Vulnerability Database · Go · Package report

github.com/deislabs/ratify: vulnerability history, versions and safety

github.com/deislabs/ratify is a package in the Go ecosystem. Vulert records 1 vulnerability for it across 120 releases, first recorded in Mar 2025. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
1 vulnerabilities recorded U1
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

Vulert verdict on github.com/deislabs/ratify v1.2.3 i

Updated on 23 Oct 2026

Action needed: v1.2.3 has 1 known vulnerability, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 77/100
  • Security No known security issues
  • Maintenance Maintaining
  • Popularity Niche
  • Community Quiet

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v1.2.3 — affected i
  • Vulnerabilities on record 1 over 1 year · 0 in the last year i
  • Latest disclosure 13 Mar 2025 i
  • Highest CVSS n/a i
  • With no published fix 0 i
  • Stars 307 i
  • Last release 20 months ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/deislabs/ratify, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.2.3 27 Jan 2025 U1 Apache-2.0 Yes Details →
v1.2.3-0.20250127165832-0ec0c08490e3 27 Jan 2025 U1 Apache-2.0 Yes Details →
v1.2.2 12 Aug 2024 U1 Apache-2.0 Yes Details →
v1.2.1 05 Jul 2024 U1 Apache-2.0 Yes Details →
v0.0.0-20240531011617-da2cdcac5523 31 May 2024 U1 Apache-2.0 Yes Details →
v1.2.0 31 May 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240524005004-c92687d4329b 24 May 2024 U1 Apache-2.0 Yes Details →
v1.2.0-rc.1 16 May 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240516020909-d78461a768fa 16 May 2024 U1 Apache-2.0 Yes Details →
v1.1.1 02 May 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240501002620-6a26a562f95d 01 May 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240424183919-482ac34f87ed 24 Apr 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240328225505-dd1b883791f9 28 Mar 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240327172548-75976cc1d250 27 Mar 2024 U1 Apache-2.0 Yes Details →
v0.0.0-20240326030341-b0dfc90d38eb 26 Mar 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240320175233-384cb0c1d92c 20 Mar 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240318171211-a023d20e5873 18 Mar 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240315012335-8acc7f2091f8 15 Mar 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240311061727-9069134ce3bb 11 Mar 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240305195818-a29d6296c5ff 05 Mar 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240229183913-fa14b0ed29ff 29 Feb 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240219070424-fde60d2ef687 19 Feb 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240207182759-c6d62fb841f2 07 Feb 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240202182851-3c94dd4b6160 02 Feb 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240201184857-74cf3b245412 01 Feb 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240129232755-2be797d11931 29 Jan 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240115085752-4c61abd77457 15 Jan 2024 U1 Apache-2.0 Yes Details →
v1.1.1-0.20240108061825-e52793624edf 08 Jan 2024 U1 Apache-2.0 Yes Details →
v1.0.1-0.20231212012444-7725e46aa0f2 12 Dec 2023 U1 Apache-2.0 Yes Details →
v1.1.0 12 Dec 2023 U1 Apache-2.0 Yes Details →
v0.0.0-20231025062813-f503a013afab 25 Oct 2023 U1 Apache-2.0 Yes Details →
v1.0.1-0.20231025062813-f503a013afab 25 Oct 2023 U1 Apache-2.0 Yes Details →
v1.0.1-0.20230928172048-3ed18af6f6e1 28 Sep 2023 U1 Apache-2.0 Yes Details →
v1.0.1-0.20230927070707-af10cccc7315 27 Sep 2023 U1 Apache-2.0 Yes Details →
