# govulncheck, default build

Generated: 2026-09-19T06:06:32Z
Commit: f404f34b623be86434dcfa029e594f4d1943a8b4

=== Symbol Results ===

Vulnerability #1: GO-2026-6452
    Panic via negative shared-string index in github.com/xuri/excelize
  More info: https://pkg.go.dev/vuln/GO-2026-6452
  Module: github.com/xuri/excelize/v2
    Found in: github.com/xuri/excelize/v2@v2.11.0
    Fixed in: N/A
    Example traces found:
      #1: internal/app/contact/import.go:808:28: contact.parseSpreadsheetInner calls excelize.Rows.Columns

Vulnerability #2: GO-2026-5048
    Denial of service via unbounded map allocations in
    github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2
  More info: https://pkg.go.dev/vuln/GO-2026-5048
  Module: github.com/hamba/avro/v2
    Found in: github.com/hamba/avro/v2@v2.31.0
    Fixed in: N/A
    Example traces found:
      #1: internal/app/contact/export.go:348:2: contact.writeXLSX calls excelize.File.Close, which eventually calls avro.AddAll
      #2: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.ArraySchema.Type
      #3: internal/cli/iostreams/iostreams.go:172:14: iostreams.IOStreams.Secret calls fmt.Fprintln, which eventually calls avro.EnumSchema.String
      #4: internal/models/event_schema.go:279:42: models.zeroDefault calls avro.EnumSchema.Symbols
      #5: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.EnumSchema.Type
      #6: internal/models/event_schema.go:301:12: models.zeroDefault calls avro.Field.Name
      #7: internal/models/event_schema.go:297:31: models.zeroDefault calls avro.Field.Type
      #8: internal/models/event_schema.go:277:59: models.zeroDefault calls avro.FixedSchema.Size
      #9: internal/cli/iostreams/iostreams.go:172:14: iostreams.IOStreams.Secret calls fmt.Fprintln, which eventually calls avro.FixedSchema.String
      #10: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.FixedSchema.Type
      #11: internal/repository/pg_email.go:1654:26: repository.emailRepository.SetSendIdentity calls json.Marshal, which eventually calls avro.Freeze
      #12: internal/repository/pg_email.go:1654:26: repository.emailRepository.SetSendIdentity calls json.Marshal, which eventually calls avro.Freeze
      #13: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.MapSchema.Type
      #14: internal/models/event_schema.go:173:29: models.schemaOf calls avro.NewArraySchema
      #15: internal/models/event_schema.go:224:30: models.recordSchema calls avro.NewField
      #16: internal/models/event_schema.go:159:30: models.schemaOf calls avro.NewFixedSchema
      #17: internal/models/event_schema.go:182:27: models.schemaOf calls avro.NewMapSchema
      #18: internal/models/event_schema.go:136:75: models.schemaOf calls avro.NewPrimitiveLogicalSchema
      #19: internal/models/event_schema.go:136:33: models.schemaOf calls avro.NewPrimitiveSchema
      #20: internal/models/event_schema.go:234:37: models.recordSchema calls avro.NewRecordSchema
      #21: internal/models/event_schema.go:326:27: models.reference calls avro.NewRefSchema
      #22: internal/models/event_schema.go:131:29: models.schemaOf calls avro.NewUnionSchema
      #23: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.NullSchema.Type
      #24: internal/models/event_schema_document.go:40:25: models.SchemaDocument calls avro.Parse
      #25: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.PrimitiveSchema.Type
      #26: internal/models/event_schema.go:296:50: models.zeroDefault calls avro.RecordSchema.Fields
      #27: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.RecordSchema.Type
      #28: internal/models/event_schema.go:293:48: models.zeroDefault calls avro.RefSchema.Schema
      #29: internal/cli/iostreams/iostreams.go:172:14: iostreams.IOStreams.Secret calls fmt.Fprintln, which eventually calls avro.RefSchema.String
      #30: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.RefSchema.Type
      #31: internal/models/event_schema.go:98:16: models.envelopeSchema calls avro.Register
      #32: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.UnionSchema.Type
      #33: internal/models/event_schema.go:287:39: models.zeroDefault calls avro.UnionSchema.Types
      #34: internal/models/event_schema.go:222:40: models.recordSchema calls avro.WithDefault
      #35: internal/models/event_schema.go:12:2: models.init calls avro.init
      #36: internal/repository/pg_contact.go:3081:26: repository.contactRepository.ExportAll calls strings.TrimSpace, which eventually calls avro.invalidNameFirstChar
      #37: internal/repository/pg_contact.go:3081:26: repository.contactRepository.ExportAll calls strings.TrimSpace, which eventually calls avro.invalidNameOtherChar
      #38: internal/models/event_schema.go:98:32: models.envelopeSchema calls avro.name.FullName
      #39: goog.getAddressList calls strings.splitSeq, which calls avro.newName
      #40: goog.getAddressList calls strings.splitSeq, which calls avro.newName

