        },
+        {
+          "attachments": [],
+          "codeFlows": [],
+          "fixes": [],
+          "graphTraversals": [],
+          "graphs": [],
+          "kind": "fail",
+          "level": "warning",
+          "locations": [
+            {
+              "annotations": [],
+              "id": -1,
+              "logicalLocations": [],
+              "physicalLocation": {
+                "artifactLocation": {
+                  "index": -1,
+                  "uri": "file:///usr/local/bin/terraform"
+                }
+              },
+              "relationships": []
+            }
+          ],
+          "message": {
+            "arguments": [],
+            "text": "Package 'stdlib@1.24.2' is vulnerable to 'CVE-2025-47907' (also known as 'GO-2025-3849')."
+          },
+          "rank": -1,
+          "relatedLocations": [],
+          "ruleId": "CVE-2025-47907",
+          "ruleIndex": 24,
+          "stacks": [],
+          "taxa": []
+        }
+      ],
+      "runAggregates": [],
+      "taxonomies": [],
+      "threadFlowLocations": [],
+      "tool": {
+        "driver": {
+          "contents": [
+            "localizedData",
+            "nonLocalizedData"
+          ],
+          "informationUri": "https://github.com/google/osv-scanner",
+          "isComprehensive": false,
+          "language": "en-US",
+          "locations": [],
+          "name": "osv-scanner",
+          "notifications": [],
+          "rules": [
+            {
+              "deprecatedIds": [
+                "CVE-2025-8556",
+                "GO-2025-3754",
+                "GHSA-2x5j-vhc8-9cwm"
+              ],
+              "fullDescription": {
+                "markdown": "CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl",
+                "text": "CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl"
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2025-8556](https://osv.dev/CVE-2025-8556)**\n(Also published as: [GO-2025-3754](https://osv.dev/GO-2025-3754), [GHSA-2x5j-vhc8-9cwm](https://osv.dev/GHSA-2x5j-vhc8-9cwm), ).\n\n## [GO-2025-3754](https://osv.dev/GO-2025-3754)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl\n\n\u003c/details\u003e\n\n## [GHSA-2x5j-vhc8-9cwm](https://osv.dev/GHSA-2x5j-vhc8-9cwm)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e ### Impact\n\u003e The CIRCL implementation of FourQ fails to validate user-supplied low-order points during Diffie-Hellman key exchange, potentially allowing attackers to force the identity point and compromise session security.\n\u003e \n\u003e Moreover, there is an incorrect point validation in ScalarMult can lead to incorrect results in the isEqual function and if a point is on the curve.\n\u003e \n\u003e \n\u003e ### Patches\n\u003e Version 1.6.1 (https://github.com/cloudflare/circl/tree/v1.6.1) mitigates the identified issues.\n\u003e \n\u003e We acknowledge Alon Livne (Botanica Software Labs) for the reported findings.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | github.com/cloudflare/circl | 1.3.7 |\n| artifact:/usr/local/bin/terraform | github.com/cloudflare/circl | 1.4.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-2x5j-vhc8-9cwm | github.com/cloudflare/circl | 1.6.1 |\n| GO-2025-3754 | github.com/cloudflare/circl | 1.6.1 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-8556\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-8556\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2025-8556](https://osv.dev/CVE-2025-8556)**\n(Also published as: [GO-2025-3754](https://osv.dev/GO-2025-3754), [GHSA-2x5j-vhc8-9cwm](https://osv.dev/GHSA-2x5j-vhc8-9cwm), ).\n\n## [GO-2025-3754](https://osv.dev/GO-2025-3754)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl\n\n\u003c/details\u003e\n\n## [GHSA-2x5j-vhc8-9cwm](https://osv.dev/GHSA-2x5j-vhc8-9cwm)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e ### Impact\n\u003e The CIRCL implementation of FourQ fails to validate user-supplied low-order points during Diffie-Hellman key exchange, potentially allowing attackers to force the identity point and compromise session security.\n\u003e \n\u003e Moreover, there is an incorrect point validation in ScalarMult can lead to incorrect results in the isEqual function and if a point is on the curve.\n\u003e \n\u003e \n\u003e ### Patches\n\u003e Version 1.6.1 (https://github.com/cloudflare/circl/tree/v1.6.1) mitigates the identified issues.\n\u003e \n\u003e We acknowledge Alon Livne (Botanica Software Labs) for the reported findings.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | github.com/cloudflare/circl | 1.3.7 |\n| artifact:/usr/local/bin/terraform | github.com/cloudflare/circl | 1.4.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-2x5j-vhc8-9cwm | github.com/cloudflare/circl | 1.6.1 |\n| GO-2025-3754 | github.com/cloudflare/circl | 1.6.1 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-8556\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-8556\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2025-8556",
+              "name": "CVE-2025-8556",
+              "properties": {
+                "security-severity": "3.7"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2025-8556: CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl",
+                "text": "CVE-2025-8556: CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2020-8908",
+                "CGA-7rjh-334q-pq8g",
+                "GHSA-5mg8-w23w-74h3"
+              ],
+              "fullDescription": {
+                "markdown": "A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava `com.google.common.io.Files.createTempDir()`. The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.\n",
+                "text": "A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava `com.google.common.io.Files.createTempDir()`. The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.\n"
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2020-8908](https://osv.dev/CVE-2020-8908)**.\n\n## [GHSA-5mg8-w23w-74h3](https://osv.dev/GHSA-5mg8-w23w-74h3)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava `com.google.common.io.Files.createTempDir()`. The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.\n\u003e \n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/guava-30.1-jre-sources.jar | com.google.guava:guava | 30.1-jre |\n| artifact:/root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/guava-30.1-jre.jar | com.google.guava:guava | 30.1-jre |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-5mg8-w23w-74h3 | com.google.guava:guava | 32.0.0-android |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2020-8908\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2020-8908](https://osv.dev/CVE-2020-8908)**.\n\n## [GHSA-5mg8-w23w-74h3](https://osv.dev/GHSA-5mg8-w23w-74h3)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava `com.google.common.io.Files.createTempDir()`. The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.\n\u003e \n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/guava-30.1-jre-sources.jar | com.google.guava:guava | 30.1-jre |\n| artifact:/root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/guava-30.1-jre.jar | com.google.guava:guava | 30.1-jre |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-5mg8-w23w-74h3 | com.google.guava:guava | 32.0.0-android |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2020-8908\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2020-8908",
+              "name": "CVE-2020-8908",
+              "properties": {
+                "security-severity": "3.3"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2020-8908: Information Disclosure in Guava",
+                "text": "CVE-2020-8908: Information Disclosure in Guava"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2025-22868",
+                "GO-2025-3488",
+                "GHSA-6v2p-p543-phr9"