v1.0.0 26 Sep 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.8.0.20230908034123-bf75a8baf7ef 08 Sep 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.7.0.20230908000856-98408ae3278a 08 Sep 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.8 08 Sep 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.7.0.20230905024143-77113e187cba 05 Sep 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.7.0.20230829071002-16945dbda8ec 29 Aug 2023 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.2 29 Aug 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.7.0.20230828074023-529b20b950d4 28 Aug 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.5.0.20230825180318-3e5256ad9d1f 25 Aug 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.7 25 Aug 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.5.0.20230814185808-dc35018dbc1e 14 Aug 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.5.0.20230721232731-d81e3050359a 21 Jul 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.5.0.20230706050132-199d5cf492be 06 Jul 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.6 06 Jul 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.5.0.20230706021204-b5a6e11ceddd 06 Jul 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.4.0.20230616200928-0d03e799a028 16 Jun 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.5 16 Jun 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.4.0.20230616011850-207af0c3e591 16 Jun 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.4.0.20230519014132-6ac746112722 19 May 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.3.0.20230512174424-faff08b2cf86 12 May 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.4 12 May 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.3.0.20230508170620-ad36ebeb88d3 08 May 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.2.0.20230411231712-100af1988096 11 Apr 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.3 11 Apr 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.2.0.20230411221450-0e5ddcbc5bac 11 Apr 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.2.0.20230411213156-1f0ee148fa35 11 Apr 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.2.0.20230411181536-dc98569fa000 11 Apr 2023 U1 Apache-2.0 Yes Details →
v1.0.0-beta.2.0.20230303192439-ec99db548cab 03 Mar 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.2 03 Mar 2023 U1 Apache-2.0 Yes Details →
v1.0.0-beta.2.0.20230228211331-45d02b89f9b0 28 Feb 2023 U1 Apache-2.0 Yes Details →
v1.0.0-beta.2.0.20230222045902-59fe0be0080d 22 Feb 2023 U1 Apache-2.0 Yes Details →
v1.0.0-beta.2.0.20230213183711-7f50850a1547 13 Feb 2023 U1 Apache-2.0 Yes Details →
v1.0.0-beta.2.0.20230206143140-7cf4b1380d51 06 Feb 2023 U1 Apache-2.0 Yes Details →
v1.0.0-beta.2.0.20230206021709-1d188f8a1ff0 06 Feb 2023 U1 Apache-2.0 Yes Details →
v1.0.0-beta.2.0.20230131234437-ccc36bfa12b9 31 Jan 2023 U1 Apache-2.0 Yes Details →
v1.0.0-rc.1 31 Jan 2023 U1 Apache-2.0 Yes Details →
v0.0.0-20230127183415-93e717331edb 27 Jan 2023 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20221228184708-c52499faa349 28 Dec 2022 U1 Apache-2.0 Yes Details →
v1.0.0-beta.2.0.20221215175339-f7e482a1979b 15 Dec 2022 U1 Apache-2.0 Yes Details →
v1.0.0-beta.2.0.20221214090259-f863b4dcf045 14 Dec 2022 U1 Apache-2.0 Yes Details →
v1.0.0-beta.1.0.20221208000333-3280b544e7d2 08 Dec 2022 U1 Apache-2.0 Yes Details →
v1.0.0-beta.2 08 Dec 2022 U1 Apache-2.0 Yes Details →
v1.0.0-beta.1.0.20221205231852-1b940dcd0e35 05 Dec 2022 U1 Apache-2.0 Yes Details →
v1.0.0-alpha.3.0.20221112002820-f85a162d7b07 12 Nov 2022 U1 Apache-2.0 Yes Details →
v1.0.0-beta.1 12 Nov 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20221102173447-a4147a5e2911 02 Nov 2022 U1 Apache-2.0 Yes Details →
v1.0.0-alpha.2.0.20221021183338-9fb314329943 21 Oct 2022 U1 Apache-2.0 Yes Details →
v1.0.0-alpha.3 21 Oct 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20221021002302-8fa646428e6c 21 Oct 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20221013005116-cc68d3615923 13 Oct 2022 U1 Apache-2.0 Yes Details →
v1.0.0-alpha.1.0.20221010223828-412bdf7e451e 10 Oct 2022 U1 Apache-2.0 Yes Details →
