[cristim]

Summary

govulncheck reports GO-2026-6865 in github.com/klauspost/compress v1.18.7, an indirect dependency. The security scan therefore fails on every platform PR (for example run 42168560467 on #1800). This bumps the module to v1.20.2, the fixed release, with go get github.com/klauspost/compress@v1.20.2 && go mod tidy. The change is 3 lines each in go.mod and go.sum. There are no code changes, and go mod verify passes.

cloud-commitments-go, cloud-commitments-mcp and cloud-commitments-cli don't depend on klauspost/compress (it isn't in any of their go.mod or go.sum files), so they need nothing.

Verification (local, throttled)

• govulncheck ./...: GO-2026-6865 is no longer reported.
• go build ./... passes.
• go test -short ./internal/... passes.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated an internal component. No changes to user-facing features or behavior are included.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The indirect github.com/klauspost/compress dependency is upgraded from v1.18.7 to v1.20.2.

Changes: Compression dependency update

Layer / File(s)	Summary
Upgrade compression dependency go.mod	The indirect github.com/klauspost/compress requirement changes from v1.18.7 to v1.20.2.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related issues

• LeanerCloud/cloud-commitments-platform#1799: The issue reports GO-2026-6865 in github.com/klauspost/compress v1.18.7 and requests v1.20.2. This PR updates the dependency to that version.

Suggested labels: type/bug

Suggested reviewers: iamjsd

Merge Risk: Minimal · up to ab857

No concrete merge-blocking issue is established for this dependency update; merge after normal dependency and build checks pass.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title identifies the dependency update, target version, and vulnerability finding.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-platform
• Branch: fix/deps-klauspost-compress-1-20-2
• File: .coderabbit.yaml
• Commit: ab8577d
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 82561c25-a976-43b8-b586-21cf1e3054a1

Commits

Reviewing files that changed from the base of the PR and between e86860c and ab8577d.

Files ignored due to path filters: 1

• go.sum is excluded by !**/*.sum

Files selected for processing: 1

• go.mod

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[cristim]

APPROVED ab8577d by claude-ui-fix-2

Cold review of a dependency-only change (+3/-3).

• Scope: go.mod changes exactly one line, github.com/klauspost/compress v1.18.7 → v1.20.2 // indirect. go.sum replaces exactly that module's two lines (h1 and /go.mod). No other module, and no code, moves.
• Integrity: the new hashes match what the Go module proxy serves for v1.20.2 (go mod download -json): h1:v5tiZvm1…7Qo= and go.mod h1:LUdAzn7Y…YuI=.
• Advisory: v1.20.2 is the "Fixed in" release for GO-2026-6865, and the scanner reached it through SavePurchaseExecutionTx → json.Marshal on fix(recommendations): key stored recs, rec ID and purchase identity on RDS az_config (#408) #1239's run.
• CI at this SHA: 41/41 pass, including Security Scanning (govulncheck now clean), Snyk, both Docker builds, the frontend build, and CI Success, which covers build and tests.

I ran no local build. CI covers build and tests at this exact SHA, and memory on the machine is tight.

[cristim]

APPROVED ab8577d by claude-qa-ui-4

• go.mod:155 and go.sum:259-260 change only github.com/klauspost/compress v1.18.7 -> v1.20.2 (indirect); no other module moves.
• Local at this head (GOMAXPROCS=4): go mod verify passes (all modules verified), go mod tidy leaves no diff, govulncheck ./... reports no vulnerabilities, go build ./... passes.
• go test -short ./internal/... locally reported "[build failed]" for several test packages under heavy memory pressure (swap ~97%); I could not get the error text before stopping the run under the memory guard, so that local result is inconclusive. CI at this head is 41/41 green, including unit, all integration suites and E2E.

[cristim]

Merged at head ab8577d as 824a923. Gate evidence:

• Cold approvals at the head: claude-ui-fix-2 and claude-qa-ui-4.
• CI green at the head (41/41, including Security Scanning). 0 unresolved threads. Merge state CLEAN.
• Combo on main 04f3515 (after chore(deps): bump cloud-commitments-go to 790f369f and forward the RI offering type #1796's go pin bump touched the same go.mod and go.sum): auto-merged cleanly, go build ./... passes, and govulncheck ./... reports no vulnerabilities.
• This unblocks the security scan on every platform PR.