No vulnerabilities reported for quic-go@0.40.0 in v3 API #2334

Activity

1. TG1999 commented on Jun 11, 2026

   

   TG1999

   on Jun 11, 2026

   Contributor

   More actions

   @lamppu thanks for bringing this up, golang packag type is not supported as of now in V3, it will be supported in future. Thanks!

   👍React with 👍1Reacted by Johanna Lamppu
2. sschuberth commented on Jul 3, 2026

   

   sschuberth

   on Jul 3, 2026

   More actions

   it will be supported in future.

   Any timeline for that? As API v1 is now gone in the public instance running at version 40.0.0, this is a breaking change for anyone interested in Golang vulnerabilities.
3. TG1999 commented on Jul 16, 2026

   

   TG1999

   on Jul 16, 2026

   Contributor

   More actions

   The current golang PURL type:

   • Uses the import path split into namespace (all but the last segment) and name (last segment).
   • Predates Go modules and therefore cannot reliably distinguish modules from packages in modern Go projects.
   • Works well for older GOPATH-style code but is imperfect for today's module-based ecosystem, where correctly identifying a module often requires consulting go.mod files or a Go module proxy.

   So we will use the current golang spec https://github.com/package-url/purl-spec/blob/main/types/golang-definition.json and will go with the approach of taking last segment of the import path as name and rest as namespace
4. pombredanne

   added this to 00-AboutCodePlanneron Jul 16, 2026
5. TG1999 commented on Jul 18, 2026

   

   TG1999

   on Jul 18, 2026

   Contributor

   More actions

   We will not ingest data from gitlab and github, we will have a new pipeline based on https://github.com/golang/vulndb and the PURL will be formed like this example

   for go.woodpecker-ci.org/woodpecker/v2 : pkg:golang/go.woodpecker-ci.org%2Fwoodpecker/v2
6. pombredanne

   assigned

   TG1999

   on Oct 13, 2026
7. TG1999 commented on Nov 3, 2026

   

   TG1999

   on Nov 3, 2026

   Contributor

   More actions

   WIP #2491

   👀React with 👀1Reacted by Sebastian Schuberth