{"uuid": "cd17c0d0-4bf1-4ec2-b8dc-101599965b41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://gist.github.com/allanrogerr/6d10196ab8eb0d80a2cfca871b45d9a8", "content": "## Description\n\nBump the two dependencies flagged by govulncheck's live DB on 2026-07-27 to their fixed versions, across every module that pins a vulnerable release:\n\n- `google.golang.org/grpc` v1.81.1 \u2192 v1.82.1 (root `go.mod`) and v1.80.0 \u2192 v1.82.1 (`test/integration/tables/iceberg-compat-tests/catalog-api-tests`) \u2014 clears GO-2026-6061 (GHSA-hrxh-6v49-42gf, xDS RBAC engine + HTTP/2 transport server).\n- `github.com/klauspost/compress` v1.17.11 / v1.18.0 / v1.18.5 \u2192 v1.18.7 (`docs/debugging/inspect`, `docs/debugging/s3-verify`, `catalog-api-tests`) \u2014 clears GO-2026-5841 (GHSA-259r-337f-4rfw, OOB read in `compress/s2`).\n\nThe bumps were produced by the repo's own tooling (`python3 govulncheck.py --fix`, added in #6246), so the diff is exactly `go get ` + `go mod tidy` in each module: 8 files, all `go.mod`/`go.sum`, 42 insertions / 42 deletions.\n\n**Basic Checks goes back to green on every open PR** \u2014 since ~17:59Z on 2026-07-27 every `Run govulncheck` step in the repo fails on these two advisories.\n\n## Motivation and Context\n\n`govulncheck` (Basic Checks, `Run govulncheck` step) fails on GO-2026-5841 and GO-2026-6061 in every run since the live vulnerability DB began reporting them between 17:20Z and 17:59Z on 2026-07-27. The pinned versions are identical on `edge` (and `master`), so this is not caused by any in-flight branch: PRs #6406, #6323, #6048, and #6535 all hit the same failure on branches that share none of each other's changes, and PR #6535's head SHA `e86c2e3` passed Basic Checks at 17:04Z and failed at 19:20Z with zero code change in between. Fixed releases exist upstream (grpc v1.82.1, compress v1.18.7). This is the same newly-disclosed-CVE pattern previously fixed by #6518 (otel), #6458 (x/net, x/text), and #6230 (quic-go).\n\n**Known gap:** the `.govulncheck-ignore.toml` entry for GO-2026-5662 (`github.com/prometheus/prometheus`) already matches nothing on `edge` \u2014 the wrapper prints a non-fatal \"ignore entries matched nothing\" warning before and after this change. Pruning it is intentionally left out of this diff to keep the bump minimal.\n\n## How to test this PR?\n\n```\npython3 govulncheck.py\n```\n\nReports `govulncheck \u2014 0 vulnerabilities, 4 ignored` and exits 0 (validated locally on this branch; the pre-fix run of the same command reproduces CI's failing `5 vulnerabilities, 4 ignored` table byte-for-byte). `go build ./...` passes in each touched module.\n\n## Types of changes\n\n- [x] Bug fix (non-breaking change which fixes an issue)\n- [ ] New feature (non-breaking change which adds functionality)\n- [ ] Optimization (provides speedup with no functional changes)\n- [ ] Cleanup/Maintenance (no functional changes)\n- [ ] Breaking change (fix or feature that would cause existing functionality to change)\n\n## Checklist:\n\n- [ ] Fixes a regression (If yes, please add `commit-id` or `PR #` here)\n- [ ] Unit tests added/updated\n- [ ] Internal documentation updated\n- [ ] Create a documentation update request [here](https://github.com/miniohq/aistor-object-store-docs/issues/new)\n- [x] No internode changes / version interoperability introduced\n\n## CI Workflow Labels\n\nOn draft PRs, CI is not run unless labels are set. See [selective-CI label\nquick reference](https://github.com/miniohq/aistor/blob/edge/.github/selective-ci.md#ci-labels-quick-reference) for more information.\n", "creation_timestamp": "2026-07-27T19:48:38.410906Z"}