+              ],
+              "fullDescription": {
+                "markdown": "An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.",
+                "text": "An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2025-22868](https://osv.dev/CVE-2025-22868)**\n(Also published as: [GO-2025-3488](https://osv.dev/GO-2025-3488), [GHSA-6v2p-p543-phr9](https://osv.dev/GHSA-6v2p-p543-phr9), ).\n\n## [GO-2025-3488](https://osv.dev/GO-2025-3488)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.\n\n\u003c/details\u003e\n\n## [GHSA-6v2p-p543-phr9](https://osv.dev/GHSA-6v2p-p543-phr9)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | golang.org/x/oauth2 | 0.20.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-6v2p-p543-phr9 | golang.org/x/oauth2 | 0.27.0 |\n| GO-2025-3488 | golang.org/x/oauth2 | 0.27.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22868\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2025-22868](https://osv.dev/CVE-2025-22868)**\n(Also published as: [GO-2025-3488](https://osv.dev/GO-2025-3488), [GHSA-6v2p-p543-phr9](https://osv.dev/GHSA-6v2p-p543-phr9), ).\n\n## [GO-2025-3488](https://osv.dev/GO-2025-3488)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.\n\n\u003c/details\u003e\n\n## [GHSA-6v2p-p543-phr9](https://osv.dev/GHSA-6v2p-p543-phr9)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | golang.org/x/oauth2 | 0.20.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-6v2p-p543-phr9 | golang.org/x/oauth2 | 0.27.0 |\n| GO-2025-3488 | golang.org/x/oauth2 | 0.27.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22868\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2025-22868",
+              "name": "CVE-2025-22868",
+              "properties": {
+                "security-severity": "7.5"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2025-22868: Unexpected memory consumption during token parsing in golang.org/x/oauth2",
+                "text": "CVE-2025-22868: Unexpected memory consumption during token parsing in golang.org/x/oauth2"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-7254",
+                "GHSA-735f-pc8j-v9w8"
+              ],
+              "fullDescription": {
+                "markdown": "### Summary\nWhen parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.\n\nReporter: Alexis Challande, Trail of Bits Ecosystem Security Team \u003cecosystem@trailofbits.com\u003e\n\nAffected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.\n\n### Severity\n[CVE-2024-7254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7254) **High** CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication)\nThis is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.\n\n### Proof of Concept\nFor reproduction details, please refer to the unit tests (Protobuf Java [LiteTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/lite/src/test/java/com/google/protobuf/LiteTest.java) and [CodedInputStreamTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/core/src/test/java/com/google/protobuf/CodedInputStreamTest.java)) that identify the specific inputs that exercise this parsing weakness.\n\n### Remediation and Mitigation\nWe have been working diligently to address this issue and have released a mitigation that is available now. Please update to the latest available versions of the following packages:\n* protobuf-java (3.25.5, 4.27.5, 4.28.2)\n* protobuf-javalite (3.25.5, 4.27.5, 4.28.2)\n* protobuf-kotlin (3.25.5, 4.27.5, 4.28.2)\n* protobuf-kotlin-lite (3.25.5, 4.27.5, 4.28.2)\n* com-protobuf [JRuby gem only] (3.25.5, 4.27.5, 4.28.2)",
+                "text": "### Summary\nWhen parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.\n\nReporter: Alexis Challande, Trail of Bits Ecosystem Security Team \u003cecosystem@trailofbits.com\u003e\n\nAffected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.\n\n### Severity\n[CVE-2024-7254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7254) **High** CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication)\nThis is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.\n\n### Proof of Concept\nFor reproduction details, please refer to the unit tests (Protobuf Java [LiteTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/lite/src/test/java/com/google/protobuf/LiteTest.java) and [CodedInputStreamTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/core/src/test/java/com/google/protobuf/CodedInputStreamTest.java)) that identify the specific inputs that exercise this parsing weakness.\n\n### Remediation and Mitigation\nWe have been working diligently to address this issue and have released a mitigation that is available now. Please update to the latest available versions of the following packages:\n* protobuf-java (3.25.5, 4.27.5, 4.28.2)\n* protobuf-javalite (3.25.5, 4.27.5, 4.28.2)\n* protobuf-kotlin (3.25.5, 4.27.5, 4.28.2)\n* protobuf-kotlin-lite (3.25.5, 4.27.5, 4.28.2)\n* com-protobuf [JRuby gem only] (3.25.5, 4.27.5, 4.28.2)"
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-7254](https://osv.dev/CVE-2024-7254)**.\n\n## [GHSA-735f-pc8j-v9w8](https://osv.dev/GHSA-735f-pc8j-v9w8)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e ### Summary\n\u003e When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.\n\u003e \n\u003e Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team \u003cecosystem@trailofbits.com\u003e\n\u003e \n\u003e Affected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.\n\u003e \n\u003e ### Severity\n\u003e [CVE-2024-7254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7254) **High** CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication)\n\u003e This is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.\n\u003e \n\u003e ### Proof of Concept\n\u003e For reproduction details, please refer to the unit tests (Protobuf Java [LiteTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/lite/src/test/java/com/google/protobuf/LiteTest.java) and [CodedInputStreamTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/core/src/test/java/com/google/protobuf/CodedInputStreamTest.java)) that identify the specific inputs that exercise this parsing weakness.\n\u003e \n\u003e ### Remediation and Mitigation\n\u003e We have been working diligently to address this issue and have released a mitigation that is available now. Please update to the latest available versions of the following packages:\n\u003e * protobuf-java (3.25.5, 4.27.5, 4.28.2)\n\u003e * protobuf-javalite (3.25.5, 4.27.5, 4.28.2)\n\u003e * protobuf-kotlin (3.25.5, 4.27.5, 4.28.2)\n\u003e * protobuf-kotlin-lite (3.25.5, 4.27.5, 4.28.2)\n\u003e * com-protobuf [JRuby gem only] (3.25.5, 4.27.5, 4.28.2)\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.19.6/protobuf-java-3.19.6.jar | com.google.protobuf:protobuf-java | 3.19.6 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-735f-pc8j-v9w8 | google-protobuf | 3.25.5, 4.27.5, 4.28.2 |\n| GHSA-735f-pc8j-v9w8 | com.google.protobuf:protobuf-java | 3.25.5, 4.27.5, 4.28.2 |\n| GHSA-735f-pc8j-v9w8 | com.google.protobuf:protobuf-javalite | 3.25.5, 4.27.5, 4.28.2 |\n| GHSA-735f-pc8j-v9w8 | com.google.protobuf:protobuf-kotlin | 3.25.5, 4.27.5, 4.28.2 |\n| GHSA-735f-pc8j-v9w8 | com.google.protobuf:protobuf-kotlin-lite | 3.25.5, 4.27.5, 4.28.2 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.19.6/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-7254\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-7254](https://osv.dev/CVE-2024-7254)**.\n\n## [GHSA-735f-pc8j-v9w8](https://osv.dev/GHSA-735f-pc8j-v9w8)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e ### Summary\n\u003e When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.\n\u003e \n\u003e Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team \u003cecosystem@trailofbits.com\u003e\n\u003e \n\u003e Affected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.