From d2def6bffd1e8b856bba4ad880d0062975d279b2 Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Fri, 21 Aug 2026 14:41:20 +0000 Subject: [PATCH 1/2] Bump klauspost/compress to v1.18.7 for GO-2026-5841 GO-2026-5841 is an out-of-bounds read in github.com/klauspost/compress/s2, introduced in 1.16.0 and fixed in 1.18.7. The agent and cluster-agent images both still carried v1.18.5, and the exception covering it expired 2026-08-20. Bumped in the 19 workspace modules that pinned v1.18.5, then re-synced with go work sync and per-module go mod tidy; go work sync added the indirect requirement to two more modules. datadogconnector (v1.18.0) and test/integration/serverless/src (v1.17.11) are outside go.work and ship in neither image, so they are left for separate review. The GO-2026-5841 exceptions are dropped rather than renewed: with the fix in source they would suppress a regression instead of documenting a gap. Verified that the rebuilt cluster-agent and process-agent binaries embed compress v1.18.7 via go version -m, and that a cluster-agent image carrying the rebuilt binary reports zero Trivy and zero Grype findings, down from 9 and 6 on the published tag. Refs: StackVista/cve-reporter#29 Tracking: #492 Co-authored-by: Cve Ticket Reconciler --- comp/core/agenttelemetry/impl/go.sum | 4 ++-- comp/core/configsync/go.sum | 4 ++-- comp/core/secrets/impl/go.sum | 4 ++-- comp/core/tagger/fx-remote/go.sum | 4 ++-- comp/core/tagger/impl-remote/go.sum | 4 ++-- comp/core/tagger/subscriber/go.sum | 4 ++-- comp/core/telemetry/go.mod | 2 +- comp/core/telemetry/go.sum | 4 ++-- comp/forwarder/defaultforwarder/go.sum | 4 ++-- .../orchestrator/orchestratorinterface/go.sum | 4 ++-- comp/otelcol/collector-contrib/def/go.mod | 1 + comp/otelcol/collector-contrib/def/go.sum | 4 ++-- comp/otelcol/collector-contrib/impl/go.mod | 2 +- comp/otelcol/collector-contrib/impl/go.sum | 4 ++-- comp/otelcol/ddflareextension/impl/go.mod | 2 +- comp/otelcol/ddflareextension/impl/go.sum | 4 ++-- comp/otelcol/ddprofilingextension/impl/go.mod | 2 +- comp/otelcol/ddprofilingextension/impl/go.sum | 4 ++-- comp/otelcol/logsagentpipeline/go.sum | 4 ++-- .../logsagentpipelineimpl/go.sum | 4 ++-- .../exporter/datadogexporter/go.mod | 2 +- .../exporter/datadogexporter/go.sum | 4 ++-- .../exporter/logsagentexporter/go.mod | 2 +- .../exporter/logsagentexporter/go.sum | 4 ++-- .../exporter/serializerexporter/go.mod | 2 +- .../exporter/serializerexporter/go.sum | 4 ++-- .../processor/infraattributesprocessor/go.sum | 4 ++-- comp/otelcol/status/impl/go.sum | 4 ++-- comp/serializer/logscompression/go.sum | 4 ++-- comp/serializer/metricscompression/go.sum | 4 ++-- .../stackstate-k8s-agent/GO-2026-5841.yaml | 24 ------------------- .../GO-2026-5841.yaml | 23 ------------------ go.mod | 2 +- go.sum | 4 ++-- internal/tools/gotest-custom/go.mod | 2 +- internal/tools/gotest-custom/go.sum | 4 ++-- pkg/config/remote/go.sum | 4 ++-- pkg/fleet/installer/go.mod | 2 +- pkg/fleet/installer/go.sum | 4 ++-- pkg/logs/client/go.sum | 4 ++-- pkg/logs/metrics/go.sum | 4 ++-- pkg/logs/pipeline/go.sum | 4 ++-- pkg/logs/processor/go.sum | 4 ++-- pkg/logs/sender/go.sum | 4 ++-- pkg/metrics/go.sum | 4 ++-- pkg/network/driver/go.sum | 4 ++-- pkg/opentelemetry-mapping-go/otlp/logs/go.mod | 2 +- pkg/opentelemetry-mapping-go/otlp/logs/go.sum | 4 ++-- pkg/process/util/api/go.mod | 2 +- pkg/process/util/api/go.sum | 4 ++-- pkg/serializer/go.mod | 2 +- pkg/serializer/go.sum | 4 ++-- pkg/telemetry/go.sum | 4 ++-- pkg/trace/otel/go.sum | 4 ++-- pkg/util/compression/go.mod | 2 +- pkg/util/compression/go.sum | 4 ++-- pkg/util/grpc/go.sum | 4 ++-- pkg/util/prometheus/go.mod | 1 + pkg/util/prometheus/go.sum | 4 ++-- ...ress-cve-remediation-7c4e19b06d2f83a1.yaml | 5 ++++ test/e2e-framework/go.mod | 2 +- test/e2e-framework/go.sum | 4 ++-- test/fakeintake/go.mod | 2 +- test/fakeintake/go.sum | 4 ++-- test/new-e2e/go.mod | 2 +- test/new-e2e/go.sum | 4 ++-- test/otel/go.mod | 2 +- test/otel/go.sum | 4 ++-- tools/build-ddot-byoc/go.mod | 2 +- tools/build-ddot-byoc/go.sum | 4 ++-- 70 files changed, 118 insertions(+), 158 deletions(-) delete mode 100644 exceptions/stackstate-k8s-agent/GO-2026-5841.yaml delete mode 100644 exceptions/stackstate-k8s-cluster-agent/GO-2026-5841.yaml create mode 100644 releasenotes/notes/issue-492-klauspost-compress-cve-remediation-7c4e19b06d2f83a1.yaml diff --git a/comp/core/agenttelemetry/impl/go.sum b/comp/core/agenttelemetry/impl/go.sum index 22b428322665..3583e277e948 100644 --- a/comp/core/agenttelemetry/impl/go.sum +++ b/comp/core/agenttelemetry/impl/go.sum @@ -39,8 +39,8 @@ github.com/itchyny/gojq v0.12.17 h1:8av8eGduDb5+rvEdaOO+zQUjA04MS0m3Ps8HiD+fceg= github.com/itchyny/gojq v0.12.17/go.mod h1:WBrEMkgAfAGO1LUcGOckBl5O726KPp+OlkKug0I/FEY= github.com/itchyny/timefmt-go v0.1.6 h1:ia3s54iciXDdzWzwaVKXZPbiXzxxnv1SPGFfM/myJ5Q= github.com/itchyny/timefmt-go v0.1.6/go.mod h1:RRDZYC5s9ErkjQvTvvU7keJjxUYzIISJGxm9/mAERQg= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/comp/core/configsync/go.sum b/comp/core/configsync/go.sum index e347f42ed6ab..c6e2160725d5 100644 --- a/comp/core/configsync/go.sum +++ b/comp/core/configsync/go.sum @@ -33,8 +33,8 @@ github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94 h1:0G5JVG0aJDpWvH1r github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94/go.mod h1:MvF7bZQy5lD2WcLXjFytRVvnTrFvrjo/qGka1MIBOPE= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/comp/core/secrets/impl/go.sum b/comp/core/secrets/impl/go.sum index 29629dd2e70c..fdeb9d4e05dd 100644 --- a/comp/core/secrets/impl/go.sum +++ b/comp/core/secrets/impl/go.sum @@ -42,8 +42,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/comp/core/tagger/fx-remote/go.sum b/comp/core/tagger/fx-remote/go.sum index d931b3607600..c56d8c68889e 100644 --- a/comp/core/tagger/fx-remote/go.sum +++ b/comp/core/tagger/fx-remote/go.sum @@ -85,8 +85,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= diff --git a/comp/core/tagger/impl-remote/go.sum b/comp/core/tagger/impl-remote/go.sum index d931b3607600..c56d8c68889e 100644 --- a/comp/core/tagger/impl-remote/go.sum +++ b/comp/core/tagger/impl-remote/go.sum @@ -85,8 +85,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= diff --git a/comp/core/tagger/subscriber/go.sum b/comp/core/tagger/subscriber/go.sum index 4375a660bc89..e169f1f29a78 100644 --- a/comp/core/tagger/subscriber/go.sum +++ b/comp/core/tagger/subscriber/go.sum @@ -9,8 +9,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= diff --git a/comp/core/telemetry/go.mod b/comp/core/telemetry/go.mod index 159d23ff4ea0..c370d4b260b4 100644 --- a/comp/core/telemetry/go.mod +++ b/comp/core/telemetry/go.mod @@ -20,7 +20,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect - github.com/klauspost/compress v1.18.5 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect github.com/prometheus/procfs v0.20.1 // indirect diff --git a/comp/core/telemetry/go.sum b/comp/core/telemetry/go.sum index f7428495a300..1bc8f6dd044d 100644 --- a/comp/core/telemetry/go.sum +++ b/comp/core/telemetry/go.sum @@ -9,8 +9,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= diff --git a/comp/forwarder/defaultforwarder/go.sum b/comp/forwarder/defaultforwarder/go.sum index e8b8ff14fa6a..cfeabbfb5669 100644 --- a/comp/forwarder/defaultforwarder/go.sum +++ b/comp/forwarder/defaultforwarder/go.sum @@ -44,8 +44,8 @@ github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94 h1:0G5JVG0aJDpWvH1r github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94/go.mod h1:MvF7bZQy5lD2WcLXjFytRVvnTrFvrjo/qGka1MIBOPE= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/comp/forwarder/orchestrator/orchestratorinterface/go.sum b/comp/forwarder/orchestrator/orchestratorinterface/go.sum index 5b4d588a4108..fd0202f48314 100644 --- a/comp/forwarder/orchestrator/orchestratorinterface/go.sum +++ b/comp/forwarder/orchestrator/orchestratorinterface/go.sum @@ -48,8 +48,8 @@ github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94 h1:0G5JVG0aJDpWvH1r github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94/go.mod h1:MvF7bZQy5lD2WcLXjFytRVvnTrFvrjo/qGka1MIBOPE= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/comp/otelcol/collector-contrib/def/go.mod b/comp/otelcol/collector-contrib/def/go.mod index 9a999c5d2352..4f1d962eaac4 100644 --- a/comp/otelcol/collector-contrib/def/go.mod +++ b/comp/otelcol/collector-contrib/def/go.mod @@ -58,6 +58,7 @@ require ( github.com/hashicorp/go-version v1.9.