Vulnerability #3: GO-2026-5047
    Integer overflow in Avro decoder in github.com/iskorotkov/avro/v2 and
    github.com/hamba/avro/v2
  More info: https://pkg.go.dev/vuln/GO-2026-5047
  Module: github.com/hamba/avro/v2
    Found in: github.com/hamba/avro/v2@v2.31.0
    Fixed in: N/A
    Example traces found:
      #1: internal/app/contact/export.go:348:2: contact.writeXLSX calls excelize.File.Close, which eventually calls avro.AddAll
      #2: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.ArraySchema.Type
      #3: internal/cli/iostreams/iostreams.go:172:14: iostreams.IOStreams.Secret calls fmt.Fprintln, which eventually calls avro.EnumSchema.String
      #4: internal/models/event_schema.go:279:42: models.zeroDefault calls avro.EnumSchema.Symbols
      #5: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.EnumSchema.Type
      #6: internal/models/event_schema.go:301:12: models.zeroDefault calls avro.Field.Name
      #7: internal/models/event_schema.go:297:31: models.zeroDefault calls avro.Field.Type
      #8: internal/models/event_schema.go:277:59: models.zeroDefault calls avro.FixedSchema.Size
      #9: internal/cli/iostreams/iostreams.go:172:14: iostreams.IOStreams.Secret calls fmt.Fprintln, which eventually calls avro.FixedSchema.String
      #10: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.FixedSchema.Type
      #11: internal/repository/pg_email.go:1654:26: repository.emailRepository.SetSendIdentity calls json.Marshal, which eventually calls avro.Freeze
      #12: internal/repository/pg_email.go:1654:26: repository.emailRepository.SetSendIdentity calls json.Marshal, which eventually calls avro.Freeze
      #13: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.MapSchema.Type
      #14: internal/models/event_schema.go:173:29: models.schemaOf calls avro.NewArraySchema
      #15: internal/models/event_schema.go:224:30: models.recordSchema calls avro.NewField
      #16: internal/models/event_schema.go:159:30: models.schemaOf calls avro.NewFixedSchema
      #17: internal/models/event_schema.go:182:27: models.schemaOf calls avro.NewMapSchema
      #18: internal/models/event_schema.go:136:75: models.schemaOf calls avro.NewPrimitiveLogicalSchema
      #19: internal/models/event_schema.go:136:33: models.schemaOf calls avro.NewPrimitiveSchema
      #20: internal/models/event_schema.go:234:37: models.recordSchema calls avro.NewRecordSchema
      #21: internal/models/event_schema.go:326:27: models.reference calls avro.NewRefSchema
      #22: internal/models/event_schema.go:131:29: models.schemaOf calls avro.NewUnionSchema
      #23: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.NullSchema.Type
      #24: internal/models/event_schema_document.go:40:25: models.SchemaDocument calls avro.Parse
      #25: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.PrimitiveSchema.Type
      #26: internal/models/event_schema.go:296:50: models.zeroDefault calls avro.RecordSchema.Fields
      #27: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.RecordSchema.Type
      #28: internal/models/event_schema.go:293:48: models.zeroDefault calls avro.RefSchema.Schema
      #29: internal/cli/iostreams/iostreams.go:172:14: iostreams.IOStreams.Secret calls fmt.Fprintln, which eventually calls avro.RefSchema.String
      #30: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.RefSchema.Type
      #31: internal/models/event_schema.go:98:16: models.envelopeSchema calls avro.Register
      #32: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.UnionSchema.Type
      #33: internal/models/event_schema.go:287:39: models.zeroDefault calls avro.UnionSchema.Types
      #34: internal/models/event_schema.go:222:40: models.recordSchema calls avro.WithDefault
      #35: internal/models/event_schema.go:12:2: models.init calls avro.init
      #36: internal/repository/pg_contact.go:3081:26: repository.contactRepository.ExportAll calls strings.TrimSpace, which eventually calls avro.invalidNameFirstChar
      #37: internal/repository/pg_contact.go:3081:26: repository.contactRepository.ExportAll calls strings.TrimSpace, which eventually calls avro.invalidNameOtherChar
      #38: internal/models/event_schema.go:98:32: models.envelopeSchema calls avro.name.FullName
      #39: goog.getAddressList calls strings.splitSeq, which calls avro.newName
      #40: goog.getAddressList calls strings.splitSeq, which calls avro.newName

