infobloxopen / migrate / 35295279278

53%

ib: 53%

Pull #65

github

Clear reachable vulnerabilities in the shipped binary

govulncheck in binary mode against the built CLI reported two reachable
findings; both are addressed here.

* klauspost/compress v1.18.0 -> v1.18.7 fixes GO-2026-5841, an OOB read
  in compress/s2. Reached through compress/zstd and internal/snapref
  rather than by importing s2 directly, which is why a package-level
  dependency listing does not show it.

* go-github v39 -> v92 removes the golang.org/x/crypto/openpgp path
  (GO-2026-5932, unmaintained and unsafe by design, no fix available).
  go-github dropped its x/crypto dependency at v60; v92 is current.
  x/crypto stays in the module graph via other dependencies, but the
  openpgp package is no longer imported or linked.

Two API changes were required. NewClient now takes options and returns
an error, and WithHTTPClient rejects a nil client, so source/github only
passes it when the URL carried user info -- preserving the previous
"defaults to http.DefaultClient" behaviour. NewEnterpriseClient is gone;
source/github_ee composes WithHTTPClient and WithEnterpriseURLs instead.

Verified with a binary built at the shipped build tags using Go 1.26.8:
"No vulnerabilities found", 0 reachable, 1 module-graph-only advisory.

Note this diverges from upstream, which is still on go-github v39, so
future upstream merges will conflict on these two files.

11 of 15 new or added lines in 2 files covered. (73.33%)

4442 of 8437 relevant lines covered (52.65%)

6424.41 hits per line