The vulnerability CVE-2022-30427 and CVE-2022-30428 have been fixed, but no specific tag denotes the patched version.

[Silence-worker-02]

Hello, we are a team researching the dependency management mechanism of Golang. During our analysis, we came across your project and noticed that you have fixed a vulnerability (snyk references, CVE: CVE-2022-30427, CWE: CWE-22, fix commit id: 726109f) (snyk references, CVE: CVE-2022-30428, CWE: CWE-22, fix commit id: 726109f). However, we observed that you have not tagged the fixing commit or its subsequent commits. As a result, users are unable to obtain the patch version through Go tool ‘go list’.

We kindly request your assistance in addressing this issue. Tagging the fixing commit or its subsequent commits will greatly benefit users who rely on your project and are seeking the patched version to address the vulnerability.

We greatly appreciate your attention to this matter and collaboration in resolving it. Thank you for your time and for your valuable contributions to our research.