Vulnerability #4: GO-2026-5046
    CPU exhaustion in Avro decoder in github.com/iskorotkov/avro/v2 and
    github.com/hamba/avro/v2
  More info: https://pkg.go.dev/vuln/GO-2026-5046
  Module: github.com/hamba/avro/v2
    Found in: github.com/hamba/avro/v2@v2.31.0
    Fixed in: N/A
    Example traces found:
      #1: internal/app/contact/export.go:348:2: contact.writeXLSX calls excelize.File.Close, which eventually calls avro.AddAll
      #2: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.ArraySchema.Type
      #3: internal/cli/iostreams/iostreams.go:172:14: iostreams.IOStreams.Secret calls fmt.Fprintln, which eventually calls avro.EnumSchema.String
      #4: internal/models/event_schema.go:279:42: models.zeroDefault calls avro.EnumSchema.Symbols
      #5: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.EnumSchema.Type
      #6: internal/models/event_schema.go:301:12: models.zeroDefault calls avro.Field.Name
      #7: internal/models/event_schema.go:297:31: models.zeroDefault calls avro.Field.Type
      #8: internal/models/event_schema.go:277:59: models.zeroDefault calls avro.FixedSchema.Size
      #9: internal/cli/iostreams/iostreams.go:172:14: iostreams.IOStreams.Secret calls fmt.Fprintln, which eventually calls avro.FixedSchema.String
      #10: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.FixedSchema.Type
      #11: internal/repository/pg_email.go:1654:26: repository.emailRepository.SetSendIdentity calls json.Marshal, which eventually calls avro.Freeze
      #12: internal/repository/pg_email.go:1654:26: repository.emailRepository.SetSendIdentity calls json.Marshal, which eventually calls avro.Freeze
      #13: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.MapSchema.Type
      #14: internal/models/event_schema.go:173:29: models.schemaOf calls avro.NewArraySchema
      #15: internal/models/event_schema.go:224:30: models.recordSchema calls avro.NewField
      #16: internal/models/event_schema.go:159:30: models.schemaOf calls avro.NewFixedSchema
      #17: internal/models/event_schema.go:182:27: models.schemaOf calls avro.NewMapSchema
      #18: internal/models/event_schema.go:136:75: models.schemaOf calls avro.NewPrimitiveLogicalSchema
      #19: internal/models/event_schema.go:136:33: models.schemaOf calls avro.NewPrimitiveSchema
      #20: internal/models/event_schema.go:234:37: models.recordSchema calls avro.NewRecordSchema
      #21: internal/models/event_schema.go:326:27: models.reference calls avro.NewRefSchema
      #22: internal/models/event_schema.go:131:29: models.schemaOf calls avro.NewUnionSchema
      #23: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.NullSchema.Type
      #24: internal/models/event_schema_document.go:40:25: models.SchemaDocument calls avro.Parse
      #25: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.PrimitiveSchema.Type
      #26: internal/models/event_schema.go:296:50: models.zeroDefault calls avro.RecordSchema.Fields
      #27: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.RecordSchema.Type
      #28: internal/models/event_schema.go:293:48: models.zeroDefault calls avro.RefSchema.Schema
      #29: internal/cli/iostreams/iostreams.go:172:14: iostreams.IOStreams.Secret calls fmt.Fprintln, which eventually calls avro.RefSchema.String
      #30: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.RefSchema.Type
      #31: internal/models/event_schema.go:98:16: models.envelopeSchema calls avro.Register
      #32: internal/models/event_schema.go:255:15: models.zeroDefault calls avro.UnionSchema.Type
      #33: internal/models/event_schema.go:287:39: models.zeroDefault calls avro.UnionSchema.Types
      #34: internal/models/event_schema.go:222:40: models.recordSchema calls avro.WithDefault
      #35: internal/models/event_schema.go:12:2: models.init calls avro.init
      #36: internal/repository/pg_contact.go:3081:26: repository.contactRepository.ExportAll calls strings.TrimSpace, which eventually calls avro.invalidNameFirstChar
      #37: internal/repository/pg_contact.go:3081:26: repository.contactRepository.ExportAll calls strings.TrimSpace, which eventually calls avro.invalidNameOtherChar
      #38: internal/models/event_schema.go:98:32: models.envelopeSchema calls avro.name.FullName
      #39: goog.getAddressList calls strings.splitSeq, which calls avro.newName
      #40: goog.getAddressList calls strings.splitSeq, which calls avro.newName

Your code is affected by 4 vulnerabilities from 2 modules.
This scan also found 1 vulnerability in packages you import and 1 vulnerability
in modules you require, but your code doesn't appear to call these
vulnerabilities.
Use '-show verbose' for more details.
exit status 3
