Description
The root module selects github.com/klauspost/compress v1.19.2 and the audit gate reports reachable GO-2026-6865, a panic on malformed two-block frames. The Go vulnerability database marks v1.20.2 as fixed. Upgrade only the affected module and checksum entries, retaining all four module checks and generated-asset gates. Retire the already-migrated reviewer configuration in the same scoped maintenance change; preserve its preimage in Git history.
Acceptance Criteria
- #1 The selected compression dependency is at least the advisory fixed version and its checksums are consistent, without unrelated module upgrades.
- #2 The audit no longer reports the reachable advisory, and required module and consumer checks pass without scanner suppression.
- #3 The scoped change retires only the obsolete reviewer configuration besides the module metadata and task record, retaining recoverable provenance.
Definition of Done
- #1 just check is green — fmt-check, lint, tidy-check, tools-check, forks-check, test, audit, gen-check, helm-check, build. Evidence, not assertion: paste or cite the run.
- #2 just gen run and its output committed if the change touches a registry-driven or generated surface (collectors, env vars, signal catalog, dashboards, alert rules, chart README, beta drift spec).
- #3 Committed green to main and pushed, with the resulting SHA recorded in this task.
Implementation Plan
Reproduce the reachable advisory on the unchanged module graph, apply only the fixed compression module and required checksum entries, run the actual OTLP compression consumers and full declared gate, then obtain combined review before landing.
Implementation Notes
The official Go advisory GO-2026-6865 records panic on malformed two-block frames and fixed version v1.20.2. The unchanged audit reproduced the called vulnerability at v1.19.2; after only selecting v1.20.2 and updating its checksum lines, the same govulncheck command passes. The module path reaches the compression implementation through the profiling dependency. No vulnerability suppressions, scanner changes, unrelated upgrades or production source changes were made. Full declared gate and combined review remain pending; the former reviewer configuration is removed with its exact preimage retained.