chore(deps-dev)(deps-dev): bump @vitejs/plugin-react from 5.1.2 to 6.0.1 in /web

[dependabot]

Bumps @vitejs/plugin-react from 5.1.2 to 6.0.1.

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.0.1

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

plugin-react@6.0.0

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:

 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [


react({



  babel: {



    plugins: ['@babel/plugin-proposal-throw-expressions'],



  },



}),





react(),



babel({



  plugins: ['@babel/plugin-proposal-throw-expressions'],



}),

]
})

For React compiler users, you can use reactCompilerPreset for easier setup with preconfigured filter to improve build performance:

 import { defineConfig } from 'vite'
-import react from '@vitejs/plugin-react'
+import react, { reactCompilerPreset } from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [

react({

 babel: {



   plugins: ['babel-plugin-react-compiler'],



 },


}),


react(),
babel({

 presets: [reactCompilerPreset()]



</tr></table>

... (truncated)

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.0.1 (2026-03-13)

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

6.0.0 (2026-03-12)

6.0.0-beta.0 (2026-03-03)

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:

 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [


react({



  babel: {



    plugins: ['@babel/plugin-proposal-throw-expressions'],



  },



}),





react(),



babel({



  plugins: ['@babel/plugin-proposal-throw-expressions'],



}),

]
})

For React compiler users, you can use reactCompilerPreset for easier setup with preconfigured filter to improve build performance:

 import { defineConfig } from 'vite'
-import react from '@vitejs/plugin-react'
+import react, { reactCompilerPreset } from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [

react({

 babel: {



   plugins: ['babel-plugin-react-compiler'],



 },



</tr></table>

... (truncated)

Commits

• 1e94c06 release: plugin-react@6.0.1
• 77c00c0 feat(plugin-react): expand @rolldown/plugin-babel peer dep range (#1146)
• dcc9012 release: plugin-react@6.0.0
• 3a17886 docs: add a link to the Oxlint rule for component exports alongside the ESLin...
• f812135 fix(deps): update all non-major dependencies (#1140)
• a0329a0 docs(react): clarify react compiler preset filter (#1137)
• 704e0d3 release: plugin-react@6.0.0-beta.0
• ac16acc feat(react)!: remove babel (#1123)
• f01b30c fix(deps): update all non-major dependencies (#1127)
• b1014bd chore(react): add changelog for #1124
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, frontend, npm, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Go Vulnerability Scan Results

Found 299 vulnerability/vulnerabilities

Details:

=== Symbol Results ===

Vulnerability #1: GO-2026-4603
URLs in meta content attribute actions are not escaped in html/template
More info: https://pkg.go.dev/vuln/GO-2026-4603
Standard library
Found in: html/template@go1.24.12
Fixed in: html/template@go1.25.8
Example traces found:
#1: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls template.Template.Execute
#2: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls template.Template.ExecuteTemplate

Vulnerability #2: GO-2026-4602
FileInfo can escape from a Root in os
More info: https://pkg.go.dev/vuln/GO-2026-4602
Standard library
Found in: os@go1.24.12
Fixed in: os@go1.25.8
Example traces found:
#1: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls os.ReadDir

Vulnerability #3: GO-2026-4601
Incorrect parsing of IPv6 host literals in net/url
More info: https://pkg.go.dev/vuln/GO-2026-4601
Standard library
Found in: net/url@go1.24.12
Fixed in: net/url@go1.25.8
Example traces found:
#1: internal/api/payment_handlers.go:223:24: api.PaymentHandlers.CreateCheckoutSession calls url.Parse
#2: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls url.ParseRequestURI
#3: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls url.URL.Parse

