What changed
Agent Deck 1.16.28 rebuilds the terminal manager for Claude, Gemini, OpenCode and Codex with Go 1.26.9 and golang.org/x/net 0.60.0. The maintainer says this clears thirteen govulncheck advisories carried by 1.16.27, while noting that the cited HTTP/2 HPACK crash was not reachable because Agent Deck does not serve HTTP/2.
Why it matters
Agent supervisors sit beside credentials, prompts, repositories and long-lived sessions. Even when one listed flaw is not reachable, shipping binaries on patched runtime and network libraries narrows avoidable exposure in a tool that coordinates multiple coding agents.
What to do
If Agent Deck is installed, upgrade to 1.16.28, record the binary version and installation source, run the project's normal session and remote-control smoke tests, and rescan the exact binary or source tree with govulncheck before treating the advisory set as closed in your environment.
Caveat
The advisory-closure and reachability statements come from the project maintainer; this release does not provide an independent exploitability analysis for every advisory. A dependency upgrade does not validate Agent Deck's own session, credential, web UI or remote-control security boundaries.