fix(deps): vuln minor upgrades — 15 packages (minor: 13 · patch: 2) [examples/programmatic-usage/custom-aws-detonator-terratest/go.mod] by gh-worker-campaigns-3e9aa4[bot] · Pull Request #86 · DataDog/threatest

gh-worker-campaigns-3e9aa4 · 2026-09-28T07:05:50Z

Warning

Shotclock auto-merge countdown

This PR may be automatically approved and merged on or after October 5, 2026 (UTC) if nobody acts and all required Shotclock eligibility checks pass.

To stop Shotclock, comment or review this PR, request changes, push a commit, or close the PR. Converting it to draft pauses automation.

⚠️ One or more lockfile regeneration steps failed. The updates listed below may not all have been applied — verify against the diff before merging. See the engraver logs for details.

Summary: Critical-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

examples/programmatic-usage/custom-aws-detonator-terratest/go.mod (go)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
golang.org/x/crypto	v0.0.0-20220511200225-c6db032c6c88	v0.57.0	minor	Transitive	24 CRITICAL, 14 HIGH, 22 MEDIUM, 3 UNKNOWN
google.golang.org/grpc	v1.43.0	v1.83.2	minor	Transitive	3 CRITICAL, 10 HIGH, 3 MEDIUM
github.com/hashicorp/go-getter	v1.6.1	v1.8.9	minor	Transitive	3 CRITICAL, 9 HIGH, 3 MEDIUM
golang.org/x/net	v0.0.0-20220425223048-2871e0cb64e4	v0.59.0	minor	Transitive	2 CRITICAL, 14 HIGH, 27 MEDIUM, 2 UNKNOWN
golang.org/x/text	v0.3.7	v0.42.0	minor	Transitive	3 HIGH, 1 UNKNOWN
gopkg.in/yaml.v3	v3.0.0-20210107192922-496545a6307b	v3.0.1	patch	Transitive	3 HIGH
github.com/aws/aws-sdk-go-v2/service/lambda	v1.17.0	v1.110.0	minor	Transitive	2 HIGH, 1 MEDIUM
golang.org/x/oauth2	v0.0.0-20211104180415-d3ed0bb246c8	v0.37.0	minor	Transitive	2 HIGH
github.com/Azure/azure-sdk-for-go/sdk/azidentity	v1.0.0	v1.14.1	minor	Transitive	4 MEDIUM
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.1.0	v1.7.20	minor	Transitive	3 MEDIUM
github.com/aws/aws-sdk-go-v2/service/s3	v1.23.0	v1.113.4	minor	Transitive	3 MEDIUM
github.com/ulikunitz/xz	v0.5.8	v0.5.17	patch	Transitive	3 MEDIUM
github.com/aws/aws-sdk-go	v1.40.56	v1.55.8	minor	Transitive	2 MEDIUM, 2 LOW
google.golang.org/protobuf	v1.27.1	v1.36.12	minor	Transitive	2 MEDIUM
golang.org/x/sys	v0.0.0-20220517195934-5e4e11fc645e	v0.48.0	minor	Transitive	1 UNKNOWN

