Cannot upload SARIF file from `govulncheck` tool: `.*` contains duplicate item

[dwisiswant0]

Raw logs:

2025-12-21T00:37:54.2197942Z ##[group]Run github/codeql-action/upload-sarif@v4
2025-12-21T00:37:54.2198246Z with:
2025-12-21T00:37:54.2198435Z   sarif_file: /tmp/results.sarif
2025-12-21T00:37:54.2198661Z   category: govulncheck
2025-12-21T00:37:54.2198904Z   checkout_path: /home/runner/work/nuclei/nuclei
2025-12-21T00:37:54.2199305Z   token: ***
2025-12-21T00:37:54.2199624Z   matrix: null
2025-12-21T00:37:54.2199816Z   wait-for-processing: true
2025-12-21T00:37:54.2200034Z env:
2025-12-21T00:37:54.2200206Z   OUTPUT: /tmp/results.sarif
2025-12-21T00:37:54.2200425Z   GOTOOLCHAIN: local
2025-12-21T00:37:54.2200612Z ##[endgroup]
2025-12-21T00:37:54.8261629Z Post-processing sarif files: ["/tmp/results.sarif"]
2025-12-21T00:37:54.8265597Z Validating /tmp/results.sarif
2025-12-21T00:37:54.8636988Z ##[group]Error details: instance.runs[0].tool.driver.rules[2].properties.tags contains duplicate item
2025-12-21T00:37:54.8638054Z {
2025-12-21T00:37:54.8638400Z   "path": [
2025-12-21T00:37:54.8638729Z     "runs",
2025-12-21T00:37:54.8639149Z     0,
2025-12-21T00:37:54.8639487Z     "tool",
2025-12-21T00:37:54.8639798Z     "driver",
2025-12-21T00:37:54.8640182Z     "rules",
2025-12-21T00:37:54.8640496Z     2,
2025-12-21T00:37:54.8640825Z     "properties",
2025-12-21T00:37:54.8641290Z     "tags"
2025-12-21T00:37:54.8641547Z   ],
2025-12-21T00:37:54.8642051Z   "property": "instance.runs[0].tool.driver.rules[2].properties.tags",
2025-12-21T00:37:54.8642703Z   "message": "contains duplicate item",
2025-12-21T00:37:54.8643122Z   "schema": {
2025-12-21T00:37:54.8643770Z     "description": "A set of distinct strings that provide additional information.",
2025-12-21T00:37:54.8644400Z     "type": "array",
2025-12-21T00:37:54.8644612Z     "minItems": 0,
2025-12-21T00:37:54.8645868Z     "uniqueItems": true,
2025-12-21T00:37:54.8646178Z     "default": [],
2025-12-21T00:37:54.8646600Z     "items": {
2025-12-21T00:37:54.8646896Z       "type": "string"
2025-12-21T00:37:54.8647165Z     }
2025-12-21T00:37:54.8647458Z   },
2025-12-21T00:37:54.8647763Z   "instance": [
2025-12-21T00:37:54.8648087Z     "CVE-2025-47906",
2025-12-21T00:37:54.8648540Z     "CVE-2025-47906"
2025-12-21T00:37:54.8648775Z   ],
2025-12-21T00:37:54.8649028Z   "name": "uniqueItems",
2025-12-21T00:37:54.8649526Z   "stack": "instance.runs[0].tool.driver.rules[2].properties.tags contains duplicate item"
2025-12-21T00:37:54.8649989Z }
2025-12-21T00:37:54.8650429Z ##[endgroup]
2025-12-21T00:37:54.8651059Z ##[group]Error details: instance.runs[0].tool.driver.rules[3].properties.tags contains duplicate item
2025-12-21T00:37:54.8651785Z {
2025-12-21T00:37:54.8652056Z   "path": [
2025-12-21T00:37:54.8652312Z     "runs",
2025-12-21T00:37:54.8652521Z     0,
2025-12-21T00:37:54.8652812Z     "tool",
2025-12-21T00:37:54.8653067Z     "driver",
2025-12-21T00:37:54.8653323Z     "rules",
2025-12-21T00:37:54.8653546Z     3,
2025-12-21T00:37:54.8653804Z     "properties",
2025-12-21T00:37:54.8654081Z     "tags"
2025-12-21T00:37:54.8654285Z   ],
2025-12-21T00:37:54.8655130Z   "property": "instance.runs[0].tool.driver.rules[3].properties.tags",
2025-12-21T00:37:54.8655570Z   "message": "contains duplicate item",
2025-12-21T00:37:54.8655870Z   "schema": {
2025-12-21T00:37:54.8656327Z     "description": "A set of distinct strings that provide additional information.",
2025-12-21T00:37:54.8656785Z     "type": "array",
2025-12-21T00:37:54.8657086Z     "minItems": 0,
2025-12-21T00:37:54.8657344Z     "uniqueItems": true,
2025-12-21T00:37:54.8657631Z     "default": [],
2025-12-21T00:37:54.8657909Z     "items": {
2025-12-21T00:37:54.8658148Z       "type": "string"
2025-12-21T00:37:54.8658428Z     }
2025-12-21T00:37:54.8658671Z   },
2025-12-21T00:37:54.8658874Z   "instance": [
2025-12-21T00:37:54.8659145Z     "CVE-2025-61725",
2025-12-21T00:37:54.8659444Z     "CVE-2025-61725"
2025-12-21T00:37:54.8659659Z   ],
2025-12-21T00:37:54.8659932Z   "name": "uniqueItems",
2025-12-21T00:37:54.8660415Z   "stack": "instance.runs[0].tool.driver.rules[3].properties.tags contains duplicate item"
2025-12-21T00:37:54.8660848Z }
2025-12-21T00:37:54.8661826Z ##[endgroup]
2025-12-21T00:37:54.8662462Z ##[group]Error details: instance.runs[0].tool.driver.rules[4].properties.tags contains duplicate item
2025-12-21T00:37:54.8663042Z {
2025-12-21T00:37:54.8663324Z   "path": [
2025-12-21T00:37:54.8663573Z     "runs",
