alanprot/prometheus

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 400s

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
• Serious CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
  go.mod
  A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-30204 golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2025-30204). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-42151 github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-42151). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-42154 github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-42154). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-40179 Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-40179). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44903 Prometheus is an open-source monitoring system and time series databas ...
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-44903). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-45337 golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2024-45337). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-22869 golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2025-22869). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-47913 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2025-47913). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39828 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-39828). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39829 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-39829). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39830 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-39830). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39831 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-39831). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39832 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-39832). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39835 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-39835). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-42508 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-42508). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-46595 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-46595). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-46597 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-46597). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-47914 golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2025-47914). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-58181 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2025-58181). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39827 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-39827). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39833 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-39833). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39834 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-39834). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-46598 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
  documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-46598). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2024-45337). Fix: Update that package to its patched version.
• Serious GO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-39833). Fix: Update that package to its patched version.
• Serious GO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-39832). Fix: Update that package to its patched version.
• Serious GO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-39830). Fix: Update that package to its patched version.
• Serious GO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-39831). Fix: Update that package to its patched version.
• Serious GO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-39834). Fix: Update that package to its patched version.
• Serious GO-2026-5021 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-42508). Fix: Update that package to its patched version.
• Serious GO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-46595). Fix: Update that package to its patched version.
• Serious GO-2026-4762 Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/documentation/examples/remote_storage/go.mod
  A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
• Serious GO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/go.mod
  A package you depend on has a known security hole (CVE-2024-45337). Fix: Update that package to its patched version.
• Serious GO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/go.mod
  A package you depend on has a known security hole (CVE-2026-39833). Fix: Update that package to its patched version.
• Serious GO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/go.mod
  A package you depend on has a known security hole (CVE-2026-39832). Fix: Update that package to its patched version.
• Serious GO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/go.mod
  A package you depend on has a known security hole (CVE-2026-39830). Fix: Update that package to its patched version.
• Serious GO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/go.mod
  A package you depend on has a known security hole (CVE-2026-39831). Fix: Update that package to its patched version.
• Serious GO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/go.mod
  A package you depend on has a known security hole (CVE-2026-39834). Fix: Update that package to its patched version.
• Serious GO-2026-5021 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/go.mod
  A package you depend on has a known security hole (CVE-2026-42508). Fix: Update that package to its patched version.
• Serious GO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/go.mod
  A package you depend on has a known security hole (CVE-2026-46595). Fix: Update that package to its patched version.
• Serious GO-2026-4762 Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/go.mod
  A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/web/ui/package-lock.json
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/web/ui/package-lock.json
  A package you depend on has a known security hole (CVE-2026-47429). Fix: Update that package to its patched version.
• Serious GHSA-9crc-q9x8-hgqq Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/web/ui/package-lock.json
  A package you depend on has a known security hole (CVE-2025-24964). Fix: Update that package to its patched version.
• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/web/ui/react-app/package-lock.json
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-wf6x-7x77-mvgw Immutable is vulnerable to Prototype Pollution
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/web/ui/react-app/package-lock.json
  A package you depend on has a known security hole (CVE-2026-29063). Fix: Update that package to its patched version.
• Serious GHSA-87r5-mp6g-5w5j jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/web/ui/react-app/package-lock.json
  A package you depend on has a known security hole (CVE-2026-1615). Fix: Update that package to its patched version.
• Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
  /workdirs/scan-c30f23eb-deb3-4a5e-9005-b3efa7b9483c/web/ui/react-app/package-lock.json
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: go:timeout