\n\u003e \n\u003e ### Severity\n\u003e [CVE-2024-7254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7254) **High** CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication)\n\u003e This is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.\n\u003e \n\u003e ### Proof of Concept\n\u003e For reproduction details, please refer to the unit tests (Protobuf Java [LiteTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/lite/src/test/java/com/google/protobuf/LiteTest.java) and [CodedInputStreamTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/core/src/test/java/com/google/protobuf/CodedInputStreamTest.java)) that identify the specific inputs that exercise this parsing weakness.\n\u003e \n\u003e ### Remediation and Mitigation\n\u003e We have been working diligently to address this issue and have released a mitigation that is available now. Please update to the latest available versions of the following packages:\n\u003e * protobuf-java (3.25.5, 4.27.5, 4.28.2)\n\u003e * protobuf-javalite (3.25.5, 4.27.5, 4.28.2)\n\u003e * protobuf-kotlin (3.25.5, 4.27.5, 4.28.2)\n\u003e * protobuf-kotlin-lite (3.25.5, 4.27.5, 4.28.2)\n\u003e * com-protobuf [JRuby gem only] (3.25.5, 4.27.5, 4.28.2)\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.19.6/protobuf-java-3.19.6.jar | com.google.protobuf:protobuf-java | 3.19.6 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-735f-pc8j-v9w8 | google-protobuf | 3.25.5, 4.27.5, 4.28.2 |\n| GHSA-735f-pc8j-v9w8 | com.google.protobuf:protobuf-java | 3.25.5, 4.27.5, 4.28.2 |\n| GHSA-735f-pc8j-v9w8 | com.google.protobuf:protobuf-javalite | 3.25.5, 4.27.5, 4.28.2 |\n| GHSA-735f-pc8j-v9w8 | com.google.protobuf:protobuf-kotlin | 3.25.5, 4.27.5, 4.28.2 |\n| GHSA-735f-pc8j-v9w8 | com.google.protobuf:protobuf-kotlin-lite | 3.25.5, 4.27.5, 4.28.2 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.19.6/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-7254\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-7254",
+              "name": "CVE-2024-7254",
+              "properties": {
+                "security-severity": "8.7"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-7254: protobuf-java has potential Denial of Service issue",
+                "text": "CVE-2024-7254: protobuf-java has potential Denial of Service issue"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2023-2976",
+                "CGA-g8pm-vcpp-9jxq",
+                "GHSA-7g45-4rm6-3mm3"
+              ],
+              "fullDescription": {
+                "markdown": "Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.\n\nEven though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.",
+                "text": "Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.\n\nEven though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2023-2976](https://osv.dev/CVE-2023-2976)**.\n\n## [GHSA-7g45-4rm6-3mm3](https://osv.dev/GHSA-7g45-4rm6-3mm3)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.\n\u003e \n\u003e Even though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/guava-30.1-jre-sources.jar | com.google.guava:guava | 30.1-jre |\n| artifact:/root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/guava-30.1-jre.jar | com.google.guava:guava | 30.1-jre |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-7g45-4rm6-3mm3 | com.google.guava:guava | 32.0.0-android |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2023-2976\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2023-2976](https://osv.dev/CVE-2023-2976)**.\n\n## [GHSA-7g45-4rm6-3mm3](https://osv.dev/GHSA-7g45-4rm6-3mm3)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.\n\u003e \n\u003e Even though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/guava-30.1-jre-sources.jar | com.google.guava:guava | 30.1-jre |\n| artifact:/root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/guava-30.1-jre.jar | com.google.guava:guava | 30.1-jre |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-7g45-4rm6-3mm3 | com.google.guava:guava | 32.0.0-android |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/root/.cache/coursier/v1/https/repo1.maven.org/maven2/com/google/guava/guava/30.1-jre/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2023-2976\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2023-2976",
+              "name": "CVE-2023-2976",
+              "properties": {
+                "security-severity": "5.5"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2023-2976: Guava vulnerable to insecure use of temporary directory",
+                "text": "CVE-2023-2976: Guava vulnerable to insecure use of temporary directory"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2025-22869",
+                "GO-2025-3487",
+                "GHSA-hcg3-q754-cr77"
+              ],
+              "fullDescription": {
+                "markdown": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.",
+                "text": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2025-22869](https://osv.dev/CVE-2025-22869)**\n(Also published as: [GO-2025-3487](https://osv.dev/GO-2025-3487), [GHSA-hcg3-q754-cr77](https://osv.dev/GHSA-hcg3-q754-cr77), ).\n\n## [GO-2025-3487](https://osv.dev/GO-2025-3487)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.\n\n\u003c/details\u003e\n\n## [GHSA-hcg3-q754-cr77](https://osv.dev/GHSA-hcg3-q754-cr77)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | golang.org/x/crypto | 0.23.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-hcg3-q754-cr77 | golang.org/x/crypto | 0.35.0 |\n| GO-2025-3487 | golang.org/x/crypto | 0.35.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22869\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2025-22869](https://osv.dev/CVE-2025-22869)**\n(Also published as: [GO-2025-3487](https://osv.dev/GO-2025-3487), [GHSA-hcg3-q754-cr77](https://osv.dev/GHSA-hcg3-q754-cr77), ).\n\n## [GO-2025-3487](https://osv.dev/GO-2025-3487)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.\n\n\u003c/details\u003e\n\n## [GHSA-hcg3-q754-cr77](https://osv.dev/GHSA-hcg3-q754-cr77)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | golang.org/x/crypto | 0.23.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-hcg3-q754-cr77 | golang.org/x/crypto | 0.35.0 |\n| GO-2025-3487 | golang.org/x/crypto | 0.35.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22869\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2025-22869",
+              "name": "CVE-2025-22869",
+              "properties": {
+                "security-severity": "7.5"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2025-22869: Potential denial of service in golang.org/x/crypto",
+                "text": "CVE-2025-22869: Potential denial of service in golang.org/x/crypto"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2025-48924",
+                "GHSA-j288-q9x7-2f5v"
+              ],
+              "fullDescription": {
+                "markdown": "Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.",