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/json-iterator/go v1.1.12 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/knadh/koanf/maps v0.1.2 // indirect github.com/knadh/koanf/providers/confmap v1.0.0 // indirect github.com/knadh/koanf/v2 v2.3.4 // indirect diff --git a/comp/otelcol/collector-contrib/def/go.sum b/comp/otelcol/collector-contrib/def/go.sum index 934f3185315d..0fd0bbbd91a5 100644 --- a/comp/otelcol/collector-contrib/def/go.sum +++ b/comp/otelcol/collector-contrib/def/go.sum @@ -50,8 +50,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo= github.com/knadh/koanf/maps v0.1.2/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI= github.com/knadh/koanf/providers/confmap v1.0.0 h1:mHKLJTE7iXEys6deO5p6olAiZdG5zwp8Aebir+/EaRE= diff --git a/comp/otelcol/collector-contrib/impl/go.mod b/comp/otelcol/collector-contrib/impl/go.mod index 43e239f92c7b..4f1f4d8654c1 100644 --- a/comp/otelcol/collector-contrib/impl/go.mod +++ b/comp/otelcol/collector-contrib/impl/go.mod @@ -296,7 +296,7 @@ require ( github.com/jpillora/backoff v1.0.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/julienschmidt/httprouter v1.3.0 // indirect - github.com/klauspost/compress v1.18.5 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/klauspost/cpuid/v2 v2.3.0 // indirect github.com/knadh/koanf/maps v0.1.2 // indirect github.com/knadh/koanf/providers/confmap v1.0.0 // indirect diff --git a/comp/otelcol/collector-contrib/impl/go.sum b/comp/otelcol/collector-contrib/impl/go.sum index ba3d182edd76..2276715e7efc 100644 --- a/comp/otelcol/collector-contrib/impl/go.sum +++ b/comp/otelcol/collector-contrib/impl/go.sum @@ -477,8 +477,8 @@ github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRt github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y= github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0= github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo= diff --git a/comp/otelcol/ddflareextension/impl/go.mod b/comp/otelcol/ddflareextension/impl/go.mod index b1c344cd82f9..42fffa3f4ed4 100644 --- a/comp/otelcol/ddflareextension/impl/go.mod +++ b/comp/otelcol/ddflareextension/impl/go.mod @@ -346,7 +346,7 @@ require ( github.com/jpillora/backoff v1.0.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/julienschmidt/httprouter v1.3.0 // indirect - github.com/klauspost/compress v1.18.5 // indirect; indirectq + github.com/klauspost/compress v1.18.7 // indirect; indirectq github.com/knadh/koanf/maps v0.1.2 // indirect github.com/knadh/koanf/providers/confmap v1.0.0 // indirect github.com/knadh/koanf/v2 v2.3.4 // indirect diff --git a/comp/otelcol/ddflareextension/impl/go.sum b/comp/otelcol/ddflareextension/impl/go.sum index fbc09811ae44..7096f6e87ca2 100644 --- a/comp/otelcol/ddflareextension/impl/go.sum +++ b/comp/otelcol/ddflareextension/impl/go.sum @@ -475,8 +475,8 @@ github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRt github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y= github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0= github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo= diff --git a/comp/otelcol/ddprofilingextension/impl/go.mod b/comp/otelcol/ddprofilingextension/impl/go.mod index 679114ded6a4..ee275e247ca3 100644 --- a/comp/otelcol/ddprofilingextension/impl/go.mod +++ b/comp/otelcol/ddprofilingextension/impl/go.mod @@ -161,7 +161,7 @@ require ( github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/json-iterator/go v1.1.12 // indirect - github.com/klauspost/compress v1.18.5 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/knadh/koanf/maps v0.1.2 // indirect github.com/knadh/koanf/providers/confmap v1.0.0 // indirect github.com/knadh/koanf/v2 v2.3.4 // indirect diff --git a/comp/otelcol/ddprofilingextension/impl/go.sum b/comp/otelcol/ddprofilingextension/impl/go.sum index 546e86585a1e..2c3a9404be94 100644 --- a/comp/otelcol/ddprofilingextension/impl/go.sum +++ b/comp/otelcol/ddprofilingextension/impl/go.sum @@ -201,8 +201,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo= github.com/knadh/koanf/maps v0.1.2/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI= github.com/knadh/koanf/providers/confmap v1.0.0 h1:mHKLJTE7iXEys6deO5p6olAiZdG5zwp8Aebir+/EaRE= diff --git a/comp/otelcol/logsagentpipeline/go.sum b/comp/otelcol/logsagentpipeline/go.sum index 9c36550e3083..b30cc7ba6fed 100644 --- a/comp/otelcol/logsagentpipeline/go.sum +++ b/comp/otelcol/logsagentpipeline/go.sum @@ -43,8 +43,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/comp/otelcol/logsagentpipeline/logsagentpipelineimpl/go.sum b/comp/otelcol/logsagentpipeline/logsagentpipelineimpl/go.sum index 9c36550e3083..b30cc7ba6fed 100644 --- a/comp/otelcol/logsagentpipeline/logsagentpipelineimpl/go.sum +++ b/comp/otelcol/logsagentpipeline/logsagentpipelineimpl/go.sum @@ -43,8 +43,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/comp/otelcol/otlp/components/exporter/datadogexporter/go.mod b/comp/otelcol/otlp/components/exporter/datadogexporter/go.mod index aabea38f5552..fa55ec6ec75d 100644 --- a/comp/otelcol/otlp/components/exporter/datadogexporter/go.mod +++ b/comp/otelcol/otlp/components/exporter/datadogexporter/go.mod @@ -175,7 +175,7 @@ require ( github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/json-iterator/go v1.1.12 // indirect - github.com/klauspost/compress v1.18.5 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/knadh/koanf/maps v0.1.2 // indirect github.com/knadh/koanf/providers/confmap v1.0.0 // indirect github.com/knadh/koanf/v2 v2.3.4 // indirect diff --git a/comp/otelcol/otlp/components/exporter/datadogexporter/go.sum b/comp/otelcol/otlp/components/exporter/datadogexporter/go.sum index 7604170f09a1..6ba1933b2dc3 100644 --- a/comp/otelcol/otlp/components/exporter/datadogexporter/go.sum +++ b/comp/otelcol/otlp/components/exporter/datadogexporter/go.sum @@ -114,8 +114,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo= github.com/knadh/koanf/maps v0.1.2/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI= github.com/knadh/koanf/providers/confmap v1.0.0 h1:mHKLJTE7iXEys6deO5p6olAiZdG5zwp8Aebir+/EaRE= diff --git a/comp/otelcol/otlp/components/exporter/logsagentexporter/go.mod b/comp/otelcol/otlp/components/exporter/logsagentexporter/go.mod index a874b0f1f204..a6637f10ba75 100644 --- a/comp/otelcol/otlp/components/exporter/logsagentexporter/go.mod +++ b/comp/otelcol/otlp/components/exporter/logsagentexporter/go.mod @@ -111,7 +111,7 @@ require ( github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/json-iterator/go v1.1.12 // indirect - github.com/klauspost/compress