https://silo.pgsty.com/tags/dependency/Recent content in Dependency on SILOHugoenSun, 02 Aug 2026 15:22:46 +0800https://silo.pgsty.com/blog/security/cve-2026-32285/Wed, 15 Apr 2026 00:00:00 +0000https://silo.pgsty.com/blog/security/cve-2026-32285/<p><strong>Status:</strong> Closed without a code change<br> <strong>GitHub issue:</strong> <a href="https://github.com/pgsty/minio/issues/26">pgsty/minio#26</a></p> <p>Security maintenance is not always a sequence of “find a vulnerability, then ship a patch.” The initial assessment of CVE-2026-32285 was that the repository might still carry a vulnerable <code>jsonparser</code>; replacing the dependency or maintaining another fork was even considered. Checking the resolved module version and actual reachability changed the conclusion: the tree already used <code>v1.1.2</code>, which contained the fix, and <code>govulncheck</code> found no reachable vulnerable symbol.</p>