Security Details

🚨 Critical & High Severity (89 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
github.com/hashicorp/go-getter	GHSA-q64h-39hv-4cf7	CRITICAL	HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches	v1.6.1	1.7.4	-
github.com/hashicorp/go-getter	CVE-2024-3817	critical	HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches	v1.6.1	-	-
github.com/hashicorp/go-getter	GO-2024-2800	critical	Argument injection when fetching remote default Git branches in github.com/hashicorp/go-getter	v1.6.1	1.7.4	-
golang.org/x/crypto	CVE-2026-39830	CRITICAL	Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	CVE-2024-45337	CRITICAL	Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GO-2026-5017	CRITICAL	Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	GHSA-jppx-rxg9-jmrx	CRITICAL	golang.org/x/crypto doesn't enforce invoking key constraints	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	CVE-2026-39833	CRITICAL	Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GO-2024-3321	CRITICAL	Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto	v0.0.0-20220511200225-c6db032c6c88	0.31.0	-
golang.org/x/crypto	GHSA-vgwf-h737-ff37	CRITICAL	golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	GHSA-v778-237x-gjrc	CRITICAL	Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto	v0.0.0-20220511200225-c6db032c6c88	0.31.0	-
golang.org/x/crypto	GHSA-f5wc-c3c7-36mc	CRITICAL	golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	CVE-2026-39832	critical	Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GO-2026-5006	critical	Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	GO-2026-5020	CRITICAL	Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	CVE-2026-39834	CRITICAL	Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GHSA-rm3j-f69w-wqmq	CRITICAL	golang.org/x/crypto vulnerable to infinite loop on large channel writes	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	GO-2026-5005	CRITICAL	Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	GHSA-89gr-r52h-f8rx	CRITICAL	golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	GO-2026-5019	CRITICAL	Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	CVE-2026-39831	CRITICAL	Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GHSA-x527-x647-q7gg	CRITICAL	golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	CVE-2026-46595	CRITICAL	Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GO-2026-5023	CRITICAL	Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	GO-2026-5021	critical	Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	CVE-2026-42508	critical	Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GHSA-5cgq-3rg8-m6cv	CRITICAL	golang.org/x/crypto vulnerable to auth bypass via unenforced @Revoked status	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/net	GO-2026-5026	critical	Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna	v0.0.0-20220425223048-2871e0cb64e4	0.55.0	-
golang.org/x/net	CVE-2026-39821	critical	Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna	v0.0.0-20220425223048-2871e0cb64e4	-	-
google.golang.org/grpc	GHSA-p77j-4mvh-x3m3	CRITICAL	gRPC-Go has an authorization bypass via missing leading slash in :path	v1.43.0	1.79.3	-
google.golang.org/grpc	GO-2026-4762	critical	Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc	v1.43.0	1.79.3	-
google.golang.org/grpc	CVE-2026-33186	critical	gRPC-Go has an authorization bypass via missing leading slash in :path	v1.43.0	-	-
github.com/aws/aws-sdk-go-v2/service/lambda	GO-2026-5764	high	DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.17.0	1.88.5	-
github.com/aws/aws-sdk-go-v2/service/lambda	CVE-2026-89090	high	Denial of service in the event stream header decoder in AWS SDK for Go v2	v1.17.0	-	-
github.com/hashicorp/go-getter	GO-2025-3892	HIGH	HashiCorp go-getter Vulnerable to Symlink Attacks in github.com/hashicorp/go-getter	v1.6.1	1.7.9	-
github.com/hashicorp/go-getter	CVE-2026-4660	high	Go-getter may allow to arbitrary filesystem reads through git operations	v1.6.1	-	-
github.com/hashicorp/go-getter	GHSA-xfhp-jf8p-mh5w	HIGH	HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation	v1.6.1	1.7.5	-
github.com/hashicorp/go-getter	GHSA-wjrx-6529-hcj3	HIGH	HashiCorp go-getter Vulnerable to Symlink Attacks	v1.6.1	1.7.9	-
github.com/hashicorp/go-getter	GHSA-92mm-2pjq-r785	HIGH	HashiCorp's go-getter library may allow arbitrary file reads	v1.6.1	1.8.6	-
github.com/hashicorp/go-getter	CVE-2025-8959	HIGH	HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack	v1.6.1	-	-
github.com/hashicorp/go-getter	GO-2026-5058	high	HashiCorp's go-getter library may allow arbitrary file reads in github.com/hashicorp/go-getter	v1.6.1	1.8.6	-
github.com/hashicorp/go-getter	CVE-2024-6257	high	HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation	v1.6.1	-	-
github.com/hashicorp/go-getter	GO-2024-2948	high	Code Execution on Git update in github.com/hashicorp/go-getter	v1.6.1	1.7.5	-
golang.org/x/crypto	CVE-2026-46597	high	Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GO-2026-5013	high	Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	CVE-2026-78662	high	Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GO-2026-6354	high	Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	0.56.0	-