v1.18.5 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/knadh/koanf/maps v0.1.2 // indirect github.com/knadh/koanf/providers/confmap v1.0.0 // indirect github.com/knadh/koanf/v2 v2.3.4 // indirect diff --git a/comp/otelcol/otlp/components/exporter/logsagentexporter/go.sum b/comp/otelcol/otlp/components/exporter/logsagentexporter/go.sum index 223a778e79e6..91e717203e1a 100644 --- a/comp/otelcol/otlp/components/exporter/logsagentexporter/go.sum +++ b/comp/otelcol/otlp/components/exporter/logsagentexporter/go.sum @@ -85,8 +85,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo= github.com/knadh/koanf/maps v0.1.2/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI= github.com/knadh/koanf/providers/confmap v1.0.0 h1:mHKLJTE7iXEys6deO5p6olAiZdG5zwp8Aebir+/EaRE= diff --git a/comp/otelcol/otlp/components/exporter/serializerexporter/go.mod b/comp/otelcol/otlp/components/exporter/serializerexporter/go.mod index 94544341acc4..3d9527e6a5d6 100644 --- a/comp/otelcol/otlp/components/exporter/serializerexporter/go.mod +++ b/comp/otelcol/otlp/components/exporter/serializerexporter/go.mod @@ -145,7 +145,7 @@ require ( github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/json-iterator/go v1.1.12 // indirect - github.com/klauspost/compress v1.18.5 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/knadh/koanf/maps v0.1.2 // indirect github.com/knadh/koanf/providers/confmap v1.0.0 // indirect github.com/knadh/koanf/v2 v2.3.4 // indirect diff --git a/comp/otelcol/otlp/components/exporter/serializerexporter/go.sum b/comp/otelcol/otlp/components/exporter/serializerexporter/go.sum index fb0e2b6ccf88..df8349b65d89 100644 --- a/comp/otelcol/otlp/components/exporter/serializerexporter/go.sum +++ b/comp/otelcol/otlp/components/exporter/serializerexporter/go.sum @@ -93,8 +93,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo= github.com/knadh/koanf/maps v0.1.2/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI= github.com/knadh/koanf/providers/confmap v1.0.0 h1:mHKLJTE7iXEys6deO5p6olAiZdG5zwp8Aebir+/EaRE= diff --git a/comp/otelcol/otlp/components/processor/infraattributesprocessor/go.sum b/comp/otelcol/otlp/components/processor/infraattributesprocessor/go.sum index 5ac36b2601d5..01b1fa9c0083 100644 --- a/comp/otelcol/otlp/components/processor/infraattributesprocessor/go.sum +++ b/comp/otelcol/otlp/components/processor/infraattributesprocessor/go.sum @@ -96,8 +96,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo= github.com/knadh/koanf/maps v0.1.2/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI= github.com/knadh/koanf/providers/confmap v1.0.0 h1:mHKLJTE7iXEys6deO5p6olAiZdG5zwp8Aebir+/EaRE= diff --git a/comp/otelcol/status/impl/go.sum b/comp/otelcol/status/impl/go.sum index b8a2d457d43d..691e04b92fcf 100644 --- a/comp/otelcol/status/impl/go.sum +++ b/comp/otelcol/status/impl/go.sum @@ -105,8 +105,8 @@ github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2E github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/comp/serializer/logscompression/go.sum b/comp/serializer/logscompression/go.sum index 1f2a01631b27..f308d108da3e 100644 --- a/comp/serializer/logscompression/go.sum +++ b/comp/serializer/logscompression/go.sum @@ -31,8 +31,8 @@ github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94 h1:0G5JVG0aJDpWvH1r github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94/go.mod h1:MvF7bZQy5lD2WcLXjFytRVvnTrFvrjo/qGka1MIBOPE= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/comp/serializer/metricscompression/go.sum b/comp/serializer/metricscompression/go.sum index 1f2a01631b27..f308d108da3e 100644 --- a/comp/serializer/metricscompression/go.sum +++ b/comp/serializer/metricscompression/go.sum @@ -31,8 +31,8 @@ github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94 h1:0G5JVG0aJDpWvH1r github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94/go.mod h1:MvF7bZQy5lD2WcLXjFytRVvnTrFvrjo/qGka1MIBOPE= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/exceptions/stackstate-k8s-agent/GO-2026-5841.yaml b/exceptions/stackstate-k8s-agent/GO-2026-5841.yaml deleted file mode 100644 index 71c2ab63538a..000000000000 --- a/exceptions/stackstate-k8s-agent/GO-2026-5841.yaml +++ /dev/null @@ -1,24 +0,0 @@ -schema_version: '1' -vulnerability: - id: GO-2026-5841 - severity: UNKNOWN -product: - consumer: stackstate-k8s-agent - image: quay.io/stackstate/stackstate-k8s-agent -component: - purl: pkg:golang/github.com/klauspost/compress@v1.18.5 - paths: - - opt/stackstate-agent/bin/agent/agent - - opt/stackstate-agent/bin/installer/installer -status: under_investigation -reason: transitive_dependency_bump_in_progress -expires: '2026-08-20' -owner: "@StackVista/observability-team" -upstream_owner: klauspost -upstream_reference: https://pkg.go.dev/vuln/GO-2026-5841 -statement: | - github.com/klauspost/compress v1.18.7 fixes this, so a compatible patch - exists and the finding is inside the 14-day remediation window. It reaches - the binary transitively through the upstream Datadog agent dependency - graph, so the bump has to go through a go.mod update rather than a direct - version pin. Tracked in STAC-25556. diff --git a/exceptions/stackstate-k8s-cluster-agent/GO-2026-5841.yaml b/exceptions/stackstate-k8s-cluster-agent/GO-2026-5841.yaml deleted file mode 100644 index aa78469d9b58..000000000000 --- a/exceptions/stackstate-k8s-cluster-agent/GO-2026-5841.yaml +++ /dev/null @@ -1,23 +0,0 @@ -schema_version: '1' -vulnerability: - id: GO-2026-5841 - severity: UNKNOWN -product: - consumer: stackstate-k8s-cluster-agent - image: quay.io/stackstate/stackstate-k8s-cluster-agent -component: - purl: pkg:golang/github.com/klauspost/compress@v1.18.5 - paths: - - opt/stackstate-agent/bin/stackstate-cluster-agent/stackstate-cluster-agent -status: under_investigation -reason: transitive_dependency_bump_in_progress -expires: '2026-08-20' -owner: "@StackVista/observability-team" -upstream_owner: klauspost -upstream_reference: https://pkg.go.dev/vuln/GO-2026-5841 -statement: | - github.com/klauspost/compress v1.18.7 fixes this, so a compatible patch - exists and the finding is inside the 14-day remediation window. It reaches - the binary transitively through the upstream Datadog agent dependency - graph, so the bump has to go through a go.mod update rather than a direct - version pin. Tracked in STAC-25556. diff --git a/go.mod b/go.mod index b2c3da66998a..b04b2a66ec4c 100644 --- a/go.mod +++ b/go.mod @@ -267,7 +267,7 @@ require ( github.com/jmoiron/sqlx v1.4.0 github.com/json-iterator/go v1.1.12 github.com/judwhite/go-svc v1.2.1 - github.com/klauspost/compress v1.18.5 + github.com/klauspost/compress v1.18.7 github.com/knqyf263/go-deb-version v0.0.0-20241115132648-6f4aee6ccd23 github.com/knqyf263/go-rpmdb v0.1.2-0.20250519070707-7e39c901d1c4 github.com/kouhin/envflag v0.0.0-20150818174321-0e9a86061649 diff --git a/go.sum b/go.sum index 0df03bcc0832..639ba3a9a326 100644 --- a/go.sum +++ b/go.sum @@ -4170,8 +4170,8 @@ github.com/klauspost/asmfmt v1.3.2/go.mod h1:AG8TuvYojzulgDAMCnYn50l/5QV3Bs/tp6j github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk= github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU= github.com/klauspost/compress v1.16.7/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg= github.com/klauspost/cpuid/v2 v2.2.3/go.mod h1:RVVoqg1df56z8g3pUjL/3lE5UfnlrJX8tyFgg4nqhuY= github.com/klauspost/cpuid/v2 v2.2.5/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws= diff --git a/internal/tools/gotest-custom/go.mod