Package
renovate
Component
stdlib
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Previous location
/usr/lib/renovate/node_modules/.pnpm/@oxlint-tsgolint+linux-arm64@7.0.2003/node_modules/@oxlint-tsgolint/linux-arm64/tsgolintNew location
/usr/lib/renovate/node_modules/.pnpm/@oxlint-tsgolint+linux-arm64@7.0.2004/node_modules/@oxlint-tsgolint/linux-arm64/tsgolintImpact
version-only path change detected during APK rebuild
Status
Impact
CVE-2026-94447 is fixed in Go 1.26.9 and 1.27.2 (https://pkg.go.dev/vuln/GO-2026-6602). tsgolint is a prebuilt Go binary that this package installs, without rebuilding it, from the npm packages @oxlint-tsgolint/linux-x64 and @oxlint-tsgolint/linux-arm64 7.0.2003. It is built with go1.26.8, and only an oxlint-tsgolint rebuild with a fixed Go toolchain can update it. The newest stable release on the npm registry, 7.0.2004 (published 2026-10-10), is still built with go1.26.8. Waiting for an oxlint-tsgolint release built with a fixed Go toolchain.
References: https://nvd.nist.gov/vuln/detail/CVE-2026-94447 https://pkg.go.dev/vuln/GO-2026-6602 https://www.npmjs.com/package/@oxlint-tsgolint/linux-x64 https://www.npmjs.com/package/@oxlint-tsgolint/linux-arm64
Status