Repository navigation
fix(deps): bump klauspost/compress to v1.20.2 (GO-2026-6865 fails CI Security Scanning) #1799
Description
govulncheck (CI "Security Scanning", pinned at v1.1.4) now reports GO-2026-6865 in github.com/klauspost/compress. The module is found at v1.18.7, an indirect dependency (go.mod:155), and the advisory says it's fixed in v1.20.2. The vulnerable code is reachable, for example through config.PostgresStore.SavePurchaseExecutionTx (internal/config/store_postgres.go:1160).
Main's last CI (e86860cb) ran before the advisory was published and passed. Every new run fails the job, including PR #1239's run 42166194527, so every open PR and main will turn red on their next CI.
Fix
Bump it as a direct requirement:
go get github.com/klauspost/compress@v1.20.2go mod tidy- Check that
tests/e2e, the separate module, doesn't need it too. - Run
govulncheck ./...locally with the pinned v1.1.4, then build and run the tests.
Activity
cristim commentedon Nov 6, 2026
Claimed by claude-cc-platform: bumping klauspost/compress to v1.20.2 as a local commit. The PR opens when a platform slot frees up or the coordinator clears it as a CI unblocker.
cristim commentedon Nov 6, 2026
Claimed by claude-cc-platform: released. #1805 carries the same bump (klauspost/compress v1.18.7 to v1.20.2, go.mod and go.sum only), so I'm dropping my local copy and not opening a duplicate PR.
cristim commentedon Nov 7, 2026
Fixed by #1805, which merged 2026-11-06. Main's
go.modnow pinsgithub.com/klauspost/compress v1.20.2 // indirect, the fixed release for GO-2026-6865, and later PRs have passed the Security Scanning job (for example #1833). #1805 didn't use a closing keyword, so this issue stayed open.