Who, what, why, where, when
| Who | The AI Test Harness 0.1.0 did the work without a person in the loop. A person decides the result; nothing in this run has been merged. |
| What | A scheduled scan of control-plane at 147f74f4edc2, no change under review. 14 of 251 packages carry known vulnerabilities. Tests for github.com/getkin/kin-openapi v0.139.0, github.com/gomarkdown/markdown v0.0.0-20240328165702-4d01890c35c0, github.com/jackc/pgx/v5 v5.8.0, github.com/klauspost/compress v1.18.5, github.com/labstack/echo/v4 v4.15.1, github.com/nats-io/nats-server/v2 v2.12.5, github.com/yuin/goldmark v1.4.13, go.opentelemetry.io/otel v1.43.0, golang.org/x/crypto v0.51.0, golang.org/x/mod v0.35.0, golang.org/x/net v0.53.0, golang.org/x/text v0.37.0, google.golang.org/grpc v1.81.0, oras.land/oras-go/v2 v2.6.0. |
| Why | The risk score decides the budget; the two strongest reasons per package: github.com/getkin/kin-openapi (score 70, budget full): reachable from first-party code; 8 known vulnerabilities for this version. github.com/gomarkdown/markdown (score 55, budget snapshot): reachability unknown, treated as reachable; 4 known vulnerabilities for this version. github.com/jackc/pgx/v5 (score 55, budget snapshot): reachability unknown, treated as reachable; 6 known vulnerabilities for this version. github.com/klauspost/compress (score 45, budget snapshot): reachability unknown, treated as reachable; 1 known vulnerability for this version. github.com/labstack/echo/v4 (score 55, budget snapshot): reachability unknown, treated as reachable; 2 known vulnerabilities for this version. github.com/nats-io/nats-server/v2 (score 45, budget reduced): 22 known vulnerabilities for this version; at least one advisory carries a severity rating. github.com/yuin/goldmark (score 45, budget snapshot): reachability unknown, treated as reachable; 1 known vulnerability for this version. go.opentelemetry.io/otel (score 45, budget snapshot): reachability unknown, treated as reachable; 1 known vulnerability for this version. golang.org/x/crypto (score 65, budget full): reachability unknown, treated as reachable; 30 known vulnerabilities for this version. golang.org/x/mod (score 45, budget snapshot): reachability unknown, treated as reachable; 2 known vulnerabilities for this version. golang.org/x/net (score 55, budget snapshot): reachability unknown, treated as reachable; 8 known vulnerabilities for this version. golang.org/x/text (score 45, budget snapshot): reachability unknown, treated as reachable; 1 known vulnerability for this version. google.golang.org/grpc (score 55, budget snapshot): reachability unknown, treated as reachable; 5 known vulnerabilities for this version. oras.land/oras-go/v2 (score 55, budget snapshot): reachability unknown, treated as reachable; 10 known vulnerabilities for this version. |
| Where | The run's own files are in this folder. |
| When | Started 2026-09-13 20:43:59 UTC. The last stage to write was analysis at 2026-09-13 20:47:30 UTC. |