New security vulnerabilities found in multiple direct and indirect third-party dependencies
Open
bug
- Dominant language
- Go
- Stars
- 27.4k
- Forks
- 2.4k
- PR merge metrics
- No merged PRs in 30d
Description
### What did you do?
A security check was run on the service which is using go-kit/kit as a third-party dependency.
### What did you expect?
No security vulnerabilities were to be found during the scan.
No vulnerable libraries should be used.
### What happened instead?
Security vulnerabilities were detected on the following libraries used inside of kit:
**direct dependencies:**
- github.com/hashicorp/consul/api v1.20.0
- github.com/nats-io/nats-server/v2 v2.8.4
**indirect dependencies:**
- golang.org/x/net v0.12.0
link between above mentioned _libraries and go-kit/kit_ was established using the `go mod graph` command.
Contributor guide
Assessment
This issue has not been assessed yet.