Repository navigation
fix(deps): update compress for CVE-2026-116591 (4.10) - #23824
dashrews78 wants to merge 1 commit into
Conversation
Backport the v1.20.3 dependency update already merged in #23464. This includes the upstream zstd two-block panic fix without application changes. User request: "Create all the necessary PRs in stackrox and scanner." This change was partially generated by AI.
|
Skipping CI for Draft Pull Request. |
|
Images are ready for the commit at 39bb308. To use with deploy scripts, first |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## release-4.10 #23824 +/- ##
================================================
- Coverage 49.52% 49.51% -0.01%
================================================
Files 2663 2663
Lines 201394 201394
================================================
- Hits 99737 99727 -10
- Misses 94202 94212 +10
Partials 7455 7455
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
@dashrews78: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Description
Backport the compress v1.20.3 update from #23464 to release-4.10 to include the CVE-2026-116591 zstd decoder fix. Updating the shared root dependency covers the binaries built from this module; legacy Scanner is updated separately in stackrox/scanner.
User-facing documentation
Testing and quality
Automated testing
How I validated my change
go list -m github.com/klauspost/compress: v1.20.3.TestDecoderHuffWeightsTableLogpasses (covers the CVE input in DecodeAll and streaming modes).git diff --checkpasses.make stylewas attempted but local validation is incomplete; CI review remains pending.Dependency-only change; existing regression and application tests were reused.