step 1/1 go run golang.org/x/vuln/cmd/govulncheck@latest ./... failed
go: downloading golang.org/x/vuln v1.8.0
go: downloading golang.org/x/telemetry v0.0.0-20260908163034-4bcc4b2ee518
go: downloading golang.org/x/mod v0.41.0
go: downloading golang.org/x/tools v0.50.0
go: downloading golang.org/x/sync v0.23.0
=== Symbol Results ===
Vulnerability #1: GO-2026-6617
HTTP/2 server crash due to HPACK encoder race in net/http
More info: https://pkg.go.dev/vuln/GO-2026-6617
Module: golang.org/x/net
Found in: golang.org/x/net@v0.59.0
Fixed in: golang.org/x/net@v0.60.0
Standard library
Found in: net/http/internal/http2@go1.27.1
Fixed in: net/http/internal/http2@go1.27.2
Example traces found:
#1: internal/sshd/sshd.go:686:15: sshd.runGit calls http2.ClientConn.Close
#2: internal/sshd/sshd.go:686:15: sshd.runGit calls http2.ClientConn.Close
#3: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.NetHTTPClientConn.Close
#4: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.NetHTTPClientConn.Close
#5: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.NetHTTPClientConn.RoundTrip
#6: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.NetHTTPClientConn.RoundTrip
#7: internal/store/repos.go:124:2: store.Store.UpdateRepoSettings calls sql.Conn.Close, which eventually calls http2.Server.GracefulShutdown
#8: internal/store/repos.go:124:2: store.Store.UpdateRepoSettings calls sql.Conn.Close, which eventually calls http2.Server.GracefulShutdown
#9: cmd/gitbayd/main.go:311:32: gitbayd.serveCmd calls http.Server.ListenAndServe, which eventually calls http2.Server.ServeConn
#10: cmd/gitbayd/main.go:311:32: gitbayd.serveCmd calls http.Server.ListenAndServe, which eventually calls http2.Server.ServeConn
#11: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.AddConn
#12: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.AddConn
#13: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.NewClientConn
#14: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.NewClientConn
#15: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.RoundTrip
#16: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.RoundTrip
#17: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.bufferedWriterTimeoutWriter.Write
#18: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.bufferedWriterTimeoutWriter.Write
#19: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.chunkWriter.Write
#20: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.chunkWriter.Write
#21: internal/push/apns.go:159:2: push.Client.Send calls http2.gzipReader.Close
#22: internal/push/apns.go:159:2: push.Client.Send calls http2.gzipReader.Close
#23: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http2.gzipReader.Read
#24: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http2.gzipReader.Read
#25: internal/sshd/sshd.go:686:15: sshd.runGit calls http2.requestBody.Close
#26: internal/sshd/sshd.go:686:15: sshd.runGit calls http2.requestBody.Close
#27: internal/httpd/builds.go:411:22: httpd.htmlStream.Write calls http.ResponseController.Flush, which eventually calls http2.responseWriter.FlushError
#28: internal/httpd/builds.go:411:22: httpd.htmlStream.Write calls http.ResponseController.Flush, which eventually calls http2.responseWriter.FlushError
#29: internal/httpd/builds.go:408:24: httpd.htmlStream.Write calls http2.responseWriter.Write
#30: internal/httpd/builds.go:408:24: httpd.htmlStream.Write calls http2.responseWriter.Write
#31: internal/httpd/compress.go:63:30: httpd.gzipWriter.WriteHeader calls http2.responseWriter.WriteHeader
#32: internal/httpd/compress.go:63:30: httpd.gzipWriter.WriteHeader calls http2.responseWriter.WriteHeader
#33: internal/gitutil/batch.go:44:29: gitutil.BlobBatch.Read calls io.WriteString, which calls http2.responseWriter.WriteString
#34: internal/gitutil/batch.go:44:29: gitutil.BlobBatch.Read calls io.WriteString, which calls http2.responseWriter.WriteString
#35: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.stickyErrWriter.Write
#36: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.stickyErrWriter.Write
#37: internal/push/apns.go:159:2: push.Client.Send calls http2.transportResponseBody.Close
#38: internal/push/apns.go:159:2: push.Client.Send calls http2.transportResponseBody.Close
#39: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http2.transportResponseBody.Read
#40: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http2.transportResponseBody.Read