golang.org/x/crypto	CVE-2026-56855	high	Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GO-2026-6355	high	Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	0.56.0	-
golang.org/x/crypto	GHSA-w879-237q-wc7r	HIGH	golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	GO-2025-4116	HIGH	Potential denial of service in golang.org/x/crypto/ssh/agent	v0.0.0-20220511200225-c6db032c6c88	0.43.0	-
golang.org/x/crypto	CVE-2026-39829	high	Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GO-2026-5018	high	Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	GHSA-q4h4-gmj2-qvw2	HIGH	golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	GHSA-56w8-48fp-6mgv	HIGH	golang.org/x/crypto/ssh/agent has a potential denial of service	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GO-2025-3487	HIGH	Potential denial of service in golang.org/x/crypto	v0.0.0-20220511200225-c6db032c6c88	0.35.0	-
golang.org/x/crypto	GHSA-hcg3-q754-cr77	HIGH	golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange	v0.0.0-20220511200225-c6db032c6c88	0.35.0	-
golang.org/x/net	GHSA-69cg-p879-7622	HIGH	golang.org/x/net/http2 Denial of Service vulnerability	v0.0.0-20220425223048-2871e0cb64e4	0.0.0-20220906165146-f3363e06e74c	-
golang.org/x/net	GO-2023-1571	HIGH	Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net	v0.0.0-20220425223048-2871e0cb64e4	0.7.0	-
golang.org/x/net	GO-2024-3333	HIGH	Non-linear parsing of case-insensitive content in golang.org/x/net/html	v0.0.0-20220425223048-2871e0cb64e4	0.33.0	-
golang.org/x/net	GO-2026-4918	high	Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net	v0.0.0-20220425223048-2871e0cb64e4	0.53.0	-
golang.org/x/net	GO-2023-2102	HIGH	HTTP/2 rapid reset can cause excessive work in net/http	v0.0.0-20220425223048-2871e0cb64e4	0.17.0	-
golang.org/x/net	CVE-2023-39325	HIGH	HTTP/2 rapid reset can cause excessive work in net/http	v0.0.0-20220425223048-2871e0cb64e4	-	-
golang.org/x/net	GHSA-4374-p667-p6c8	HIGH	HTTP/2 rapid reset can cause excessive work in net/http	v0.0.0-20220425223048-2871e0cb64e4	0.17.0	-
golang.org/x/net	CVE-2026-33814	high	Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net	v0.0.0-20220425223048-2871e0cb64e4	-	-
golang.org/x/net	GO-2022-0969	HIGH	Denial of service in net/http and golang.org/x/net/http2	v0.0.0-20220425223048-2871e0cb64e4	0.0.0-20220906165146-f3363e06e74c	-
golang.org/x/net	CVE-2022-27664	HIGH	-	v0.0.0-20220425223048-2871e0cb64e4	-	-
golang.org/x/net	GHSA-w32m-9786-jp63	HIGH	Non-linear parsing of case-insensitive content in golang.org/x/net/html	v0.0.0-20220425223048-2871e0cb64e4	-	-
golang.org/x/net	CVE-2022-41723	HIGH	Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net	v0.0.0-20220425223048-2871e0cb64e4	-	-
golang.org/x/net	GHSA-vvpx-j8f3-3w6h	HIGH	golang.org/x/net vulnerable to Uncontrolled Resource Consumption	v0.0.0-20220425223048-2871e0cb64e4	0.7.0	-
golang.org/x/net	CVE-2023-44487	high	This package is related to CVE CVE-2023-44487 which was detected by cisa.gov as actively being exploited in the wild	v0.0.0-20220425223048-2871e0cb64e4	-	-
golang.org/x/oauth2	GHSA-6v2p-p543-phr9	HIGH	golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability	v0.0.0-20211104180415-d3ed0bb246c8	0.27.0	-
golang.org/x/oauth2	GO-2025-3488	HIGH	Unexpected memory consumption during token parsing in golang.org/x/oauth2	v0.0.0-20211104180415-d3ed0bb246c8	0.27.0	-
golang.org/x/text	CVE-2022-32149	high	Denial of service via crafted Accept-Language header in golang.org/x/text/language	v0.3.7	-	-
golang.org/x/text	GHSA-69ch-w2m2-3vjp	HIGH	golang.org/x/text/language Denial of service via crafted Accept-Language header	v0.3.7	0.3.8	-
golang.org/x/text	GO-2022-1059	high	Denial of service via crafted Accept-Language header in golang.org/x/text/language	v0.3.7	0.3.8	-
google.golang.org/grpc	GHSA-vp52-pcj8-j9qc	HIGH	gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation	v1.43.0	1.83.1	-
google.golang.org/grpc	GHSA-m425-mq94-257g	HIGH	gRPC-Go HTTP/2 Rapid Reset vulnerability	v1.43.0	1.56.3	-
google.golang.org/grpc	GO-2023-2153	HIGH	Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc	v1.43.0	1.56.3	-
google.golang.org/grpc	GO-2026-6061	HIGH	Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc	v1.43.0	1.82.1	-
google.golang.org/grpc	GO-2026-6443	high	Server panic via missing authority or Host headers in google.golang.org/grpc	v1.43.0	1.82.2	-
google.golang.org/grpc	CVE-2026-84445	high	gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers	v1.43.0	-	-
google.golang.org/grpc	CVE-2026-84304	high	gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation	v1.43.0	-	-
google.golang.org/grpc	GO-2026-6348	high	Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc	v1.43.0	1.83.1	-
google.golang.org/grpc	GHSA-2v4p-qf9q-27wj	HIGH	gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers	v1.43.0	1.82.2	-
google.golang.org/grpc	GHSA-hrxh-6v49-42gf	HIGH	gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities	v1.43.0	1.82.1	-
gopkg.in/yaml.v3	GHSA-hp87-p4gw-j4gq	HIGH	gopkg.in/yaml.v3 Denial of Service	v3.0.0-20210107192922-496545a6307b	3.0.1	-
gopkg.in/yaml.v3	CVE-2022-28948	HIGH	-	v3.0.0-20210107192922-496545a6307b	-	-
gopkg.in/yaml.v3	GO-2022-0603	HIGH	Panic in gopkg.in/yaml.v3	v3.0.0-20210107192922-496545a6307b	3.0.0-20220521103104-8f96da9f5d5e	-

