Request
Please upgrade the bundled Go dependencies in lark-cli to remediate the CVEs listed below.
Affected release and evidence
- Latest checked release:
v1.0.92 (2026-08-28)
- Affected artifact:
lark-cli-1.0.92-linux-amd64.tar.gz
go version -m reports:
golang.org/x/net v0.33.0golang.org/x/image v0.30.0golang.org/x/text v0.28.0
These versions were detected in Decidex vulnerability scan GALAXY-39266 on 2026-08-28. The scan also reported the affected component as lark-cli.
High severity CVEs
| CVE |
Dependency |
Detected version |
Scanner-reported fixed version |
| CVE-2026-33814 |
golang.org/x/net |
v0.33.0 |
v0.53.0 |
| CVE-2026-39821 |
golang.org/x/net |
v0.33.0 |
v0.55.0 |
| CVE-2026-46600 |
golang.org/x/net |
v0.33.0 |
v0.56.0 |
| CVE-2026-46602 |
golang.org/x/image |
v0.30.0 |
v0.43.0 |
| CVE-2026-56852 |
golang.org/x/text |
v0.28.0 |
v0.39.0 |
Medium severity CVEs
| CVE |
Dependency |
Detected version |
Scanner-reported fixed version |
| CVE-2025-22870 |
golang.org/x/net |
v0.33.0 |
v0.36.0 |
| CVE-2025-22872 |
golang.org/x/net |
v0.33.0 |
v0.38.0 |
| CVE-2025-47911 |
golang.org/x/net |
v0.33.0 |
v0.45.0 |
| CVE-2025-58190 |
golang.org/x/net |
v0.33.0 |
v0.45.0 |
| CVE-2026-25680 |
golang.org/x/net |
v0.33.0 |
v0.55.0 |
| CVE-2026-42502 |
golang.org/x/net |
v0.33.0 |
v0.55.0 |
| CVE-2026-42506 |
golang.org/x/net |
v0.33.0 |
v0.55.0 |
| CVE-2026-33809 |
golang.org/x/image |
v0.30.0 |
v0.38.0 |
| CVE-2026-33812 |
golang.org/x/image |
v0.30.0 |
v0.39.0 |
| CVE-2026-33813 |
golang.org/x/image |
v0.30.0 |
v0.42.0 |
| CVE-2026-42500 |
golang.org/x/image |
v0.30.0 |
v0.41.0 |
| CVE-2026-46599 |
golang.org/x/image |
v0.30.0 |
v0.41.0 |
| CVE-2026-46601 |
golang.org/x/image |
v0.30.0 |
v0.43.0 |
| CVE-2026-46604 |
golang.org/x/image |
v0.30.0 |
v0.43.0 |
Requested action
Please upgrade to secure compatible versions, preferably at least:
golang.org/x/net >= v0.56.0golang.org/x/image >= v0.43.0golang.org/x/text >= v0.39.0
After publishing a new release, we can verify the embedded module versions from the release binaries and rerun the Decidex scan.
Thank you!
Request
Please upgrade the bundled Go dependencies in
lark-clito remediate the CVEs listed below.Affected release and evidence
v1.0.92(2026-08-28)lark-cli-1.0.92-linux-amd64.tar.gzgo version -mreports:golang.org/x/net v0.33.0golang.org/x/image v0.30.0golang.org/x/text v0.28.0These versions were detected in Decidex vulnerability scan
GALAXY-39266on 2026-08-28. The scan also reported the affected component aslark-cli.High severity CVEs
golang.org/x/netgolang.org/x/netgolang.org/x/netgolang.org/x/imagegolang.org/x/textMedium severity CVEs
golang.org/x/netgolang.org/x/netgolang.org/x/netgolang.org/x/netgolang.org/x/netgolang.org/x/netgolang.org/x/netgolang.org/x/imagegolang.org/x/imagegolang.org/x/imagegolang.org/x/imagegolang.org/x/imagegolang.org/x/imagegolang.org/x/imageRequested action
Please upgrade to secure compatible versions, preferably at least:
golang.org/x/net >= v0.56.0golang.org/x/image >= v0.43.0golang.org/x/text >= v0.39.0After publishing a new release, we can verify the embedded module versions from the release binaries and rerun the Decidex scan.
Thank you!