2025-12-21T00:37:54.8663811Z     0,
2025-12-21T00:37:54.8664061Z     "tool",
2025-12-21T00:37:54.8664440Z     "driver",
2025-12-21T00:37:54.8665024Z     "rules",
2025-12-21T00:37:54.8665286Z     4,
2025-12-21T00:37:54.8665547Z     "properties",
2025-12-21T00:37:54.8665811Z     "tags"
2025-12-21T00:37:54.8666067Z   ],
2025-12-21T00:37:54.8666435Z   "property": "instance.runs[0].tool.driver.rules[4].properties.tags",
2025-12-21T00:37:54.8666853Z   "message": "contains duplicate item",
2025-12-21T00:37:54.8667201Z   "schema": {
2025-12-21T00:37:54.8667608Z     "description": "A set of distinct strings that provide additional information.",
2025-12-21T00:37:54.8668115Z     "type": "array",
2025-12-21T00:37:54.8668451Z     "minItems": 0,
2025-12-21T00:37:54.8668701Z     "uniqueItems": true,
2025-12-21T00:37:54.8668975Z     "default": [],
2025-12-21T00:37:54.8669266Z     "items": {
2025-12-21T00:37:54.8669512Z       "type": "string"
2025-12-21T00:37:54.8669755Z     }
2025-12-21T00:37:54.8670028Z   },
2025-12-21T00:37:54.8670274Z   "instance": [
2025-12-21T00:37:54.8670498Z     "CVE-2025-58187",
2025-12-21T00:37:54.8670810Z     "CVE-2025-58187"
2025-12-21T00:37:54.8671053Z   ],
2025-12-21T00:37:54.8671394Z   "name": "uniqueItems",
2025-12-21T00:37:54.8672364Z   "stack": "instance.runs[0].tool.driver.rules[4].properties.tags contains duplicate item"
2025-12-21T00:37:54.8672811Z }
2025-12-21T00:37:54.8673264Z ##[endgroup]
2025-12-21T00:37:54.8673837Z ##[group]Error details: instance.runs[0].tool.driver.rules[5].properties.tags contains duplicate item
2025-12-21T00:37:54.8674353Z {
2025-12-21T00:37:54.8674570Z   "path": [
2025-12-21T00:37:54.8675011Z     "runs",
2025-12-21T00:37:54.8675257Z     0,
2025-12-21T00:37:54.8675476Z     "tool",
2025-12-21T00:37:54.8675735Z     "driver",
2025-12-21T00:37:54.8676030Z     "rules",
2025-12-21T00:37:54.8676254Z     5,
2025-12-21T00:37:54.8676515Z     "properties",
2025-12-21T00:37:54.8676777Z     "tags"
2025-12-21T00:37:54.8676981Z   ],
2025-12-21T00:37:54.8677346Z   "property": "instance.runs[0].tool.driver.rules[5].properties.tags",
2025-12-21T00:37:54.8677803Z   "message": "contains duplicate item",
2025-12-21T00:37:54.8678124Z   "schema": {
2025-12-21T00:37:54.8678531Z     "description": "A set of distinct strings that provide additional information.",
2025-12-21T00:37:54.8678970Z     "type": "array",
2025-12-21T00:37:54.8679255Z     "minItems": 0,
2025-12-21T00:37:54.8679534Z     "uniqueItems": true,
2025-12-21T00:37:54.8679858Z     "default": [],
2025-12-21T00:37:54.8680129Z     "items": {
2025-12-21T00:37:54.8680375Z       "type": "string"
2025-12-21T00:37:54.8680643Z     }
2025-12-21T00:37:54.8680879Z   },
2025-12-21T00:37:54.8681104Z   "instance": [
2025-12-21T00:37:54.8681474Z     "CVE-2025-58189",
2025-12-21T00:37:54.8681764Z     "CVE-2025-58189"
2025-12-21T00:37:54.8682895Z   ],
2025-12-21T00:37:54.8683159Z   "name": "uniqueItems",
2025-12-21T00:37:54.8683638Z   "stack": "instance.runs[0].tool.driver.rules[5].properties.tags contains duplicate item"
2025-12-21T00:37:54.8684101Z }
2025-12-21T00:37:54.8684524Z ##[endgroup]
2025-12-21T00:37:54.8685511Z ##[group]Error details: instance.runs[0].tool.driver.rules[6].properties.tags contains duplicate item
2025-12-21T00:37:54.8686108Z {
2025-12-21T00:37:54.8686313Z   "path": [
2025-12-21T00:37:54.8686579Z     "runs",
2025-12-21T00:37:54.8686833Z     0,
2025-12-21T00:37:54.8687041Z     "tool",
2025-12-21T00:37:54.8687285Z     "driver",
2025-12-21T00:37:54.8687544Z     "rules",
2025-12-21T00:37:54.8687751Z     6,
2025-12-21T00:37:54.8688083Z     "properties",
2025-12-21T00:37:54.8688356Z     "tags"
2025-12-21T00:37:54.8688546Z   ],
2025-12-21T00:37:54.8688904Z   "property": "instance.runs[0].tool.driver.rules[6].properties.tags",
2025-12-21T00:37:54.8689560Z   "message": "contains duplicate item",
2025-12-21T00:37:54.8689896Z   "schema": {
2025-12-21T00:37:54.8690298Z     "description": "A set of distinct strings that provide additional information.",
2025-12-21T00:37:54.8690767Z     "type": "array",
2025-12-21T00:37:54.8691040Z     "minItems": 0,
2025-12-21T00:37:54.8691475Z     "uniqueItems": true,
2025-12-21T00:37:54.8691970Z     "default": [],
2025-12-21T00:37:54.8692230Z     "items": {
2025-12-21T00:37:54.8692477Z       "type": "string"
2025-12-21T00:37:54.8692753Z     }
2025-12-21T00:37:54.8693000Z   },
2025-12-21T00:37:54.8693203Z   "instance": [
2025-12-21T00:37:54.8693854Z     "CVE-2025-61723",
2025-12-21T00:37:54.8694152Z     "CVE-2025-61723"
2025-12-21T00:37:54.8694393Z   ],
2025-12-21T00:37:54.8695034Z   "name": "uniqueItems",
2025-12-21T00:37:54.8695511Z   "stack": "instance.runs[0].tool.driver.rules[6].properties.tags contains duplicate item"
2025-12-21T00:37:54.8695931Z }
2025-12-21T00:37:54.8696469Z ##[endgroup]
2025-12-21T00:37:54.8697053Z ##[group]Error details: instance.runs[0].tool.driver.rules[7].properties.tags contains duplicate item
2025-12-21T00:37:54.8697532Z {
2025-12-21T00:37:54.8697777Z   "path": [
2025-12-21T00:37:54.8698005Z     "runs",
2025-12-21T00:37:54.8698293Z     0,
2025-12-21T00:37:54.8698501Z     "tool",
2025-12-21T00:37:54.8698739Z     "driver",
2025-12-21T00:37:54.8699015Z     "rules",
2025-12-21T00:37:54.8699234Z     7,
2025-12-21T00:37:54.8699488Z     "properties",
2025-12-21T00:37:54.8699779Z     "tags"
2025-12-21T00:37:54.8700078Z   ],
2025-12-21T00:37:54.8700658Z   "property": "instance.runs[0].tool.driver.rules[7].properties.tags",
2025-12-21T00:37:54.8701313Z   "message": "contains duplicate item",
2025-12-21T00:37:54.8701766Z   "schema": {
2025-12-21T00:37:54.8702428Z     "description": "A set of distinct strings that provide additional information.",
2025-12-21T00:37:54.8703773Z     "type": "array",
2025-12-21T00:37:54.8704065Z     "minItems": 0,
2025-12-21T00:37:54.8704339Z     "uniqueItems": true,
2025-12-21T00:37:54.8704862Z     "default": [],
2025-12-21T00:37:54.8705127Z     "items": {
2025-12-21T00:37:54.8705403Z       "type": "string"
2025-12-21T00:37:54.8705780Z     }
2025-12-21T00:37:54.8706003Z   },
2025-12-21T00:37:54.8706219Z   "instance": [
2025-12-21T00:37:54.8706494Z     "CVE-2025-47912",
2025-12-21T00:37:54.8706769Z     "CVE-2025-47912"
2025-12-21T00:37:54.8707022Z   ],
2025-12-21T00:37:54.8707276Z   "name": "uniqueItems",
2025-12-21T00:37:54.8707739Z   "stack": "instance.runs[0].tool.driver.rules[7].properties.tags contains duplicate item"
2025-12-21T00:37:54.8708195Z }
2025-12-21T00:37:54.8708597Z ##[endgroup]
2025-12-21T00:37:54.8709211Z ##[group]Error details: instance.runs[0].tool.driver.rules[8].properties.tags contains duplicate item
2025-12-21T00:37:54.8709723Z {
2025-12-21T00:37:54.8709944Z   "path": [
2025-12-21T00:37:54.8710188Z     "runs",
2025-12-21T00:37:54.8710419Z     0,
2025-12-21T00:37:54.8710668Z     "tool",
2025-12-21T00:37:54.8710909Z     "driver",
2025-12-21T00:37:54.8711256Z     "rules",
2025-12-21T00:37:54.8711490Z     8,
2025-12-21T00:37:54.8711748Z     "properties",
2025-12-21T00:37:54.8712012Z     "tags"
2025-12-21T00:37:54.8712247Z   ],
2025-12-21T00:37:54.8712651Z   "property": "instance.runs[0].tool.driver.rules[8].properties.tags",
2025-12-21T00:37:54.8713046Z   "message": "contains duplicate item",
2025-12-21T00:37:54.8713349Z   "schema": {
2025-12-21T00:37:54.8713829Z     "description": "A set of distinct strings that provide additional information.",
2025-12-21T00:37:54.8714231Z     "type": "array",
2025-12-21T00:37:54.8716029Z     "minItems": 0,
2025-12-21T00:37:54.8716379Z     "uniqueItems": true,
2025-12-21T00:37:54.8716632Z     "default": [],
2025-12-21T00:37:54.8716891Z     "items": {
2025-12-21T00:37:54.8717197Z       "type": "string"
2025-12-21T00:37:54.8717438Z     }
2025-12-21T00:37:54.8717652Z   },
2025-12-21T00:37:54.8717917Z   "instance": [
2025-12-21T00:37:54.8718909Z     "CVE-2025-58185",
2025-12-21T00:37:54.8719157Z     "CVE-2025-58185"
2025-12-21T00:37:54.8719616Z   ],
2025-12-21T00:37:54.8719899Z   "name": "uniqueItems",
2025-12-21T00:37:54.8720333Z   "stack": "instance.runs[0].tool.driver.rules[8].properties.tags contains duplicate item"
2025-12-21T00:37:54.8720801Z }
2025-12-21T00:37:54.8721328Z ##[endgroup]
2025-12-21T00:37:54.8721946Z ##[group]Error details: instance.runs[0].tool.driver.rules[9].properties.tags contains duplicate item
2025-12-21T00:37:54.8722974Z {
2025-12-21T00:37:54.8723236Z   "path": [
2025-12-21T00:37:54.8723463Z     "runs",
2025-12-21T00:37:54.8723707Z     0,
2025-12-21T00:37:54.8723976Z     "tool",
2025-12-21T00:37:54.8724223Z     "driver",
2025-12-21T00:37:54.8724473Z     "rules",
2025-12-21T00:37:54.8725321Z     9,
2025-12-21T00:37:54.8725567Z     "properties",
2025-12-21T00:37:54.8725829Z     "tags"
2025-12-21T00:37:54.8726075Z   ],
2025-12-21T00:37:54.8726442Z   "property": "instance.runs[0].tool.driver.rules[9].properties.tags",
2025-12-21T00:37:54.8726875Z   "message": "contains duplicate item",
2025-12-21T00:37:54.8727204Z   "schema": {
2025-12-21T00:37:54.8727653Z     "description": "A set of distinct strings that provide additional information.",
2025-12-21T00:37:54.8728060Z     "type": "array",
2025-12-21T00:37:54.8728640Z     "minItems": 0,
2025-12-21T00:37:54.8728931Z     "uniqueItems": true,
2025-12-21T00:37:54.8729187Z     "default": [],
2025-12-21T00:37:54.8729456Z     "items": {
2025-12-21T00:37:54.8729746Z       "type": "string"
2025-12-21T00:37:54.8729974Z     }
2025-12-21T00:37:54.8730230Z   },
2025-12-21T00:37:54.8730487Z   "instance": [
2025-12-21T00:37:54.8730727Z     "CVE-2025-58186",
2025-12-21T00:37:54.8731019Z     "CVE-2025-58186"
2025-12-21T00:37:54.8731433Z   ],
2025-12-21T00:37:54.8732101Z   "name": "uniqueItems",
2025-12-21T00:37:54.8732588Z   "stack": "instance.runs[0].tool.driver.rules[9].properties.tags contains duplicate item"
2025-12-21T00:37:54.8733035Z }
2025-12-21T00:37:54.8733435Z ##[endgroup]
2025-12-21T00:37:54.8735148Z (node:2515) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
2025-12-21T00:37:54.8736090Z (Use `node --trace-deprecation ...` to show where the warning was created)
2025-12-21T00:37:54.8736904Z ##[group]Error details: instance.runs[0].tool.driver.rules[10].properties.tags contains duplicate item
2025-12-21T00:37:54.8737392Z {
2025-12-21T00:37:54.8737941Z   "path": [
2025-12-21T00:37:54.8738232Z     "runs",
2025-12-21T00:37:54.8738441Z     0,
2025-12-21T00:37:54.8738702Z     "tool",
2025-12-21T00:37:54.8738985Z     "driver",
2025-12-21T00:37:54.8739207Z     "rules",
2025-12-21T00:37:54.8740043Z     10,
2025-12-21T00:37:54.8740664Z     "properties",
2025-12-21T00:37:54.8740897Z     "tags"
2025-12-21T00:37:54.8741137Z   ],
2025-12-21T00:37:54.8741712Z   "property": "instance.runs[0].tool.driver.rules[10].properties.tags",
2025-12-21T00:37:54.8743210Z   "message": "contains duplicate item",
2025-12-21T00:37:54.8743530Z   "schema": {
2025-12-21T00:37:54.8744113Z     "description": "A set of distinct strings that provide additional information.",
2025-12-21T00:37:54.8744850Z     "type": "array",
2025-12-21T00:37:54.8745128Z     "minItems": 0,
2025-12-21T00:37:54.8746064Z     "uniqueItems": true,
2025-12-21T00:37:54.8746503Z     "default": [],
2025-12-21T00:37:54.8746911Z     "items": {
2025-12-21T00:37:54.8748137Z       "type": "string"
2025-12-21T00:37:54.8748500Z     }
2025-12-21T00:37:54.8748719Z   },
2025-12-21T00:37:54.8749340Z   "instance": [
2025-12-21T00:37:54.8749685Z     "CVE-2025-58188",
2025-12-21T00:37:54.8749958Z     "CVE-2025-58188"
2025-12-21T00:37:54.8750288Z   ],
2025-12-21T00:37:54.8750601Z   "name": "uniqueItems",
2025-12-21T00:37:54.8751350Z   "stack": "instance.runs[0].tool.driver.rules[10].properties.tags contains duplicate item"
2025-12-21T00:37:54.8752320Z }
2025-12-21T00:37:54.8752807Z ##[endgroup]
2025-12-21T00:37:54.8753707Z ##[group]Error details: instance.runs[0].tool.driver.rules[11].properties.tags contains duplicate item
2025-12-21T00:37:54.8754264Z {
2025-12-21T00:37:54.8754564Z   "path": [
2025-12-21T00:37:54.8755228Z     "runs",
2025-12-21T00:37:54.8755509Z     0,
2025-12-21T00:37:54.8755809Z     "tool",
2025-12-21T00:37:54.8756130Z     "driver",
2025-12-21T00:37:54.8756387Z     "rules",
2025-12-21T00:37:54.8756676Z     11,
2025-12-21T00:37:54.8756970Z     "properties",
2025-12-21T00:37:54.8757332Z     "tags"
2025-12-21T00:37:54.8757616Z   ],
2025-12-21T00:37:54.8758077Z   "property": "instance.runs[0].tool.driver.rules[11].properties.tags",
2025-12-21T00:37:54.8758543Z   "message": "contains duplicate item",
2025-12-21T00:37:54.8758927Z   "schema": {
2025-12-21T00:37:54.8759464Z     "description": "A set of distinct strings that provide additional information.",
2025-12-21T00:37:54.8759974Z     "type": "array",
2025-12-21T00:37:54.8760288Z     "minItems": 0,
2025-12-21T00:37:54.8760629Z     "uniqueItems": true,
2025-12-21T00:37:54.8760960Z     "default": [],
2025-12-21T00:37:54.8761384Z     "items": {
2025-12-21T00:37:54.8761721Z       "type": "string"
2025-12-21T00:37:54.8762019Z     }
2025-12-21T00:37:54.8849193Z   },
2025-12-21T00:37:54.8849557Z   "instance": [
2025-12-21T00:37:54.8849872Z     "CVE-2025-58183",
2025-12-21T00:37:54.8850188Z     "CVE-2025-58183"
2025-12-21T00:37:54.8850468Z   ],
2025-12-21T00:37:54.8850802Z   "name": "uniqueItems",
2025-12-21T00:37:54.8851576Z   "stack": "instance.runs[0].tool.driver.rules[11].properties.tags contains duplicate item"
2025-12-21T00:37:54.8852134Z }
2025-12-21T00:37:54.8852608Z ##[endgroup]
2025-12-21T00:37:54.8853322Z ##[group]Error details: instance.runs[0].tool.driver.rules[12].properties.tags contains duplicate item
2025-12-21T00:37:54.8854053Z {
2025-12-21T00:37:54.8854303Z   "path": [
2025-12-21T00:37:54.8854568Z     "runs",
2025-12-21T00:37:54.8855121Z     0,
2025-12-21T00:37:54.8855395Z     "tool",
2025-12-21T00:37:54.8855668Z     "driver",
2025-12-21T00:37:54.8855970Z     "rules",
2025-12-21T00:37:54.8856271Z     12,
2025-12-21T00:37:54.8856581Z     "properties",
2025-12-21T00:37:54.8856863Z     "tags"
2025-12-21T00:37:54.8857115Z   ],
2025-12-21T00:37:54.8857627Z   "property": "instance.runs[0].tool.driver.rules[12].properties.tags",
2025-12-21T00:37:54.8858284Z   "message": "contains duplicate item",
2025-12-21T00:37:54.8858724Z   "schema": {
2025-12-21T00:37:54.8859407Z     "description": "A set of distinct strings that provide additional information.",
2025-12-21T00:37:54.8860076Z     "type": "array",
2025-12-21T00:37:54.8860452Z     "minItems": 0,
2025-12-21T00:37:54.8860857Z     "uniqueItems": true,
2025-12-21T00:37:54.8862973Z     "default": [],
2025-12-21T00:37:54.8863372Z     "items": {
2025-12-21T00:37:54.8863725Z       "type": "string"
2025-12-21T00:37:54.8864020Z     }
2025-12-21T00:37:54.8864284Z   },
2025-12-21T00:37:54.8864574Z   "instance": [
2025-12-21T00:37:54.8865246Z     "CVE-2025-61724",
2025-12-21T00:37:54.8865600Z     "CVE-2025-61724"
2025-12-21T00:37:54.8865888Z   ],
2025-12-21T00:37:54.8866170Z   "name": "uniqueItems",
2025-12-21T00:37:54.8866800Z   "stack": "instance.runs[0].tool.driver.rules[12].properties.tags contains duplicate item"
2025-12-21T00:37:54.8867388Z }
2025-12-21T00:37:54.8867903Z ##[endgroup]
2025-12-21T00:37:54.8868714Z ##[group]Error details: instance.runs[0].tool.driver.rules[13].properties.tags contains duplicate item
2025-12-21T00:37:54.8869423Z {
2025-12-21T00:37:54.8869708Z   "path": [
2025-12-21T00:37:54.8869980Z     "runs",
2025-12-21T00:37:54.8870262Z     0,
2025-12-21T00:37:54.8870558Z     "tool",
2025-12-21T00:37:54.8870837Z     "driver",
2025-12-21T00:37:54.8871126Z     "rules",
2025-12-21T00:37:54.8871572Z     13,
2025-12-21T00:37:54.8871839Z     "properties",
2025-12-21T00:37:54.8872109Z     "tags"
2025-12-21T00:37:54.8872368Z   ],
2025-12-21T00:37:54.8872856Z   "property": "instance.runs[0].tool.driver.rules[13].properties.tags",
2025-12-21T00:37:54.8873433Z   "message": "contains duplicate item",
2025-12-21T00:37:54.8873778Z   "schema": {
2025-12-21T00:37:54.8874545Z     "description": "A set of distinct strings that provide additional information.",
2025-12-21T00:37:54.8875254Z     "type": "array",
2025-12-21T00:37:54.8875463Z     "minItems": 0,
2025-12-21T00:37:54.8875668Z     "uniqueItems": true,
2025-12-21T00:37:54.8875885Z     "default": [],
2025-12-21T00:37:54.8876074Z     "items": {
2025-12-21T00:37:54.8876275Z       "type": "string"
2025-12-21T00:37:54.8876555Z     }
2025-12-21T00:37:54.8876711Z   },
2025-12-21T00:37:54.8876879Z   "instance": [
2025-12-21T00:37:54.8877070Z     "CVE-2025-61729",
2025-12-21T00:37:54.8877278Z     "CVE-2025-61729"
2025-12-21T00:37:54.8877461Z   ],
2025-12-21T00:37:54.8877631Z   "name": "uniqueItems",
2025-12-21T00:37:54.8878039Z   "stack": "instance.runs[0].tool.driver.rules[13].properties.tags contains duplicate item"
2025-12-21T00:37:54.8878408Z }
2025-12-21T00:37:54.8878731Z ##[endgroup]
2025-12-21T00:37:54.8901343Z ##[error]Unable to upload "/tmp/results.sarif" as it is not valid SARIF:
- instance.runs[0].tool.driver.rules[2].properties.tags contains duplicate item
- instance.runs[0].tool.driver.rules[3].properties.tags contains duplicate item
- instance.runs[0].tool.driver.rules[4].properties.tags contains duplicate item
- instance.runs[0].tool.driver.rules[5].properties.tags contains duplicate item
- instance.runs[0].tool.driver.rules[6].properties.tags contains duplicate item
- instance.runs[0].tool.driver.rules[7].properties.tags contains duplicate item
- instance.runs[0].tool.driver.rules[8].properties.tags contains duplicate item
- instance.runs[0].tool.driver.rules[9].properties.tags contains duplicate item
- instance.runs[0].tool.driver.rules[10].properties.tags contains duplicate item
- instance.runs[0].tool.driver.rules[11].properties.tags contains duplicate item
- instance.runs[0].tool.driver.rules[12].properties.tags contains duplicate item
- instance.runs[0].tool.driver.rules[13].properties.tags contains duplicate item

Workflow: https://github.com/projectdiscovery/nuclei/actions/runs/20402255851/workflow
Job run: https://github.com/projectdiscovery/nuclei/actions/runs/20402255851/job/58626329641

[dwisiswant0]

SARIF content:

{
  "version": "2.1.0",
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "govulncheck",
          "semanticVersion": "v1.1.4",
          "informationUri": "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck",
          "properties": {
            "protocol_version": "v1.0.0",
            "scanner_name": "govulncheck",
            "scanner_version": "v1.1.4",
            "db": "https://vuln.go.dev",
            "db_last_modified": "2025-12-16T19:39:14Z",
            "go_version": "go1.25.5",
            "scan_level": "package",
            "scan_mode": "source"
          },
          "rules": [
            {
              "id": "GO-2025-3764",
              "shortDescription": {
                "text": "[GO-2025-3764] SQL injection vulnerability via the component /types/append_value.go in github.com/go-pg/pg"
              },
              "fullDescription": {
                "text": "SQL injection vulnerability via the component /types/append_value.go in github.com/go-pg/pg"
              },
              "help": {
                "text": "SQL injection vulnerability via the component /types/append_value.go in github.com/go-pg/pg"
              },
              "helpUri": "https://pkg.go.dev/vuln/GO-2025-3764",
              "properties": {
                "tags": [
                  "CVE-2024-44905",
                  "GHSA-6xp3-p59p-q4fj"
                ]
              }
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "GO-2025-3764",
          "level": "error",
          "message": {
            "text": "Your code imports 7 vulnerable packages (github.com/go-pg/pg/v10, github.com/go-pg/pg/v10/internal, github.com/go-pg/pg/v10/internal/parser, github.com/go-pg/pg/v10/internal/pool, github.com/go-pg/pg/v10/orm, github.com/go-pg/pg/v10/pgjson, and github.com/go-pg/pg/v10/types). Run the call-level analysis to understand whether your code actually calls the vulnerabilities."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "go.mod",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              },
              "message": {
                "text": "Findings for vulnerability GO-2025-3764"
              }
            }
          ]
        }
      ]
    }
  ]
}

[dwisiswant0]

Code scanning: https://github.com/projectdiscovery/nuclei/security/code-scanning

[mbg]

Hi @dwisiswant0 👋🏻

Thanks for opening this issue and sorry for the delay in getting back to you during the holidays etc.

The CodeQL Action validates SARIF files against the SARIF schema (specification). According to Section 3.8.2 ("Tags"):

If a property bag contains a property named tags, the property value SHALL be an array of zero or more unique (§3.7.3), hierarchical (§3.5.4) strings.

So if there are duplicate tags, then the CodeQL Action is correct in rejecting the SARIF file and the issue is with the tool producing it (i.e. govulncheck).

The contents of the SARIF file you posted look OK, but don't seem to be the same as the SARIF file that fails validation (the errors suggest that there are quite a few elements in the rules array, but the SARIF contents you posted only have one element). To obtain the actual SARIF file that's generated by govulncheck in your workflow, it would probably be best to add an actions/upload-artifact step before the github/codeql-action/upload-sarif step which uploads /tmp/results.sarif as a workflow artifact. I'd expect that you would then find rules in there with duplicate tags, as reported by the validation errors.

[dwisiswant0]

[...] it would probably be best to add an actions/upload-artifact step [...]

I did not want to clutter the commits.

[...] but don't seem to be the same as the SARIF file that fails validation (the errors suggest that there are quite a few elements in the rules array [...]

so I reproduced it locally to get the results. I can confirm it’s the same content.

[dwisiswant0]

Update: you are right, it looks like my assumption was wrong, sorry about that.

The content from the workflow is different from what I have locally. This is the content from the workflow;

results.sarif

{
  "version": "2.1.0",
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "govulncheck",
          "semanticVersion": "v1.1.4",
          "informationUri": "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck",
          "properties": {
            "protocol_version": "v1.0.0",
            "scanner_name": "govulncheck",
            "scanner_version": "v1.1.4",
            "db": "https://vuln.go.dev",
            "db_last_modified": "2025-12-30T01:49:57Z",
            "go_version": "go1.24.4",
            "scan_level": "package",
            "scan_mode": "source"
          },
          "rules": [
            {
              "id": "GO-2025-3764",
              "shortDescription": {
                "text": "[GO-2025-3764] SQL injection vulnerability via the component /types/append_value.go in github.com/go-pg/pg"
              },
              "fullDescription": {
                "text": "SQL injection vulnerability via the component /types/append_value.go in github.com/go-pg/pg"
              },
              "help": {
                "text": "SQL injection vulnerability via the component /types/append_value.go in github.com/go-pg/pg"
              },
              "helpUri": "https://pkg.go.dev/vuln/GO-2025-3764",
              "properties": {
                "tags": [
                  "CVE-2024-44905",
                  "GHSA-6xp3-p59p-q4fj"
                ]
              }
            },
            {
              "id": "GO-2025-3849",
              "shortDescription": {
                "text": "[GO-2025-3849] Incorrect results returned from Rows.Scan in database/sql"
              },
              "fullDescription": {
                "text": "Incorrect results returned from Rows.Scan in database/sql"
              },
              "help": {
                "text": "Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error."
              },
              "helpUri": "https://pkg.go.dev/vuln/GO-2025-3849",
              "properties": {
                "tags": [
                  "CVE-2025-47907"
                ]
              }
            },
            {
              "id": "GO-2025-3956",
              "shortDescription": {
                "text": "[GO-2025-3956] Unexpected paths returned from LookPath in os/exec"
              },
              "fullDescription": {
                "text": "Unexpected paths returned from LookPath in os/exec"
              },
              "help": {
                "text": "If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (\"\", \".\", and \"..\"), can result in the binaries listed in the PATH being unexpectedly returned."
              },
              "helpUri": "https://pkg.go.dev/vuln/GO-2025-3956",
              "properties": {
                "tags": [
                  "CVE-2025-47906",
                  "CVE-2025-47906"
                ]
              }
            },
            {
              "id": "GO-2025-4006",
              "shortDescription": {
                "text": "[GO-2025-4006] Excessive CPU consumption in ParseAddress in net/mail"
              },
              "fullDescription": {
                "text": "Excessive CPU consumption in ParseAddress in net/mail"
              },
              "help": {
                "text": "The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption."
              },
              "helpUri": "https://pkg.go.dev/vuln/GO-2025-4006",
              "properties": {
                "tags": [
                  "CVE-2025-61725",
                  "CVE-2025-61725"
                ]
              }
            },
            {
              "id": "GO-2025-4007",
              "shortDescription": {
                "text": "[GO-2025-4007] Quadratic complexity when checking name constraints in crypto/x509"
              },
              "fullDescription": {
                "text": "Quadratic complexity when checking name constraints in crypto/x509"
              },
              "help": {
                "text": "Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate.\n\nThis affects programs which validate arbitrary certificate chains."
              },
              "helpUri": "https://pkg.go.dev/vuln/GO-2025-4007",
              "properties": {
                "tags": [
                  "CVE-2025-58187",
                  "CVE-2025-58187"
                ]
              }
            },
            {
              "id": "GO-2025-4008",
              "shortDescription": {
                "text": "[GO-2025-4008] ALPN negotiation error contains attacker controlled information in crypto/tls"
              },
              "fullDescription": {
                "text": "ALPN negotiation error contains attacker controlled information in crypto/tls"
              },
              "help": {
                "text": "When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped."
              },
              "helpUri": "https://pkg.go.dev/vuln/GO-2025-4008",
              "properties": {
                "tags": [
                  "CVE-2025-58189",
                  "CVE-2025-58189"
                ]
              }
            },
            {
              "id": "GO-2025-4009",
              "shortDescription": {
                "text": "[GO-2025-4009] Quadratic complexity when parsing some invalid inputs in encoding/pem"
              },
              "fullDescription": {
                "text": "Quadratic complexity when parsing some invalid inputs in encoding/pem"
              },
              "help": {
                "text": "The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input.\n\nThis affects programs which parse untrusted PEM inputs."
              },
              "helpUri": "https://pkg.go.dev/vuln/GO-2025-4009",
              "properties": {
                "tags": [
                  "CVE-2025-61723",
                  "CVE-2025-61723"
                ]
              }
            },
            {
              "id": "GO-2025-4010",
              "shortDescription": {
                "text": "[GO-2025-4010] Insufficient validation of bracketed IPv6 hostnames in net/url"
              },
              "fullDescription": {
                "text": "Insufficient validation of bracketed IPv6 hostnames in net/url"
              },
              "help": {
                "text": "The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement."
              },
              "helpUri": "https://pkg.go.dev/vuln/GO-2025-4010",
              "properties": {
                "tags": [
                  "CVE-2025-47912",
                  "CVE-2025-47912"
                ]
              }
            },
            {
              "id": "GO-2025-4011",
              "shortDescription": {
                "text": "[GO-2025-4011] Parsing DER payload can cause memory exhaustion in encoding/asn1"
              },
              "fullDescription": {
                "text": "Parsing DER payload can cause memory exhaustion in encoding/asn1"
              },
              "help": {
                "text": "Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion."
              },
              "helpUri": "https://pkg.go.dev/vuln/GO-2025-4011",
              "properties": {
                "tags": [
                  "CVE-2025-58185",
                  "CVE-2025-58185"
                ]
              }
            },
            {
              "id": "GO-2025-4012",
              "shortDescription": {
                "text": "[GO-2025-4012] Lack of limit when parsing cookies can cause memory exhaustion in net/http"
              },
              "fullDescription": {
                "text": "Lack of limit when parsing cookies can cause memory exhaustion in net/http"
              },
              "help": {
                "text": "Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \"a=;\", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption."
              },
              "helpUri": "https://pkg.go.dev/vuln/GO-2025-4012",
              "properties": {
                "tags": [
                  "CVE-2025-58186",
                  "CVE-2025-58186"
                ]
              }
            },
            {
              "id": "GO-2025-4013",
              "shortDescription": {
                "text": "[GO-2025-4013] Panic when validating certificates with DSA public keys in crypto/x509"
              },
              "fullDescription": {
                "text": "Panic when validating certificates with DSA public keys in crypto/x509"
              },
              "help": {
                "text": "Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method.\n\nThis affects programs which validate arbitrary certificate chains."
              },
              "helpUri": "https://pkg.go.dev/vuln/GO-2025-4013",
              "properties": {
                "tags": [
                  "CVE-2025-58188",
                  "CVE-2025-58188"
                ]
              }
            },
            {
              "id": "GO-2025-4014",
              "shortDescription": {
                "text": "[GO-2025-4014] Unbounded allocation when parsing GNU sparse map in archive/tar"
              },
              "fullDescription": {
                "text": "Unbounded allocation when parsing GNU sparse map in archive/tar"
              },
              "help": {
                "text": "tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations."
              },
              "helpUri": "https://pkg.go.dev/vuln/GO-2025-4014",
              "properties": {
                "tags": [
                  "CVE-2025-58183",
                  "CVE-2025-58183"
                ]
              }
            },
            {
              "id": "GO-2025-4015",
              "shortDescription": {
                "text": "[GO-2025-4015] Excessive CPU consumption in Reader.ReadResponse in net/textproto"
              },
              "fullDescription": {
                "text": "Excessive CPU consumption in Reader.ReadResponse in net/textproto"
              },
              "help": {
                "text": "The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption."
              },
              "helpUri": "https://pkg.go.dev/vuln/GO-2025-4015",
              "properties": {
                "tags": [
                  "CVE-2025-61724",
                  "CVE-2025-61724"
                ]
              }
            },
            {
              "id": "GO-2025-4155",
              "shortDescription": {
