STAC-25556: bump klauspost/compress to v1.18.7 and drop the cleared CVE exceptions - #495
Merged
LouisParkin merged 2 commits intoAug 24, 2026
Merged
Conversation
LouisParkin
added a commit
that referenced
this pull request
Aug 24, 2026
…7.78.2-5 CVE-2026-69247 (fixed in cryptography 50.0.0) and CVE-2026-69249 (fixed in 49.0.0) are both cleared by the bump to integrations 7.78.2-5, whose agent_requirements.in moves cryptography 48.0.1 -> 50.0.0. The agent does not pin cryptography itself; omnibus rebuilds whatever the integrations release installs, so the release tag is the only input. That bump is PR #494, so these two files are only obsolete once it merges. Carried here rather than added to #494 to avoid rerunning its build, which is already green. Nothing depends on merge order: both image scans currently run mode: inform, so an unmatched finding reports but cannot fail a build. If #495 lands first, the two CVEs simply appear un-excepted in the report until #494 follows. CVE-2026-69248 stays. Trivy publishes no fixed version for it, and while its statement expects the same bump to clear it incidentally, that is a prediction rather than something to delete an exception on. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
LouisParkin
changed the title
LouisParkin
added a commit
that referenced
this pull request
Aug 24, 2026
…7.78.2-5 CVE-2026-69247 (fixed in cryptography 50.0.0) and CVE-2026-69249 (fixed in 49.0.0) are both cleared by the bump to integrations 7.78.2-5, whose agent_requirements.in moves cryptography 48.0.1 -> 50.0.0. The agent does not pin cryptography itself; omnibus rebuilds whatever the integrations release installs, so the release tag is the only input. That bump is PR #494, so these two files are only obsolete once it merges. Carried here rather than added to #494 to avoid rerunning its build, which is already green. Nothing depends on merge order: both image scans currently run mode: inform, so an unmatched finding reports but cannot fail a build. If #495 lands first, the two CVEs simply appear un-excepted in the report until #494 follows. CVE-2026-69248 stays. Trivy publishes no fixed version for it, and while its statement expects the same bump to clear it incidentally, that is a prediction rather than something to delete an exception on. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
LouisParkin
force-pushed
the
STAC-25556-bump-klauspost-compress
branch
from
August 24, 2026 10:23
4c3694b to
3bd71e7
Compare
GO-2026-5841 (GHSA-259r-337f-4rfw) is an out-of-bounds read in the s2 encoder, reachable via s2.NewDict with a crafted dictionary. It affects v1.16.0 up to v1.18.7, which is the fix. The agent never imports compress/s2 -- only zstd, zlib and flate -- so the vulnerable symbol is not reachable from our command graph. The bump is still the right fix rather than a VEX statement: it is a patch release on a direct dependency, so it costs less than arguing reachability to an SCA scanner that matches on version. Applied with `go get` on the root module followed by `go work sync`, which is what CI's check-mod-tidy reproduces. `go mod tidy` on the root is a no-op afterwards. Two modules stay behind deliberately: datadogconnector (v1.18.0) and test/integration/serverless/src (v1.17.11) are outside the workspace and outside the root build graph, so they reach no shipped binary and tidy would not upgrade them either. Drops the two GO-2026-5841 exception files, which pinned the finding at v1.18.5 and existed only as a bridge until this bump landed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…7.78.2-5 CVE-2026-69247 (fixed in cryptography 50.0.0) and CVE-2026-69249 (fixed in 49.0.0) are both cleared by the bump to integrations 7.78.2-5, whose agent_requirements.in moves cryptography 48.0.1 -> 50.0.0. The agent does not pin cryptography itself; omnibus rebuilds whatever the integrations release installs, so the release tag is the only input. That bump is PR #494, so these two files are only obsolete once it merges. Carried here rather than added to #494 to avoid rerunning its build, which is already green. Nothing depends on merge order: both image scans currently run mode: inform, so an unmatched finding reports but cannot fail a build. If #495 lands first, the two CVEs simply appear un-excepted in the report until #494 follows. CVE-2026-69248 stays. Trivy publishes no fixed version for it, and while its statement expects the same bump to clear it incidentally, that is a prediction rather than something to delete an exception on. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
LouisParkin
force-pushed
the
STAC-25556-bump-klauspost-compress
branch
from
August 24, 2026 12:46
3bd71e7 to
059dc63
Compare
LouisParkin
enabled auto-merge
August 24, 2026 13:48
|
P2: Please delete Upstream advisory: GHSA-m2h6-j472-rp4c |
LouisLotter
approved these changes
Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two changes, both closing out STAC-25556.
1.
klauspost/compressv1.18.5 -> v1.18.7, clearing GO-2026-5841 (OOB read in the s2 encoder). Applied withgo geton the root module thengo work sync— the same pair CI'scheck-mod-tidyreproduces — so the diff is large but mechanical: every changed line in all 87 module files is the version string, andgo mod tidyon the root is a no-op afterwards.datadogconnector(v1.18.0) andtest/integration/serverless/src(v1.17.11) stay behind on purpose; both sit outside the workspace and outside the root build graph, so they reach no shipped binary.2. Deletes three now-obsolete exception files.
GO-2026-5841(both images) is cleared by change 1.CVE-2026-69247andCVE-2026-69249are cleared by cryptography 50.0.0, which arrives with integrations7.78.2-5in #494 — the agent does not pin cryptography itself, so the release tag is the only input.CVE-2026-69248stays: no upstream fix published.Merge order does not matter. Both image scans currently run
mode: inform, so an unmatched finding reports but cannot fail a build. If this lands before #494, those two CVEs just appear un-excepted in the report until #494 follows. Carried here rather than added to #494 so that green build does not have to rerun.Reviewer note: we never import
compress/s2, so the vulnerables2.NewDictpath was not reachable. Bumping was still cheaper than arguing reachability to a scanner that matches on version.Validated:
pkg/util/compressionbuilds and its tests pass, includingimpl-zstd-nocgo(the klauspost zstd implementation).That
mode: informgap is now tracked separately as STAC-25626.https://stackstate.atlassian.net/browse/STAC-25556