[r3.6] go.mod: bump klauspost/compress, otel, quic-go to sync security deps with main - #22865
Merged
Merged
Conversation
Sync security-relevant dependencies on release/3.6 with main. - klauspost/compress v1.18.6 -> v1.19.1 (GO-2026-5841: s2 decoder OOB read) - go.opentelemetry.io/otel v1.43.0 -> v1.44.0 (GO-2026-5158: baggage DoS) - quic-go v0.59.1 -> v0.60.0 (sync with main)
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates release/3.6 dependency versions for three security-relevant modules to match main, addressing reported govulncheck advisories and reducing version drift on the release branch.
Changes:
- Bump
github.com/klauspost/compressfromv1.18.6tov1.19.1. - Bump
go.opentelemetry.io/otel(+otel/metric,otel/trace) fromv1.43.0tov1.44.0. - Bump
github.com/quic-go/quic-gofromv0.59.1tov0.60.0(and record new transitive sums).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| go.mod | Updates the required versions of compress, otel (and submodules), and quic-go. |
| go.sum | Updates module checksums to match the bumped dependency versions (including new transitive entries). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
yperbasis
approved these changes
Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps three security-relevant dependencies on
release/3.6to bring them in line withmain:github.com/klauspost/compressgo.opentelemetry.io/otel(+/metric,/trace)github.com/quic-go/quic-gomain(FIPS 140-3 / bug fixes / Go 1.25 compat; no CVE)Closes #22863.
Why
release/3.6was branched frommainand drifted. Agovulncheckaudit found these versions laggingmainand/or carrying advisories. Bothklauspost/compressandotelfindings are classified bygovulncheckas not on a proven call path from Erigon code, so real-world severity is low; the bumps keeprelease/3.6clean and consistent withmain.Not included
crypto/tls(GO-2026-5856) andos(GO-2026-4970) are toolchain-driven, resolved by building withgo1.26.5+— not a dependency version, out of scope here.golang.org/x/crypto/openpgp(GO-2026-5932) has no fix available and the package is unused by Erigon.x/text,x/net,x/crypto, andgo-chi/chifixes were already present onrelease/3.6.Verification
go build ./...— clean (no API breakage from any bump)make erigon integration— both binaries buildgo veton consumer packages — cleanmake lint— 0 issuesgo test -shorton all 7 packages consuming the bumped libs — passgovulncheck ./...— GO-2026-5841 and GO-2026-5158 no longer reportedr3.6-specific adaptations
None — straight dependency bump, no code changes required.