b/internal/tools/gotest-custom/go.mod index 2254bab38bc4..72077126c772 100644 --- a/internal/tools/gotest-custom/go.mod +++ b/internal/tools/gotest-custom/go.mod @@ -4,7 +4,7 @@ go 1.26.0 require ( github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 - github.com/klauspost/compress v1.18.5 + github.com/klauspost/compress v1.18.7 ) replace github.com/go-openapi/testify/v2 => github.com/go-openapi/testify/v2 v2.4.1 diff --git a/internal/tools/gotest-custom/go.sum b/internal/tools/gotest-custom/go.sum index 7707547a6858..721488b37245 100644 --- a/internal/tools/gotest-custom/go.sum +++ b/internal/tools/gotest-custom/go.sum @@ -1,4 +1,4 @@ github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4= github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= diff --git a/pkg/config/remote/go.sum b/pkg/config/remote/go.sum index 40c388d9337e..bcefd7a95d21 100644 --- a/pkg/config/remote/go.sum +++ b/pkg/config/remote/go.sum @@ -95,8 +95,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= diff --git a/pkg/fleet/installer/go.mod b/pkg/fleet/installer/go.mod index 4417acc3b3e3..12d0b9ced085 100644 --- a/pkg/fleet/installer/go.mod +++ b/pkg/fleet/installer/go.mod @@ -38,7 +38,7 @@ require ( github.com/ebitengine/purego v0.10.0 // indirect github.com/go-ole/go-ole v1.3.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect - github.com/klauspost/compress v1.18.5 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect github.com/mattn/go-colorable v0.1.14 // indirect github.com/mattn/go-isatty v0.0.20 // indirect diff --git a/pkg/fleet/installer/go.sum b/pkg/fleet/installer/go.sum index ad2078336468..93ab9086b055 100644 --- a/pkg/fleet/installer/go.sum +++ b/pkg/fleet/installer/go.sum @@ -30,8 +30,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= diff --git a/pkg/logs/client/go.sum b/pkg/logs/client/go.sum index ff3eca2c69b4..9552a60742b4 100644 --- a/pkg/logs/client/go.sum +++ b/pkg/logs/client/go.sum @@ -35,8 +35,8 @@ github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94 h1:0G5JVG0aJDpWvH1r github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94/go.mod h1:MvF7bZQy5lD2WcLXjFytRVvnTrFvrjo/qGka1MIBOPE= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/pkg/logs/metrics/go.sum b/pkg/logs/metrics/go.sum index 67146c834ed7..fc3cd035b5d1 100644 --- a/pkg/logs/metrics/go.sum +++ b/pkg/logs/metrics/go.sum @@ -11,8 +11,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= diff --git a/pkg/logs/pipeline/go.sum b/pkg/logs/pipeline/go.sum index 9c36550e3083..b30cc7ba6fed 100644 --- a/pkg/logs/pipeline/go.sum +++ b/pkg/logs/pipeline/go.sum @@ -43,8 +43,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/pkg/logs/processor/go.sum b/pkg/logs/processor/go.sum index 99d90a9088d8..e74221951ec0 100644 --- a/pkg/logs/processor/go.sum +++ b/pkg/logs/processor/go.sum @@ -41,8 +41,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/pkg/logs/sender/go.sum b/pkg/logs/sender/go.sum index 9b650195ef53..d078d6f10ae4 100644 --- a/pkg/logs/sender/go.sum +++ b/pkg/logs/sender/go.sum @@ -37,8 +37,8 @@ github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94 h1:0G5JVG0aJDpWvH1r github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94/go.mod h1:MvF7bZQy5lD2WcLXjFytRVvnTrFvrjo/qGka1MIBOPE= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/pkg/metrics/go.sum b/pkg/metrics/go.sum index c94c1cb3864f..498020f7e7b6 100644 --- a/pkg/metrics/go.sum +++ b/pkg/metrics/go.sum @@ -39,8 +39,8 @@ github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94 h1:0G5JVG0aJDpWvH1r github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94/go.mod h1:MvF7bZQy5lD2WcLXjFytRVvnTrFvrjo/qGka1MIBOPE= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/pkg/network/driver/go.sum b/pkg/network/driver/go.sum index 4375a660bc89..e169f1f29a78 100644 --- a/pkg/network/driver/go.sum +++ b/pkg/network/driver/go.sum @@ -9,8 +9,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= diff --git a/pkg/opentelemetry-mapping-go/otlp/logs/go.mod b/pkg/opentelemetry-mapping-go/otlp/logs/go.mod index f7c7a5bf6c76..0fddf6957686 100644 --- a/pkg/opentelemetry-mapping-go/otlp/logs/go.mod +++ b/pkg/opentelemetry-mapping-go/otlp/logs/go.mod @@ -40,7 +40,7 @@ require ( github.com/google/uuid v1.6.0 // indirect github.com/hashicorp/go-version v1.9.0 // indirect github.com/json-iterator/go v1.1.12 // indirect - github.com/klauspost/compress v1.18.5 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect github.com/patrickmn/go-cache v2.1.0+incompatible // indirect diff --git a/pkg/opentelemetry-mapping-go/otlp/logs/go.sum b/pkg/opentelemetry-mapping-go/otlp/logs/go.sum index 2b5b00b4d225..0a923c290196 100644 --- a/pkg/opentelemetry-mapping-go/otlp/logs/go.sum +++ b/pkg/opentelemetry-mapping-go/otlp/logs/go.sum @@ -34,8 +34,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= diff --git a/pkg/process/util/api/go.mod b/pkg/process/util/api/go.mod index db4f17654658..fe565454d2d6 100644 --- a/pkg/process/util/api/go.mod +++ b/pkg/process/util/api/go.mod @@ -55,7 +55,7 @@ require ( github.com/gofrs/flock v0.13.0 // indirect github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect - github.com/klauspost/compress v1.18.5 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect github.com/magiconair/properties v1.8.10 // indirect github.com/mdlayher/socket v0.5.1 // indirect diff --git a/pkg/process/util/api/go.sum b/pkg/process/util/api/go.sum index 6bd727548460..68b76af65129 100644 --- a/pkg/process/util/api/go.sum +++ b/pkg/process/util/api/go.sum @@ -45,8 +45,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/pkg/serializer/go.mod b/pkg/serializer/go.mod index 640fbe9c46b5..3a9549dac1df 100644 --- a/pkg/serializer/go.mod +++ b/pkg/serializer/go.mod @@ -101,7 +101,7 @@ require ( github.com/hashicorp/go-multierror v1.1.1 // indirect github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect - github.com/klauspost/compress v1.18.5 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect github.com/magiconair/properties v1.8.10 // indirect github.com/mattn/go-colorable v0.1.14 // indirect diff --git a/pkg/serializer/go.sum b/pkg/serializer/go.sum index 289bdd93ea1a..df63fbcf9f4f 100644 --- a/pkg/serializer/go.sum +++ b/pkg/serializer/go.sum @@ -68,8 +68,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/pkg/telemetry/go.sum b/pkg/telemetry/go.sum index 3430672f2b3c..24d0ca9b0796 100644 --- a/pkg/telemetry/go.sum +++ b/pkg/telemetry/go.sum @@ -9,8 +9,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= diff --git a/pkg/trace/otel/go.sum b/pkg/trace/otel/go.sum index 22d73f032cd5..94f9fcd38578 100644 --- a/pkg/trace/otel/go.sum +++ b/pkg/trace/otel/go.sum @@ -115,8 +115,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo= github.com/knadh/koanf/maps v0.1.2/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI= github.com/knadh/koanf/providers/confmap v1.0.0 h1:mHKLJTE7iXEys6deO5p6olAiZdG5zwp8Aebir+/EaRE= diff --git a/pkg/util/compression/go.mod b/pkg/util/compression/go.mod index b23f599e66bb..f33fc6f7f09e 100644 --- a/pkg/util/compression/go.mod +++ b/pkg/util/compression/go.mod @@ -6,7 +6,7 @@ require ( github.com/DataDog/datadog-agent/comp/core/config v0.78.3-rc.2 github.com/DataDog/datadog-agent/pkg/util/log v0.78.3-rc.2 github.com/DataDog/zstd v1.5.7 - github.com/klauspost/compress v1.18.5 + github.com/klauspost/compress v1.18.7 ) require gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/pkg/util/compression/go.sum b/pkg/util/compression/go.sum index 1f2a01631b27..f308d108da3e 