Affected by GO-2026-4588 and 1 other vulnerabilities

GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

pkg/

Details

Path	Synopsis
build
pipelines
sbom Package sbom defines build-time SBOM structures and utilities.	Package sbom defines build-time SBOM structures and utilities.
sbom/spdx Package spdx implements an SPDX SBOM generator for Melange builds.	Package spdx implements an SPDX SBOM generator for Melange builds.
cli
cond
config
container
docker
http