What is not working as expected?
The project is pinning a vulnerable version of the https://github.com/oras-project/oras-go dependency.
The pinned version is v2.6.0, which is vulnerable to multiple known vulnerabilities (see https://github.com/oras-project/oras-go/security).
What did you expect to happen?
The project should automatically detect and bump up vulnerable dependencies.
How can we reproduce it?
Manually inspecting the go.mod file is enough.
Describe your environment
Cloned and built from git.
What is the version of your Notation CLI or Notation Library?
This was observed in latest (2c82269).
What is not working as expected?
The project is pinning a vulnerable version of the https://github.com/oras-project/oras-go dependency.
The pinned version is
v2.6.0, which is vulnerable to multiple known vulnerabilities (see https://github.com/oras-project/oras-go/security).What did you expect to happen?
The project should automatically detect and bump up vulnerable dependencies.
How can we reproduce it?
Manually inspecting the go.mod file is enough.
Describe your environment
Cloned and built from git.
What is the version of your Notation CLI or Notation Library?
This was observed in latest (2c82269).