From c1aec0518afbed13da876329bfeccb3a7856e954 Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Sat, 1 Aug 2026 11:06:10 +0800 Subject: [PATCH] fix: upgrade klauspost/compress to 1.18.7 Move MinIO from v1.18.6 to v1.18.7 to pick up the GO-2026-5841 fix. The vulnerable dictionary symbols are not reachable in this tree, but keeping the direct compression dependency patched avoids carrying the affected release. Verified with go mod verify, full go test and go vet runs, and govulncheck reporting no reachable symbol or imported-package vulnerabilities. Co-authored-by: ChatGPT Co-authored-by: Claude --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index e766f7745..5d29ed9d1 100644 --- a/go.mod +++ b/go.mod @@ -52,7 +52,7 @@ require ( github.com/google/uuid v1.6.0 github.com/inconshreveable/mousetrap v1.1.0 github.com/json-iterator/go v1.1.12 - github.com/klauspost/compress v1.18.6 + github.com/klauspost/compress v1.18.7 github.com/klauspost/cpuid/v2 v2.3.0 github.com/klauspost/filepathx v1.1.1 github.com/klauspost/pgzip v1.2.6 diff --git a/go.sum b/go.sum index 8fa9c67b6..dabead9a2 100644 --- a/go.sum +++ b/go.sum @@ -378,8 +378,8 @@ github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXw github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= github.com/klauspost/compress v1.14.4/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk= -github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao= -github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg= github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y= github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=