100644 --- a/pkg/util/compression/go.sum +++ b/pkg/util/compression/go.sum @@ -31,8 +31,8 @@ github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94 h1:0G5JVG0aJDpWvH1r github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94/go.mod h1:MvF7bZQy5lD2WcLXjFytRVvnTrFvrjo/qGka1MIBOPE= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= diff --git a/pkg/util/grpc/go.sum b/pkg/util/grpc/go.sum index 5c0d9e81d987..814983151bc5 100644 --- a/pkg/util/grpc/go.sum +++ b/pkg/util/grpc/go.sum @@ -83,8 +83,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= diff --git a/pkg/util/prometheus/go.mod b/pkg/util/prometheus/go.mod index 099b0c21c43f..b96756efcba3 100644 --- a/pkg/util/prometheus/go.mod +++ b/pkg/util/prometheus/go.mod @@ -21,6 +21,7 @@ require ( github.com/gogo/protobuf v1.3.2 // indirect github.com/googleapis/gax-go/v2 v2.20.0 // indirect github.com/grafana/regexp v0.0.0-20250905093917-f7b3be9d1853 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/kr/pretty v0.3.1 // indirect github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect github.com/prometheus/client_model v0.6.2 // indirect diff --git a/pkg/util/prometheus/go.sum b/pkg/util/prometheus/go.sum index 64df378938b1..4159887c53d0 100644 --- a/pkg/util/prometheus/go.sum +++ b/pkg/util/prometheus/go.sum @@ -75,8 +75,8 @@ github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2E github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= diff --git a/releasenotes/notes/issue-492-klauspost-compress-cve-remediation-7c4e19b06d2f83a1.yaml b/releasenotes/notes/issue-492-klauspost-compress-cve-remediation-7c4e19b06d2f83a1.yaml new file mode 100644 index 000000000000..77d1b44bdbb7 --- /dev/null +++ b/releasenotes/notes/issue-492-klauspost-compress-cve-remediation-7c4e19b06d2f83a1.yaml @@ -0,0 +1,5 @@ +--- +security: + - | + Update ``github.com/klauspost/compress`` to ``v1.18.7`` to incorporate the + fix for the out-of-bounds read in the ``s2`` decoder (``GO-2026-5841``). diff --git a/test/e2e-framework/go.mod b/test/e2e-framework/go.mod index 174a51e8b4dc..8f82055d2db8 100644 --- a/test/e2e-framework/go.mod +++ b/test/e2e-framework/go.mod @@ -173,7 +173,7 @@ require ( github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/kevinburke/ssh_config v1.2.0 // indirect - github.com/klauspost/compress v1.18.5 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/kr/fs v0.1.0 // indirect github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect github.com/lucasb-eyer/go-colorful v1.2.0 // indirect diff --git a/test/e2e-framework/go.sum b/test/e2e-framework/go.sum index a47837b0298e..4dcaec035a75 100644 --- a/test/e2e-framework/go.sum +++ b/test/e2e-framework/go.sum @@ -288,8 +288,8 @@ github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8= github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= diff --git a/test/fakeintake/go.mod b/test/fakeintake/go.mod index 49820e9f5cd9..4473ab67fbc1 100644 --- a/test/fakeintake/go.mod +++ b/test/fakeintake/go.mod @@ -38,7 +38,7 @@ require ( github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect - github.com/klauspost/compress v1.18.5 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/kr/text v0.2.0 // indirect github.com/mattn/go-runewidth v0.0.19 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect diff --git a/test/fakeintake/go.sum b/test/fakeintake/go.sum index 2f54f8bfb9ca..880419121c4e 100644 --- a/test/fakeintake/go.sum +++ b/test/fakeintake/go.sum @@ -34,8 +34,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= diff --git a/test/new-e2e/go.mod b/test/new-e2e/go.mod index 3aeee97dde2a..674c8c2483b3 100644 --- a/test/new-e2e/go.mod +++ b/test/new-e2e/go.mod @@ -299,7 +299,7 @@ require ( github.com/hashicorp/go-version v1.9.0 // indirect github.com/iwdgo/sigintwindows v0.2.2 // indirect github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 // indirect - github.com/klauspost/compress v1.18.5 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/klauspost/cpuid/v2 v2.3.0 // indirect github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect github.com/minio/highwayhash v1.0.3 // indirect diff --git a/test/new-e2e/go.sum b/test/new-e2e/go.sum index 9bd4d825c68f..2f12c9ce0bb8 100644 --- a/test/new-e2e/go.sum +++ b/test/new-e2e/go.sum @@ -361,8 +361,8 @@ github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y= github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0= github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8= diff --git a/test/otel/go.mod b/test/otel/go.mod index c33e4a7efb58..5e6ad730ccdb 100644 --- a/test/otel/go.mod +++ b/test/otel/go.mod @@ -170,7 +170,7 @@ require ( github.com/hectane/go-acl v0.0.0-20230225031251-cdfc9e3acf94 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/json-iterator/go v1.1.12 // indirect - github.com/klauspost/compress v1.18.5 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/knadh/koanf/maps v0.1.2 // indirect github.com/knadh/koanf/providers/confmap v1.0.0 // indirect github.com/knadh/koanf/v2 v2.3.4 // indirect diff --git a/test/otel/go.sum b/test/otel/go.sum index 2369e2623b55..b6602b2eb8d9 100644 --- a/test/otel/go.sum +++ b/test/otel/go.sum @@ -104,8 +104,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo= github.com/knadh/koanf/maps v0.1.2/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI= github.com/knadh/koanf/providers/confmap v1.0.0 h1:mHKLJTE7iXEys6deO5p6olAiZdG5zwp8Aebir+/EaRE= diff --git a/tools/build-ddot-byoc/go.mod b/tools/build-ddot-byoc/go.mod index a943f94d4e04..c77b30d0bc25 100644 --- a/tools/build-ddot-byoc/go.mod +++ b/tools/build-ddot-byoc/go.mod @@ -4,7 +4,7 @@ go 1.26.0 require ( github.com/google/go-containerregistry v0.20.7 - github.com/klauspost/compress v1.18.5 + github.com/klauspost/compress v1.18.7 ) require ( diff --git a/tools/build-ddot-byoc/go.sum b/tools/build-ddot-byoc/go.sum index 17919cc8dedb..28c3ffd65c31 100644 --- a/tools/build-ddot-byoc/go.sum +++ b/tools/build-ddot-byoc/go.sum @@ -14,8 +14,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/go-containerregistry v0.20.7 h1:24VGNpS0IwrOZ2ms2P1QE3Xa5X9p4phx0aUgzYzHW6I= github.com/google/go-containerregistry v0.20.7/go.mod h1:Lx5LCZQjLH1QBaMPeGwsME9biPeo1lPx6lbGj/UmzgM= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y= github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= From 094fae68cce69d9def47359393a00da0ae833f36 Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Fri, 21 Aug 2026 14:41:41 +0000 Subject: [PATCH 2/2] Review the expired agent CVE exceptions Every stackstate-k8s-agent and stackstate-k8s-cluster-agent exception expired on 2026-08-20. The SLA requires re-checking upstream at each renewal rather than extending the date, and that re-check changes the answer for most of them. Seven python entries are obsolete. They were written against the embedded 3.13.13 runtime, and the 3.13.15 bump in #463 already carries the fix: Grype now lists 3.13.15 among the fixed versions for CVE-2025-15366, CVE-2026-0864, CVE-2026-11940, CVE-2026-11972, CVE-2026-12003, CVE-2026-15308 and CVE-2026-6879. Renewing them would have asserted an upstream gap that no longer exists, and keeping them would suppress the findings if the interpreter ever moved back. CVE-2025-15367 and CVE-2026-4360 survive the re-check -- the first is fixed only in the 3.15.0a6 pre-release, the second has no fixed version at all -- so they keep a short review deadline and their purl moves to 3.13.15 to match what the image will contain. CVE-2026-14456 is new, and is not a version bump. Scanners name 3.5.8, 3.6.4 and 4.0.2 as fixed, but none of those are released: the newest tags are 3.5.7, 3.6.3 and 4.0.1, and OSV enumerates all three as affected. 