# Dependencies

## Go 1.25.5 and x/text 0.14.0 carry 20 reachable advisories [#682] {#toolchain}

Costs: `govulncheck` found 20 reachable advisories, one in `x/text` and 19 in
the standard library. They include template XSS, parser denial of service and
TLS issues. Reachable traces run through the ONNX embedder's normalization,
mavweb's HTML rendering, email header decoding and the mavgpud proxy. The
vendored toolchain was built 2025-11-26.
Revisit when: now. This is the highest-severity open entry and the fix is
mechanical, so it ages badly for no reason.
Workaround: none.

None of `staticcheck`, `govulncheck` or `deadcode` is installed on this box or
wired into a make target. `make audit` is a git-grep inventory over loc, todo,
stubs, docs, tests and gaps. **Do not read it as a static-analysis gate.** That
gate is part of this entry.