=== Symbol Results ===

Vulnerability #1: GO-2026-6617
    HTTP/2 server crash due to HPACK encoder race in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6617
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
      #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
      #3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
      #4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
      #5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
      #6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
      #7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
      #8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
      #9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
      #10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
      #11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
      #12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
      #13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
      #14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
      #15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
      #16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
      #17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
      #18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
      #19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
      #20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
      #21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
      #22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
      #23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
      #30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
      #31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
      #32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
      #33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
      #38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
      #39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
      #40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
      #41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
      #42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
      #43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
      #44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
      #45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
      #46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
      #47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
      #56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
      #57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
      #62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
      #63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
      #64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
      #65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
      #66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
      #67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
      #68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
      #69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
      #70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
      #71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
      #72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
      #73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
      #74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
      #75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
      #76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
      #77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
      #78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
      #79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
      #80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
      #81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
      #82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
      #83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
      #84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
      #85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
      #86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
      #87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
      #88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
      #89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
      #90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
      #91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
      #92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
      #93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
      #94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
      #95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
      #98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
      #99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
      #100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
      #101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
      #106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
      #107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
      #112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
      #113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
      #116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
      #117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
      #118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
      #119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
      #120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error

Vulnerability #2: GO-2026-6613
    HTTP/1 server connection desynchronization after 2xx CONNECT response in
    net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6613
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.CanonicalHeaderKey
      #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
      #3: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader, which eventually calls http.Header.Del
      #4: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.Header.Get
      #5: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
      #6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
      #7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
      #8: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
      #9: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
      #10: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
      #11: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
      #12: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
      #13: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
      #14: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
      #15: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #16: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #17: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
      #19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
      #20: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #21: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #22: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
      #23: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close, which eventually calls http.expectContinueReader.Close
      #24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
      #25: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
      #26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
      #27: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
      #28: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
      #29: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #30: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
      #32: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #34: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close, which eventually calls http.readTrackingBody.Close
      #35: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
      #36: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #37: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
      #38: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
      #39: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error

Vulnerability #3: GO-2026-6612
    Double flow control refund on HTTP/2 server streams in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6612
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
      #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
      #3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
      #4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
      #5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
      #6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
      #7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
      #8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
      #9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
      #10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
      #11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
      #12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
      #13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
      #14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
      #15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
      #16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
      #17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
      #18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
      #19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
      #20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
      #21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
      #22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
      #23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
      #30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
      #31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
      #32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
      #33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
      #38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
      #39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
      #40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
      #41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
      #42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
      #43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
      #44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
      #45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
      #46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
      #47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
      #56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
      #57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
      #62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
      #63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
      #64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
      #65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
      #66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
      #67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
      #68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
      #69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
      #70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
      #71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
      #72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
      #73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
      #74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
      #75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
      #76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
      #77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
      #78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
      #79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
      #80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
      #81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
      #82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
      #83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
      #84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
      #85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
      #86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
      #87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
      #88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
      #89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
      #90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
      #91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
      #92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
      #93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
      #94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
      #95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
      #98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
      #99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
      #100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
      #101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
      #106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
      #107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
      #112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
      #113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
      #116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
      #117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
      #118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
      #119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
      #120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error

Vulnerability #4: GO-2026-6611
    Excessive CPU consumption from repeated initial window changes in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6611
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
      #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
      #3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
      #4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
      #5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
      #6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
      #7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
      #8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
      #9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
      #10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
      #11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
      #12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
      #13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
      #14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
      #15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
      #16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
      #17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
      #18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
      #19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
      #20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
      #21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
      #22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
      #23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
      #30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
      #31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
      #32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
      #33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
      #38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
      #39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
      #40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
      #41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
      #42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
      #43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
      #44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
      #45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
      #46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
      #47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
      #56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
      #57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
      #62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
      #63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
      #64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
      #65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
      #66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
      #67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
      #68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
      #69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
      #70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
      #71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
      #72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
      #73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
      #74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
      #75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
      #76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
      #77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
      #78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
      #79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
      #80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
      #81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
      #82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
      #83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
      #84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
      #85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
      #86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
      #87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
      #88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
      #89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
      #90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
      #91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
      #92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
      #93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
      #94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
      #95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
      #98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
      #99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
      #100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
      #101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
      #106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
      #107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
      #112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
      #113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
      #116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
      #117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
      #118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
      #119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
      #120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error

