Repository navigation
fix(deps): compress, x/net and zlib security fixes, v0.1.32 - #213
Merged
Merged
Conversation
- github.com/klauspost/compress 1.20.2 fixes GO-2026-6865. v1.20.2 is the narrow security release; v1.20.3 also rewrites parts of the zstd decoder. - golang.org/x/net 0.62.0 fixes CVE-2026-78661, which Trivy reports on the gateway binary by module version. The binary doesn't compile x/net/html. - alpine 3.24.3 has zlib 1.3.2-r1, which fixes CVE-2026-85091. It's the oldest base with the fix, so it also meets the 7-day rule.
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| JavaScript |  |
Nov 6, 2026 8:16p.m. | Review ↗ |
| Go | |
Nov 6, 2026 8:16p.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The nightly Security Scan started failing on advisories published this week. This takes the fixes and bumps the version, because
image-scanchecks the published:latestimage and only a new release can clear it.klauspost/compress1.20.1, in the CLI only (go list -deps ./cmd/gatewaydoesn't list it)gz_vacate()(HIGH)alpine:3.24.2base, in all three Dockerfilesalpine:3.24.3, which has 1.3.2-r1golang.org/x/net0.61.0, flagged on the gateway binary by module version, though the binary doesn't compilex/net/htmlVersions chosen
Testing
--severity HIGH,CRITICAL --ignore-unfixed) reports 2 findings on the published v0.1.31 image (zlib and x/net) and 0 on an image built from this branch. That image was built withoutCOPY --chmod, because the test machine has no BuildKit; the Dockerfile itself is built by therelease-smokejob.govulncheck ./...passes on this branch. It reports GO-2026-6865 and fails onmain.After merging: tag v0.1.32.
image-scanstays red until the Release workflow has published it.