+                "text": "Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2025-48924](https://osv.dev/CVE-2025-48924)**.\n\n## [GHSA-j288-q9x7-2f5v](https://osv.dev/GHSA-j288-q9x7-2f5v)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\u003e \n\u003e This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\u003e \n\u003e The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.\n\u003e \n\u003e Users are recommended to upgrade to version 3.18.0, which fixes the issue.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/root/.cache/coursier/v1/https/repo1.maven.org/maven2/org/apache/commons/commons-lang3/3.14.0/commons-lang3-3.14.0.jar | org.apache.commons:commons-lang3 | 3.14.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-j288-q9x7-2f5v | org.apache.commons:commons-lang3 | 3.18.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/root/.cache/coursier/v1/https/repo1.maven.org/maven2/org/apache/commons/commons-lang3/3.14.0/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-48924\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2025-48924](https://osv.dev/CVE-2025-48924)**.\n\n## [GHSA-j288-q9x7-2f5v](https://osv.dev/GHSA-j288-q9x7-2f5v)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\u003e \n\u003e This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\u003e \n\u003e The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.\n\u003e \n\u003e Users are recommended to upgrade to version 3.18.0, which fixes the issue.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/root/.cache/coursier/v1/https/repo1.maven.org/maven2/org/apache/commons/commons-lang3/3.14.0/commons-lang3-3.14.0.jar | org.apache.commons:commons-lang3 | 3.14.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-j288-q9x7-2f5v | org.apache.commons:commons-lang3 | 3.18.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/root/.cache/coursier/v1/https/repo1.maven.org/maven2/org/apache/commons/commons-lang3/3.14.0/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-48924\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2025-48924",
+              "name": "CVE-2025-48924",
+              "properties": {
+                "security-severity": "6.5"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2025-48924: Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs",
+                "text": "CVE-2025-48924: Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2025-22870",
+                "GO-2025-3503",
+                "GHSA-qxp5-gwg8-xv66"
+              ],
+              "fullDescription": {
+                "markdown": "Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied.",
+                "text": "Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2025-22870](https://osv.dev/CVE-2025-22870)**\n(Also published as: [GO-2025-3503](https://osv.dev/GO-2025-3503), [GHSA-qxp5-gwg8-xv66](https://osv.dev/GHSA-qxp5-gwg8-xv66), ).\n\n## [GO-2025-3503](https://osv.dev/GO-2025-3503)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied.\n\n\u003c/details\u003e\n\n## [GHSA-qxp5-gwg8-xv66](https://osv.dev/GHSA-qxp5-gwg8-xv66)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | golang.org/x/net | 0.25.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-qxp5-gwg8-xv66 | golang.org/x/net | 0.36.0 |\n| GO-2025-3503 | golang.org/x/net | 0.36.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22870\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2025-22870](https://osv.dev/CVE-2025-22870)**\n(Also published as: [GO-2025-3503](https://osv.dev/GO-2025-3503), [GHSA-qxp5-gwg8-xv66](https://osv.dev/GHSA-qxp5-gwg8-xv66), ).\n\n## [GO-2025-3503](https://osv.dev/GO-2025-3503)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied.\n\n\u003c/details\u003e\n\n## [GHSA-qxp5-gwg8-xv66](https://osv.dev/GHSA-qxp5-gwg8-xv66)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | golang.org/x/net | 0.25.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-qxp5-gwg8-xv66 | golang.org/x/net | 0.36.0 |\n| GO-2025-3503 | golang.org/x/net | 0.36.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22870\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2025-22870",
+              "name": "CVE-2025-22870",
+              "properties": {
+                "security-severity": "4.4"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2025-22870: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net",
+                "text": "CVE-2025-22870: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-45337",
+                "GO-2024-3321",
+                "GHSA-v778-237x-gjrc"
+              ],
+              "fullDescription": {
+                "markdown": "Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.\n\nThe documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.\n\nFor example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.\n\nSince this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.\n\nUsers should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.",
+                "text": "Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.\n\nThe documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.\n\nFor example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.\n\nSince this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.\n\nUsers should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-45337](https://osv.dev/CVE-2024-45337)**\n(Also published as: [GO-2024-3321](https://osv.dev/GO-2024-3321), [GHSA-v778-237x-gjrc](https://osv.dev/GHSA-v778-237x-gjrc), ).\n\n## [GO-2024-3321](https://osv.dev/GO-2024-3321)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.\n\u003e \n\u003e The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.\n\u003e \n\u003e For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.\n\u003e \n\u003e Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.\n\u003e \n\u003e Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.\n\n\u003c/details\u003e\n\n## [GHSA-v778-237x-gjrc](https://osv.dev/GHSA-v778-237x-gjrc)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.\n\u003e \n\u003e The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.\n\u003e \n\u003e For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.\n\u003e \n\u003e Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.\n\u003e \n\u003e Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | golang.org/x/crypto | 0.23.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-v778-237x-gjrc | golang.org/x/crypto | 0.31.0 |\n| GO-2024-3321 | golang.org/x/crypto | 0.31.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-45337\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-45337](https://osv.dev/CVE-2024-45337)**\n(Also published as: [GO-2024-3321](https://osv.dev/GO-2024-3321), [GHSA-v778-237x-gjrc](https://osv.dev/GHSA-v778-237x-gjrc), ).\n\n## [GO-2024-3321](https://osv.dev/GO-2024-3321)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.\n\u003e \n\u003e The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.\n\u003e \n\u003e For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.\n\u003e \n\u003e Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.\n\u003e \n\u003e Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.\n\n\u003c/details\u003e\n\n## [GHSA-v778-237x-gjrc](https://osv.dev/GHSA-v778-237x-gjrc)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.\n\u003e \n\u003e The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.\n\u003e \n\u003e For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.\n\u003e \n\u003e Since this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.\n\u003e \n\u003e Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | golang.org/x/crypto | 0.23.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-v778-237x-gjrc | golang.org/x/crypto | 0.31.0 |\n| GO-2024-3321 | golang.org/x/crypto | 0.31.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-45337\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-45337",
+              "name": "CVE-2024-45337",
+              "properties": {
+                "security-severity": "9.1"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-45337: Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto",
+                "text": "CVE-2024-45337: Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2025-22872",
+                "GO-2025-3595",
+                "GHSA-vvgc-356p-c3xw"
+              ],
+              "fullDescription": {
+                "markdown": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).",