ℹ️ Other Vulnerabilities (82)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
github.com/Azure/azure-sdk-for-go/sdk/azidentity	PYSEC-2026-1209	medium	Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability	v1.0.0	-	-
github.com/Azure/azure-sdk-for-go/sdk/azidentity	CVE-2024-35255	medium	-	v1.0.0	-	-
github.com/Azure/azure-sdk-for-go/sdk/azidentity	GO-2024-2918	medium	Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity	v1.0.0	1.6.0	-
github.com/hashicorp/go-getter	GO-2023-1578	medium	Denial of service in github.com/hashicorp/go-getter/v2	v1.6.1	1.7.0	-
github.com/hashicorp/go-getter	CVE-2023-0475	medium	Go-Getter Vulnerable to Decompression Bombs	v1.6.1	-	-
github.com/ulikunitz/xz	GO-2025-3922	medium	Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz	v0.5.8	0.5.15	-
github.com/ulikunitz/xz	CVE-2025-58058	medium	github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives	v0.5.8	-	-
golang.org/x/crypto	GO-2023-2402	medium	Man-in-the-middle attacker can compromise integrity of secure channel in golang.org/x/crypto	v0.0.0-20220511200225-c6db032c6c88	0.17.0	-
golang.org/x/crypto	CVE-2023-48795	medium	-	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	CVE-2026-39827	medium	Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GO-2026-5016	medium	Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	GO-2026-5033	medium	Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	PYSEC-2026-1758	medium	Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	CVE-2026-46598	medium	Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/net	GO-2026-5025	medium	Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html	v0.0.0-20220425223048-2871e0cb64e4	0.55.0	-
golang.org/x/net	GO-2026-5028	medium	Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html	v0.0.0-20220425223048-2871e0cb64e4	0.55.0	-
golang.org/x/net	CVE-2026-25680	medium	Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html	v0.0.0-20220425223048-2871e0cb64e4	-	-
golang.org/x/net	CVE-2026-42506	medium	Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html	v0.0.0-20220425223048-2871e0cb64e4	-	-
golang.org/x/net	CVE-2026-42502	medium	Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html	v0.0.0-20220425223048-2871e0cb64e4	-	-
golang.org/x/net	CVE-2026-27136	medium	Invoking duplicate attributes can cause XSS in golang.org/x/net/html	v0.0.0-20220425223048-2871e0cb64e4	-	-
golang.org/x/net	GO-2026-5029	medium	Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html	v0.0.0-20220425223048-2871e0cb64e4	0.55.0	-
golang.org/x/net	CVE-2026-25681	medium	Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html	v0.0.0-20220425223048-2871e0cb64e4	-	-
golang.org/x/net	GO-2026-5027	medium	Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html	v0.0.0-20220425223048-2871e0cb64e4	0.55.0	-
golang.org/x/net	GO-2026-5030	medium	Invoking duplicate attributes can cause XSS in golang.org/x/net/html	v0.0.0-20220425223048-2871e0cb64e4	0.55.0	-
google.golang.org/grpc	CVE-2026-84303	medium	gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion	v1.43.0	-	-
google.golang.org/grpc	GO-2026-6441	medium	Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc	v1.43.0	1.83.1	-
github.com/Azure/azure-sdk-for-go/sdk/azidentity	GHSA-m5vv-6r4h-3vj9	MODERATE	Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability	v1.0.0	1.6.0-beta.4.0.20240610221955-50774cd97099	-
github.com/aws/aws-sdk-go	GO-2022-0646	MODERATE	CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go	v1.40.56	-	-
