wagoodman / dive

75 dependencies checked (25 direct), go, via deps.dev. Findings apply only to the packages and versions checked.

• GHSA-pxq6-2prw-chj9 · github.com/docker/docker (direct)Moby has an Off-by-one error in its plugin privilege validationAsk about this findingMODERATE
• GHSA-rg2x-37c3-w2rh · github.com/docker/docker (direct)Docker: Race condition in docker cp allows bind mount redirection to host pathAsk about this findingMODERATE
• GHSA-vp62-88p7-qqf5 · github.com/docker/docker (direct)Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapAsk about this findingMODERATE
• GHSA-x86f-5xw2-fm2r · github.com/docker/docker (direct)Docker: `PUT /containers/{id}/archive` executes container binary on the hostAsk about this findingMODERATE
• GO-2026-4883 · github.com/docker/docker (direct)Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/dockerAsk about this findingMODERATE
• GO-2026-4887 · github.com/docker/docker (direct)Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/dockerAsk about this findingMODERATE
• GO-2026-5617 · github.com/docker/docker (direct)Race condition in 'docker cp' in github.com/docker/docker allows bind mount redirectionAsk about this findingMODERATE
• GO-2026-5668 · github.com/docker/docker (direct)Race condition in 'docker cp' in github.com/docker/docker allows creation of arbitrary filesAsk about this findingMODERATE
• GO-2026-5746 · github.com/docker/docker (direct)Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/dockerAsk about this findingMODERATE

OpenSSF Scorecard · 3.4/10

Checks sorted from strongest to weakest.

• No risky CI workflowsNo dangerous workflow patterns detected10/10
• No binaries in the repositoryNo binaries found in the repo10/10
• License fileLicense file detected10/10
• Code review before mergeFound 12/19 approved changesets6/10
• Pinned dependenciesDependency not pinned by hash detected1/10
• Recent activity0 commits and 0 issue activity found in the last 90 days0/10
• Least-privilege CI tokensDetected GitHub workflow tokens with excessive permissions0/10
• OpenSSF best-practices badgeNo effort to earn an OpenSSF best practices badge detected0/10
• Security policySecurity policy file not detected0/10
• Fuzz testingProject is not fuzzed0/10
• Signed releasesProject has not signed or included provenance with any releases.0/10
• Static analysis on commitsSAST tool is not run on all commits0/10
• Published through a build pipelinePackaging workflow not detectednot scored
• Branch protectionScorecard could not run this check.not scored

License compatibility

Repo license: MIT · 25 deps checked · 0 potential conflicts.