[prodsec-github-automation]

Snyk agentic fix

The Snyk Open Source scan of fix/CLI-1843_legacycli-placeholder-token reported vulnerabilities at or above high severity. This branch was produced by snyk fix --agentic working on those.

The fix itself was applied to main, not to fix/CLI-1843_legacycli-placeholder-token, so this pull request stands on its own rather than stacking on the branch that triggered it. A vulnerability that exists only on fix/CLI-1843_legacycli-placeholder-token is therefore not addressed here.

Whether that scan also failed the build depends on the Enhanced Gate, which blocks only once a vulnerability has passed its remediation SLA — so this pull request may exist for a build that is green.

3 of 5 fixed.

These changes are generated. Review them as you would any dependency bump — check the changelogs of the upgraded packages before merging.

Fixed

Severity	Vulnerability	Where	Breaking-change risk
High	Inefficient Algorithmic Complexity	cliv2-private/go.mod, cliv2/go.mod	Medium — This patch upgrade for go-jose introduces stricter validation that could affect existing applications. Behavioral Change: - v4.1.6: The library now rejects JSON Web Encryption (JWE) messages with mismatched Content Encryption Key (CEK) lengths. Previously, these may have been processed, but now they will result in an error. Recommendation: Verify that any systems generating JWE tokens for consumption by this service are correctly formatting the CEK. This change improves security and spec compliance but could cause issues with incorrectly generated tokens. Source: GitHub Release Notes
High	Integer Overflow or Wraparound	cliv2-private/go.mod, cliv2/go.mod	Low — This is a minor version upgrade that includes security fixes and bug fixes. The primary change is in version 1.20.2, which addresses a high-severity vulnerability. - Security Fix (v1.20.2): This version patches a vulnerability (GHSA-fpmh-frq8-7rj8) where a crafted input to the zstd decoder could cause a panic (denial of service). The fix prevents the application from crashing when processing malformed data. No breaking API changes are documented in this version range. The upgrade is recommended to incorporate the security patch. Source: Release notes
High	Integer Overflow or Wraparound	cliv2-private/go.mod, cliv2/go.mod	Low — This is a minor version upgrade that primarily includes optimizations and a security fix. - Security Fix (CVE-2026-116591): Version 1.20.2 corrects a high-severity vulnerability where a crafted input could cause a panic in the huff0 decoder, leading to a denial of service. - Optimizations: The releases within this range include performance improvements for the huff0 package. There are no documented breaking API changes. The upgrade is recommended to patch the security vulnerability. Source: Release Notes

Not fixed

Severity	Vulnerability	Where	Fix available	Breaking-change risk
High	Uncontrolled Recursion	package.json	Yes	Low — This is a patch version upgrade from 4.26.2 to 4.26.3. Patch releases typically consist of bug fixes and security patches and are not expected to contain breaking changes. No specific release notes or changelog for this exact version were found, but given the nature of a patch update, the risk of breaking changes is considered low. Source: Package documentation
High	Regular Expression Denial of Service (ReDoS)	package.json	Yes	Low — This is a patch version upgrade from 4.26.2 to 4.26.3. Patch releases typically consist of bug fixes and security patches and are not expected to contain breaking changes. No specific release notes or changelog for this exact version were found, but given the nature of a patch update, the risk of breaking changes is considered low. Source: Package documentation

A row marked Fix available: No has no upgrade path for snyk fix to take. One marked Yes does, but needed a change the agent would not make unattended — those are the rows to look at first.

This is not necessarily a complete fix. The build on this pull request runs the same Open Source scan and quality gate, so its result — not this description — is the verdict on what is left.

Changes

 cliv2-private/go.mod | 4 ++--
 cliv2-private/go.sum | 4 ++++
 cliv2/go.mod         | 4 ++--
 cliv2/go.sum         | 4 ++++
 4 files changed, 12 insertions(+), 4 deletions(-)

_{Snyk ProdSec orb · build 685422 · model claude-sonnet-5-5}

---

Note

Medium Risk
Touches crypto/JWE validation (go-jose) and decompression of untrusted data (klauspost/compress) via transitive deps; go-jose v4.1.6 may reject previously accepted malformed JWE tokens.

Overview
Bumps indirect Go dependencies in cliv2 and cliv2-private to address Snyk high-severity findings. No application source changes—only go.mod / go.sum.

github.com/go-jose/go-jose/v4 4.1.4 → 4.1.6 fixes inefficient algorithmic complexity in JWE/JWS handling. v4.1.6 also rejects JWE with mismatched CEK lengths (stricter spec compliance), which could break interaction with peers that emit malformed tokens.

github.com/klauspost/compress 1.19.2 → 1.20.2 patches integer-overflow / crafted-input issues in zstd and huff0 decoders that could panic (DoS) on malicious compressed data.

Reviewers should treat this like any dependency security bump: confirm changelogs and that CLI paths that decompress untrusted input or verify JWE/JWT via transitive stacks behave as expected.

^{Reviewed by Cursor Bugbot for commit eecbcb0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 6 relevant code sections from 3 files (average relevance: 0.89) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) package-lock.json (2 segments, lines 6-270) CLAUDE.md (3 segments, lines 274-355)

🤖 Repository instructions applied (from AGENTS.md)

[github-actions]

	Warnings
⚠️	"fix: remediate high-and-above vulnerabilities reported by Snyk Open Source" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against eecbcb0