github.com/aws/aws-sdk-go	GHSA-f5pg-7wfw-84q9	MODERATE	CBC padding oracle issue in AWS S3 Crypto SDK for golang	v1.40.56	1.34.0	-
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	GO-2026-5764	MODERATE	DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.1.0	1.7.8	-
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	CVE-2026-89090	MODERATE	Denial of service in the event stream header decoder in AWS SDK for Go v2	v1.1.0	-	-
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	GHSA-xmrv-pmrh-hhx2	MODERATE	Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder	v1.1.0	1.7.8	-
github.com/aws/aws-sdk-go-v2/service/lambda	GHSA-xmrv-pmrh-hhx2	MODERATE	Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder	v1.17.0	1.88.5	-
github.com/aws/aws-sdk-go-v2/service/s3	CVE-2026-89090	MODERATE	Denial of service in the event stream header decoder in AWS SDK for Go v2	v1.23.0	-	-
github.com/aws/aws-sdk-go-v2/service/s3	GHSA-xmrv-pmrh-hhx2	MODERATE	Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder	v1.23.0	1.97.3	-
github.com/aws/aws-sdk-go-v2/service/s3	GO-2026-5764	MODERATE	DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.23.0	1.97.3	-
github.com/hashicorp/go-getter	GHSA-jpxj-2jvg-6jv9	MODERATE	Data Amplification in HashiCorp go-getter	v1.6.1	1.7.0	-
github.com/ulikunitz/xz	GHSA-jc7w-c686-c4v9	MODERATE	github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives	v0.5.8	0.5.15	-
golang.org/x/crypto	CVE-2026-39835	MODERATE	Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GHSA-78mq-xcr3-xm33	MODERATE	golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	CVE-2026-39828	MODERATE	Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GO-2026-5014	MODERATE	Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	GHSA-45gg-vh54-h5m9	MODERATE	golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	GO-2026-5015	MODERATE	Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	GHSA-qpw4-5x99-6vjp	MODERATE	golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	GHSA-j5w8-q4qc-rx2x	MODERATE	golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption	v0.0.0-20220511200225-c6db032c6c88	0.45.0	-
golang.org/x/crypto	GHSA-45x7-px36-x8w8	MODERATE	Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin	v0.0.0-20220511200225-c6db032c6c88	0.17.0	-
golang.org/x/crypto	CVE-2025-58181	MODERATE	Unbounded memory consumption in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GO-2025-4134	MODERATE	Unbounded memory consumption in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	0.45.0	-
golang.org/x/crypto	GHSA-9m57-25v3-79x9	MODERATE	golang.org/x/crypto: Invoking pathological inputs can lead to client panic	v0.0.0-20220511200225-c6db032c6c88	0.52.0	-
golang.org/x/crypto	GHSA-f6x5-jh6r-wrfv	MODERATE	golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read	v0.0.0-20220511200225-c6db032c6c88	0.45.0	-
golang.org/x/crypto	CVE-2025-47914	MODERATE	Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GO-2025-4135	MODERATE	Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent	v0.0.0-20220511200225-c6db032c6c88	0.45.0	-
golang.org/x/net	GO-2025-3595	MODERATE	Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net	v0.0.0-20220425223048-2871e0cb64e4	0.38.0	-
golang.org/x/net	CVE-2023-3978	MODERATE	Improper rendering of text nodes in golang.org/x/net/html	v0.0.0-20220425223048-2871e0cb64e4	-	-
golang.org/x/net	GHSA-w4gw-w5jq-g9jh	MODERATE	golang.org/x/net/html has a Quadratic Parsing Complexity issue	v0.0.0-20220425223048-2871e0cb64e4	-	-
