[renovate-update-app]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/klauspost/compress	v1.20.1 → v1.20.2

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Panic on two-block frames in github.com/klauspost/compress

CVE-2026-116591 / GHSA-fpmh-frq8-7rj8 / GO-2026-6865

More information

Details

Panic on two-block frames in github.com/klauspost/compress

Severity

Unknown

References

• https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8
• https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d
• https://github.com/klauspost/compress/releases/tag/v1.20.2

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

klauspost/compress (github.com/klauspost/compress)

v1.20.2

Compare Source

• zstd: Fix DecodeAll crash on specially crafted input. GHSA-fpmh-frq8-7rj8.
• s2: fix LZ4 block conversion writing past dst by @​klauspost in #​1244
• dict: Stricter input validation by @​klauspost in #​1250
• zstd: reject snappy copy shorter than minimum match by @​Raghuvardhan-Reddy78 in #​1235

Full Changelog: klauspost/compress@v1.20.1...v1.20.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[renovatee-approver-stackvista]

Auto-approving verified Renovate commits with native automerge enabled.

[ai-collaboration-app]

CVE remediation verification for https://github.com/StackVista/cve-reporter/issues/117 (supervisor owns ticket updates).

Reused this Renovate PR: github.com/klauspost/compress v1.20.1 → v1.20.2. PR head: ba8c7f7c9ba3242e27aee45ed5c6a6a61bf23c46; signed merged source: 678632b4ad5b6c480c591f4d3136b5ed09209785. The full release range from the scanned source 4387aa12 contains only this dependency/checksum change. A new checkpoint branch, cve/2026-116591-process-agent-42183453045, points to the signed merged source. No duplicate implementation PR is needed.

Normal publication already completed in master CI 42149601450. Publication was not repeated. Normal reference: quay.io/stackstate/stackstate-k8s-process-agent:678632b4.

Manifest	Digest
Multi-architecture index	sha256:094cd21751ea2ee05250852e2c5697f1faa5e283092fdd36953bdb4e3b522607
linux/amd64 image	sha256:5c3787f8d97048cdc3e394a969a36b5fbff72dedee33102ac1bd533625cf715a
linux/arm64 image	sha256:84a3e3d8d6fcb4ef05dcd8fb062427e1835522c76e191f4e2ba8cdacff73f814

Validation:

• Reused successful PR CI 42142773750 and master CI: generated-code checks, module verification, build, unit tests, image smoke tests, all-severity secret checks, Trivy and Grype, and signed publication on both architectures. CI binaries report version 678632b4.
• Both master CI scan artifacts (process-agent-scan-amd64, process-agent-scan-arm64) identify v1.20.2 in opt/stackstate-agent/bin/agent/process-agent, contain no CVE-2026-116591 finding, and report zero secrets.
• Independently scanned each published architecture image by the digest above with Trivy 0.74.0, all severities, --scanners vuln,secret --list-all-pkgs --image-src remote. Both packaged binaries contain v1.20.2; both have zero assigned-CVE findings and zero secrets. One unrelated UNKNOWN finding, GO-2026-5932 in golang.org/x/crypto, remains informational on each architecture.
• Registry OCI labels match the merged source SHA, version 678632b4, and master publication run. The multi-architecture index Cosign signature verifies with issuer https://token.actions.githubusercontent.com and identity https://github.com/StackVista/stackstate-process-agent/.github/workflows/ci.yml@refs/heads/master.

Ready for supervisor-assigned independent review of the reused PR/merged commit and publication evidence. The existing Updatecli consumer resolves processAgentHash from master and checks normal image existence before updating processAgentTag: stable/suse-observability-agent/values.yaml, nodeAgent.containers.processAgent.image.tag. Intended tag is 678632b4 (repository stackstate/stackstate-k8s-process-agent); the current chart still uses 4387aa12. Chart adoption/release and a clean dev delivery scan remain with the supervisor/release owner. No chart repository changes or chart-mutating workflows were performed.