go: downloading golang.org/x/vuln v0.0.0-20221116204841-fac3670c993c
go: downloading golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e
go: downloading golang.org/x/tools v0.2.1-0.20221108172846-9474ca31d0df
go: downloading golang.org/x/mod v0.6.0
go: downloading golang.org/x/sys v0.1.0
govulncheck is an experimental tool. Share feedback at https://go.dev/s/govulncheck-feedback.

Scanning for dependencies with known vulnerabilities...
Found 4 known vulnerabilities.

Vulnerability #1: GO-2022-1095
  Due to unsanitized NUL values, attackers may be able to
  maliciously set environment variables on Windows. In
  syscall.StartProcess and os/exec.Cmd, invalid environment
  variable values containing NUL values are not properly checked
  for. A malicious environment variable value can exploit this
  behavior to set a value for a different environment variable.
  For example, the environment variable string "A=B\x00C=D" sets
  the variables "A=B" and "C=D".

  Call stacks in your code:
      business/web/auth/auth.go:194:18: github.com/ardanlabs/service/business/web/auth.Auth.opaPolicyEvaluation calls github.com/open-policy-agent/opa/rego.Rego.PrepareForEval, which eventually calls os/exec.Cmd.Start
      foundation/docker/docker.go:49:50: github.com/ardanlabs/service/foundation/docker.StopContainer calls os/exec.Cmd.Run
      foundation/docker/docker.go:62:63: github.com/ardanlabs/service/foundation/docker.DumpContainerLogs calls os/exec.Cmd.CombinedOutput

  Found in: os/exec@go1.19
  Fixed in: os/exec@go1.19.3
  More info: https://pkg.go.dev/vuln/GO-2022-1095

Vulnerability #2: GO-2022-1095
  Due to unsanitized NUL values, attackers may be able to
  maliciously set environment variables on Windows. In
  syscall.StartProcess and os/exec.Cmd, invalid environment
  variable values containing NUL values are not properly checked
  for. A malicious environment variable value can exploit this
  behavior to set a value for a different environment variable.
  For example, the environment variable string "A=B\x00C=D" sets
  the variables "A=B" and "C=D".

  Call stacks in your code:
      business/web/auth/auth.go:194:18: github.com/ardanlabs/service/business/web/auth.Auth.opaPolicyEvaluation calls github.com/open-policy-agent/opa/rego.Rego.PrepareForEval, which eventually calls syscall.StartProcess

  Found in: syscall@go1.19
  Fixed in: syscall@go1.19.3
  More info: https://pkg.go.dev/vuln/GO-2022-1095

Vulnerability #3: GO-2022-1039
  Programs which compile regular expressions from untrusted
  sources may be vulnerable to memory exhaustion or denial of
  service. The parsed regexp representation is linear in the size
  of the input, but in some cases the constant factor can be as
  high as 40,000, making relatively small regexps consume much
  larger amounts of memory. After fix, each regexp being parsed is
  limited to a 256 MB memory footprint. Regular expressions whose
  representation would use more space than that are rejected.
  Normal use of regular expressions is unaffected.

  Call stacks in your code:
      business/sys/validate/validate.go:51:33: github.com/ardanlabs/service/business/sys/validate.init#1 calls regexp.MustCompile, which eventually calls regexp/syntax.Parse

  Found in: regexp/syntax@go1.19
  Fixed in: regexp/syntax@go1.19.2
  More info: https://pkg.go.dev/vuln/GO-2022-1039

Vulnerability #4: GO-2022-1037
  Reader.Read does not set a limit on the maximum size of file
  headers. A maliciously crafted archive could cause Read to
  allocate unbounded amounts of memory, potentially causing
  resource exhaustion or panics. After fix, Reader.Read limits the
  maximum size of header blocks to 1 MiB.

  Call stacks in your code:
      business/web/auth/auth.go:194:18: github.com/ardanlabs/service/business/web/auth.Auth.opaPolicyEvaluation calls github.com/open-policy-agent/opa/rego.Rego.PrepareForEval, which eventually calls archive/tar.Reader.Next

  Found in: archive/tar@go1.19
  Fixed in: archive/tar@go1.19.2
  More info: https://pkg.go.dev/vuln/GO-2022-1037

Vulnerability #5: GO-2022-0969
  HTTP/2 server connections can hang forever waiting for a clean
  shutdown that was preempted by a fatal error. This condition can
  be exploited by a malicious client to cause a denial of service.

  Call stacks in your code:
      app/services/metrics/publisher/expvar/expvar.go:43:38: github.com/ardanlabs/service/app/services/metrics/publisher/expvar.New$1 calls net/http.Server.ListenAndServe
      app/services/sales-api/main.go:204:32: github.com/ardanlabs/service/app/services/sales-api.run$2 calls net/http.ListenAndServe

  Found in: net/http@go1.19
  Fixed in: net/http@go1.19.1
  More info: https://pkg.go.dev/vuln/GO-2022-0969

=== Informational ===

The vulnerabilities below are in packages that you import, but your code
doesn't appear to call any vulnerable functions. You may not need to take any
action. See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
for details.

Vulnerability #1: GO-2022-0988
  JoinPath and URL.JoinPath do not remove ../ path elements
  appended to a relative path. For example,
  JoinPath("https://go.dev", "../go") returns the URL
  "https://go.dev/../go", despite the JoinPath documentation
  stating that ../ path elements are removed from the result.
  Found in: net/url@go1.19
  Fixed in: net/url@go1.19.1
  More info: https://pkg.go.dev/vuln/GO-2022-0988

Exited with code exit status 3
CircleCI received exit code 3