golang.org/x/net	GO-2026-4440	MODERATE	Quadratic parsing complexity in golang.org/x/net/html	v0.0.0-20220425223048-2871e0cb64e4	0.45.0	-
golang.org/x/net	GO-2024-2687	MODERATE	HTTP/2 CONTINUATION flood in net/http	v0.0.0-20220425223048-2871e0cb64e4	0.23.0	-
golang.org/x/net	GHSA-4v7x-pqxf-cx7m	MODERATE	net/http, x/net/http2: close connections when receiving too many headers	v0.0.0-20220425223048-2871e0cb64e4	0.23.0	-
golang.org/x/net	GHSA-vvgc-356p-c3xw	MODERATE	golang.org/x/net vulnerable to Cross-site Scripting	v0.0.0-20220425223048-2871e0cb64e4	0.38.0	-
golang.org/x/net	GHSA-5cv4-jp36-h3mw	MODERATE	Go Net HTML parser is vulnerable to denial of service	v0.0.0-20220425223048-2871e0cb64e4	0.55.0	-
golang.org/x/net	GO-2025-3503	MODERATE	HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net	v0.0.0-20220425223048-2871e0cb64e4	0.36.0	-
golang.org/x/net	GHSA-qxp5-gwg8-xv66	MODERATE	HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net	v0.0.0-20220425223048-2871e0cb64e4	0.36.0	-
golang.org/x/net	GHSA-xrjj-mj9h-534m	MODERATE	golang.org/x/net/http2 vulnerable to possible excessive memory growth	v0.0.0-20220425223048-2871e0cb64e4	0.4.0	-
golang.org/x/net	GHSA-qppj-fm5r-hxr3	MODERATE	HTTP/2 Stream Cancellation Attack	v0.0.0-20220425223048-2871e0cb64e4	0.17.0	-
golang.org/x/net	CVE-2022-41717	MODERATE	Excessive memory growth in net/http and golang.org/x/net/http2	v0.0.0-20220425223048-2871e0cb64e4	-	-
golang.org/x/net	GO-2022-1144	MODERATE	Excessive memory growth in net/http and golang.org/x/net/http2	v0.0.0-20220425223048-2871e0cb64e4	0.4.0	-
golang.org/x/net	GO-2023-1988	MODERATE	Improper rendering of text nodes in golang.org/x/net/html	v0.0.0-20220425223048-2871e0cb64e4	0.13.0	-
golang.org/x/net	CVE-2023-44487	MODERATE	-	v0.0.0-20220425223048-2871e0cb64e4	-	-
golang.org/x/net	GHSA-2wrh-6pvc-2jm9	MODERATE	Improper rendering of text nodes in golang.org/x/net/html	v0.0.0-20220425223048-2871e0cb64e4	0.13.0	-
google.golang.org/grpc	GHSA-qc2q-p7wx-3px3	MODERATE	gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion	v1.43.0	1.83.1	-
google.golang.org/protobuf	GHSA-8r3f-844c-mc37	MODERATE	Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON	v1.27.1	1.33.0	-
google.golang.org/protobuf	GO-2024-2611	MODERATE	Infinite loop in JSON unmarshaling in google.golang.org/protobuf	v1.27.1	1.33.0	-
github.com/aws/aws-sdk-go	GHSA-7f33-f4f5-xwgw	LOW	In-band key negotiation issue in AWS S3 Crypto SDK for golang	v1.40.56	1.34.0	-
github.com/aws/aws-sdk-go	GO-2022-0635	LOW	In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go	v1.40.56	-	-
golang.org/x/crypto	GO-2026-5932	unknown	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues	v0.0.0-20220511200225-c6db032c6c88	-	-
golang.org/x/crypto	GO-2024-2961	unknown	Limited directory traversal vulnerability on Windows in golang.org/x/crypto	v0.0.0-20220511200225-c6db032c6c88	0.0.0-20220525230936-793ad666bf5e	-
golang.org/x/crypto	GO-2026-6303	unknown	Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh	v0.0.0-20220511200225-c6db032c6c88	0.55.0	-
golang.org/x/net	GO-2026-4441	unknown	Infinite parsing loop in golang.org/x/net	v0.0.0-20220425223048-2871e0cb64e4	0.45.0	-
golang.org/x/net	GO-2026-5942	unknown	Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage	v0.0.0-20220425223048-2871e0cb64e4	0.56.0	-
golang.org/x/sys	GO-2026-5024	unknown	Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows	v0.0.0-20220517195934-5e4e11fc645e	0.44.0	-
golang.org/x/text	GO-2026-5970	unknown	Infinite loop on invalid input in golang.org/x/text	v0.3.7	0.39.0	-