+                "text": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts)."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2025-22872](https://osv.dev/CVE-2025-22872)**\n(Also published as: [GO-2025-3595](https://osv.dev/GO-2025-3595), [GHSA-vvgc-356p-c3xw](https://osv.dev/GHSA-vvgc-356p-c3xw), ).\n\n## [GO-2025-3595](https://osv.dev/GO-2025-3595)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).\n\n\u003c/details\u003e\n\n## [GHSA-vvgc-356p-c3xw](https://osv.dev/GHSA-vvgc-356p-c3xw)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | golang.org/x/net | 0.25.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-vvgc-356p-c3xw | golang.org/x/net | 0.38.0 |\n| GO-2025-3595 | golang.org/x/net | 0.38.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22872\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2025-22872](https://osv.dev/CVE-2025-22872)**\n(Also published as: [GO-2025-3595](https://osv.dev/GO-2025-3595), [GHSA-vvgc-356p-c3xw](https://osv.dev/GHSA-vvgc-356p-c3xw), ).\n\n## [GO-2025-3595](https://osv.dev/GO-2025-3595)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).\n\n\u003c/details\u003e\n\n## [GHSA-vvgc-356p-c3xw](https://osv.dev/GHSA-vvgc-356p-c3xw)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | golang.org/x/net | 0.25.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-vvgc-356p-c3xw | golang.org/x/net | 0.38.0 |\n| GO-2025-3595 | golang.org/x/net | 0.38.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22872\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2025-22872",
+              "name": "CVE-2025-22872",
+              "properties": {
+                "security-severity": "5.3"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2025-22872: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net",
+                "text": "CVE-2025-22872: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-6257",
+                "GO-2024-2948",
+                "GHSA-xfhp-jf8p-mh5w"
+              ],
+              "fullDescription": {
+                "markdown": "A crafted request can execute Git update on an existing maliciously modified Git Configuration. This can potentially lead to arbitrary code execution. When performing a Git operation, the library will try to clone the given repository to a specified destination. Cloning initializes a git config in the provided destination. An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.",
+                "text": "A crafted request can execute Git update on an existing maliciously modified Git Configuration. This can potentially lead to arbitrary code execution. When performing a Git operation, the library will try to clone the given repository to a specified destination. Cloning initializes a git config in the provided destination. An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-6257](https://osv.dev/CVE-2024-6257)**\n(Also published as: [GO-2024-2948](https://osv.dev/GO-2024-2948), [GHSA-xfhp-jf8p-mh5w](https://osv.dev/GHSA-xfhp-jf8p-mh5w), ).\n\n## [GO-2024-2948](https://osv.dev/GO-2024-2948)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A crafted request can execute Git update on an existing maliciously modified Git Configuration. This can potentially lead to arbitrary code execution. When performing a Git operation, the library will try to clone the given repository to a specified destination. Cloning initializes a git config in the provided destination. An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.\n\n\u003c/details\u003e\n\n## [GHSA-xfhp-jf8p-mh5w](https://osv.dev/GHSA-xfhp-jf8p-mh5w)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution. When go-getter is performing a Git operation, go-getter will try to clone the given repository in a specified destination. Cloning initializes a git config to the provided destination and if the repository needs to get updated go-getter will pull the new changes .\n\u003e \n\u003e An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | github.com/hashicorp/go-getter | 1.7.4 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-xfhp-jf8p-mh5w | github.com/hashicorp/go-getter | 1.7.5 |\n| GO-2024-2948 | github.com/hashicorp/go-getter | 1.7.5 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-6257\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-6257](https://osv.dev/CVE-2024-6257)**\n(Also published as: [GO-2024-2948](https://osv.dev/GO-2024-2948), [GHSA-xfhp-jf8p-mh5w](https://osv.dev/GHSA-xfhp-jf8p-mh5w), ).\n\n## [GO-2024-2948](https://osv.dev/GO-2024-2948)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A crafted request can execute Git update on an existing maliciously modified Git Configuration. This can potentially lead to arbitrary code execution. When performing a Git operation, the library will try to clone the given repository to a specified destination. Cloning initializes a git config in the provided destination. An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.\n\n\u003c/details\u003e\n\n## [GHSA-xfhp-jf8p-mh5w](https://osv.dev/GHSA-xfhp-jf8p-mh5w)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution. When go-getter is performing a Git operation, go-getter will try to clone the given repository in a specified destination. Cloning initializes a git config to the provided destination and if the repository needs to get updated go-getter will pull the new changes .\n\u003e \n\u003e An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | github.com/hashicorp/go-getter | 1.7.4 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GHSA-xfhp-jf8p-mh5w | github.com/hashicorp/go-getter | 1.7.5 |\n| GO-2024-2948 | github.com/hashicorp/go-getter | 1.7.5 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-6257\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-6257",
+              "name": "CVE-2024-6257",
+              "properties": {
+                "security-severity": "8.4"
+              },
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-6257: Code Execution on Git update in github.com/hashicorp/go-getter",
+                "text": "CVE-2024-6257: Code Execution on Git update in github.com/hashicorp/go-getter"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2020-8912",
+                "GO-2022-0635",
+                "GHSA-7f33-f4f5-xwgw"
+              ],
+              "fullDescription": {
+                "markdown": "A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this in combination with a decryption oracle can reveal the authentication key used by AES-GCM as decrypting the GMAC tag leaves the authentication key recoverable as an algebraic equation. It is recommended to update your SDK to V2 or later, and re-encrypt your files.",
+                "text": "A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this in combination with a decryption oracle can reveal the authentication key used by AES-GCM as decrypting the GMAC tag leaves the authentication key recoverable as an algebraic equation. It is recommended to update your SDK to V2 or later, and re-encrypt your files."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2020-8912](https://osv.dev/CVE-2020-8912)**.\n\n## [GO-2022-0635](https://osv.dev/GO-2022-0635)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this in combination with a decryption oracle can reveal the authentication key used by AES-GCM as decrypting the GMAC tag leaves the authentication key recoverable as an algebraic equation. It is recommended to update your SDK to V2 or later, and re-encrypt your files.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | github.com/aws/aws-sdk-go | 1.44.122 |\n| artifact:/usr/local/bin/terraform | github.com/aws/aws-sdk-go | 1.44.122 |\n\n## Remediation\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2020-8912\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2020-8912\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2020-8912](https://osv.dev/CVE-2020-8912)**.\n\n## [GO-2022-0635](https://osv.dev/GO-2022-0635)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this in combination with a decryption oracle can reveal the authentication key used by AES-GCM as decrypting the GMAC tag leaves the authentication key recoverable as an algebraic equation. It is recommended to update your SDK to V2 or later, and re-encrypt your files.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | github.com/aws/aws-sdk-go | 1.44.122 |\n| artifact:/usr/local/bin/terraform | github.com/aws/aws-sdk-go | 1.44.122 |\n\n## Remediation\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2020-8912\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2020-8912\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2020-8912",
