[ako]

Problem

The v1 BSON driver removal (#1497) ran go mod tidy. That deleted the github.com/klauspost/compress v1.20.3 requirement added in #1493.

• Why tidy removed it: no package mxcli builds imports that module. It only arrives through mongo-driver/v2, and tidy removes requirements nothing needs.
• Result: the module graph fell back to the v1.19.2 that mongo-driver/v2@v2.9.2 declares:

  $ go list -m github.com/klauspost/compress   # on main
  github.com/klauspost/compress v1.19.2
  

  That version is flagged for GHSA-fpmh-frq8-7rj8. The customer's dependency scan reads the module graph, not the binary, so it would block the release again.
• Nothing noticed: no build, test or CI job failed. The same change has already gone upstream in Sync ako/mxcli: drop the v1 BSON driver; container RenderMode, Calendar expression properties (CE0642), column filter-slot hint mendixlabs/mxcli#1594.

Fix

• Floor file: internal/depfloor/floor.go blank-imports github.com/klauspost/compress/zstd behind a depfloor build tag. Nothing sets that tag.
  • go mod tidy treats every build tag except ignore as enabled. So the requirement is now direct and survives tidy:

    github.com/klauspost/compress v1.20.3
    

  • No build compiles the file, so the binary is unchanged: go version -m bin/mxcli lists no klauspost/compress.
• Guard test: TestGoModKeepsSecurityFloors reads go.mod and fails when a floored module is missing or required below its floor.
  • A direct requirement at or above the floor guarantees MVS selects at least that version.
  • It also pins go.mongodb.org/mongo-driver/v2 ≥ v2.9.2, for CVE-2026-81521, which regressed in v2.9.0 and v2.9.1.
  • To raise a floor: go get <module>@<version>, then go mod tidy. The file's doc comment says this too.

Evidence

Test first. On main, the new test fails with the regression:

go.mod does not require github.com/klauspost/compress, so the module graph falls back to whatever a dependency declares.

Controls, each followed by go mod tidy:

State	go.mod after tidy	Test
hand-written require … v1.20.3, no floor.go (the #1493 approach)	line removed	—
floor.go deleted	no klauspost line	fails: "does not require"
floor.go present, no version pinned	klauspost/compress v1.19.2	fails: "below the floor v1.20.2"
this PR	klauspost/compress v1.20.3	passes

A second go mod tidy on this branch changes nothing.

Checks: make build, make test, make lint, make vet (both tag sets), make check-findings, go mod verify and go vet -tags depfloor ./internal/depfloor/ pass.

Second commit: CHANGELOG repair

This is a separate concern, kept as its own commit. Happy to split it into its own PR.

The merge of #1517 resolved CHANGELOG.md with the stale side of its Unreleased section:

• Dropped: the three Security entries for the v1 driver removal (refactor(deps): move off the deprecated v1 BSON driver entirely #1497) and the "go mod tidy runs again" Fixed entry.
• Duplicated: thirteen Fixed entries and the klauspost Security block.

upstream/main's copy was intact, so the next upstream sync would have carried the damage there. The file is now upstream's, plus the two entries #1517 adds. search --exclude-marketplace moves from the released [0.27.0] section to Unreleased, because the contributor's branch predates that release.

Not changed: Unreleased still has an older entry saying mongo-driver v1 "remains flagged and cannot be upgraded out", which #1497 made untrue. It also still has two ### Security headings. Both are left as upstream has them.

Third commit: Go toolchain 1.27.2 → 1.27.3 (GO-2026-6809)

The first CI run on this PR failed at the govulncheck step:

Vulnerability #1: GO-2026-6809
    Distrust compromised intermediate certificates in crypto/x509
    Found in: crypto/x509@go1.27.2
    Fixed in: crypto/x509@go1.27.3
  #1: internal/marketplace/client.go:316:22: marketplace.Client.Download calls io.Copy, which eventually calls x509.Certificate.Verify

• Not caused by this PR. It is a new advisory against the standard library, and build-and-test is red on main for the same reason. It is fixed here because otherwise this PR cannot go green.
• The fix follows the earlier bump for GO-2026-5856: toolchain go1.27.3 in go.mod and go-version: '1.27.3' in the nightly, push-test and release workflows.
• Checked locally: govulncheck ./... reports the advisory on go1.27.2 (exit 3), and on go1.27.3 it reports No vulnerabilities found. make build, make test and make vet pass on go1.27.3.

Bookkeeping

• Finding: .claude/skills/fix-issue/findings/other/2026-10-21-go-mod-tidy-dropped-klauspost-floor.json.
• CHANGELOG: one Security entry.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AeAyg3qx2my26Q8cvGyW5z