CGA-c9wf-pj5j-cv77

quic-go 0.56.0 removed the logging and metrics packages which kubo depends upon, meaning builds against the fixed version (0.57.1) fail. To remediate this vulnerability, kubo upstream will need to adapt their code to the new quic-go API and cut a release.

Govulncheck found no affected symbols in the scanned Go binaries.