chore(deps-dev)(deps-dev): bump tailwindcss from 3.4.19 to 4.2.1 in /web

[dependabot]

Bumps tailwindcss from 3.4.19 to 4.2.1.

Release notes

Sourced from tailwindcss's releases.

v4.2.1

Fixed

• Allow trailing dash in functional utility names for backwards compatibility (#19696)
• Properly detect classes containing . characters within curly braces in MDX files (#19711)

v4.2.0

Added

• Add mauve, olive, mist, and taupe color palettes to the default theme (#19627)
• Add @tailwindcss/webpack package to run Tailwind CSS as a webpack plugin (#19610)
• Add pbs-* and pbe-* utilities for padding-block-start and padding-block-end (#19601)
• Add mbs-* and mbe-* utilities for margin-block-start and margin-block-end (#19601)
• Add scroll-pbs-* and scroll-pbe-* utilities for scroll-padding-block-start and scroll-padding-block-end (#19601)
• Add scroll-mbs-* and scroll-mbe-* utilities for scroll-margin-block-start and scroll-margin-block-end (#19601)
• Add border-bs-* and border-be-* utilities for border-block-start and border-block-end (#19601)
• Add inline-*, min-inline-*, max-inline-* utilities for inline-size, min-inline-size, and max-inline-size (#19612)
• Add block-*, min-block-*, max-block-* utilities for block-size, min-block-size, and max-block-size (#19612)
• Add inset-s-*, inset-e-*, inset-bs-*, inset-be-* utilities for inset-inline-start, inset-inline-end, inset-block-start, and inset-block-end (#19613)
• Add font-features-* utility for font-feature-settings (#19623)

Fixed

• Prevent double @supports wrapper for color-mix values (#19450)
• Allow whitespace around @source inline() argument (#19461)
• Emit comment when source maps are saved to files when using @tailwindcss/cli (#19447)
• Detect utilities containing capital letters followed by numbers (#19465)
• Fix class extraction for Rails' strict locals (#19525)
• Align @utility name validation with Oxide scanner rules (#19524)
• Fix infinite loop when using @variant inside @custom-variant (#19633)
• Allow multiples of .25 in aspect-* fractions (e.g. aspect-8.5/11) (#19688)
• Ensure changes to external files listed via @source trigger a full page reload when using @tailwindcss/vite (#19670)
• Improve performance of Oxide scanner in bigger projects by reducing file system walks (#19632)
• Ensure import aliases in Astro v5 work without crashing when using @tailwindcss/vite (#19677)
• Allow escape characters in @utility names to improve support with formatters such as Biome (#19626)
• Fix incorrect canonicalization results when canonicalizing multiple times (#19675)
• Add .jj to default ignored content directories (#19687)

Deprecated

• Deprecate start-* and end-* utilities in favor of inset-s-* and inset-e-* utilities (#19613)

v4.1.18

Fixed

• Ensure validation of source(…) happens relative to the file it is in (#19274)
• Include filename and line numbers in CSS parse errors (#19282)
• Skip comments in Ruby files when checking for class names (#19243)
• Skip over arbitrary property utilities with a top-level ! in the value (#19243)
• Support environment API in @tailwindcss/vite (#18970)

... (truncated)

Changelog

Sourced from tailwindcss's changelog.

[4.2.1] - 2026-02-23

Fixed

• Allow trailing dash in functional utility names for backwards compatibility (#19696)
• Properly detect classes containing . characters within curly braces in MDX files (#19711)

[4.2.0] - 2026-02-18

Added

• Add mauve, olive, mist, and taupe color palettes to the default theme (#19627)
• Add @tailwindcss/webpack package to run Tailwind CSS as a webpack plugin (#19610)
• Add pbs-* and pbe-* utilities for padding-block-start and padding-block-end (#19601)
• Add mbs-* and mbe-* utilities for margin-block-start and margin-block-end (#19601)
• Add scroll-pbs-* and scroll-pbe-* utilities for scroll-padding-block-start and scroll-padding-block-end (#19601)
• Add scroll-mbs-* and scroll-mbe-* utilities for scroll-margin-block-start and scroll-margin-block-end (#19601)
• Add border-bs-* and border-be-* utilities for border-block-start and border-block-end (#19601)
• Add inline-*, min-inline-*, max-inline-* utilities for inline-size, min-inline-size, and max-inline-size (#19612)
• Add block-*, min-block-*, max-block-* utilities for block-size, min-block-size, and max-block-size (#19612)
• Add inset-s-*, inset-e-*, inset-bs-*, inset-be-* utilities for inset-inline-start, inset-inline-end, inset-block-start, and inset-block-end (#19613)
• Add font-features-* utility for font-feature-settings (#19623)

