GeezerVison is showing github.com — go-feature-server image includes an outdated brotli package (DSA-6582-1) · Issue #7094 · feast-dev/feast
go-feature-server image includes an outdated brotli package (DSA-6582-1) #7094
Description
Description
The feastdev/go-feature-server:0.67.0 image includes an outdated brotli package in its Debian base layer with a known vulnerability (DSA-6582-1). DSA-6582-1 is a critical Debian Security Advisory released on October 23, 2026, addressing a major vulnerability in the brotli compression suite. Since this is inherited from the base image rather than user-installed, downstream consumers cannot remediate it independently.
Affected image
- quay.io/feastdev/go-feature-server:0.67.0
- Vulnerable package:
brotli / libbrotli1
Advisories detected
| Advisory |
Fixed version (brotli ≥) |
| DSA-6582-1 |
1.1.0-2+deb13u1 |
Steps to reproduce
- Pull the image:
docker pull feastdev/go-feature-server:0.67.0
- Check package version:
docker run --rm feastdev/go-feature-server:0.67.0 dpkg -s libbrotli1 | grep Version
Expected behavior
The image scans clean without triggering DSA-6582-1.
Environment
- Feast version: 0.67.0
- Image: feastdev/go-feature-server:0.67.0
Activity
shyamaryan commented on Oct 30, 2026
Joystyxx commented on Nov 2, 2026
Hi, I'm a Data Engineer using Feast for real-time feature serving. I'd like to update the Go feature server Dockerfile to address DSA-6582-1. Can I be assigned?
Reacted by Shuchu Han and shyamaryan
shuchu commented on Nov 2, 2026
sure thing. I can assign it to you. @Joystyxx
Metadata
Metadata
Development
No branches or pull requestsIssue actions