Aikido 471474713 (rated critical, EOL Go). Verified on origin/main: go.mod declares go 1.23; CI compiles with go-version: stable (go-lint.yml), so the shipped binary is NOT built by an EOL toolchain — this is a floor-only row, false severity. Bumping the directive to go 1.25 is a one-line hygiene change that closes the vendor row without touching what ships.
Filed by the 2026-09-02 go-live security audit lane. Source-of-truth read from origin/main; vendor finding ids are listed so the row can be closed at the vendor when this lands.
https://claude.ai/code/session_01K9mRh8G2ugbUt2kaXvFvF6
Aikido 471474713 (rated critical, EOL Go). Verified on origin/main: go.mod declares
go 1.23; CI compiles withgo-version: stable(go-lint.yml), so the shipped binary is NOT built by an EOL toolchain — this is a floor-only row, false severity. Bumping the directive togo 1.25is a one-line hygiene change that closes the vendor row without touching what ships.Filed by the 2026-09-02 go-live security audit lane. Source-of-truth read from
origin/main; vendor finding ids are listed so the row can be closed at the vendor when this lands.https://claude.ai/code/session_01K9mRh8G2ugbUt2kaXvFvF6