Skip to content

Update brotli dependency to v1.2.7 (AST-189161) - #1610

Merged
cx-aniket-shinde merged 6 commits into
stagingfrom
other/AST-189161
Nov 5, 2026
Merged

Update brotli dependency to v1.2.7 (AST-189161)#1610
cx-aniket-shinde merged 6 commits into
stagingfrom
other/AST-189161

Conversation

@cx-anurag-dalke

@cx-anurag-dalke cx-anurag-dalke commented Nov 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

By submitting this pull request, you agree to the terms within the Checkmarx Code of Conduct. Please review the contributing guidelines for guidance on creating high-quality pull requests.

Description

Bumps the indirect dependency github.com/andybalholm/brotli from v1.2.0 to v1.2.7.

Also refreshes the SHA256-pinned Docker base image checkmarx/bash:5.3 to the r14 build pushed on 2026-11-04 (e52a196c3a91…).

brotli is not imported by this repository directly. It is pulled in via anchore/syft → anchore/archiver, which uses it for brotli-compressed archive handling during container SBOM extraction.

Impact analysis

  • API: v1.2.7 only adds exported symbols (new encoder/match-finder types, HTTP helpers). Nothing removed or renamed. archiver calls only brotli.NewWriterLevel and brotli.NewReader, both unchanged.
  • Behaviour: 46 upstream commits, almost all encoder-side performance/compression work. Decoder changes are limited to gofmt comment reformatting, Huffman buffer reuse on Reader.Reset, and an earlier error for malformed block-switch streams. No effect on valid input.
  • Dependencies: brotli's own go.mod is unchanged between the two versions (same Go floor, same single dependency). go mod tidy produced no other changes.
  • Security: no OSV advisories exist for this module; govulncheck reports nothing related to brotli.
  • Binary size: stripped cx binary is ~6 KB smaller than main.

Type of Change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update
  • Dependency update (non-breaking)

Related Issues

AST-189161

Checklist

  • I have performed a self-review of my code
  • I have added tests that prove my fix is effective or that my feature works (dependency-only change; covered by existing suites)
  • I have added necessary documentation (if appropriate)
  • Any dependent changes have been merged and published in downstream modules
  • I have updated the CLI help for new/changed functionality in this PR (if applicable)
  • All active GitHub checks for tests, formatting, and security are passing
  • The correct base branch is being used

Additional Notes

Local verification: all packages and test binaries compile; brotli's own test suite passes at v1.2.7 within this module graph.

🤖 Generated with Claude Code

@cx-anurag-dalke @claude
Update github.com/andybalholm/brotli from v1.2.0 to v1.2.7 (AST-189161)
a1685ac 
Indirect dependency pulled in via anchore/syft -> anchore/archiver.
No API removals; archiver only uses NewWriterLevel/NewReader, which are unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@cx-anurag-dalke
cx-anurag-dalke requested a review from a team as a code owner November 4, 2026 18:00
cx-anurag-dalke and others added 4 commits November 5, 2026 14:03
@cx-anurag-dalke @claude
Update Docker base image checkmarx/bash:5.3 to latest digest (AST-189…
48c6a26 
…161)

Bumps the SHA256-pinned base image to the 5.3-r14 build pushed on 2026-11-04.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@cx-anurag-dalke @claude
Replace .trivyignore entries with current binary findings (AST-189161)
495f70d 
Ignore GO-2026-5932 (x/crypto/openpgp via helm provenance), CVE-2026-78661 and
CVE-2026-97045 (x/net/html via syft Maven cataloger). Remove the previous Wolfi
base-image and syft/docker entries, which no longer apply.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@cx-anurag-dalke @claude
Restore syft and docker entries in .trivyignore (AST-189161)
329c1cd 
CVE-2026-33481 (syft temp cleanup) and CVE-2026-33997 (moby plugin privilege
bypass) are still reported against the binary. Neither has an adoptable fix:
syft >= 1.42.3 reintroduces the binary-size regression reverted in AST-188320
and docker/docker has no 29.x release on its module path. Justifications and
reachability analysis are recorded in the file.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@cx-atish-jadhav @claude
Bump golang.org/x/net to v0.62.0 and trim .trivyignore (AST-189161)
9990e6f 
Bump the indirect golang.org/x/net dependency to v0.62.0, which fixes
CVE-2026-78661 and CVE-2026-97045, so their ignore entries are dropped.
Keep only the ignores that cannot be fixed directly: GO-2026-5932
(x/crypto openpgp, via helm), CVE-2026-33481 (syft) and CVE-2026-33997
(docker).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@cx-aniket-shinde
cx-aniket-shinde merged commit 0e0237d into staging Nov 5, 2026
23 of 26 checks passed
cx-aniket-shinde added a commit that referenced this pull request Nov 5, 2026
@cx-rahul-pidde @cx-anurag-dalke
@claude @cx-atish-jadhav @cx-sumit-morchhale @cx-aniket-shinde
Staging (#1606)
16701c0 
* Honour the VS Code Checkmarx Self-Healing setting in Copilot agent hooks (AST-180812) (#1603)