Vulnerability #2: GO-2026-6613
HTTP/1 server connection desynchronization after 2xx CONNECT response in
net/http
More info: https://pkg.go.dev/vuln/GO-2026-6613
Standard library
Found in: net/http@go1.27.1
Fixed in: net/http@go1.27.2
Example traces found:
#1: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http.CanonicalHeaderKey
#2: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do
#3: internal/httpd/compress.go:57:7: httpd.gzipWriter.decide calls http.Header.Add
#4: internal/httpd/compress.go:55:7: httpd.gzipWriter.decide calls http.Header.Del
#5: internal/push/apns.go:168:25: push.Client.Send calls http.Header.Get
#6: internal/push/apns.go:149:16: push.Client.Send calls http.Header.Set
#7: internal/control/ghimport.go:117:29: control.ghClient.get calls http.NewRequest
#8: internal/push/apns.go:145:40: push.Client.Send calls http.NewRequestWithContext
#9: internal/imapc/imapc.go:93:25: imapc.Dial calls tls.Conn.Handshake, which eventually calls http.ParseTime
#10: internal/httpd/builds.go:411:22: httpd.htmlStream.Write calls http.ResponseController.Flush
#11: internal/httpd/routes.go:263:17: httpd.Server.Handler calls http.ServeMux.HandleFunc
#12: cmd/gitbayd/main.go:311:32: gitbayd.serveCmd calls http.Server.ListenAndServe
#13: cmd/gitbayd/main.go:314:35: gitbayd.serveCmd calls http.Server.ListenAndServeTLS
#14: cmd/gitbayd/main.go:408:25: gitbayd.serveCmd calls http.Server.Shutdown
#15: internal/push/apns.go:159:2: push.Client.Send calls http.body.Close
#16: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http.body.Read
#17: internal/push/apns.go:159:2: push.Client.Send calls http.bodyEOFSignal.Close
#18: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http.bodyEOFSignal.Read
#19: internal/gitutil/read.go:186:9: gitutil.ShowPatch calls io.Copy, which eventually calls http.bodyLocked.Read
#20: internal/gitutil/batch.go:44:29: gitutil.BlobBatch.Read calls io.WriteString, which calls http.bufioFlushWriter.Write
#21: internal/push/apns.go:159:2: push.Client.Send calls http.cancelTimerBody.Close
#22: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http.cancelTimerBody.Read
#23: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http.checkConnErrorWriter.Write
#24: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http.chunkWriter.Write
#25: internal/gitutil/read.go:186:9: gitutil.ShowPatch calls io.Copy, which eventually calls http.connReader.Read
#26: internal/sshd/sshd.go:686:15: sshd.runGit calls http.expectContinueReader.Close
#27: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http.expectContinueReader.Read
#28: internal/push/apns.go:159:2: push.Client.Send calls http.gzipReader.Close
#29: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http.gzipReader.Read
#30: internal/gitutil/batch.go:71:26: gitutil.BlobBatch.Read calls io.ReadFull, which eventually calls http.loggingConn.Read
#31: internal/sshd/sshd.go:485:14: sshd.Exec calls fmt.Fprintf, which calls http.loggingConn.Write
#32: internal/sshd/sshd.go:686:15: sshd.runGit calls http.maxBytesReader.Close
#33: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http.maxBytesReader.Read
#34: internal/sshd/sshd.go:283:15: sshd.Server.Stop calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
#35: internal/gitutil/read.go:186:9: gitutil.ShowPatch calls io.Copy, which eventually calls http.persistConn.Read
#36: internal/gitutil/read.go:186:9: gitutil.ShowPatch calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
#37: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http.persistConnWriter.Write
#38: internal/sshd/sshd.go:686:15: sshd.runGit calls http.readTrackingBody.Close
#39: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http.readTrackingBody.Read
#40: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http.readWriteCloserBody.Read
#41: internal/gitutil/read.go:186:9: gitutil.ShowPatch calls io.Copy, which eventually calls http.response.ReadFrom
#42: internal/httpd/builds.go:408:24: httpd.htmlStream.Write calls http.response.Write
#43: internal/httpd/compress.go:63:30: httpd.gzipWriter.WriteHeader calls http.response.WriteHeader
#44: internal/gitutil/batch.go:44:29: gitutil.BlobBatch.Read calls io.WriteString, which calls http.response.WriteString
#45: internal/control/register.go:325:56: control.RegisterAccount calls http.transportReadFromServerError.Error
Vulnerability #3: GO-2026-6612
