[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-259r-337f-4rfw	github.com/klauspost/compress	None	v1.18.5	1.18.7		confirmed

Not Included

• Deferred by batch limit: 82 advisories. They will be considered by future runs.
• Other deferred scanner findings: 7.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	claude-agent-sdk	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	pillow	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	anyio	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	anyio	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	certifi	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	certifi	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	pyjwt	Missing CVE/GHSA identifier required for Socket fix planning.

---

Note

Low Risk
Patch-level dependency bump with no code changes; low regression risk aside from normal zstd/compression behavior in profile-related commands.

Overview
Bumps github.com/klauspost/compress from v1.18.5 to v1.18.7 to address GHSA-259r-337f-4rfw (Socket-confirmed remediation). The module is a direct dependency in go.mod and is used in the CLI for zstd handling (e.g. profile/archive flows in cmd/profiles.go).

go.sum is refreshed accordingly, including checksum lines for transitive modules pulled in by the updated graph. No application source files change—only dependency lockfiles.

^{Reviewed by Cursor Bugbot for commit e28ac46. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​klauspost/​compress@​v1.18.5 ⏵ v1.18.7	+1	+16

View full report