* AST-180812 - Detect VS Code Copilot CLI sessions from GITHUB_COPILOT_INTEGRATION_ID (#1604)

* Feature/ast 180812 vscode copilot cli host (#1607)

* Update brotli dependency to v1.2.7 (AST-189161) (#1610)

* Update github.com/andybalholm/brotli from v1.2.0 to v1.2.7 (AST-189161)

Indirect dependency pulled in via anchore/syft -> anchore/archiver.
No API removals; archiver only uses NewWriterLevel/NewReader, which are unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Update Docker base image checkmarx/bash:5.3 to latest digest (AST-189161)

Bumps the SHA256-pinned base image to the 5.3-r14 build pushed on 2026-11-04.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Replace .trivyignore entries with current binary findings (AST-189161)

Ignore GO-2026-5932 (x/crypto/openpgp via helm provenance), CVE-2026-78661 and
CVE-2026-97045 (x/net/html via syft Maven cataloger). Remove the previous Wolfi
base-image and syft/docker entries, which no longer apply.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Restore syft and docker entries in .trivyignore (AST-189161)

CVE-2026-33481 (syft temp cleanup) and CVE-2026-33997 (moby plugin privilege
bypass) are still reported against the binary. Neither has an adoptable fix:
syft >= 1.42.3 reintroduces the binary-size regression reverted in AST-188320
and docker/docker has no 29.x release on its module path. Justifications and
reachability analysis are recorded in the file.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Bump golang.org/x/net to v0.62.0 and trim .trivyignore (AST-189161)

Bump the indirect golang.org/x/net dependency to v0.62.0, which fixes
CVE-2026-78661 and CVE-2026-97045, so their ignore entries are dropped.
Keep only the ignores that cannot be fixed directly: GO-2026-5932
(x/crypto openpgp, via helm), CVE-2026-33481 (syft) and CVE-2026-33997
(docker).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: atishj99 <atish.jadhav@checkmarx.com>

* revret exclude git config changes (#1609)

Co-authored-by: Aniket Shinde <aniket.shinde@checkmarx.com>

* Use self-repository syntax for reusable workflow in nightly-parallel (AST-189161)

Replace `uses: ./.github/workflows/ci-tests.yml` with the `$/` form to
satisfy the zizmor `self-repository` audit (added in zizmor v1.30.0).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Anurag Dalke <anurag.dalke@checkmarx.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: atishj99 <atish.jadhav@checkmarx.com>
Co-authored-by: Sumit Morchhale <sumit.morchhale@checkmarx.com>
Co-authored-by: Aniket Shinde <aniket.shinde@checkmarx.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cx-atish-jadhav cx-atish-jadhav cx-atish-jadhav approved these changes
@cx-hitesh-madgulkar cx-hitesh-madgulkar cx-hitesh-madgulkar approved these changes
@cx-sumit-morchhale cx-sumit-morchhale Awaiting requested review from cx-sumit-morchhale
@cx-rahul-pidde cx-rahul-pidde Awaiting requested review from cx-rahul-pidde
@cx-rakesh-kadu cx-rakesh-kadu Awaiting requested review from cx-rakesh-kadu

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@cx-anurag-dalke @cx-atish-jadhav @cx-hitesh-madgulkar @cx-aniket-shinde