The go 1.18 directive in go.mod now blocks dependency maintenance, and the
cost is visible in the OpenSSF Scorecard: the Vulnerabilities check scores
0 — "13 existing vulnerabilities detected".
Why the floor is the blocker
The vulnerabilities are in the stale indirect modules:
| Module |
Pinned |
Latest |
golang.org/x/net |
v0.35.0 (2025-02-10) |
v0.57.0 |
golang.org/x/text |
v0.22.0 (2025-02-04) |
v0.40.0 |
They cannot be upgraded where they are:
| Version |
Requires |
x/net v0.57.0 |
go 1.25.0 |
x/net v0.38.0 (oldest current line) |
go 1.23.0 |
x/text v0.40.0 |
go 1.25.0 |
Every candidate needs a directive above 1.18, so no amount of dependency
bumping fixes this without raising the floor first.
Worth noting make audit stays green today: govulncheck does reachability
analysis and these are unreachable from this package's code — they arrive
indirectly and test-only via gomega. Scorecard's check is presence-based, not
reachability-based. So this is a hygiene and consumer-perception problem rather
than an exploitable one here, but consumers running presence-based scanners
inherit the noise.
Scope
Compatibility
This is the first non-additive change in a while: v1.20.0, v1.21.0 and v1.22.0
were each verified purely additive with gorelease. Raising the floor drops
support for consumers on older toolchains, so it wants its own release and a
clear note in the release body.
The
go 1.18directive ingo.modnow blocks dependency maintenance, and thecost is visible in the OpenSSF Scorecard: the
Vulnerabilitiescheck scores0 — "13 existing vulnerabilities detected".
Why the floor is the blocker
The vulnerabilities are in the stale indirect modules:
golang.org/x/netgolang.org/x/textThey cannot be upgraded where they are:
x/netv0.57.0go 1.25.0x/netv0.38.0 (oldest current line)go 1.23.0x/textv0.40.0go 1.25.0Every candidate needs a directive above 1.18, so no amount of dependency
bumping fixes this without raising the floor first.
Worth noting
make auditstays green today:govulncheckdoes reachabilityanalysis and these are unreachable from this package's code — they arrive
indirectly and test-only via gomega. Scorecard's check is presence-based, not
reachability-based. So this is a hygiene and consumer-perception problem rather
than an exploitable one here, but consumers running presence-based scanners
inherit the noise.
Scope
godirective (1.25 or 1.26 — decide which)golang.org/x/netandgolang.org/x/textbuild-floorCI job'sgo-versioncopyloopvarandintrangein.golangci.yml— both arecurrently disabled by golangci-lint itself with
"this linter is disabled because the Go version (1.18) of your project is
lower than Go 1.22", and both start applying once the floor moves
ignorerule for gomega. The pinned-dependency guard isonly a comment today, so Dependabot will keep re-proposing a bump that has
been deliberately declined
Compatibility
This is the first non-additive change in a while: v1.20.0, v1.21.0 and v1.22.0
were each verified purely additive with
gorelease. Raising the floor dropssupport for consumers on older toolchains, so it wants its own release and a
clear note in the release body.