Fixed

• Prevent double @supports wrapper for color-mix values (#19450)
• Allow whitespace around @source inline() argument (#19461)
• Emit comment when source maps are saved to files when using @tailwindcss/cli (#19447)
• Detect utilities containing capital letters followed by numbers (#19465)
• Fix class extraction for Rails' strict locals (#19525)
• Align @utility name validation with Oxide scanner rules (#19524)
• Fix infinite loop when using @variant inside @custom-variant (#19633)
• Allow multiples of .25 in aspect-* fractions (e.g. aspect-8.5/11) (#19688)
• Ensure changes to external files listed via @source trigger a full page reload when using @tailwindcss/vite (#19670)
• Improve performance of Oxide scanner in bigger projects by reducing file system walks (#19632)
• Ensure import aliases in Astro v5 work without crashing when using @tailwindcss/vite (#19677)
• Allow escape characters in @utility names to improve support with formatters such as Biome (#19626)
• Fix incorrect canonicalization results when canonicalizing multiple times (#19675)
• Add .jj to default ignored content directories (#19687)

Deprecated

• Deprecate start-* and end-* utilities in favor of inset-s-* and inset-e-* utilities (#19613)

[4.1.18] - 2025-12-11

Fixed

• Ensure validation of source(…) happens relative to the file it is in (#19274)
• Include filename and line numbers in CSS parse errors (#19282)

... (truncated)

Commits

• 1dce64e 4.2.1 (#19714)
• d15d92c Allow trailing dash in functional utility names (#19696)
• 1b16411 4.2.0 (#19695)
• 6118f4f Fix/misc docs and tests (#19652)
• 5a4a7eb fix(canonicalize): prevent collapse cache pollution across calls (#19675)
• d0a5612 Add mauve, olive, mist, and taupe color palettes (#19627)
• d9fff9f docs: update package README CI badge to main (#19692)
• ed52d3e feat: handle backslash in @utility name (#19626)
• 6eb3b32 Allow multiples of .25 in aspect-* fractions (#19688)
• 8ed67bf Fix Tailwind CSS package README GitHub links (#19644)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for tailwindcss since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, frontend, npm, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

NPM Vulnerability Scan Results - web

Severity	Count
Critical	0
High	3
Moderate	1
Low	0
Total	4

Click to see details

# npm audit report

ajv  <6.14.0
Severity: moderate
ajv has ReDoS when using `$data` option - https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
fix available via `npm audit fix`
node_modules/ajv

flatted  <3.4.0
Severity: high
flatted vulnerable to unbounded recursion DoS in parse() revive phase - https://github.com/advisories/GHSA-25h7-pfq9-p65f
fix available via `npm audit fix`
node_modules/flatted

minimatch  <=3.1.3 || 9.0.0 - 9.0.6
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix`
node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch
node_modules/minimatch

rollup  4.0.0 - 4.58.0
Severity: high
Rollup 4 has Arbitrary File Write via Path Traversal - https://github.com/advisories/GHSA-mw96-cpmx-2vgc
fix available via `npm audit fix`
node_modules/rollup

4 vulnerabilities (1 moderate, 3 high)

To address all issues, run:
  npm audit fix

[github-actions]

NPM Vulnerability Scan Results - e2e

Severity	Count
Critical	0
High	0
Moderate	0
Low	1
Total	1

Click to see details

# npm audit report

qs  6.7.0 - 6.14.1
qs's arrayLimit bypass in comma parsing allows denial of service - https://github.com/advisories/GHSA-w7fw-mjwx-w883
fix available via `npm audit fix`
node_modules/qs

1 low severity vulnerability

To address all issues, run:
  npm audit fix

[github-actions]

Go Vulnerability Scan Results

Found 299 vulnerability/vulnerabilities

Details:

=== Symbol Results ===

Vulnerability #1: GO-2026-4603
URLs in meta content attribute actions are not escaped in html/template
More info: https://pkg.go.dev/vuln/GO-2026-4603
Standard library
Found in: html/template@go1.24.12
Fixed in: html/template@go1.25.8
Example traces found:
#1: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls template.Template.Execute
#2: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls template.Template.ExecuteTemplate

Vulnerability #2: GO-2026-4602
FileInfo can escape from a Root in os
More info: https://pkg.go.dev/vuln/GO-2026-4602
Standard library
Found in: os@go1.24.12
Fixed in: os@go1.25.8
Example traces found:
#1: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls os.ReadDir

Vulnerability #3: GO-2026-4601
Incorrect parsing of IPv6 host literals in net/url
More info: https://pkg.go.dev/vuln/GO-2026-4601
Standard library
Found in: net/url@go1.24.12
Fixed in: net/url@go1.25.8
Example traces found:
#1: internal/api/payment_handlers.go:223:24: api.PaymentHandlers.CreateCheckoutSession calls url.Parse
#2: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls url.ParseRequestURI
#3: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls url.URL.Parse

