[Kiran01bm]

Bump Go from 1.26.0 to 1.26.11 and klauspost/compress from v1.18.7 to v1.20.4 so a pg-sprite build no longer calls into any known vulnerability.

Why

go.mod says go 1.26.0, and CI and the release workflow install the Go release that go.mod names. So the tests and the release binaries use the Go 1.26.0 standard library. govulncheck reports 30 advisories in it as reachable from pg-sprite; Go fixed them in releases 1.26.1 through 1.26.11. The newest is GO-2026-6859, a net/http server panic published on 2026-11-11. One more reachable finding, GO-2026-6865, is in klauspost/compress v1.18.7, an indirect dependency. Releases from v1.20.2 carry that fix.

What

• Raise the go directive to 1.26.11.
• Raise github.com/klauspost/compress to v1.20.4.

No code changes. A module that imports pg-sprite needs Go 1.26.11 or newer after this.

Before / after

Only the Go release and one indirect dependency change. No pg-sprite code changes. The example is one manual run of govulncheck ./... (v1.6.0), first at main and then on this branch.

Before: go 1.26.0, compress v1.18.7       After: go 1.26.11, compress v1.20.4

┌──────────────────────────────────┐      ┌──────────────────────────────────┐
│ govulncheck ./...                │      │ govulncheck ./...                │
│ at main, run by hand             │      │ on this branch, run by hand      │
└───────────────┬──────────────────┘      └───────────────┬──────────────────┘
                │ the scan reads go1.26.0                 │ the scan reads go1.26.11
                │ and compress v1.18.7                    │ and compress v1.20.4
                ▼                                         ▼
┌──────────────────────────────────┐      ┌──────────────────────────────────┐
│ 31 reachable findings: 30 in the │      │ 0 reachable vulnerabilities      │
│ standard library, 1 in compress  │      │                                  │
└───────────────┬──────────────────┘      └───────────────┬──────────────────┘
                │ exit 3                                  │ exit 0
                ▼                                         ▼
┌──────────────────────────────────┐      ┌──────────────────────────────────┐
│ ✗ a pg-sprite build calls into   │      │ ✓ a pg-sprite build calls into   │
│ 31 known vulnerabilities         │      │ no known vulnerability           │
└──────────────────────────────────┘      └──────────────────────────────────┘

References

• GO-2026-6859
• GO-2026-6865

🤖 Generated with Amp (claude-opus-5-5)

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-11T06:53:58.556546Z We couldn’t complete this review. Comment @codex review to try again.	7b055bd	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[JashLal]

🤖 Reviewed by Jash’s AI agent (Codex) at 7b055bd.

No blocking issue found in the full two-file diff. The module minimum moves from Go 1.26.0 to 1.26.11, and the indirect klauspost/compress requirement moves to v1.20.4 with both its module and content checksums added. Older go.sum entries do not override the version selected in go.mod. The higher minimum also applies to downstream consumers, as the description notes.

Validation: all 17 reported GitHub checks passed. I did not run local tests/builds or independently reproduce the reported vulnerability scan. The new scanning workflow in #350 includes these same dependency changes; landing this prerequisite first keeps that stack straightforward.

[JashLal]

🤖 Approved by Jash’s AI agent (Codex). Review findings and validation limits are recorded in my substantive PR comment.