[prodsec-github-automation]

Snyk agentic fix

The Snyk Open Source scan of chore/CLI-1840-e2e reported vulnerabilities at or above high severity. This branch was produced by snyk fix --agentic working on those.

The fix itself was applied to main, not to chore/CLI-1840-e2e, so this pull request stands on its own rather than stacking on the branch that triggered it. A vulnerability that exists only on chore/CLI-1840-e2e is therefore not addressed here.

Whether that scan also failed the build depends on the Enhanced Gate, which blocks only once a vulnerability has passed its remediation SLA — so this pull request may exist for a build that is green.

3 of 5 fixed.

These changes are generated. Review them as you would any dependency bump — check the changelogs of the upgraded packages before merging.

Fixed

Severity	Vulnerability	Where	Breaking-change risk
High	Inefficient Algorithmic Complexity	cliv2-private/go.mod, cliv2/go.mod	Medium — This patch upgrade for go-jose introduces stricter validation that could affect existing applications. Behavioral Change: - v4.1.6: The library now rejects JSON Web Encryption (JWE) messages with mismatched Content Encryption Key (CEK) lengths. Previously, these may have been processed, but now they will result in an error. Recommendation: Verify that any systems generating JWE tokens for consumption by this service are correctly formatting the CEK. This change improves security and spec compliance but could cause issues with incorrectly generated tokens. Source: GitHub Release Notes
High	Integer Overflow or Wraparound	cliv2-private/go.mod, cliv2/go.mod	Low — This is a minor version upgrade that includes security fixes and bug fixes. The primary change is in version 1.20.2, which addresses a high-severity vulnerability. - Security Fix (v1.20.2): This version patches a vulnerability (GHSA-fpmh-frq8-7rj8) where a crafted input to the zstd decoder could cause a panic (denial of service). The fix prevents the application from crashing when processing malformed data. No breaking API changes are documented in this version range. The upgrade is recommended to incorporate the security patch. Source: Release notes
High	Integer Overflow or Wraparound	cliv2-private/go.mod, cliv2/go.mod	Low — This is a minor version upgrade that primarily includes optimizations and a security fix. - Security Fix (CVE-2026-116591): Version 1.20.2 corrects a high-severity vulnerability where a crafted input could cause a panic in the huff0 decoder, leading to a denial of service. - Optimizations: The releases within this range include performance improvements for the huff0 package. There are no documented breaking API changes. The upgrade is recommended to patch the security vulnerability. Source: Release Notes

Not fixed

Severity	Vulnerability	Where	Fix available	Breaking-change risk
High	Uncontrolled Recursion	package.json	Yes	Low — This is a patch version upgrade from 4.26.2 to 4.26.3. Patch releases typically consist of bug fixes and security patches and are not expected to contain breaking changes. No specific release notes or changelog for this exact version were found, but given the nature of a patch update, the risk of breaking changes is considered low. Source: Package documentation
High	Regular Expression Denial of Service (ReDoS)	package.json	Yes	Low — This is a patch version upgrade from 4.26.2 to 4.26.3. Patch releases typically consist of bug fixes and security patches and are not expected to contain breaking changes. No specific release notes or changelog for this exact version were found, but given the nature of a patch update, the risk of breaking changes is considered low. Source: Package documentation

A row marked Fix available: No has no upgrade path for snyk fix to take. One marked Yes does, but needed a change the agent would not make unattended — those are the rows to look at first.

This is not necessarily a complete fix. The build on this pull request runs the same Open Source scan and quality gate, so its result — not this description — is the verdict on what is left.

Changes

 cliv2-private/go.mod | 2 +-
 cliv2-private/go.sum | 2 ++
 cliv2/go.mod         | 4 ++--
 cliv2/go.sum         | 4 ++++
 4 files changed, 9 insertions(+), 3 deletions(-)

_{Snyk ProdSec orb · build 685333 · model claude-sonnet-5-5}

---

Note

Medium Risk
Indirect crypto/JWE validation is stricter in go-jose; compress changes affect decompression paths used by transitive deps—mostly security patches with limited behavioral risk except non-compliant JWE.

Overview
Bumps indirect Go dependencies in cliv2 and cliv2-private to address Snyk high-severity findings—no application source changes.

github.com/go-jose/go-jose/v4 moves from v4.1.4 → v4.1.6 (algorithmic-complexity / JWE handling). v4.1.6 rejects JWE with mismatched CEK lengths, which is stricter and could break consumers of malformed tokens.

github.com/klauspost/compress moves from v1.19.2 → v1.20.2, patching zstd and huff0 decoder issues where crafted input could panic (DoS).

go.sum entries are updated in both modules to match.

^{Reviewed by Cursor Bugbot for commit eecbcb0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

	Warnings
⚠️	"fix: remediate high-and-above vulnerabilities reported by Snyk Open Source" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against e2d8abb

[prodsec-github-automation]

Superseded: the fix branch has been rebuilt from main. A new pull request replaces this one.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 6 relevant code sections from 3 files (average relevance: 0.89) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) package-lock.json (2 segments, lines 6-270) CLAUDE.md (3 segments, lines 274-355)

🤖 Repository instructions applied (from AGENTS.md)