+              "name": "CVE-2020-8912",
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2020-8912: In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go",
+                "text": "CVE-2020-8912: In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2020-8911",
+                "GO-2022-0646",
+                "GHSA-f5pg-7wfw-84q9"
+              ],
+              "fullDescription": {
+                "markdown": "A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has write access to the target's S3 bucket and can observe whether or not an endpoint with access to the key can decrypt a file, they can reconstruct the plaintext with (on average) 128*length (plaintext) queries to the endpoint, by exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors. It is recommended to update your SDK to V2 or later, and re-encrypt your files.",
+                "text": "A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has write access to the target's S3 bucket and can observe whether or not an endpoint with access to the key can decrypt a file, they can reconstruct the plaintext with (on average) 128*length (plaintext) queries to the endpoint, by exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors. It is recommended to update your SDK to V2 or later, and re-encrypt your files."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2020-8911](https://osv.dev/CVE-2020-8911)**.\n\n## [GO-2022-0646](https://osv.dev/GO-2022-0646)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has write access to the target's S3 bucket and can observe whether or not an endpoint with access to the key can decrypt a file, they can reconstruct the plaintext with (on average) 128*length (plaintext) queries to the endpoint, by exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors. It is recommended to update your SDK to V2 or later, and re-encrypt your files.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | github.com/aws/aws-sdk-go | 1.44.122 |\n| artifact:/usr/local/bin/terraform | github.com/aws/aws-sdk-go | 1.44.122 |\n\n## Remediation\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2020-8911\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2020-8911\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2020-8911](https://osv.dev/CVE-2020-8911)**.\n\n## [GO-2022-0646](https://osv.dev/GO-2022-0646)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has write access to the target's S3 bucket and can observe whether or not an endpoint with access to the key can decrypt a file, they can reconstruct the plaintext with (on average) 128*length (plaintext) queries to the endpoint, by exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors. It is recommended to update your SDK to V2 or later, and re-encrypt your files.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | github.com/aws/aws-sdk-go | 1.44.122 |\n| artifact:/usr/local/bin/terraform | github.com/aws/aws-sdk-go | 1.44.122 |\n\n## Remediation\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2020-8911\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2020-8911\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2020-8911",
+              "name": "CVE-2020-8911",
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2020-8911: CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go",
+                "text": "CVE-2020-8911: CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-34155",
+                "BIT-golang-2024-34155",
+                "GO-2024-3105"
+              ],
+              "fullDescription": {
+                "markdown": "Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.",
+                "text": "Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-34155](https://osv.dev/CVE-2024-34155)**.\n\n## [GO-2024-3105](https://osv.dev/GO-2024-3105)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2024-3105 | stdlib | 1.22.7, 1.23.1 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-34155\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-34155](https://osv.dev/CVE-2024-34155)**.\n\n## [GO-2024-3105](https://osv.dev/GO-2024-3105)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2024-3105 | stdlib | 1.22.7, 1.23.1 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-34155\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-34155",
+              "name": "CVE-2024-34155",
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-34155: Stack exhaustion in all Parse functions in go/parser",
+                "text": "CVE-2024-34155: Stack exhaustion in all Parse functions in go/parser"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-34156",
+                "BIT-golang-2024-34156",
+                "GO-2024-3106"
+              ],
+              "fullDescription": {
+                "markdown": "Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.",
+                "text": "Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-34156](https://osv.dev/CVE-2024-34156)**.\n\n## [GO-2024-3106](https://osv.dev/GO-2024-3106)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2024-3106 | stdlib | 1.22.7, 1.23.1 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-34156\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-34156](https://osv.dev/CVE-2024-34156)**.\n\n## [GO-2024-3106](https://osv.dev/GO-2024-3106)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2024-3106 | stdlib | 1.22.7, 1.23.1 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-34156\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-34156",
+              "name": "CVE-2024-34156",
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-34156: Stack exhaustion in Decoder.Decode in encoding/gob",
+                "text": "CVE-2024-34156: Stack exhaustion in Decoder.Decode in encoding/gob"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-34158",
+                "BIT-golang-2024-34158",
+                "GO-2024-3107"
+              ],
+              "fullDescription": {
+                "markdown": "Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.",
+                "text": "Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-34158](https://osv.dev/CVE-2024-34158)**.\n\n## [GO-2024-3107](https://osv.dev/GO-2024-3107)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2024-3107 | stdlib | 1.22.7, 1.23.1 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-34158\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-34158](https://osv.dev/CVE-2024-34158)**.\n\n## [GO-2024-3107](https://osv.dev/GO-2024-3107)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2024-3107 | stdlib | 1.22.7, 1.23.1 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-34158\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-34158",
+              "name": "CVE-2024-34158",
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-34158: Stack exhaustion in Parse in go/build/constraint",
+                "text": "CVE-2024-34158: Stack exhaustion in Parse in go/build/constraint"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-45338",
+                "GO-2024-3333",
+                "GHSA-w32m-9786-jp63"
+              ],
+              "fullDescription": {
+                "markdown": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.",
