[aikido-autofix]

Upgrade compress to fix critical zstd decoder DoS vulnerability causing panics on malformed frames due to FSE normalized count overflow.

✅ 13 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-288845	HIGH	[github.com/klauspost/compress] A crafted zstd frame with an oversized FSE normalized count can cause an integer overflow, leading to a malformed Huffman weight table that reuses previous decoding state. This results in a panic (denial of service) when the decoder attempts to access an out-of-range table index.
AIKIDO-2026-73951	HIGH	[go] Go's cgo compiler and linker flag validation accepts Clang's -gen-* and GCC's -gnat* flags through its broad -g allowlist, allowing a malicious package to write files to arbitrary locations or desynchronize argument parsing and pass unvalidated linker inputs that cause code execution during ...
AIKIDO-2026-700439	HIGH	[go] The Go toolchain accepts crafted #cgo LDFLAGS whose arguments can reach the host linker as unvalidated input files, allowing a malicious cgo package to load a linker script and execute arbitrary code on the build machine during linking. Patched versions require correctly prefixed second argu...
AIKIDO-2026-51917	HIGH	[go] A vulnerability in cgo package building allows loading malicious local pkg-config files or unsafe compiler/linker arguments, enabling remote code execution on the build machine. The fix restricts local .pc file references and unsafe pkg-config options to prevent exploitation.
AIKIDO-2026-314155	HIGH	[go] The Go build command forwards package-supplied .syso files and cgo linker inputs to the host linker without validating their binary format or embedded options, allowing a malicious dependency to inject linker flags or execute arbitrary code on the build machine through disguised linker scrip...
AIKIDO-2026-211289	HIGH	[go] The Go linker accepts crafted .syso files as Go compiler objects, allowing embedded cgo directives to bypass flag validation and inject arbitrary external linker flags, potentially executing attacker-controlled code during a build. Patched versions reject unrecognized .syso object formats an...
AIKIDO-2026-824066	HIGH	[go] The Go command accepts unsafe compiler and linker flags in malicious packages' #cgo directives, allowing an attacker to execute arbitrary code on the build machine by redirecting compiler tools, supplying linker scripts through sysroot arguments, or selecting unsupported compiler input langu...
AIKIDO-2026-779925	HIGH	[go] Go's cgo linker flag validation allowed GCC to load attacker-controlled spec files from linker search directories or the working directory, letting a malicious package execute arbitrary commands on the build machine during linking. Patched versions reject untrusted search directories contain...
AIKIDO-2026-57119	HIGH	[go] The Go compiler and linker allow crafted //go:cgo_* directives in malicious packages to inject arbitrary external linker flags or response file arguments on ELF platforms, potentially loading an attacker-controlled linker plugin during a build. The patch rejects commas in directive symbol na...
AIKIDO-2026-335465	HIGH	[go] Inconsistent handling of escaped quotes in Go's generated //go:cgo_ldflag directives lets a malicious cgo package smuggle disallowed linker flags or unvalidated search paths past build-time validation, potentially executing arbitrary code on the build host; related flag deduplication can als...
AIKIDO-2026-340273	HIGH	[go] A cgo linker-flag validation vulnerability allows malicious packages to bypass checks by splitting -l arguments, enabling attackers to load arbitrary LTO plugins and achieve code execution on the build machine.
AIKIDO-2026-124556	HIGH	[go] A malicious package can exploit insufficient validation of library names in cgo directives and Windows PE objects to pass unsafe arguments to the external linker, enabling path traversal attacks to reference arbitrary files on the build machine during linking.
AIKIDO-2026-813996	MEDIUM	[go] In net/http HTTP/1 servers, exceeding the MaxBytesReader body limit can race with response header writes and crash the process, causing denial of service. The fix uses an atomic flag instead of modifying headers from the body-reading goroutine.

🤖 Remediation details

This PR fixes two vulnerable dependencies in the Go module github.com/qor5/x/v3: github.com/klauspost/compress and the go language version. The changes are in the root go.mod and go.sum. go.mod now requires github.com/klauspost/compress v1.20.2 and declares go 1.26.11. go build ./... passed before and after the changes.

github.com/klauspost/compress

This is an indirect dependency. It was raised from v1.18.7 to v1.20.2 with go get github.com/klauspost/compress@v1.20.2, then go mod tidy. v1.20.2 is the lowest patched release, and the installed version was inside the affected range (>=1.15.0 <=1.20.1). The module is still an indirect requirement, and no source files changed.

go

The go directive in go.mod was raised from 1.26.10 to 1.26.11 with go get go@1.26.11. This is the lowest patched release on the 1.26 line, and 1.26.10 was in the affected range. No go.work or vendor directory exists, so no workspace sync or re-vendoring was needed.

Version changes

Package	From	To	Why updated
github.com/klauspost/compress	v1.18.7	v1.20.2	Direct CVE fix (indirect dependency, bumped explicitly)
go (go.mod directive)	1.26.10	1.26.11	Direct CVE fix (Go toolchain and standard library)