[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-259r-337f-4rfw	github.com/klauspost/compress	None	v1.18.3	1.18.7		confirmed

Not Included

• Deferred by batch limit: 33 advisories. They will be considered by future runs.
• Other deferred scanner findings: 1.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	github.com/getkin/kin-openapi	Missing CVE/GHSA identifier required for Socket fix planning.

---

Note

Low Risk
Patch-level dependency bump with no runtime code changes; limited blast radius aside from zstd compression behavior in dependent code.

Overview
Dependency-only security remediation for the server Go module: bumps direct dependency github.com/klauspost/compress from v1.18.3 to v1.18.7, with matching go.sum checksum entries.

There are no application or config code changes in this diff—only the module lockfiles. The upgraded library is used for zstd compression (e.g. server/lib/zstdutil).

Note: The PR description references a fix for go.opentelemetry.io/otel/sdk/log, but that version change does not appear in this diff.

^{Reviewed by Cursor Bugbot for commit 51a180b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​klauspost/​compress@​v1.18.3 ⏵ v1.18.7	+1	+16

View full report

[ulziibay-kernel]

Not approving as-is — this breaks the build. server/go.mod raises go.opentelemetry.io/otel/log and otel/sdk/log to v0.21.0 but leaves the exporter at go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.20.0, which compiles against the pre-0.21 log API. build-headful, build-headless, and test-server-unit all fail with undefined: api.KeyValue / api.Kind* in otlploghttp@v0.20.0/internal/transform. Fix: bump otlploghttp to v0.21.0 alongside (it pairs with the 0.21 log API) and refresh go.sum, or revert the whole log-SDK line to 0.20.0 so it moves together.