+                "text": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-45338](https://osv.dev/CVE-2024-45338)**.\n\n## [GO-2024-3333](https://osv.dev/GO-2024-3333)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | golang.org/x/net | 0.25.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2024-3333 | golang.org/x/net | 0.33.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-45338\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-45338](https://osv.dev/CVE-2024-45338)**.\n\n## [GO-2024-3333](https://osv.dev/GO-2024-3333)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | golang.org/x/net | 0.25.0 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2024-3333 | golang.org/x/net | 0.33.0 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-45338\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-45338",
+              "name": "CVE-2024-45338",
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-45338: Non-linear parsing of case-insensitive content in golang.org/x/net/html",
+                "text": "CVE-2024-45338: Non-linear parsing of case-insensitive content in golang.org/x/net/html"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-45341",
+                "BIT-golang-2024-45341",
+                "GO-2025-3373"
+              ],
+              "fullDescription": {
+                "markdown": "A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain.\n\nCertificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.",
+                "text": "A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain.\n\nCertificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-45341](https://osv.dev/CVE-2024-45341)**.\n\n## [GO-2025-3373](https://osv.dev/GO-2025-3373)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain.\n\u003e \n\u003e Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n| artifact:/usr/local/bin/actionlint | stdlib | 1.23.4 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2025-3373 | stdlib | 1.22.11, 1.23.5, 1.24.0-rc.2 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-45341\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-45341\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-45341](https://osv.dev/CVE-2024-45341)**.\n\n## [GO-2025-3373](https://osv.dev/GO-2025-3373)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain.\n\u003e \n\u003e Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n| artifact:/usr/local/bin/actionlint | stdlib | 1.23.4 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2025-3373 | stdlib | 1.22.11, 1.23.5, 1.24.0-rc.2 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-45341\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-45341\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-45341",
+              "name": "CVE-2024-45341",
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-45341: Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509",
+                "text": "CVE-2024-45341: Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2024-45336",
+                "BIT-golang-2024-45336",
+                "GO-2025-3420"
+              ],
+              "fullDescription": {
+                "markdown": "The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com.\n\nIn the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.",
+                "text": "The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com.\n\nIn the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2024-45336](https://osv.dev/CVE-2024-45336)**.\n\n## [GO-2025-3420](https://osv.dev/GO-2025-3420)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com.\n\u003e \n\u003e In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n| artifact:/usr/local/bin/actionlint | stdlib | 1.23.4 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2025-3420 | stdlib | 1.22.11, 1.23.5, 1.24.0-rc.2 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-45336\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-45336\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2024-45336](https://osv.dev/CVE-2024-45336)**.\n\n## [GO-2025-3420](https://osv.dev/GO-2025-3420)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com.\n\u003e \n\u003e In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n| artifact:/usr/local/bin/actionlint | stdlib | 1.23.4 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2025-3420 | stdlib | 1.22.11, 1.23.5, 1.24.0-rc.2 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-45336\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2024-45336\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2024-45336",
+              "name": "CVE-2024-45336",
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2024-45336: Sensitive headers incorrectly sent after cross-domain redirect in net/http",
+                "text": "CVE-2024-45336: Sensitive headers incorrectly sent after cross-domain redirect in net/http"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2025-22866",
+                "BIT-golang-2025-22866",
+                "GO-2025-3447"
+              ],
+              "fullDescription": {
+                "markdown": "Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.",
+                "text": "Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2025-22866](https://osv.dev/CVE-2025-22866)**.\n\n## [GO-2025-3447](https://osv.dev/GO-2025-3447)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n| artifact:/usr/local/bin/actionlint | stdlib | 1.23.4 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2025-3447 | stdlib | 1.22.12, 1.23.6, 1.24.0-rc.3 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22866\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22866\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2025-22866](https://osv.dev/CVE-2025-22866)**.\n\n## [GO-2025-3447](https://osv.dev/GO-2025-3447)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n| artifact:/usr/local/bin/actionlint | stdlib | 1.23.4 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2025-3447 | stdlib | 1.22.12, 1.23.6, 1.24.0-rc.3 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22866\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22866\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2025-22866",
+              "name": "CVE-2025-22866",
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2025-22866: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec",
+                "text": "CVE-2025-22866: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2025-22871",
+                "BIT-golang-2025-22871",
+                "GO-2025-3563"
+              ],
+              "fullDescription": {
+                "markdown": "The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.",
+                "text": "The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2025-22871](https://osv.dev/CVE-2025-22871)**.\n\n## [GO-2025-3563](https://osv.dev/GO-2025-3563)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n| artifact:/usr/local/bin/actionlint | stdlib | 1.23.4 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2025-3563 | stdlib | 1.23.8, 1.24.2 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22871\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22871\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2025-22871](https://osv.dev/CVE-2025-22871)**.\n\n## [GO-2025-3563](https://osv.dev/GO-2025-3563)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n| artifact:/usr/local/bin/actionlint | stdlib | 1.23.4 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2025-3563 | stdlib | 1.23.8, 1.24.2 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22871\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22871\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2025-22871",
+              "name": "CVE-2025-22871",
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2025-22871: Request smuggling due to acceptance of invalid chunked data in net/http",
+                "text": "CVE-2025-22871: Request smuggling due to acceptance of invalid chunked data in net/http"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2025-22874",
+                "BIT-golang-2025-22874",
+                "GO-2025-3749"
