Repository navigation
go-feature-server image includes an outdated brotli package (DSA-6582-1) #7094
Description
Description
The feastdev/go-feature-server:0.67.0 image includes an outdated brotli package in its Debian base layer with a known vulnerability (DSA-6582-1). DSA-6582-1 is a critical Debian Security Advisory released on October 23, 2026, addressing a major vulnerability in the brotli compression suite. Since this is inherited from the base image rather than user-installed, downstream consumers cannot remediate it independently.
Affected image
- quay.io/feastdev/go-feature-server:0.67.0
- Vulnerable package:
brotli/libbrotli1
Advisories detected
| Advisory | Fixed version (brotli ≥) |
|---|---|
| DSA-6582-1 | 1.1.0-2+deb13u1 |
Steps to reproduce
- Pull the image:
docker pull feastdev/go-feature-server:0.67.0 - Check package version:
docker run --rm feastdev/go-feature-server:0.67.0 dpkg -s libbrotli1 | grep Version
Expected behavior
The image scans clean without triggering DSA-6582-1.
Environment
- Feast version: 0.67.0
- Image: feastdev/go-feature-server:0.67.0
Activity
shyamaryan commentedon Oct 30, 2026
@shuchu @NopeCharon can you please look into this?
Joystyxx commentedon Nov 2, 2026
Hi, I'm a Data Engineer using Feast for real-time feature serving. I'd like to update the Go feature server Dockerfile to address DSA-6582-1. Can I be assigned?
shuchu commentedon Nov 2, 2026
sure thing. I can assign it to you. @Joystyxx