Package · golang
golang.org/x/text
3 images ship it, in 4 versions. Oldest version first. Search its versions.
Not covered
2 images have no package set in the report. Whether they ship this is unknown: amazonlinux:2023, debian:trixie-slim.
v0.38.0
pkg:golang/golang.org/x/text@v0.38.0
| Image | Repository | Package list read from |
|---|---|---|
| platform-tools:latest | ghcr.io/northcutted/images/platform-tools | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
| Advisory | Severity | Fixed in | Images that count it | Suppressed in |
|---|---|---|---|---|
| GO-2026-5970 | high | 0.39.0 | 1 | 0 |
| GO-2026-6629 | high | 0.41.0 | 1 | 0 |
v0.40.0
pkg:golang/golang.org/x/text@v0.40.0
| Image | Repository | Package list read from |
|---|---|---|
| amazonlinux-tools:latest | ghcr.io/northcutted/images/amazonlinux-tools | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
| debian-tools:latest | ghcr.io/northcutted/images/debian-tools | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
| platform-tools:latest | ghcr.io/northcutted/images/platform-tools | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
| Advisory | Severity | Fixed in | Images that count it | Suppressed in |
|---|---|---|---|---|
| GO-2026-6629 | high | 0.41.0 | 3 | 0 |
v0.41.0
pkg:golang/golang.org/x/text@v0.41.0
| Image | Repository | Package list read from |
|---|---|---|
| platform-tools:latest | ghcr.io/northcutted/images/platform-tools | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
v0.42.0
pkg:golang/golang.org/x/text@v0.42.0
| Image | Repository | Package list read from |
|---|---|---|
| platform-tools:latest | ghcr.io/northcutted/images/platform-tools | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
Each image's package list was read from the evidence named, for the platform images listed (its packages are their union). Verified means a trusted signer vouched for all of it; anything else means some of it wasn't verified, so the list may not be complete. Not recorded means the report doesn't say where it came from.