Repository navigation
fix(deps): update compress for CVE-2026-116591 (master) - #4130
dashrews78 wants to merge 1 commit into
Conversation
Update the shared full/slim Scanner dependency to the fixed version already used by StackRox master. This includes the upstream zstd two-block panic fix without application changes. User request: "Create all the necessary PRs in stackrox and scanner." This change was partially generated by AI.
dashrews78
added
dependencies
|
Skipping CI for Draft Pull Request. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update the dependency version go.mod |
The indirect github.com/klauspost/compress dependency version changes from v1.19.1 to v1.20.3. |
Estimated code review effort: 1 (Trivial) | ~3 minutes
Change: Other
Suggested reviewers: bradlugo
Merge Risk: 
2c5db
-
No merge-blocking risk is identified in this dependency-only update.
Pre-merge checks: 
-
Check name Status Explanation Title check The title clearly identifies the dependency update and its security purpose. It is concise and directly related to the changeset. Description check The description accurately explains the dependency upgrade, security fix, affected builds, and reported validation. It is directly related to the changeset. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
Finishing Touches
-
Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
|
@dashrews78: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Update github.com/klauspost/compress from v1.19.1 to v1.20.3, including the CVE-2026-116591 zstd decoder fix. This uses the version already merged in stackrox/stackrox#23464 and updates the dependency shared by full and slim Scanner builds.
Validation: upstream
TestDecoderHuffWeightsTableLogandpkg/tarutiltests pass;pkg/vulndumpcompiles; module selection is v1.20.3;git diff --checkpasses.make stylewas attempted but blocked by an invalid protoc archive during local tooling setup. CI review is pending.