⚠️ GoVulnCheck scan found vulnerabilities:

1. GO-2025-3754
   • Module: github.com/cloudflare/circl
   • Found in: v1.3.7
   • Fixed in: v1.6.1
   • Example Traces:
     1. test/helpers/kubernetesversions/template.go:37:2: kubernetesversions.init calls framework.init, which eventually calls ecc.init
     2. test/helpers/kubernetesversions/template.go:37:2: kubernetesversions.init calls framework.init, which eventually calls ecc.init
     3. test/helpers/kubernetesversions/template.go:37:2: kubernetesversions.init calls framework.init, which eventually calls ecc.init
     4. test/helpers/kubernetesversions/template.go:37:2: kubernetesversions.init calls framework.init, which eventually calls ed25519.init
     5. test/helpers/kubernetesversions/template.go:37:2: kubernetesversions.init calls framework.init, which eventually calls x448.init
2. GO-2025-4123
   • Module: github.com/dvsekhvalnov/jose2go
   • Found in: v1.6.0
   • Fixed in: v1.7.0
   • Example Traces:
     1. pkg/rosa/client.go:51:70: rosa.NewOCMClient calls ocm.Build, which eventually calls keyring.Get
3. GO-2025-3553
   • Module: github.com/golang-jwt/jwt/v4
   • Found in: v4.5.1
   • Fixed in: v4.5.2
   • Example Traces:
     1. pkg/rosa/client.go:51:70: rosa.NewOCMClient calls ocm.Build, which eventually calls authentication.Build
4. GO-2025-3595
   • Module: golang.org/x/net
   • Found in: v0.33.0
   • Fixed in: v0.38.0
   • Example Traces:
     1. pkg/rosa/externalauthproviders.go:52:35: rosa.UpdateExternalAuth calls v1.Send, which eventually calls bluemonday.sanitize

Please review these findings and fix the issues before merging.

Click 'View more details' to see the workflow run and detailed results in the Bulwark repository.