⚠️ Dependencies that have Reached EOL (15)

Dependency	Unsafe Version	EOL Date	New Version	Path	Case
github.com/Azure/azure-sdk-for-go/sdk/azidentity	`v1.0.0`	-	`v1.14.1`	`examples/programmatic-usage/custom-aws-detonator-terratest/go.mod`	-
github.com/aws/aws-sdk-go	`v1.40.56`	-	`v1.55.8`	`examples/programmatic-usage/custom-aws-detonator-terratest/go.mod`	-
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	`v1.1.0`	-	`v1.7.20`	`examples/programmatic-usage/custom-aws-detonator-terratest/go.mod`	-
github.com/aws/aws-sdk-go-v2/service/lambda	`v1.17.0`	-	`v1.110.0`	`examples/programmatic-usage/custom-aws-detonator-terratest/go.mod`	-
github.com/aws/aws-sdk-go-v2/service/s3	`v1.23.0`	-	`v1.113.4`	`examples/programmatic-usage/custom-aws-detonator-terratest/go.mod`	-
github.com/hashicorp/go-getter	`v1.6.1`	May 19, 2025	`v1.8.9`	`examples/programmatic-usage/custom-aws-detonator-terratest/go.mod`	-
github.com/ulikunitz/xz	`v0.5.8`	-	`v0.5.17`	`examples/programmatic-usage/custom-aws-detonator-terratest/go.mod`	-
golang.org/x/crypto	`v0.0.0-20220511200225-c6db032c6c88`	-	`v0.57.0`	`examples/programmatic-usage/custom-aws-detonator-terratest/go.mod`	-
golang.org/x/net	`v0.0.0-20220425223048-2871e0cb64e4`	-	`v0.59.0`	`examples/programmatic-usage/custom-aws-detonator-terratest/go.mod`	-
golang.org/x/oauth2	`v0.0.0-20211104180415-d3ed0bb246c8`	-	`v0.37.0`	`examples/programmatic-usage/custom-aws-detonator-terratest/go.mod`	-
golang.org/x/sys	`v0.0.0-20220517195934-5e4e11fc645e`	May 17, 2025	`v0.48.0`	`examples/programmatic-usage/custom-aws-detonator-terratest/go.mod`	-
golang.org/x/text	`v0.3.7`	-	`v0.42.0`	`examples/programmatic-usage/custom-aws-detonator-terratest/go.mod`	-
google.golang.org/grpc	`v1.43.0`	-	`v1.83.2`	`examples/programmatic-usage/custom-aws-detonator-terratest/go.mod`	-
google.golang.org/protobuf	`v1.27.1`	-	`v1.36.12`	`examples/programmatic-usage/custom-aws-detonator-terratest/go.mod`	-
gopkg.in/yaml.v3	`v3.0.0-20210107192922-496545a6307b`	-	`v3.0.1`	`examples/programmatic-usage/custom-aws-detonator-terratest/go.mod`	-