Vulnerability #5: GO-2026-6610
    HTTP/2 transport accepts malformed framing-related headers in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6610
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
      #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do

Vulnerability #6: GO-2026-6608
    Memory limit bypass when parsing MIME headers in net/textproto,
    mime/multipart
  More info: https://pkg.go.dev/vuln/GO-2026-6608
  Standard library
    Found in: net/textproto@go1.26
    Fixed in: net/textproto@go1.26.9
    Example traces found:
      #1: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader

Vulnerability #7: GO-2026-6607
    Reject malformed ECH outer extension references in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-6607
  Standard library
    Found in: crypto/tls@go1.26
    Fixed in: crypto/tls@go1.26.9
    Example traces found:
      #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext
      #2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read
      #3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write
      #4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Vulnerability #8: GO-2026-6605
    HTTP/1 client connection desynchronization after CONNECT rejection in
    net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6605
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do

Vulnerability #9: GO-2026-6603
    HTTP/2 server memory exhaustion due to Trailer headers in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6603
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
      #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
      #3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
      #4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
      #5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
      #6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
      #7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
      #8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
      #9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
      #10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
      #11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
      #12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
      #13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
      #14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
      #15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
      #16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
      #17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
      #18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
      #19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
      #20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
      #21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
      #22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
      #23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
      #30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
      #31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
      #32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
      #33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
      #38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
      #39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
      #40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
      #41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
      #42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
      #43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
      #44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
      #45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
      #46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
      #47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
      #56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
      #57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
      #62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
      #63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
      #64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
      #65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
      #66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
      #67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
      #68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
      #69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
      #70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
      #71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
      #72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
      #73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
      #74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
      #75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
      #76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
      #77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
      #78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
      #79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
      #80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
      #81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
      #82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
      #83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
      #84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
      #85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
      #86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
      #87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
      #88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
      #89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
      #90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
      #91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
      #92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
      #93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
      #94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
      #95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
      #98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
      #99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
      #100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
      #101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
      #106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
      #107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
      #112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
      #113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
      #116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
      #117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
      #118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
      #119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
      #120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error

Vulnerability #10: GO-2026-6218
    Avoid quadratic complexity in resolvePath in net/url
  More info: https://pkg.go.dev/vuln/GO-2026-6218
  Standard library
    Found in: net/url@go1.26
    Fixed in: net/url@go1.26.6
    Example traces found:
      #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls url.URL.Parse

Vulnerability #11: GO-2026-6090
    Limit handshake messages we are willing to accept post-handshake in
    crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-6090
  Standard library
    Found in: crypto/tls@go1.26
    Fixed in: crypto/tls@go1.26.6
    Example traces found:
      #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext
      #2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read
      #3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write
      #4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Vulnerability #12: GO-2026-6089
    Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6089
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.6
    Example traces found:
      #1: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS

Vulnerability #13: GO-2026-5972
    Enforce maximum recursion depth in encoding/asn1
  More info: https://pkg.go.dev/vuln/GO-2026-5972
  Standard library
    Found in: encoding/asn1@go1.26
    Fixed in: encoding/asn1@go1.26.6
    Example traces found:
      #1: internal/hub/client.go:48:30: hub.NewClient calls x509.CertPool.AppendCertsFromPEM, which eventually calls asn1.Unmarshal

