[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-qc2q-p7wx-3px3	GHSA-qc2q-p7wx-3px3	None	None	see lockfile		confirmed

Not Included

• Deferred by batch limit: 1 advisories. They will be considered by future runs.
• Other deferred scanner findings: 0.
• Unconfirmed attempted fixes: 0.

---

Note

Low Risk
Indirect dependency version bump and lockfile-only changes; no runtime logic or auth/data paths are modified in this diff.

Overview
Socket-driven vulnerability remediation with no application source changes—only module metadata.

The direct fix is bumping the indirect dependency github.com/klauspost/compress from v1.18.1 to v1.18.7 in go.mod, addressing GHSA-qc2q-p7wx-3px3. go.sum is regenerated accordingly, including new checksum lines for that package and a broader refresh of transitive entries (e.g. Docker-related modules and other indirect deps pulled in by the updated graph).

^{Reviewed by Cursor Bugbot for commit 4017f17. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4017f17. Configure here.}

[cursor]

Claimed gRPC advisory remains unfixed

Medium Severity

This change upgrades github.com/klauspost/compress and leaves google.golang.org/grpc at v1.82.2. GHSA-qc2q-p7wx-3px3 is a gRPC-Go xDS RBAC bypass fixed in v1.83.1, so the claimed remediation does not apply.

Additional Locations (1)

• go.mod#L90-L91

 

^{Reviewed by Cursor Bugbot for commit 4017f17. Configure here.}