[prodsec-github-automation]

Snyk agentic fix

The Snyk Open Source scan of chore/CLI-1840 reported vulnerabilities at or above high severity. This branch was produced by snyk fix --agentic working on those.

The fix itself was applied to main, not to chore/CLI-1840, so this pull request stands on its own rather than stacking on the branch that triggered it. A vulnerability that exists only on chore/CLI-1840 is therefore not addressed here.

Whether that scan also failed the build depends on the Enhanced Gate, which blocks only once a vulnerability has passed its remediation SLA — so this pull request may exist for a build that is green.

3 of 5 fixed.

These changes are generated. Review them as you would any dependency bump — check the changelogs of the upgraded packages before merging.

Fixed

Severity	Vulnerability	Where	Breaking-change risk
High	Inefficient Algorithmic Complexity	cliv2-private/go.mod, cliv2/go.mod	Medium — This patch upgrade for go-jose introduces stricter validation that could affect existing applications. Behavioral Change: - v4.1.6: The library now rejects JSON Web Encryption (JWE) messages with mismatched Content Encryption Key (CEK) lengths. Previously, these may have been processed, but now they will result in an error. Recommendation: Verify that any systems generating JWE tokens for consumption by this service are correctly formatting the CEK. This change improves security and spec compliance but could cause issues with incorrectly generated tokens. Source: GitHub Release Notes
High	Integer Overflow or Wraparound	cliv2-private/go.mod, cliv2/go.mod	Low — This is a minor version upgrade that includes security fixes and bug fixes. The primary change is in version 1.20.2, which addresses a high-severity vulnerability. - Security Fix (v1.20.2): This version patches a vulnerability (GHSA-fpmh-frq8-7rj8) where a crafted input to the zstd decoder could cause a panic (denial of service). The fix prevents the application from crashing when processing malformed data. No breaking API changes are documented in this version range. The upgrade is recommended to incorporate the security patch. Source: Release notes
High	Integer Overflow or Wraparound	cliv2-private/go.mod, cliv2/go.mod	Low — This is a minor version upgrade that primarily includes optimizations and a security fix. - Security Fix (CVE-2026-116591): Version 1.20.2 corrects a high-severity vulnerability where a crafted input could cause a panic in the huff0 decoder, leading to a denial of service. - Optimizations: The releases within this range include performance improvements for the huff0 package. There are no documented breaking API changes. The upgrade is recommended to patch the security vulnerability. Source: Release Notes

Not fixed

Severity	Vulnerability	Where	Fix available	Breaking-change risk
High	Uncontrolled Recursion	package.json	Yes	Low — This is a patch version upgrade from 4.26.2 to 4.26.3. Patch releases typically consist of bug fixes and security patches and are not expected to contain breaking changes. No specific release notes or changelog for this exact version were found, but given the nature of a patch update, the risk of breaking changes is considered low. Source: Package documentation
High	Regular Expression Denial of Service (ReDoS)	package.json	Yes	Low — This is a patch version upgrade from 4.26.2 to 4.26.3. Patch releases typically consist of bug fixes and security patches and are not expected to contain breaking changes. No specific release notes or changelog for this exact version were found, but given the nature of a patch update, the risk of breaking changes is considered low. Source: Package documentation

A row marked Fix available: No has no upgrade path for snyk fix to take. One marked Yes does, but needed a change the agent would not make unattended — those are the rows to look at first.

This is not necessarily a complete fix. The build on this pull request runs the same Open Source scan and quality gate, so its result — not this description — is the verdict on what is left.

Changes

 cliv2-private/go.mod | 4 ++--
 cliv2-private/go.sum | 4 ++++
 cliv2/go.mod         | 4 ++--
 cliv2/go.sum         | 4 ++++
 4 files changed, 12 insertions(+), 4 deletions(-)

_{Snyk ProdSec orb · build 685297 · model claude-sonnet-5-5}

---

Note

Medium Risk
Indirect crypto and compression library upgrades; go-jose v4.1.6 may reject previously accepted JWE tokens, while compress mainly hardens decoding against malicious inputs.

Overview
Bumps indirect Go module versions in cliv2 and cliv2-private (go.mod / go.sum) to address Snyk high-severity findings—no application source changes.

github.com/go-jose/go-jose/v4 moves 4.1.4 → 4.1.6 (algorithmic-complexity fix). v4.1.6 tightens JWE handling by rejecting mismatched Content Encryption Key lengths, which can break interaction with non-compliant token producers.

github.com/klauspost/compress moves 1.19.2 → 1.20.2 (integer-overflow / DoS issues in zstd and huff0 decoders on crafted input). This is a patch-level dependency refresh with no documented API breaks.

JavaScript package.json issues noted in the Snyk run (e.g. braces, picomatch) are not changed in this diff.

^{Reviewed by Cursor Bugbot for commit e49b227. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

	Warnings
⚠️	"fix: remediate high-and-above vulnerabilities reported by Snyk Open Source" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against e49b227

[prodsec-github-automation]

Superseded: the fix branch has been rebuilt from main. A new pull request replaces this one.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 5 relevant code sections from 4 files (average relevance: 0.88) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) package-lock.json (lines 6-270) CLAUDE.md (2 segments, lines 274-355) package.json (lines 1-242)

🤖 Repository instructions applied (from AGENTS.md)

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e2d8abb. Configure here.}

[cursor]

Incomplete go-jose private upgrade

Medium Severity

cliv2 now pins go-jose/v4 at v4.1.6, but cliv2-private still lists v4.1.4 and its go.sum has no v4.1.6 checksums. The high-severity go-jose finding stays on the private module, and shared-dependency validation between the two go.mod files will fail.

Additional Locations (1)

• cliv2/go.mod#L126-L127

 

^{Triggered by learned rule: cliv2-private mirrored go.sum bumps}

^{Reviewed by Cursor Bugbot for commit e2d8abb. Configure here.}