lukaszraczylo/graphql-monitoring-proxy
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/graphql-monitoring-proxy.git synced 2026-10-20 06:28:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(deps): bump klauspost/compress to v1.18.7 for s2 out-of-bounds read (GHSA-259r-337f-4rfw)

Browse Source 
The indirect dependency github.com/klauspost/compress v1.18.6 contained an out-of-bounds read in the s2 package (GO-2026-5841). The proxy pulls this module in through valyala/fasthttp. govulncheck reports the vulnerable path as unreachable, so the real risk is low, but v1.18.7 removes the defect. The bump is a patch release with no API change.
This commit is contained in:
lukaszraczylo
2026-08-17 19:30:07 +01:00
parent 8258b3d99a
commit 3bce659203
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+1 -1
View File
@@ -49,7 +49,7 @@ require (
github.com/jackc/pgpassfile v1.0.0 // indirect
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
github.com/jackc/puddle/v2 v2.2.2 // indirect
github.com/klauspost/compress v1.18.6 // indirect
github.com/klauspost/compress v1.18.7 // indirect
github.com/mattn/go-colorable v0.1.15 // indirect
github.com/mattn/go-isatty v0.0.22 // indirect
github.com/philhofer/fwd v1.2.0 // indirect