Open-source security reports

reactive-commons-go is an open-source Go library from Bancolombia with common abstractions for messaging patterns in microservices. Its go.mod pinned github.com/rabbitmq/amqp091-go at v1.10.0, which falls in the affected range of 10 advisories published in September 2026: 3 critical (a missing TLS minimum version in the URI parser, frame injection through an integer overflow, and silent truncation of short strings) and 7 high. All 10 are fixed in v1.13.0.

Reported on October 4, 2026, with the list of advisories and the fix. The maintainers upgraded to v1.15.0, which has no advisories in OSV as of October 2026, in pull request #6, and closed the report as completed on October 7, 2026.

async-dataflow is an open-source Elixir project from Bancolombia that delivers asynchronous responses to client applications in real time. Its channel-sender service pinned versions of cowboy, cowlib, plug_cowboy and plug that fall in the affected range of high-severity advisories: CVE-2026-8466 and EEF-CVE-2026-65624 (cowboy), CVE-2026-7790 (cowlib), CVE-2026-32688 (plug_cowboy), and CVE-2026-54892 and CVE-2026-8468 (plug). The test-only dependencies gun and hackney also had advisories.

Reported on October 4, 2026. The maintainers checked each finding against their lockfile and OSV, corrected several points of the report (among them the fixed version for gun and the test-only scope of gun and hackney) and added plug_cowboy, which the report had missed. They upgraded the dependencies and removed the unused hackney in pull request #149, merged on October 16, 2026, which closed the report.