A customer scanner has identified 3 CVEs based on our use of Go 1.25.0:
- CVE-2025-61726 - no effect on the tools because they don't parse forms
- CVE-2025-61728 - no effect on the tools because they don't touch ZIP files
- CVE-2025-68121 - no effect on the tools because they don't call the relevant tls package APIs, nor does the Go driver
Go 1.25.7 contains fixes for all of these.