Double flow control refund on HTTP/2 server streams in net/http
More info: https://pkg.go.dev/vuln/GO-2026-6612
Module: golang.org/x/net
Found in: golang.org/x/net@v0.59.0
Fixed in: golang.org/x/net@v0.60.0
Standard library
Found in: net/http/internal/http2@go1.27.1
Fixed in: net/http/internal/http2@go1.27.2
Example traces found:
#1: cmd/gitbayd/main.go:311:32: gitbayd.serveCmd calls http.Server.ListenAndServe, which eventually calls http2.Server.ServeConn
#2: cmd/gitbayd/main.go:311:32: gitbayd.serveCmd calls http.Server.ListenAndServe, which eventually calls http2.Server.ServeConn
#3: internal/sshd/sshd.go:686:15: sshd.runGit calls http2.requestBody.Close
#4: internal/sshd/sshd.go:686:15: sshd.runGit calls http2.requestBody.Close
#5: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http2.requestBody.Read
#6: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http2.requestBody.Read
Vulnerability #4: GO-2026-6611
Excessive CPU consumption from repeated initial window changes in net/http
More info: https://pkg.go.dev/vuln/GO-2026-6611
Module: golang.org/x/net
Found in: golang.org/x/net@v0.59.0
Fixed in: golang.org/x/net@v0.60.0
Standard library
Found in: net/http/internal/http2@go1.27.1
Fixed in: net/http/internal/http2@go1.27.2
Example traces found:
#1: internal/sshd/sshd.go:686:15: sshd.runGit calls http2.ClientConn.Close
#2: internal/sshd/sshd.go:686:15: sshd.runGit calls http2.ClientConn.Close
#3: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.NetHTTPClientConn.Close
#4: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.NetHTTPClientConn.Close
#5: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.NetHTTPClientConn.RoundTrip
#6: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.NetHTTPClientConn.RoundTrip
#7: internal/store/repos.go:124:2: store.Store.UpdateRepoSettings calls sql.Conn.Close, which eventually calls http2.Server.GracefulShutdown
#8: internal/store/repos.go:124:2: store.Store.UpdateRepoSettings calls sql.Conn.Close, which eventually calls http2.Server.GracefulShutdown
#9: cmd/gitbayd/main.go:311:32: gitbayd.serveCmd calls http.Server.ListenAndServe, which eventually calls http2.Server.ServeConn
#10: cmd/gitbayd/main.go:311:32: gitbayd.serveCmd calls http.Server.ListenAndServe, which eventually calls http2.Server.ServeConn
#11: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.AddConn
#12: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.AddConn
#13: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.NewClientConn
#14: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.NewClientConn
#15: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.RoundTrip
#16: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.RoundTrip
#17: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.bufferedWriterTimeoutWriter.Write
#18: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.bufferedWriterTimeoutWriter.Write
#19: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.chunkWriter.Write
#20: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.chunkWriter.Write
#21: internal/push/apns.go:159:2: push.Client.Send calls http2.gzipReader.Close
#22: internal/push/apns.go:159:2: push.Client.Send calls http2.gzipReader.Close
#23: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http2.gzipReader.Read
#24: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http2.gzipReader.Read
#25: internal/sshd/sshd.go:686:15: sshd.runGit calls http2.requestBody.Close
#26: internal/sshd/sshd.go:686:15: sshd.runGit calls http2.requestBody.Close
#27: internal/httpd/builds.go:411:22: httpd.htmlStream.Write calls http.ResponseController.Flush, which eventually calls http2.responseWriter.FlushError
#28: internal/httpd/builds.go:411:22: httpd.htmlStream.Write calls http.ResponseController.Flush, which eventually calls http2.responseWriter.FlushError
#29: internal/httpd/builds.go:408:24: httpd.htmlStream.Write calls http2.responseWriter.Write
#30: internal/httpd/builds.go:408:24: httpd.htmlStream.Write calls http2.responseWriter.Write
#31: internal/httpd/compress.go:63:30: httpd.gzipWriter.WriteHeader calls http2.responseWriter.WriteHeader
#32: internal/httpd/compress.go:63:30: httpd.gzipWriter.WriteHeader calls http2.responseWriter.WriteHeader
#33: internal/gitutil/batch.go:44:29: gitutil.BlobBatch.Read calls io.WriteString, which calls http2.responseWriter.WriteString
