From c014fe3ee1f08d219d50f587cd878452eb262f39 Mon Sep 17 00:00:00 2001 From: Juan Antonio Osorio Date: Mon, 27 Jul 2026 17:57:51 +0000 Subject: [PATCH] Bump klauspost/compress to v1.18.7 GO-2026-5841 (GHSA-259r-337f-4rfw), an out-of-bounds read in github.com/klauspost/compress/s2, is fixed in v1.18.7. We were on v1.18.6, so govulncheck fails on main and on every open PR. The advisory is newly published rather than newly introduced: the same Go Vulnerability Check passed on PR #6031 at 17:08 and failed at 17:52 on a test-only delta. govulncheck queries the advisory database at run time, so nothing in the tree changed -- the database did. Bumped rather than added to the workflow's IGNORED_VULNS. That list is reserved for advisories with no available fix (GO-2026-5932, openpgp deprecated-by-design) or an unavoidable toolchain lag (GO-2026-5037/38/39, pending a setup-go manifest refresh), each with a written justification. This one has a fixed version, so excluding it would misuse that mechanism. The dependency stays indirect: it reaches us via prometheus/client_golang -> klauspost/compress/zstd. Only zstd is used, not the affected s2 package, so exposure was low -- but the fix is one line, so reachability does not need arguing. --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 4346886b7a..f36f0b4d09 100644 --- a/go.mod +++ b/go.mod @@ -197,7 +197,7 @@ require ( github.com/jpillora/backoff v1.0.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/kevinburke/ssh_config v1.2.0 // indirect - github.com/klauspost/compress v1.18.6 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/lestrrat-go/option/v2 v2.0.0 // indirect github.com/lucasb-eyer/go-colorful v1.4.0 // indirect github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect diff --git a/go.sum b/go.sum index 8a58454cd7..46e747c7c2 100644 --- a/go.sum +++ b/go.sum @@ -496,8 +496,8 @@ github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4 github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao= -github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y= github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0= github.com/knadh/koanf/maps v0.1.1 h1:G5TjmUh2D7G2YWf5SQQqSiHRJEjaicvU0KpypqB3NIs=