3.5.7 is already what we pin. The vulnerable path is the QUIC server listener, which the agent does not run. Without an entry the finding publishes unmanaged. The cryptography entries keep a deadline on the SLA date and now name the actual blocker: the version is pinned in stackstate-agent-integrations at the tag STACKSTATE_INTEGRATIONS_VERSION selects, so it cannot be changed here. Refs: StackVista/cve-reporter#29 Tracking: #492, #489, #484 Co-authored-by: Cve Ticket Reconciler --- .../stackstate-k8s-agent/CVE-2025-15366.yaml | 26 -------------- .../stackstate-k8s-agent/CVE-2025-15367.yaml | 22 ++++++------ .../stackstate-k8s-agent/CVE-2026-0864.yaml | 26 -------------- .../stackstate-k8s-agent/CVE-2026-11940.yaml | 26 -------------- .../stackstate-k8s-agent/CVE-2026-11972.yaml | 26 -------------- .../stackstate-k8s-agent/CVE-2026-12003.yaml | 26 -------------- .../stackstate-k8s-agent/CVE-2026-14456.yaml | 35 +++++++++++++++++++ .../stackstate-k8s-agent/CVE-2026-15308.yaml | 26 -------------- .../stackstate-k8s-agent/CVE-2026-4360.yaml | 13 ++++--- .../stackstate-k8s-agent/CVE-2026-6879.yaml | 22 ------------ .../stackstate-k8s-agent/CVE-2026-69247.yaml | 20 +++++++---- .../stackstate-k8s-agent/CVE-2026-69248.yaml | 16 ++++++--- .../stackstate-k8s-agent/CVE-2026-69249.yaml | 21 +++++++---- .../stackstate-k8s-agent/GO-2026-5932.yaml | 2 +- .../GO-2026-5932.yaml | 2 +- 15 files changed, 95 insertions(+), 214 deletions(-) delete mode 100644 exceptions/stackstate-k8s-agent/CVE-2025-15366.yaml delete mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-0864.yaml delete mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-11940.yaml delete mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-11972.yaml delete mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-12003.yaml create mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-14456.yaml delete mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-15308.yaml delete mode 100644 exceptions/stackstate-k8s-agent/CVE-2026-6879.yaml diff --git a/exceptions/stackstate-k8s-agent/CVE-2025-15366.yaml b/exceptions/stackstate-k8s-agent/CVE-2025-15366.yaml deleted file mode 100644 index 4784c149340d..000000000000 --- a/exceptions/stackstate-k8s-agent/CVE-2025-15366.yaml +++ /dev/null @@ -1,26 +0,0 @@ -schema_version: '1' -vulnerability: - id: CVE-2025-15366 - severity: MEDIUM -product: - consumer: stackstate-k8s-agent - image: quay.io/stackstate/stackstate-k8s-agent -component: - purl: pkg:generic/python@3.13.13 - paths: - - opt/stackstate-agent/embedded/bin/python3.13 -status: accepted_pending_upstream_fix -reason: no_upstream_fix_for_pinned_runtime_line -expires: '2026-08-20' -owner: "@StackVista/observability-team" -upstream_owner: python -upstream_reference: https://www.cve.org/CVERecord?id=CVE-2025-15366 -statement: | - No fix is published for the CPython 3.13 maintenance line. Upstream - currently carries the fix only in 3.15.0a6, a pre-release of a different - minor version, so there is no compatible patch we could apply without - moving the embedded interpreter to an unreleased runtime. Under the - remediation SLA this falls outside the patch commitment, so the date below - is a short review deadline rather than an acceptance: re-check upstream for - a 3.13 backport before renewing. Tracked with the rest of the - embedded-runtime work in STAC-25556. diff --git a/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml b/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml index f9be944281b8..73f47fa6f9d5 100644 --- a/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml +++ b/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml @@ -6,21 +6,23 @@ product: consumer: stackstate-k8s-agent image: quay.io/stackstate/stackstate-k8s-agent component: - purl: pkg:generic/python@3.13.13 + purl: pkg:generic/python@3.13.15 paths: - opt/stackstate-agent/embedded/bin/python3.13 status: accepted_pending_upstream_fix reason: no_upstream_fix_for_pinned_runtime_line -expires: '2026-08-20' +expires: '2026-09-04' owner: "@StackVista/observability-team" upstream_owner: python upstream_reference: https://www.cve.org/CVERecord?id=CVE-2025-15367 statement: | - No fix is published for the CPython 3.13 maintenance line. Upstream - currently carries the fix only in 3.15.0a6, a pre-release of a different - minor version, so there is no compatible patch we could apply without - moving the embedded interpreter to an unreleased runtime. Under the - remediation SLA this falls outside the patch commitment, so the date below - is a short review deadline rather than an acceptance: re-check upstream for - a 3.13 backport before renewing. Tracked with the rest of the - embedded-runtime work in STAC-25556. + No fix is published for the CPython 3.13 maintenance line. Upstream carries + the fix only in 3.15.0a6, a pre-release of a different minor version, so + there is no compatible patch we could apply without moving the embedded + interpreter to an unreleased runtime. Under the remediation SLA this falls + outside the patch commitment, so the date above is a short review deadline + rather than an acceptance. + + Re-checked on 2026-08-21 against the embedded 3.13.15 build: still no 3.13 + backport. Re-check again before renewing. Tracked in + StackVista/stackstate-agent#489. diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-0864.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-0864.yaml deleted file mode 100644 index 5080525c5523..000000000000 --- a/exceptions/stackstate-k8s-agent/CVE-2026-0864.yaml +++ /dev/null @@ -1,26 +0,0 @@ -schema_version: '1' -vulnerability: - id: CVE-2026-0864 - severity: MEDIUM -product: - consumer: stackstate-k8s-agent - image: quay.io/stackstate/stackstate-k8s-agent -component: - purl: pkg:generic/python@3.13.13 - paths: - - opt/stackstate-agent/embedded/bin/python3.13 -status: accepted_pending_upstream_fix -reason: no_upstream_fix_for_pinned_runtime_line -expires: '2026-08-20' -owner: "@StackVista/observability-team" -upstream_owner: python -upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-0864 -statement: | - No fix is published for the CPython 3.13 maintenance line. Upstream - currently carries the fix only in 3.15.0b4, a pre-release of a different - minor version, so there is no compatible patch we could apply without - moving the embedded interpreter to an unreleased runtime. Under the - remediation SLA this falls outside the patch commitment, so the date below - is a short review deadline rather than an acceptance: re-check upstream for - a 3.13 backport before renewing. Tracked with the rest of the - embedded-runtime work in STAC-25556. diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-11940.