go-kit / go-kit/kit

New security vulnerabilities found in multiple direct and indirect third-party dependencies

Open
#1,280 0 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
Go
Stars
27.4k
Forks
2.4k
PR merge metrics
No merged PRs in 30d

Description

### What did you do?

A security check was run on the service which is using go-kit/kit as a third-party dependency.

### What did you expect?

No security vulnerabilities were to be found during the scan.
No vulnerable libraries should be used.

### What happened instead?

Security vulnerabilities were detected on the following libraries used inside of kit:

**direct dependencies:**
- github.com/hashicorp/consul/api v1.20.0
- github.com/nats-io/nats-server/v2 v2.8.4

**indirect dependencies:**
- golang.org/x/net v0.12.0

link between above mentioned _libraries and go-kit/kit_ was established using the `go mod graph` command.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.