+              ],
+              "fullDescription": {
+                "markdown": "Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.",
+                "text": "Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2025-22874](https://osv.dev/CVE-2025-22874)**.\n\n## [GO-2025-3749](https://osv.dev/GO-2025-3749)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/local/bin/terraform | stdlib | 1.24.2 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2025-3749 | stdlib | 1.24.4 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22874\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2025-22874](https://osv.dev/CVE-2025-22874)**.\n\n## [GO-2025-3749](https://osv.dev/GO-2025-3749)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/local/bin/terraform | stdlib | 1.24.2 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2025-3749 | stdlib | 1.24.4 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-22874\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2025-22874",
+              "name": "CVE-2025-22874",
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2025-22874: Usage of ExtKeyUsageAny disables policy validation in crypto/x509",
+                "text": "CVE-2025-22874: Usage of ExtKeyUsageAny disables policy validation in crypto/x509"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2025-0913",
+                "BIT-golang-2025-0913",
+                "GO-2025-3750"
+              ],
+              "fullDescription": {
+                "markdown": "os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.",
+                "text": "os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2025-0913](https://osv.dev/CVE-2025-0913)**.\n\n## [GO-2025-3750](https://osv.dev/GO-2025-3750)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n| artifact:/usr/local/bin/actionlint | stdlib | 1.23.4 |\n| artifact:/usr/local/bin/terraform | stdlib | 1.24.2 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2025-3750 | stdlib | 1.23.10, 1.24.4 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-0913\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-0913\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2025-0913](https://osv.dev/CVE-2025-0913)**.\n\n## [GO-2025-3750](https://osv.dev/GO-2025-3750)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n| artifact:/usr/local/bin/actionlint | stdlib | 1.23.4 |\n| artifact:/usr/local/bin/terraform | stdlib | 1.24.2 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2025-3750 | stdlib | 1.23.10, 1.24.4 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-0913\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-0913\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2025-0913",
+              "name": "CVE-2025-0913",
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2025-0913: Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall",
+                "text": "CVE-2025-0913: Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2025-4673",
+                "BIT-golang-2025-4673",
+                "GO-2025-3751"
+              ],
+              "fullDescription": {
+                "markdown": "Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.",
+                "text": "Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2025-4673](https://osv.dev/CVE-2025-4673)**.\n\n## [GO-2025-3751](https://osv.dev/GO-2025-3751)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n| artifact:/usr/local/bin/actionlint | stdlib | 1.23.4 |\n| artifact:/usr/local/bin/terraform | stdlib | 1.24.2 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2025-3751 | stdlib | 1.23.10, 1.24.4 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-4673\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-4673\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2025-4673](https://osv.dev/CVE-2025-4673)**.\n\n## [GO-2025-3751](https://osv.dev/GO-2025-3751)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n| artifact:/usr/local/bin/actionlint | stdlib | 1.23.4 |\n| artifact:/usr/local/bin/terraform | stdlib | 1.24.2 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2025-3751 | stdlib | 1.23.10, 1.24.4 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-4673\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-4673\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2025-4673",
+              "name": "CVE-2025-4673",
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2025-4673: Sensitive headers not cleared on cross-origin redirect in net/http",
+                "text": "CVE-2025-4673: Sensitive headers not cleared on cross-origin redirect in net/http"
+              }
+            },
+            {
+              "deprecatedIds": [
+                "CVE-2025-47907",
+                "GO-2025-3849"
+              ],
+              "fullDescription": {
+                "markdown": "Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.",
+                "text": "Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error."
+              },
+              "help": {
+                "markdown": "**Your dependency is vulnerable to [CVE-2025-47907](https://osv.dev/CVE-2025-47907)**.\n\n## [GO-2025-3849](https://osv.dev/GO-2025-3849)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n| artifact:/usr/local/bin/actionlint | stdlib | 1.23.4 |\n| artifact:/usr/local/bin/terraform | stdlib | 1.24.2 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2025-3849 | stdlib | 1.23.12, 1.24.6 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-47907\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-47907\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n",
+                "text": "**Your dependency is vulnerable to [CVE-2025-47907](https://osv.dev/CVE-2025-47907)**.\n\n## [GO-2025-3849](https://osv.dev/GO-2025-3849)\n\n\u003cdetails\u003e\n\u003csummary\u003eDetails\u003c/summary\u003e\n\n\u003e Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.\n\n\u003c/details\u003e\n\n---\n\n### Affected Packages\n\n| Source | Package Name | Package Version |\n| --- | --- | --- |\n| artifact:/usr/bin/tflint | stdlib | 1.22.5 |\n| artifact:/usr/local/bin/actionlint | stdlib | 1.23.4 |\n| artifact:/usr/local/bin/terraform | stdlib | 1.24.2 |\n\n## Remediation\n\nTo fix these vulnerabilities, update the vulnerabilities past the listed fixed versions below.\n\n### Fixed Versions\n\n| Vulnerability ID | Package Name | Fixed Version |\n| --- | --- | --- |\n| GO-2025-3849 | stdlib | 1.23.12, 1.24.6 |\n\nIf you believe these vulnerabilities do not affect your code and wish to ignore them, add them to the ignore list in an\n`osv-scanner.toml` file located in the same directory as the lockfile containing the vulnerable dependency.\n\nSee the format and more options in our documentation here: https://google.github.io/osv-scanner/configuration/\n\nAdd or append these values to the following config files to ignore this vulnerability:\n\n`/usr/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-47907\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n`/usr/local/bin/osv-scanner.toml`\n\n```\n[[IgnoredVulns]]\nid = \"CVE-2025-47907\"\nreason = \"Your reason for ignoring this vulnerability\"\n```\n"
+              },
+              "id": "CVE-2025-47907",
+              "name": "CVE-2025-47907",
+              "relationships": [],
+              "shortDescription": {
+                "markdown": "CVE-2025-47907: Incorrect results returned from Rows.Scan in database/sql",
+                "text": "CVE-2025-47907: Incorrect results returned from Rows.Scan in database/sql"
+              }
+            }
+          ],
+          "supportedTaxonomies": [],
+          "taxa": [],
+          "version": "2.2.0"
+        },
+        "extensions": []
+      },
+      "translations": [],
+      "versionControlProvenance": [],
+      "webRequests": [],
+      "webResponses": []
+    }
+  ],
+  "properties": {}
+}