Vulnerability #4: GO-2026-4394
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH
Hijacking in go.opentelemetry.io/otel/sdk
More info: https://pkg.go.dev/vuln/GO-2026-4394
Module: go.opentelemetry.io/otel/sdk
Found in: go.opentelemetry.io/otel/sdk@v1.38.0
Fixed in: go.opentelemetry.io/otel/sdk@v1.40.0
Example traces found:
#1: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls env.BatchSpanProcessorExportTimeout
#2: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls env.BatchSpanProcessorMaxExportBatchSize
#3: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls env.BatchSpanProcessorMaxQueueSize
#4: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls env.BatchSpanProcessorScheduleDelay
#5: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanAttributeCount
#6: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanAttributeValueLength
#7: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanEventAttributeCount
#8: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanEventCount
#9: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanLinkAttributeCount
#10: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanLinkCount
#11: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which calls env.init
#12: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which calls instrumentation.init
#13: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls resource.Default
#14: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls resource.Default
#15: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls resource.Environment
#16: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls resource.Merge
#17: internal/tracing/tracing.go:71:26: tracing.NewProvider calls resource.New
#18: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which eventually calls resource.NewSchemaless
#19: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls resource.Resource.Equivalent
#20: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls resource.Resource.Iter
#21: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls resource.Resource.SchemaURL
#22: internal/tracing/tracing.go:73:26: tracing.NewProvider calls resource.WithAttributes
#23: internal/tracing/tracing.go:18:2: tracing.init calls resource.init
#24: internal/tracing/tracing.go:236:20: tracing.Provider.Tracer calls trace.TracerProvider.Tracer, which eventually calls sdk.Version
#25: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which calls sdk.init
#26: internal/tracing/tracing.go:100:34: tracing.NewProvider calls trace.AlwaysSample
#27: internal/tracing/tracing.go:102:33: tracing.NewProvider calls trace.NeverSample
#28: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider
#29: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.Shutdown
#30: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.Shutdown
#31: internal/tracing/tracing.go:104:39: tracing.NewProvider calls trace.TraceIDRatioBased
#32: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown
#33: internal/tracing/tracing.go:236:20: tracing.Provider.Tracer calls trace.TracerProvider.Tracer
#34: internal/tracing/tracing.go:112:29: tracing.NewProvider calls trace.WithBatchTimeout
#35: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher
#36: internal/tracing/tracing.go:113:35: tracing.NewProvider calls trace.WithMaxExportBatchSize
#37: internal/tracing/tracing.go:109:24: tracing.NewProvider calls trace.WithResource
#38: internal/tracing/tracing.go:110:23: tracing.NewProvider calls trace.WithSampler
#39: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls trace.errUnsupportedSampler.Error
#40: internal/tracing/tracing.go:19:2: tracing.init calls trace.init
#41: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.init
#42: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.logDropped[go.opentelemetry.io/otel/sdk/trace.Event]
#43: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.logDropped[go.opentelemetry.io/otel/sdk/trace.Link]
#44: internal/tracing/helpers.go:91:15: tracing.AddEvent calls trace.nonRecordingSpan.AddEvent
#45: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls otelhttp.wrappedBody.Close, which calls trace.nonRecordingSpan.End
#46: internal/tracing/helpers.go:77:27: tracing.StartSpan calls noop.Tracer.Start, which calls trace.nonRecordingSpan.IsRecording
#47: internal/tracing/helpers.go:81:20: tracing.StartSpan calls trace.nonRecordingSpan.RecordError
#48: internal/tracing/helpers.go:97:20: tracing.SetAttributes calls trace.nonRecordingSpan.SetAttributes
#49: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls trace.nonRecordingSpan.SetName
#50: internal/tracing/helpers.go:82:18: tracing.StartSpan calls trace.nonRecordingSpan.SetStatus
#51: internal/middleware/tracing.go:55:41: middleware.GetSpanID calls trace.SpanContextFromContext, which calls trace.nonRecordingSpan.SpanContext
#52: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls trace.nonRecordingSpan.TracerProvider
#53: internal/tracing/helpers.go:91:15: tracing.AddEvent calls trace.recordingSpan.AddEvent
#54: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls otelhttp.wrappedBody.Close, which calls trace.recordingSpan.End
#55: internal/tracing/helpers.go:77:27: tracing.StartSpan calls noop.Tracer.Start, which calls trace.recordingSpan.IsRecording
#56: internal/tracing/helpers.go:81:20: tracing.StartSpan calls trace.recordingSpan.RecordError
#57: internal/tracing/helpers.go:97:20: tracing.SetAttributes calls trace.recordingSpan.SetAttributes
#58: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls trace.recordingSpan.SetName
#59: internal/tracing/helpers.go:82:18: tracing.StartSpan calls trace.recordingSpan.SetStatus
#60: internal/middleware/tracing.go:55:41: middleware.GetSpanID calls trace.SpanContextFromContext, which calls trace.recordingSpan.SpanContext
#61: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls trace.recordingSpan.TracerProvider
#62: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls trace.samplerArgParseError.Error
#63: internal/api/stream_handlers.go:1530:15: api.StreamHandlers.LockStream calls errors.Is, which eventually calls trace.samplerArgParseError.Unwrap
#64: internal/tracing/helpers.go:77:27: tracing.StartSpan calls trace.tracer.Start
#65: internal/tracing/tracing.go:121:27: tracing.NewProvider calls otel.SetTextMapPropagator, which eventually calls trace.tracerProviderConfig.MarshalLog
#66: internal/tracing/tracing.go:236:20: tracing.Provider.Tracer calls trace.TracerProvider.Tracer, which eventually calls x.Feature[string].Enabled[string]
#67: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls x.Feature[string].Enabled[string]
#68: internal/tracing/tracing.go:18:2: tracing.init calls resource.init, which calls x.init
#69: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which calls x.init

