How to interpret Snyk Fixed In Go versions that aren't released?
I ran the Snyk security scanner to find vulnerabilities in a Go project, which it did, but it seems like the fixed versions reported don't exist, or are not released, yet.
Here are two examples that seem to report fixes in Go 1.56.3, 1.57.1, and 1.58.3, as well as Go 3.24.1, while the highest version at go.dev/dl is 1.23.3.
What do these release numbers refer to, and how would one remediate these findings?
Snyk reports fixes in Go 1.56.3, 1.57.1, and 1.58.3
Snyk reports fixes in Go 3.24.1
Not sure why it's displaying that way, maybe if you click "show more detail", but for the first one at least you need to upgrade google.golang.org/grpc to version 1.56.3, 1.57.1, 1.58.3 or higher (see https://security.snyk.io/vuln/SNYK-GOLANG-GOOGLEGOLANGORGGRPC-5953328).
I'm sure the second one is similar - it's for a specific package, not for the go version itself (e.g. it could be https://security.snyk.io/vuln/SNYK-GOLANG-GOTHETHINGSNETWORKLORAWANSTACKV3PKGWEBUIACCOUNTVIEWSLOGIN-7653732)
- How to use switch type on value of reflect.TypeOf(value)
- Cannot parse BSON datetime from string
- Interface naming convention Golang
- golang glob matches wrong segment path
- Go with Generics: type *T is pointer to type parameter, not type parameter
- Lowercase JSON key names with JSON Marshal in Go
- Pipe character in Golang
- How to get Windows Security Information?
- Hide sensitive fields in Uber Zap go
- Can't import gorilla/mux (github.com/gorilla/mux@v1.7.4: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt)
- VSCode does not do auto formatting on save - Go
- How to set default behavior on delete?
- Can we assume that queries written with clause.Locking are transactional by default?
- Relation "users" does not exist (SQLSTATE 42P01)
- Set-Cookies Header not setting the cookie
- Go Project in IntelliJ Not Resolving Dependencies
- Is it required to assign default value to variable?
- What's the standard Go approach to mapping values from one structure to another
- How to unit test Go errors
- Golang, Buffered Channel and its closing
- Go gmail api quickstart results in localhost refused to connect ERR_CONNECTION_REFUSED
- how to generate multiple uuid and md5 files in golang
- size of a struct in Go without initialising a variable of struct
- Sizeof struct in Go
- Go project not pulling import updates from github
- "unrecognized import path" with go get
- What is the Advantage of sync.WaitGroup over Channels?
- Struct field with multiple const types
- How do I iterate over a go time.Tick channel?
- RabbitMQ: How to requeue message with counter