#34: internal/gitutil/batch.go:44:29: gitutil.BlobBatch.Read calls io.WriteString, which calls http2.responseWriter.WriteString
#35: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.stickyErrWriter.Write
#36: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.stickyErrWriter.Write
#37: internal/push/apns.go:159:2: push.Client.Send calls http2.transportResponseBody.Close
#38: internal/push/apns.go:159:2: push.Client.Send calls http2.transportResponseBody.Close
#39: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http2.transportResponseBody.Read
#40: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http2.transportResponseBody.Read
Vulnerability #5: GO-2026-6610
HTTP/2 transport accepts malformed framing-related headers in net/http
More info: https://pkg.go.dev/vuln/GO-2026-6610
Module: golang.org/x/net
Found in: golang.org/x/net@v0.59.0
Fixed in: golang.org/x/net@v0.60.0
Standard library
Found in: net/http/internal/http2@go1.27.1
Fixed in: net/http/internal/http2@go1.27.2
Example traces found:
#1: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.AddConn
#2: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.AddConn
#3: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.NewClientConn
#4: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.NewClientConn
#5: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.RoundTrip
#6: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.RoundTrip
Vulnerability #6: GO-2026-6609
Lack of limit on size of parsed Range headers in net/http
More info: https://pkg.go.dev/vuln/GO-2026-6609
Standard library
Found in: net/http@go1.27.1
Fixed in: net/http@go1.27.2
Example traces found:
#1: internal/httpd/web.go:138:19: httpd.Server.image calls http.ServeContent
Vulnerability #7: GO-2026-6608
Memory limit bypass when parsing MIME headers in net/textproto,
mime/multipart
More info: https://pkg.go.dev/vuln/GO-2026-6608
Standard library
Found in: net/textproto@go1.27.1
Fixed in: net/textproto@go1.27.2
Example traces found:
#1: internal/mailin/body.go:58:28: mailin.walk calls multipart.Reader.NextRawPart
#2: internal/httpd/milestoneactions.go:137:32: httpd.Server.releaseAssetSubmit calls http.Request.ParseMultipartForm, which calls multipart.Reader.ReadForm
#3: internal/mailin/mailin.go:147:30: mailin.Processor.Handle calls mail.ReadMessage, which eventually calls textproto.Reader.ReadContinuedLine
#4: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls textproto.Reader.ReadMIMEHeader
Vulnerability #8: GO-2026-6607
Reject malformed ECH outer extension references in crypto/tls
More info: https://pkg.go.dev/vuln/GO-2026-6607
Standard library
Found in: crypto/tls@go1.27.1
Fixed in: crypto/tls@go1.27.2
Example traces found:
#1: internal/imapc/imapc.go:93:25: imapc.Dial calls tls.Conn.Handshake
#2: cmd/gitbayd/main.go:311:32: gitbayd.serveCmd calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
#3: internal/gitutil/read.go:186:9: gitutil.ShowPatch calls io.Copy, which eventually calls tls.Conn.Read
#4: internal/gitutil/batch.go:44:29: gitutil.BlobBatch.Read calls io.WriteString, which calls tls.Conn.Write
#5: internal/mail/mail.go:102:23: mail.dial calls tls.Dial
#6: internal/imapc/imapc.go:76:33: imapc.Dial calls tls.DialWithDialer
#7: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls tls.Dialer.DialContext
Vulnerability #9: GO-2026-6605
HTTP/1 client connection desynchronization after CONNECT rejection in
net/http
More info: https://pkg.go.dev/vuln/GO-2026-6605
Standard library
Found in: net/http@go1.27.1
Fixed in: net/http@go1.27.2
Example traces found:
#1: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do
Vulnerability #10: GO-2026-6603
HTTP/2 server memory exhaustion due to Trailer headers in net/http
More info: https://pkg.go.dev/vuln/GO-2026-6603
Module: golang.org/x/net
Found in: golang.org/x/net@v0.59.0
Fixed in: golang.org/x/net@v0.60.0
Standard library
Found in: net/http/internal/http2@go1.27.1
Fixed in: net/http/internal/http2@go1.27.2
Example traces found:
#1: internal/sshd/sshd.go:686:15: sshd.runGit calls http2.ClientConn.Close
#2: internal/sshd/sshd.go:686:15: sshd.runGit calls http2.ClientConn.Close
#3: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.NetHTTPClientConn.Close
#4: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.NetHTTPClientConn.Close
#5: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.NetHTTPClientConn.RoundTrip
#6: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.NetHTTPClientConn.RoundTrip