Review Checklist

Standard review:

Review changes for compatibility with your code
Check for breaking changes in release notes
Run tests locally or wait for CI
Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

…les/programmatic-usage/custom-aws-detonator-terratest/go.mod]

ADMS: vuln minor upgrades — 15 packages (minor: 13 · patch: 2) [examp…

1b4e1f8

…les/programmatic-usage/custom-aws-detonator-terratest/go.mod]

dd-octo-sts Bot marked this pull request as ready for review September 28, 2026 19:17

dd-octo-sts Bot requested review from a team as code owners September 28, 2026 19:17

gh-worker-campaigns-3e9aa4 Bot closed this Oct 19, 2026

gh-worker-campaigns-3e9aa4 Bot deleted the engraver-auto-version-upgrade/minorpatch/go/programmatic-usage/0-1790579130 branch October 19, 2026 07:00

Navigation Menu

Repository navigation

fix(deps): vuln minor upgrades — 15 packages (minor: 13 · patch: 2) [examples/programmatic-usage/custom-aws-detonator-terratest/go.mod] - #86

fix(deps): vuln minor upgrades — 15 packages (minor: 13 · patch: 2) [examples/programmatic-usage/custom-aws-detonator-terratest/go.mod]#86
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/go/programmatic-usage/0-1790579130

gh-worker-campaigns-3e9aa4 Bot commented Sep 28, 2026 •

edited by dd-octo-sts Bot

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

gh-worker-campaigns-3e9aa4 Bot commented Sep 28, 2026 • edited by dd-octo-sts Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Updates

Security Details

Review Checklist

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

gh-worker-campaigns-3e9aa4 Bot commented Sep 28, 2026 •

edited by dd-octo-sts Bot

Loading