[tannevaled]

The lane this repository gained in #26 caught them in one night

Both advisories were published 2026-11-05 at 22:54 UTC. The nightly sweep went red on 11-06 and again on 11-07 — the first two scheduled runs after publication — and the report it keeps on failure named both. That is the whole purpose of #26, demonstrated rather than argued.

advisory	module	reachable through
GO-2026-6888 (CVE-2026-111497) brotli v1.2.6 → v1.2.7	"a small crafted brotli stream … hundreds of megabytes of allocations per kilobyte of input, leading to denial of service"	session.go:106 engineRender → engine.Engine.RenderWithLinks → brotli.Reader.Read server.go:155 dispatch → brotli.decodeError.Error
GO-2026-6865 (CVE-2026-116591) klauspost/compress v1.18.7 → v1.20.2	panic on two-block frames in fse/huff0	server.go:115 Server.HandlerListener → grpc.NewServer → fse.Decompress, huff0.ReadTable

⛔ The first trace is the render path. brotli.Reader.Read is reached from engineRender — this program decoding a page it fetched. The exact symbol the advisory names, on the job the proxy exists to do, against content nobody here controls. The second pair is the gRPC server's compression. Both are denial of service on untrusted input; both have released fixes.

⛔ And both were // indirect. Renovate has no version string to compare or rewrite for a requirement the module does not declare for itself, so nothing was watching either — the third time this mechanism has hidden a reachable advisory in this repository, after x/net in #26.

Measured

Same tree, same govulncheck, GOOS=linux GOARCH=amd64:

before   2 vulnerabilities, the 4 symbol traces above
after    No vulnerabilities found.   Your code is affected by 0 vulnerabilities.

The lane's own gate run by hand: govulncheck wrote 889 KB of JSON and vulngate exited 0, judging the one remaining finding a notice — required, not called, and its upstream fix is a pseudo-version rather than a release.

Second commit: two dashes, before the shim goes away

Running that gate surfaced a deprecation:

⚠ vulngate: -go now takes two dashes; read as --go. The standard flag package
  accepted one dash and pflag does not. Update the call site: this shim will
  not outlive the next major.

vulngate moved to cobra. ⛔ A warning inside a green lane is a warning nobody reads — it would have become a red night on a major bump, for a reason unrelated to anything this lane measures. And the call site installs vulngate@latest on purpose (a pin inside a run: block is read by no dependency manager and rots: gitsafe carried one 36 minor versions behind), so the removal would have arrived here without a commit of ours.

Verified rather than assumed: --go is accepted, silent, same verdict, same exit status.

Checks

actionlint silent · gofmt clean · go build ./... ok · go vet ./... silent · go test ./... 2 packages ok.

Not in this PR

go-webengine/engine reaches GO-2026-6865 too, in its root and its nested bench module. That repository is claimed by another session; the finding has been sent to them.

🤖 Generated with Claude Code