Vulnerability #14: GO-2026-5856
    Invoking Encrypted Client Hello privacy leak in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-5856
  Standard library
    Found in: crypto/tls@go1.26
    Fixed in: crypto/tls@go1.26.5
    Example traces found:
      #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext
      #2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read
      #3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write
      #4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Vulnerability #15: GO-2026-5039
    Arbitrary inputs are included in errors without any escaping in
    net/textproto
  More info: https://pkg.go.dev/vuln/GO-2026-5039
  Standard library
    Found in: net/textproto@go1.26
    Fixed in: net/textproto@go1.26.4
    Example traces found:
      #1: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader

Vulnerability #16: GO-2026-5037
    Inefficient candidate hostname parsing in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-5037
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.4
    Example traces found:
      #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify
      #2: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.VerifyHostname
      #3: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls x509.HostnameError.Error

Vulnerability #17: GO-2026-5026
    Invoking failure to reject ASCII-only Punycode-encoded labels in
    golang.org/x/net/idna
  More info: https://pkg.go.dev/vuln/GO-2026-5026
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.6
    Example traces found:
      #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do

Vulnerability #18: GO-2026-4971
    Panic in Dial and LookupPort when handling NUL byte on Windows in net
  More info: https://pkg.go.dev/vuln/GO-2026-4971
  Standard library
    Found in: net@go1.26
    Fixed in: net@go1.26.3
    Example traces found:
      #1: internal/storage/watchdog.go:404:22: storage.HostLiveness.Present calls net.DialTimeout
      #2: internal/pbs/probe.go:31:27: pbs.ProbeFingerprint calls net.Dialer.DialContext
      #3: internal/localapi/server.go:617:23: localapi.Server.Run calls net.Listen
      #4: internal/poke/poke.go:133:28: poke.Listener.serve calls net.ListenConfig.ListenPacket
      #5: internal/wgtunnel/manager.go:62:40: wgtunnel.netResolver.LookupIPv4 calls net.Resolver.LookupNetIP

Vulnerability #19: GO-2026-4947
    Unexpected work during chain building in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4947
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.2
    Example traces found:
      #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify

Vulnerability #20: GO-2026-4946
    Inefficient policy validation in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4946
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.2
    Example traces found:
      #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify

Vulnerability #21: GO-2026-4918
    Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in
    net/http/internal/http2 in golang.org/x/net
  More info: https://pkg.go.dev/vuln/GO-2026-4918
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.3
    Example traces found:
      #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do

Vulnerability #22: GO-2026-4870
    Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection
    retention and DoS in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-4870
  Standard library
    Found in: crypto/tls@go1.26
    Fixed in: crypto/tls@go1.26.2
    Example traces found:
      #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext
      #2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read
      #3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write
      #4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Vulnerability #23: GO-2026-4866
    Case-sensitive excludedSubtrees name constraints cause Auth Bypass in
    crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4866
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.2
    Example traces found:
      #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify

Vulnerability #24: GO-2026-4602
    FileInfo can escape from a Root in os
  More info: https://pkg.go.dev/vuln/GO-2026-4602
  Standard library
    Found in: os@go1.26
    Fixed in: os@go1.26.1
    Example traces found:
      #1: internal/storage/netmount.go:512:28: storage.SudoHostOps.MigrateNetworkUnits calls os.ReadDir

Vulnerability #25: GO-2026-4601
    Incorrect parsing of IPv6 host literals in net/url
  More info: https://pkg.go.dev/vuln/GO-2026-4601
  Standard library
    Found in: net/url@go1.26
    Fixed in: net/url@go1.26.1
    Example traces found:
      #1: internal/config/config.go:999:21: config.HubConfig.Validate calls url.Parse
      #2: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS, which eventually calls url.ParseRequestURI
      #3: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls url.URL.Parse

Vulnerability #26: GO-2026-4600
    Panic in name constraint checking for malformed certificates in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4600
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.1
    Example traces found:
      #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify

Vulnerability #27: GO-2026-4599
    Incorrect enforcement of email constraints in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4599
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.1
    Example traces found:
      #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify

Your code is affected by 27 vulnerabilities from the Go standard library.
This scan also found 10 vulnerabilities in packages you import and 13
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