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-11940.yaml deleted file mode 100644 index f6d0d59faee4..000000000000 --- a/exceptions/stackstate-k8s-agent/CVE-2026-11940.yaml +++ /dev/null @@ -1,26 +0,0 @@ -schema_version: '1' -vulnerability: - id: CVE-2026-11940 - severity: HIGH -product: - consumer: stackstate-k8s-agent - image: quay.io/stackstate/stackstate-k8s-agent -component: - purl: pkg:generic/python@3.13.13 - paths: - - opt/stackstate-agent/embedded/bin/python3.13 -status: accepted_pending_upstream_fix -reason: no_upstream_fix_for_pinned_runtime_line -expires: '2026-08-20' -owner: "@StackVista/observability-team" -upstream_owner: python -upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-11940 -statement: | - No fix is published for the CPython 3.13 maintenance line. Upstream - currently carries the fix only in 3.15.0b4, a pre-release of a different - minor version, so there is no compatible patch we could apply without - moving the embedded interpreter to an unreleased runtime. Under the - remediation SLA this falls outside the patch commitment, so the date below - is a short review deadline rather than an acceptance: re-check upstream for - a 3.13 backport before renewing. Tracked with the rest of the - embedded-runtime work in STAC-25556. diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-11972.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-11972.yaml deleted file mode 100644 index 44a30b317212..000000000000 --- a/exceptions/stackstate-k8s-agent/CVE-2026-11972.yaml +++ /dev/null @@ -1,26 +0,0 @@ -schema_version: '1' -vulnerability: - id: CVE-2026-11972 - severity: HIGH -product: - consumer: stackstate-k8s-agent - image: quay.io/stackstate/stackstate-k8s-agent -component: - purl: pkg:generic/python@3.13.13 - paths: - - opt/stackstate-agent/embedded/bin/python3.13 -status: accepted_pending_upstream_fix -reason: no_upstream_fix_for_pinned_runtime_line -expires: '2026-08-20' -owner: "@StackVista/observability-team" -upstream_owner: python -upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-11972 -statement: | - No fix is published for the CPython 3.13 maintenance line. Upstream - currently carries the fix only in 3.15.0b4, a pre-release of a different - minor version, so there is no compatible patch we could apply without - moving the embedded interpreter to an unreleased runtime. Under the - remediation SLA this falls outside the patch commitment, so the date below - is a short review deadline rather than an acceptance: re-check upstream for - a 3.13 backport before renewing. Tracked with the rest of the - embedded-runtime work in STAC-25556. diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-12003.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-12003.yaml deleted file mode 100644 index 7466dfe8720f..000000000000 --- a/exceptions/stackstate-k8s-agent/CVE-2026-12003.yaml +++ /dev/null @@ -1,26 +0,0 @@ -schema_version: '1' -vulnerability: - id: CVE-2026-12003 - severity: MEDIUM -product: - consumer: stackstate-k8s-agent - image: quay.io/stackstate/stackstate-k8s-agent -component: - purl: pkg:generic/python@3.13.13 - paths: - - opt/stackstate-agent/embedded/bin/python3.13 -status: accepted_pending_upstream_fix -reason: no_upstream_fix_for_pinned_runtime_line -expires: '2026-08-20' -owner: "@StackVista/observability-team" -upstream_owner: python -upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-12003 -statement: | - No fix is published for the CPython 3.13 maintenance line. Upstream - currently carries the fix only in 3.15.0b3, a pre-release of a different - minor version, so there is no compatible patch we could apply without - moving the embedded interpreter to an unreleased runtime. Under the - remediation SLA this falls outside the patch commitment, so the date below - is a short review deadline rather than an acceptance: re-check upstream for - a 3.13 backport before renewing. Tracked with the rest of the - embedded-runtime work in STAC-25556. diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-14456.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-14456.yaml new file mode 100644 index 000000000000..d1ae29ad6cde --- /dev/null +++ b/exceptions/stackstate-k8s-agent/CVE-2026-14456.yaml @@ -0,0 +1,35 @@ +schema_version: '1' +vulnerability: + id: CVE-2026-14456 + severity: HIGH +product: + consumer: stackstate-k8s-agent + image: quay.io/stackstate/stackstate-k8s-agent +component: + purl: pkg:generic/openssl@3.5.7 + paths: + - opt/stackstate-agent/embedded/lib/libssl.so.3 + - opt/stackstate-agent/embedded/lib/libcrypto.so.3 + - opt/stackstate-agent/embedded/bin/openssl +status: accepted_pending_upstream_fix +reason: no_upstream_fix_published +expires: '2026-09-02' +owner: "@StackVista/observability-team" +upstream_owner: openssl +upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-14456 +statement: | + Scanners report the fix as 3.5.8, 3.6.4 or 4.0.2. None of those exist: the + newest releases in each line are 3.5.7, 3.6.3 and 4.0.1, and OSV enumerates + all three as affected. The fix landed upstream on 2026-08-12 but has not been + released, so the advertised fixed versions are anticipated release numbers + rather than shipped tarballs. 3.5.7 is what we already pin and is the newest + 3.5.x, so there is no bump to make. + + The vulnerable path is the QUIC server listener accepting Initial packets for + unknown connection IDs. The agent is a client and runs no OpenSSL QUIC + listener, and the OpenSSL FIPS module is outside the affected boundary. + + The date above is a short review deadline, not an acceptance -- re-check for + a released 3.5.x before renewing, and bump all four coordinated pins together + (deps/openssl/version.bzl, deps/repos.MODULE.bazel, and openssl3.rb). + Tracked in StackVista/stackstate-agent#489. diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-15308.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-15308.yaml deleted file mode 100644 index 690ecbdd9cd2..000000000000 --- a/exceptions/stackstate-k8s-agent/CVE-2026-15308.yaml +++ /dev/null @@ -1,26 +0,0 @@ -schema_version: '1' -vulnerability: - id: CVE-2026-15308 - severity: HIGH -product: - consumer: stackstate-k8s-agent - image: quay.io/stackstate/stackstate-k8s-agent -component: - purl: pkg:generic/python@3.13.13 - paths: - - opt/stackstate-agent/embedded/bin/python3.13 -status: accepted_pending_upstream_fix -reason: no_upstream_fix_for_pinned_runtime_line -expires: '2026-08-20' -owner: "@StackVista/observability-team" -upstream_owner: python -upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-15308 -statement: | - No fix is published for the CPython 3.13 maintenance line. Upstream - currently carries the fix only in 3.15.0, a pre-release of a different - minor version, so there is no compatible patch we could apply without - moving the embedded interpreter to an unreleased runtime. Under the - remediation SLA this falls outside the patch commitment, so the date below - is a short review deadline rather than an acceptance: re-check upstream for - a 3.13 backport before renewing. Tracked with the rest of the - embedded-runtime work in STAC-25556. diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml index 0079db8231f6..fcd6e56eefb3 100644 --- a/exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml +++ b/exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml @@ -6,17 +6,20 @@ product: consumer: stackstate-k8s-agent image: quay.io/stackstate/stackstate-k8s-agent component: - purl: pkg:generic/python@3.13.13 + purl: pkg:generic/python@3.13.15 paths: - opt/stackstate-agent/embedded/bin/python3.13 status: accepted_pending_upstream_fix reason: no_upstream_fix_published -expires: '2026-08-20' +expires: '2026-09-04' owner: "@StackVista/observability-team" upstream_owner: python upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-4360 statement: | Upstream has published no fixed CPython version for this CVE in any release - line, so no patch exists to apply. The date below is a short review - deadline, not an acceptance -- re-check upstream before renewing. Tracked - with the rest of the embedded-runtime work in STAC-25556. + line, so no patch exists to apply. The date above is a short review deadline, + not an acceptance. + + Re-checked on 2026-08-21 against the embedded 3.13.15 build: scanners still + report no fixed version. Re-check again before renewing. Tracked in + StackVista/stackstate-agent#489. diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-6879.