does not rebuild/release to "fix" CVEs whichdo not apply

-https://github.com/tianon/gosu/blob/e157efb749be5ce1f32e07aa9849abe3fd953b1c/SECURITY.md (emphasis added)

While the list of CVEs is annoying for users,@tianon is correct and the problem lies in security scanners. They should not blindly attribute a CVE for including a library when go has tooling that they can use to do better and know which functions of the library were included in the binary. They should only attribute the CVE if the vulnerable code path is included and useable in the binary.

Lets pretend we are living in a better world where the vulnerability scanners are better and don't report any false CVE's.

You still have a problem of docker postgres including a binary that was created with a compiler that is a year past End Of Life!

The 2 golang compilers that aren't EOL are 1.23.x and 1.24.x
gosu was compiled with 1.18.x,
1.18.x went EOF Feb 2023 when 1.22 was released

Is there a concrete problem caused by using an "end of life" compiler? Because if so, the Linux distributions would probably like to know about it. As far as I know, there is no meaningful change caused to thegosu binary by recompiling it with a newer compiler except some strings in the binary have a slightly higher number (and the binaries compile slightly differently due to different changes in the compiler). There aren't any active bugs I'm aware of in the versions of the compiler used thatactually affect thegosu binary in any way. If there were, I'd be happy to update (just like a normal Linux distro would/does for their precompiled binary builds).

The point about not using EOL software, is that no one is maintaining it any longer, no one is fixing newly discovered problems with it.
It has got to be less work to just keep compilers updated, than it make every 'customer' of your product (downloader of you image) read through every one of the un-needed 58 CVE's caused by gosu and say, 'This is fine'

The point about not using EOL software, is that no one is maintaining it any longer, no one is fixing newly discovered problems with it.

I would add that security researchers are focused on up-to-date supported software versions: that's where they are looking and where CVEs are discovered, and only afterwards are any related older versions called out. Researches are not hacking on old EOL versions of compilers and libraries. This entire debate is akin to someone claiming their Win-95 server is secure because nobody has reported a CVE against Win-95 in the past 20-odd years. 🤦

I would like to see Golang owners chime in here, and confirm or deny this "best practice" of refusing to upgrade dependencies off of EOL.