GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

  GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

  GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

  GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

  GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

  GO-2026-5279: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange

  GO-2026-5562: melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

  GO-2026-5968: melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko