#BoltDB is a Go rewrite of #LMDB (mostly; it has a lot more limitations). It's no longer maintained. Since 2021 some forks had a backdoor giving remote command access to machines.
https://snyk.io/blog/go-malicious-package-alert/
All of this is inconceivable for LMDB, since it has no other dependencies. Also, the thought of an embedded DB engine having access to any networking APIs at all is just mindboggling.
The Go build system, and its automatic pulling of dependencies from github, is ludicrous.
#golang