From 8e652cd35ffbb172955a5cb00a1bb285a9678f61 Mon Sep 17 00:00:00 2001 From: tommyd450 Date: Mon, 2 Nov 2026 09:18:07 +0000 Subject: [PATCH] Bump klauspost/compress to v1.20.2 Fixes CVE-2026-116591: zstd DecodeAll and streaming decoder panic on crafted two-block frames due to integer overflow in huff0.ReadTable. Co-Authored-By: Claude Opus 4.6 --- go.mod | 2 ++ go.sum | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/go.mod b/go.mod index 2c94ffb7e..d5adba481 100644 --- a/go.mod +++ b/go.mod @@ -46,6 +46,8 @@ require ( sigs.k8s.io/release-utils v0.12.4 ) +require github.com/klauspost/compress v1.20.2 // indirect + require ( cloud.google.com/go v0.123.0 // indirect cloud.google.com/go/auth v0.22.0 // indirect diff --git a/go.sum b/go.sum index 777a2840d..a9164cfb0 100644 --- a/go.sum +++ b/go.sum @@ -210,8 +210,8 @@ github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRt github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk= -github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.20.2 h1:v5tiZvm1KGLyg5d5oXdXe3lsSPrbEUiKoXGia//I7Qo= +github.com/klauspost/compress v1.20.2/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=