v1.0.0-alpha.2 10 Oct 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20220919173433-ff3afe68951f 19 Sep 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20220914201636-1c3cb610b6f2 14 Sep 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20220907161745-967e0dd04937 07 Sep 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20220907000244-53ba6c5b13c4 07 Sep 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20220825172525-240aabceb4f8 25 Aug 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20220824214511-9e15222c3a6b 24 Aug 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20220824202846-2b1e479bffe4 24 Aug 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20220819212933-c13a7ed75be5 19 Aug 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20220817154323-d00f9ab75c45 17 Aug 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20220817004939-983b36858f97 17 Aug 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20220816222935-d102b5b8e5d5 16 Aug 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20220816184633-f72eb6b49d45 16 Aug 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20220802182234-32c03ab957aa 02 Aug 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1.0.20220801205101-ce29be050485 01 Aug 2022 U1 Apache-2.0 Yes Details →
v1.1.0-alpha.1 27 Jul 2022 U1 — Yes Details →
v1.0.0-alpha.1.0.20220720025710-a562be430a65 20 Jul 2022 U1 — Yes Details →
v1.0.0-alpha.1.0.20220719065127-87e706d8161d 19 Jul 2022 U1 — Yes Details →
v1.0.0-alpha.1 14 Jul 2022 U1 — Yes Details →
v0.1.4-alpha.1.0.20220714160149-58e25b7c41c0 14 Jul 2022 U1 — Yes Details →
v0.1.4-alpha.1.0.20220628221344-a87389c43723 28 Jun 2022 U1 — Yes Details →
v0.1.4-alpha.1.0.20220628174148-d24624106cb7 28 Jun 2022 U1 — Yes Details →
v0.1.4-alpha.1.0.20220628172514-c803db3df240 28 Jun 2022 U1 — Yes Details →
v0.1.4-alpha.1.0.20220616213902-7a12d8a4230a 16 Jun 2022 U1 — Yes Details →
v0.1.4-alpha.1.0.20220616211955-903f2c1dba4c 16 Jun 2022 U1 — Yes Details →
v0.1.4-alpha.1.0.20220606200024-0d7f470ef64f 06 Jun 2022 U1 — Yes Details →
v0.1.4-alpha.1.0.20220602220050-b19c69130243 02 Jun 2022 U1 — Yes Details →
v0.1.4-alpha.1.0.20220602172923-00bb7e77061d 02 Jun 2022 U1 — Yes Details →
v0.1.4-alpha.1.0.20220602022327-9d56bbe295a1 02 Jun 2022 U1 — Yes Details →
v0.1.4-alpha.1.0.20220601213641-219e4a382cf1 01 Jun 2022 U1 — Yes Details →
v0.1.4-alpha.1.0.20220601211413-3d7b7b554a85 01 Jun 2022 U1 — Yes Details →
v0.1.4-alpha.1.0.20220601195149-ffc945777144 01 Jun 2022 U1 — Yes Details →
v0.1.4-alpha.1.0.20220531230729-24f687ba9136 31 May 2022 U1 — Yes Details →
v0.1.4-alpha.1.0.20220524224423-013be6f2755d 24 May 2022 U1 — Yes Details →
v0.1.4-alpha.1.0.20220524205846-7c0eb34abc0e 24 May 2022 U1 — Yes Details →

The newest 120 of 170 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2025 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 1 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/deislabs/ratify

The 1 most severe of 1 vulnerabilities recorded for this package

Search all 1 in the database →

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/deislabs/ratify

Is github.com/deislabs/ratify safe to use?

Vulert records 1 vulnerabilities for github.com/deislabs/ratify in Go: 0 critical, 0 high, 0 medium and 0 low, plus 1 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/deislabs/ratify's Vulert package health score?

Vulert scores github.com/deislabs/ratify 77/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/deislabs/ratify affected?

Yes. v1.2.3, the version you would install today, has 1 known vulnerability, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/deislabs/ratify should I use?

v1.2.3 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/deislabs/ratify have?

1 vulnerability is recorded for github.com/deislabs/ratify in the Go ecosystem: 0 critical, 0 high, 0 medium and 0 low, plus 1 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/deislabs/ratify vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/deislabs/ratify in the last 12 months, and the oldest entry in this database dates to 13 Mar 2025. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/deislabs/ratify are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/deislabs/ratify for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/deislabs/ratify version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.