Vulnerability #5: GO-2026-4337
Unexpected session resumption in crypto/tls
More info: https://pkg.go.dev/vuln/GO-2026-4337
Standard library
Found in: crypto/tls@go1.24.12
Fixed in: crypto/tls@go1.24.13
Example traces found:
#1: internal/stream/quality_metrics_repository.go:209:15: stream.PostgresQualityMetricsRepository.GetParticipantsWithHighPacketLoss calls sql.Rows.Next, which eventually calls tls.Conn.Handshake
#2: internal/indexer/client.go:208:36: indexer.Client.connect calls websocket.Dialer.DialContext, which eventually calls tls.Conn.HandshakeContext
#3: internal/indexer/car.go:102:23: indexer.CARReader.ReadByte calls io.ReadFull, which eventually calls tls.Conn.Read
#4: examples/jwt-rotation-integration.go:45:12: examples.main calls fmt.Printf, which eventually calls tls.Conn.Write
#5: cmd/api/main.go:345:32: api.main calls redis.NewClient, which eventually calls tls.DialWithDialer
#6: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Your code is affected by 5 vulnerabilities from 1 module and the Go standard library.
This scan found no other vulnerabilities in packages you import or modules you
require.
Use '-show verbose' for more details.

[github-actions]

Docker Image Scan Results - Dockerfile.api

Image: subcults-api:scan

Severity	Count
Critical	0
High	1
Medium	3
Low	1
Total	5

Click to see details

Report Summary

┌───────────────────────────────────┬──────────┬─────────────────┬─────────┐
│              Target               │   Type   │ Vulnerabilities │ Secrets │
├───────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ subcults-api:scan (alpine 3.21.6) │  alpine  │        0        │    -    │
├───────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ app/api                           │ gobinary │        5        │    -    │
└───────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


app/api (gobinary)
==================
Total: 5 (LOW: 1, MEDIUM: 3, HIGH: 1, CRITICAL: 0)

┌──────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐
│           Library            │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version  │                            Title                             │
├──────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/pion/dtls/v3      │ CVE-2026-26014 │ MEDIUM   │ fixed  │ v3.0.7            │ 3.1.1, 3.0.11  │ github.com/pion/dtls: Pion DTLS uses random nonce generation │
│                              │                │          │        │                   │                │ with AES GCM ciphers risks...                                │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-26014                   │
├──────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼──────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel/sdk │ CVE-2026-24051 │ HIGH     │        │ v1.38.0           │ 1.40.0         │ OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution  │
│                              │                │          │        │                   │                │ via PATH Hijacking                                           │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-24051                   │
├──────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib                       │ CVE-2026-25679 │ MEDIUM   │        │ v1.24.13          │ 1.25.8, 1.26.1 │ net/url: Incorrect parsing of IPv6 host literals in net/url  │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-25679                   │
│                              ├────────────────┤          │        │                   │                ├──────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-27142 │          │        │                   │                │ html/template: URLs in meta content attribute actions are    │
│                              │                │          │        │                   │                │ not escaped in html/template...                              │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-27142                   │
│                              ├────────────────┼──────────┤        │                   │                ├──────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-27139 │ LOW      │        │                   │                │ os: FileInfo can escape from a Root in golang os module      │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-27139                   │
└──────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────┴──────────────────────────────────────────────────────────────┘