Vulnerability #4: GO-2026-4394
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH
Hijacking in go.opentelemetry.io/otel/sdk
More info: https://pkg.go.dev/vuln/GO-2026-4394
Module: go.opentelemetry.io/otel/sdk
Found in: go.opentelemetry.io/otel/sdk@v1.38.0
Fixed in: go.opentelemetry.io/otel/sdk@v1.40.0
Example traces found:
#1: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls env.BatchSpanProcessorExportTimeout
#2: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls env.BatchSpanProcessorMaxExportBatchSize
#3: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls env.BatchSpanProcessorMaxQueueSize
#4: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls env.BatchSpanProcessorScheduleDelay
#5: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanAttributeCount
#6: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanAttributeValueLength
#7: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanEventAttributeCount
#8: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanEventCount
#9: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanLinkAttributeCount
#10: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls env.SpanLinkCount
#11: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which calls env.init
#12: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which calls instrumentation.init
#13: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls resource.Default
#14: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls resource.Default
#15: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls resource.Environment
#16: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider, which eventually calls resource.Merge
#17: internal/tracing/tracing.go:71:26: tracing.NewProvider calls resource.New
#18: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which eventually calls resource.NewSchemaless
#19: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls resource.Resource.Equivalent
#20: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls resource.Resource.Iter
#21: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher, which eventually calls resource.Resource.SchemaURL
#22: internal/tracing/tracing.go:73:26: tracing.NewProvider calls resource.WithAttributes
#23: internal/tracing/tracing.go:18:2: tracing.init calls resource.init
#24: internal/tracing/tracing.go:236:20: tracing.Provider.Tracer calls trace.TracerProvider.Tracer, which eventually calls sdk.Version
#25: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which calls sdk.init
#26: internal/tracing/tracing.go:100:34: tracing.NewProvider calls trace.AlwaysSample
#27: internal/tracing/tracing.go:102:33: tracing.NewProvider calls trace.NeverSample
#28: internal/tracing/tracing.go:108:34: tracing.NewProvider calls trace.NewTracerProvider
#29: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.Shutdown
#30: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.Shutdown
#31: internal/tracing/tracing.go:104:39: tracing.NewProvider calls trace.TraceIDRatioBased
#32: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown
#33: internal/tracing/tracing.go:236:20: tracing.Provider.Tracer calls trace.TracerProvider.Tracer
#34: internal/tracing/tracing.go:112:29: tracing.NewProvider calls trace.WithBatchTimeout
#35: internal/tracing/tracing.go:111:23: tracing.NewProvider calls trace.WithBatcher
#36: internal/tracing/tracing.go:113:35: tracing.NewProvider calls trace.WithMaxExportBatchSize
#37: internal/tracing/tracing.go:109:24: tracing.NewProvider calls trace.WithResource
#38: internal/tracing/tracing.go:110:23: tracing.NewProvider calls trace.WithSampler
#39: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls trace.errUnsupportedSampler.Error
#40: internal/tracing/tracing.go:19:2: tracing.init calls trace.init
#41: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.init
#42: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.logDropped[go.opentelemetry.io/otel/sdk/trace.Event]
#43: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls http.http2requestBody.Close, which eventually calls trace.logDropped[go.opentelemetry.io/otel/sdk/trace.Link]
#44: internal/tracing/helpers.go:91:15: tracing.AddEvent calls trace.nonRecordingSpan.AddEvent
#45: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls otelhttp.wrappedBody.Close, which calls trace.nonRecordingSpan.End
#46: internal/tracing/helpers.go:77:27: tracing.StartSpan calls noop.Tracer.Start, which calls trace.nonRecordingSpan.IsRecording
#47: internal/tracing/helpers.go:81:20: tracing.StartSpan calls trace.nonRecordingSpan.RecordError
#48: internal/tracing/helpers.go:97:20: tracing.SetAttributes calls trace.nonRecordingSpan.SetAttributes
#49: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls trace.nonRecordingSpan.SetName
#50: internal/tracing/helpers.go:82:18: tracing.StartSpan calls trace.nonRecordingSpan.SetStatus
#51: internal/middleware/tracing.go:55:41: middleware.GetSpanID calls trace.SpanContextFromContext, which calls trace.nonRecordingSpan.SpanContext
#52: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls trace.nonRecordingSpan.TracerProvider
#53: internal/tracing/helpers.go:91:15: tracing.AddEvent calls trace.recordingSpan.AddEvent
#54: internal/health/livekit.go:48:1: health.LiveKitChecker.HealthCheck calls otelhttp.wrappedBody.Close, which calls trace.recordingSpan.End
#55: internal/tracing/helpers.go:77:27: tracing.StartSpan calls noop.Tracer.Start, which calls trace.recordingSpan.IsRecording
#56: internal/tracing/helpers.go:81:20: tracing.StartSpan calls trace.recordingSpan.RecordError
#57: internal/tracing/helpers.go:97:20: tracing.SetAttributes calls trace.recordingSpan.SetAttributes
#58: cmd/api/main.go:1310:34: api.main calls http.Server.ListenAndServe, which eventually calls trace.recordingSpan.SetName
#59: internal/tracing/helpers.go:82:18: tracing.StartSpan calls trace.recordingSpan.SetStatus
#60: internal/middleware/tracing.go:55:41: middleware.GetSpanID calls trace.SpanContextFromContext, which calls trace.recordingSpan.SpanContext
#61: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls trace.recordingSpan.TracerProvider
#62: internal/indexer/repository.go:235:34: indexer.PostgresRecordRepository.DeleteRecord calls trace.samplerArgParseError.Error
#63: internal/api/stream_handlers.go:1530:15: api.StreamHandlers.LockStream calls errors.Is, which eventually calls trace.samplerArgParseError.Unwrap
#64: internal/tracing/helpers.go:77:27: tracing.StartSpan calls trace.tracer.Start
#65: internal/tracing/tracing.go:121:27: tracing.NewProvider calls otel.SetTextMapPropagator, which eventually calls trace.tracerProviderConfig.MarshalLog
#66: internal/tracing/tracing.go:225:25: tracing.Provider.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls x.Feature[string].Enabled[string]
#67: internal/tracing/tracing.go:236:20: tracing.Provider.Tracer calls trace.TracerProvider.Tracer, which eventually calls x.Feature[string].Enabled[string]
#68: internal/tracing/tracing.go:18:2: tracing.init calls resource.init, which calls x.init
#69: internal/tracing/tracing.go:19:2: tracing.init calls trace.init, which calls x.init