#7: internal/store/repos.go:124:2: store.Store.UpdateRepoSettings calls sql.Conn.Close, which eventually calls http2.Server.GracefulShutdown
#8: internal/store/repos.go:124:2: store.Store.UpdateRepoSettings calls sql.Conn.Close, which eventually calls http2.Server.GracefulShutdown
#9: cmd/gitbayd/main.go:311:32: gitbayd.serveCmd calls http.Server.ListenAndServe, which eventually calls http2.Server.ServeConn
#10: cmd/gitbayd/main.go:311:32: gitbayd.serveCmd calls http.Server.ListenAndServe, which eventually calls http2.Server.ServeConn
#11: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.AddConn
#12: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.AddConn
#13: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.NewClientConn
#14: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.NewClientConn
#15: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.RoundTrip
#16: internal/push/apns.go:155:24: push.Client.Send calls http.Client.Do, which eventually calls http2.Transport.RoundTrip
#17: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.bufferedWriterTimeoutWriter.Write
#18: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.bufferedWriterTimeoutWriter.Write
#19: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.chunkWriter.Write
#20: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.chunkWriter.Write
#21: internal/push/apns.go:159:2: push.Client.Send calls http2.gzipReader.Close
#22: internal/push/apns.go:159:2: push.Client.Send calls http2.gzipReader.Close
#23: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http2.gzipReader.Read
#24: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http2.gzipReader.Read
#25: internal/sshd/sshd.go:686:15: sshd.runGit calls http2.requestBody.Close
#26: internal/sshd/sshd.go:686:15: sshd.runGit calls http2.requestBody.Close
#27: internal/httpd/builds.go:411:22: httpd.htmlStream.Write calls http.ResponseController.Flush, which eventually calls http2.responseWriter.FlushError
#28: internal/httpd/builds.go:411:22: httpd.htmlStream.Write calls http.ResponseController.Flush, which eventually calls http2.responseWriter.FlushError
#29: internal/httpd/builds.go:408:24: httpd.htmlStream.Write calls http2.responseWriter.Write
#30: internal/httpd/builds.go:408:24: httpd.htmlStream.Write calls http2.responseWriter.Write
#31: internal/httpd/compress.go:63:30: httpd.gzipWriter.WriteHeader calls http2.responseWriter.WriteHeader
#32: internal/httpd/compress.go:63:30: httpd.gzipWriter.WriteHeader calls http2.responseWriter.WriteHeader
#33: internal/gitutil/batch.go:44:29: gitutil.BlobBatch.Read calls io.WriteString, which calls http2.responseWriter.WriteString
#34: internal/gitutil/batch.go:44:29: gitutil.BlobBatch.Read calls io.WriteString, which calls http2.responseWriter.WriteString
#35: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.stickyErrWriter.Write
#36: internal/cliconfig/cliconfig.go:83:38: cliconfig.Save calls toml.Encoder.Encode, which eventually calls http2.stickyErrWriter.Write
#37: internal/push/apns.go:159:2: push.Client.Send calls http2.transportResponseBody.Close
#38: internal/push/apns.go:159:2: push.Client.Send calls http2.transportResponseBody.Close
#39: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http2.transportResponseBody.Read
#40: internal/config/config.go:428:24: config.MailInbound.Password calls io.ReadAll, which calls http2.transportResponseBody.Read
Vulnerability #11: GO-2026-6600
Recognize yield as regexp preceder keyword in html/template
More info: https://pkg.go.dev/vuln/GO-2026-6600
Standard library
Found in: html/template@go1.27.1
Fixed in: html/template@go1.27.2
Example traces found:
#1: internal/web/web.go:318:26: web.Render calls template.Template.ExecuteTemplate
Vulnerability #12: GO-2026-6599
Reset context tracking on consecutive template expressions in html/template
More info: https://pkg.go.dev/vuln/GO-2026-6599
Standard library
Found in: html/template@go1.27.1
Fixed in: html/template@go1.27.2
Example traces found:
#1: internal/web/web.go:318:26: web.Render calls template.Template.ExecuteTemplate
Your code is affected by 12 vulnerabilities from the Go standard library.
This scan also found 1 vulnerability in packages you import and 1 vulnerability
in modules you require, but your code doesn't appear to call these
vulnerabilities.
Use '-show verbose' for more details.
exit status 3
step 1/1 failed: exit 1