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-6879.yaml deleted file mode 100644 index 5abe5fd4c54a..000000000000 --- a/exceptions/stackstate-k8s-agent/CVE-2026-6879.yaml +++ /dev/null @@ -1,22 +0,0 @@ -schema_version: '1' -vulnerability: - id: CVE-2026-6879 - severity: LOW -product: - consumer: stackstate-k8s-agent - image: quay.io/stackstate/stackstate-k8s-agent -component: - purl: pkg:generic/python@3.13.13 - paths: - - opt/stackstate-agent/embedded/bin/python3.13 -status: accepted_pending_upstream_fix -reason: no_upstream_fix_published -expires: '2026-08-20' -owner: "@StackVista/observability-team" -upstream_owner: python -upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-6879 -statement: | - Upstream has published no fixed CPython version for this CVE in any release - line, so no patch exists to apply. The date below is a short review - deadline, not an acceptance -- re-check upstream before renewing. Tracked - with the rest of the embedded-runtime work in STAC-25556. diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-69247.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-69247.yaml index 65fedbbae7a0..26673b412cc9 100644 --- a/exceptions/stackstate-k8s-agent/CVE-2026-69247.yaml +++ b/exceptions/stackstate-k8s-agent/CVE-2026-69247.yaml @@ -11,14 +11,20 @@ component: - opt/stackstate-agent/embedded/lib/python3.13/site-packages/cryptography status: under_investigation reason: omnibus_runtime_bump_in_progress -expires: '2026-08-20' +expires: '2026-09-03' owner: "@StackVista/observability-team" upstream_owner: pyca upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-69247 statement: | - cryptography 50.0.0 fixes this, so a compatible patch exists and the - finding is inside the 14-day remediation window rather than being accepted. - The package is installed into the omnibus-embedded Python environment, so - the fix is a requirements bump in the omnibus build, tracked in STAC-25556. - Do not renew this exception without re-checking whether the bump has - landed. + cryptography 50.0.0 fixes this, so a compatible patch exists and the finding + is inside the remediation window rather than being accepted. + + The version is not settable in this repo. It is pinned as cryptography==48.0.1 + in stackstate-agent-integrations at the tag named by + STACKSTATE_INTEGRATIONS_VERSION in stackstate-deps.json, and that tag is what + the omnibus build resolves requirements from. Closing this needs the + integrations pin bumped and a new tag published (STAC-25514), then + STACKSTATE_INTEGRATIONS_VERSION moved to it here. + + Do not renew without re-checking whether that tag exists. Tracked in + StackVista/stackstate-agent#484. diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-69248.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-69248.yaml index 6f7d66fa1273..180ad5fa7082 100644 --- a/exceptions/stackstate-k8s-agent/CVE-2026-69248.yaml +++ b/exceptions/stackstate-k8s-agent/CVE-2026-69248.yaml @@ -11,12 +11,18 @@ component: - opt/stackstate-agent/embedded/lib/python3.13/site-packages/cryptography status: accepted_pending_upstream_fix reason: no_upstream_fix_published -expires: '2026-08-20' +expires: '2026-09-03' owner: "@StackVista/observability-team" upstream_owner: pyca upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-69248 statement: | - Trivy reports no fixed version for this CVE, so there is no patch to apply. - It will most likely be resolved incidentally by the cryptography bump that - clears CVE-2026-69247 and CVE-2026-69249; until then the date below is a - short review deadline, not an acceptance. Tracked in STAC-25556. + Scanners now report 49.0.0 as the fixed version, so this rides the same + cryptography bump that clears CVE-2026-69247 and CVE-2026-69249 rather than + waiting on a separate upstream fix. + + The version is not settable in this repo -- it is pinned in + stackstate-agent-integrations at the tag named by + STACKSTATE_INTEGRATIONS_VERSION in stackstate-deps.json (STAC-25514). + + Do not renew without re-checking whether that tag exists. Tracked in + StackVista/stackstate-agent#484. diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-69249.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-69249.yaml index 4ca636daae4f..e5ed2f5864d2 100644 --- a/exceptions/stackstate-k8s-agent/CVE-2026-69249.yaml +++ b/exceptions/stackstate-k8s-agent/CVE-2026-69249.yaml @@ -11,14 +11,21 @@ component: - opt/stackstate-agent/embedded/lib/python3.13/site-packages/cryptography status: under_investigation reason: omnibus_runtime_bump_in_progress -expires: '2026-08-20' +expires: '2026-09-03' owner: "@StackVista/observability-team" upstream_owner: pyca upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-69249 statement: | - cryptography 49.0.0 fixes this, so a compatible patch exists and the - finding is inside the 14-day remediation window rather than being accepted. - The package is installed into the omnibus-embedded Python environment, so - the fix is a requirements bump in the omnibus build, tracked in STAC-25556. - Do not renew this exception without re-checking whether the bump has - landed. + cryptography 49.0.0 fixes this, so a compatible patch exists and the finding + is inside the remediation window rather than being accepted. It clears on the + same bump as CVE-2026-69247, which needs 50.0.0. + + The version is not settable in this repo. It is pinned as cryptography==48.0.1 + in stackstate-agent-integrations at the tag named by + STACKSTATE_INTEGRATIONS_VERSION in stackstate-deps.json, and that tag is what + the omnibus build resolves requirements from. Closing this needs the + integrations pin bumped and a new tag published (STAC-25514), then + STACKSTATE_INTEGRATIONS_VERSION moved to it here. + + Do not renew without re-checking whether that tag exists. Tracked in + StackVista/stackstate-agent#484. diff --git a/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml b/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml index 9bf472a31069..0dd31e00fcc6 100644 --- a/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml +++ b/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml @@ -12,7 +12,7 @@ component: - opt/stackstate-agent/bin/installer/installer status: accepted_with_compensating_control reason: unpublished_image_vex_identity_bridge -expires: '2026-08-20' +expires: '2026-09-04' owner: "@StackVista/observability-team" upstream_owner: golang upstream_reference: https://pkg.go.dev/vuln/GO-2026-5932 diff --git a/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml b/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml index 4155fc6390b2..4a1ebe01bfd6 100644 --- a/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml +++ b/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml @@ -11,7 +11,7 @@ component: - opt/stackstate-agent/bin/stackstate-cluster-agent/stackstate-cluster-agent status: accepted_with_compensating_control reason: unpublished_image_vex_identity_bridge -expires: '2026-08-20' +expires: '2026-09-04' owner: "@StackVista/observability-team" upstream_owner: golang upstream_reference: https://pkg.go.dev/vuln/GO-2026-5932