Vulnerability #5: GO-2026-4337
Unexpected session resumption in crypto/tls
More info: https://pkg.go.dev/vuln/GO-2026-4337
Standard library
Found in: crypto/tls@go1.24.12
Fixed in: crypto/tls@go1.24.13
Example traces found:
#1: internal/stream/quality_metrics_repository.go:209:15: stream.PostgresQualityMetricsRepository.GetParticipantsWithHighPacketLoss calls sql.Rows.Next, which eventually calls tls.Conn.Handshake
#2: internal/indexer/client.go:208:36: indexer.Client.connect calls websocket.Dialer.DialContext, which eventually calls tls.Conn.HandshakeContext
#3: internal/indexer/car.go:102:23: indexer.CARReader.ReadByte calls io.ReadFull, which eventually calls tls.Conn.Read
#4: examples/jwt-rotation-integration.go:45:12: examples.main calls fmt.Printf, which eventually calls tls.Conn.Write
#5: cmd/api/main.go:345:32: api.main calls redis.NewClient, which eventually calls tls.DialWithDialer
#6: internal/health/livekit.go:44:25: health.LiveKitChecker.HealthCheck calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Your code is affected by 5 vulnerabilities from 1 module and the Go standard library.
This scan found no other vulnerabilities in packages you import or modules you
require.
Use '-show verbose' for more details.

[github-actions]

Docker Image Scan Results - Dockerfile.indexer

Image: subcults-indexer:scan

Severity	Count
Critical	0
High	1
Medium	2
Low	1
Total	4

Click to see details

Report Summary

┌──────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│                Target                │   Type   │ Vulnerabilities │ Secrets │
├──────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ subcults-indexer:scan (debian 12.13) │  debian  │        0        │    -    │
├──────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ app/indexer                          │ gobinary │        4        │    -    │
└──────────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


app/indexer (gobinary)
======================
Total: 4 (LOW: 1, MEDIUM: 2, HIGH: 1, CRITICAL: 0)

┌──────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬─────────────────────────────────────────────────────────────┐
│           Library            │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version  │                            Title                            │
├──────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────┼─────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel/sdk │ CVE-2026-24051 │ HIGH     │ fixed  │ v1.38.0           │ 1.40.0         │ OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution │
│                              │                │          │        │                   │                │ via PATH Hijacking                                          │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-24051                  │
├──────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼─────────────────────────────────────────────────────────────┤
│ stdlib                       │ CVE-2026-25679 │ MEDIUM   │        │ v1.24.13          │ 1.25.8, 1.26.1 │ net/url: Incorrect parsing of IPv6 host literals in net/url │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-25679                  │
│                              ├────────────────┤          │        │                   │                ├─────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-27142 │          │        │                   │                │ html/template: URLs in meta content attribute actions are   │
│                              │                │          │        │                   │                │ not escaped in html/template...                             │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-27142                  │
│                              ├────────────────┼──────────┤        │                   │                ├─────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-27139 │ LOW      │        │                   │                │ os: FileInfo can escape from a Root in golang os module     │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-27139                  │
└──────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────┴─────────────────────────────────────────────────────────────┘

[github-actions]

Docker Image Scan Results - Dockerfile.api

Image: subcults-api:scan

Severity	Count
Critical	0
High	1
Medium	3
Low	1
Total	5

Click to see details

Report Summary

┌───────────────────────────────────┬──────────┬─────────────────┬─────────┐
│              Target               │   Type   │ Vulnerabilities │ Secrets │
├───────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ subcults-api:scan (alpine 3.21.6) │  alpine  │        0        │    -    │
├───────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ app/api                           │ gobinary │        5        │    -    │
└───────────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


app/api (gobinary)
==================
Total: 5 (LOW: 1, MEDIUM: 3, HIGH: 1, CRITICAL: 0)

┌──────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐
│           Library            │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version  │                            Title                             │
├──────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/pion/dtls/v3      │ CVE-2026-26014 │ MEDIUM   │ fixed  │ v3.0.7            │ 3.1.1, 3.0.11  │ github.com/pion/dtls: Pion DTLS uses random nonce generation │
│                              │                │          │        │                   │                │ with AES GCM ciphers risks...                                │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-26014                   │
├──────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼──────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel/sdk │ CVE-2026-24051 │ HIGH     │        │ v1.38.0           │ 1.40.0         │ OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution  │
│                              │                │          │        │                   │                │ via PATH Hijacking                                           │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-24051                   │
├──────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib                       │ CVE-2026-25679 │ MEDIUM   │        │ v1.24.13          │ 1.25.8, 1.26.1 │ net/url: Incorrect parsing of IPv6 host literals in net/url  │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-25679                   │
│                              ├────────────────┤          │        │                   │                ├──────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-27142 │          │        │                   │                │ html/template: URLs in meta content attribute actions are    │
│                              │                │          │        │                   │                │ not escaped in html/template...                              │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-27142                   │
│                              ├────────────────┼──────────┤        │                   │                ├──────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-27139 │ LOW      │        │                   │                │ os: FileInfo can escape from a Root in golang os module      │
│                              │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-27139                   │
└──────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────┴──────────────────────────────────────────────────────────────┘