                "text": "[GO-2025-4155] Excessive resource consumption when printing error string for host certificate validation in crypto/x509"
              },
              "fullDescription": {
                "text": "Excessive resource consumption when printing error string for host certificate validation in crypto/x509"
              },
              "help": {
                "text": "Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption."
              },
              "helpUri": "https://pkg.go.dev/vuln/GO-2025-4155",
              "properties": {
                "tags": [
                  "CVE-2025-61729",
                  "CVE-2025-61729"
                ]
              }
            },
            {
              "id": "GO-2025-4175",
              "shortDescription": {
                "text": "[GO-2025-4175] Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509"
              },
              "fullDescription": {
                "text": "Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509"
              },
              "help": {
                "text": "An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com."
              },
              "helpUri": "https://pkg.go.dev/vuln/GO-2025-4175",
              "properties": {
                "tags": [
                  "CVE-2025-61727"
                ]
              }
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "GO-2025-3764",
          "level": "error",
          "message": {
            "text": "Your code imports 7 vulnerable packages (github.com/go-pg/pg/v10, github.com/go-pg/pg/v10/internal, github.com/go-pg/pg/v10/internal/parser, github.com/go-pg/pg/v10/internal/pool, github.com/go-pg/pg/v10/orm, github.com/go-pg/pg/v10/pgjson, and github.com/go-pg/pg/v10/types). Run the call-level analysis to understand whether your code actually calls the vulnerabilities."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "go.mod",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              },
              "message": {
                "text": "Findings for vulnerability GO-2025-3764"
              }
            }
          ]
        },
        {
          "ruleId": "GO-2025-3849",
          "level": "error",
          "message": {
            "text": "Your code imports 1 vulnerable package (database/sql). Run the call-level analysis to understand whether your code actually calls the vulnerabilities."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "go.mod",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              },
              "message": {
                "text": "Findings for vulnerability GO-2025-3849"
              }
            }
          ]
        },
        {
          "ruleId": "GO-2025-3956",
          "level": "error",
          "message": {
            "text": "Your code imports 1 vulnerable package (os/exec). Run the call-level analysis to understand whether your code actually calls the vulnerabilities."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "go.mod",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              },
              "message": {
                "text": "Findings for vulnerability GO-2025-3956"
              }
            }
          ]
        },
        {
          "ruleId": "GO-2025-4006",
          "level": "error",
          "message": {
            "text": "Your code imports 1 vulnerable package (net/mail). Run the call-level analysis to understand whether your code actually calls the vulnerabilities."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "go.mod",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              },
              "message": {
                "text": "Findings for vulnerability GO-2025-4006"
              }
            }
          ]
        },
        {
          "ruleId": "GO-2025-4007",
          "level": "error",
          "message": {
            "text": "Your code imports 1 vulnerable package (crypto/x509). Run the call-level analysis to understand whether your code actually calls the vulnerabilities."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "go.mod",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              },
              "message": {
                "text": "Findings for vulnerability GO-2025-4007"
              }
            }
          ]
        },
        {
          "ruleId": "GO-2025-4008",
          "level": "error",
          "message": {
            "text": "Your code imports 1 vulnerable package (crypto/tls). Run the call-level analysis to understand whether your code actually calls the vulnerabilities."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "go.mod",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              },
              "message": {
                "text": "Findings for vulnerability GO-2025-4008"
              }
            }
          ]
        },
        {
          "ruleId": "GO-2025-4009",
          "level": "error",
          "message": {
            "text": "Your code imports 1 vulnerable package (encoding/pem). Run the call-level analysis to understand whether your code actually calls the vulnerabilities."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "go.mod",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              },
              "message": {
                "text": "Findings for vulnerability GO-2025-4009"
              }
            }
          ]
        },
        {
          "ruleId": "GO-2025-4010",
          "level": "error",
          "message": {
            "text": "Your code imports 1 vulnerable package (net/url). Run the call-level analysis to understand whether your code actually calls the vulnerabilities."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "go.mod",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              },
              "message": {
                "text": "Findings for vulnerability GO-2025-4010"
              }
            }
          ]
        },
        {
          "ruleId": "GO-2025-4011",
          "level": "error",
          "message": {
            "text": "Your code imports 1 vulnerable package (encoding/asn1). Run the call-level analysis to understand whether your code actually calls the vulnerabilities."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "go.mod",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              },
              "message": {
                "text": "Findings for vulnerability GO-2025-4011"
              }
            }
          ]
        },
        {
          "ruleId": "GO-2025-4012",
          "level": "error",
          "message": {
            "text": "Your code imports 1 vulnerable package (net/http). Run the call-level analysis to understand whether your code actually calls the vulnerabilities."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "go.mod",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              },
              "message": {
                "text": "Findings for vulnerability GO-2025-4012"
              }
            }
          ]
        },
        {
          "ruleId": "GO-2025-4013",
          "level": "error",
          "message": {
            "text": "Your code imports 1 vulnerable package (crypto/x509). Run the call-level analysis to understand whether your code actually calls the vulnerabilities."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "go.mod",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              },
              "message": {
                "text": "Findings for vulnerability GO-2025-4013"
              }
            }
          ]
        },
        {
          "ruleId": "GO-2025-4014",
          "level": "error",
          "message": {
            "text": "Your code imports 1 vulnerable package (archive/tar). Run the call-level analysis to understand whether your code actually calls the vulnerabilities."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "go.mod",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              },
              "message": {
                "text": "Findings for vulnerability GO-2025-4014"
              }
            }
          ]
        },
        {
          "ruleId": "GO-2025-4015",
          "level": "error",
          "message": {
            "text": "Your code imports 1 vulnerable package (net/textproto). Run the call-level analysis to understand whether your code actually calls the vulnerabilities."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "go.mod",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              },
              "message": {
                "text": "Findings for vulnerability GO-2025-4015"
              }
            }
          ]
        },
        {
          "ruleId": "GO-2025-4155",
          "level": "error",
          "message": {
            "text": "Your code imports 1 vulnerable package (crypto/x509). Run the call-level analysis to understand whether your code actually calls the vulnerabilities."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "go.mod",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              },
              "message": {
                "text": "Findings for vulnerability GO-2025-4155"
              }
            }
          ]
        },
        {
          "ruleId": "GO-2025-4175",
          "level": "error",
          "message": {
            "text": "Your code imports 1 vulnerable package (crypto/x509). Run the call-level analysis to understand whether your code actually calls the vulnerabilities."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "go.mod",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 1
                }
              },
              "message": {
                "text": "Findings for vulnerability GO-2025-4175"
              }
            }
          ]
        }
      ]
    }
  ]
}

you can download the artifact here - https://github.com/projectdiscovery/nuclei/actions/runs/20714004275

[mbg]

The content from the workflow is different from what I have locally. This is the content from the workflow;

That does confirm the duplicate tags. I have also tried this myself locally by cloning your repo and running govulncheck on it and can see the same results (with the duplicate tags).

Looks like an issue with govulncheck and I'd suggest reporting the problem there. I'll close the issue here, since the schema validation is working as expected.

[dwisiswant0]

Thanks for the clarification and for double-checking locally, @mbg.

I’ll report this upstream to govulncheck. Appreciate the help!