Add github.com/klauspost/compress (v1.19.2) — scope: api-platform

[Thushani-Jayasekera]

Registry change (dependency-registry/go.yaml):

  - module: github.com/klauspost/compress
    versions:
      - version: ">=v1.19.2"
        allowed_scopes:
          - api-platform

1. Purpose of Dependency

Please describe the core functionality of the requested dependency:

github.com/klauspost/compress is a collection of pure-Go compression codecs. First-party code imports exactly one package from it — compress/zstd, a Zstandard (RFC 8878) encoder/decoder with a streaming io.Reader/io.Writer API and configurable per-stream worker concurrency. The linked package set is zstd plus the six support packages it pulls in itself (fse, huff0, internal/le, internal/snapref, zstd/internal/xxhash, and the root package); nothing else in the library is reachable from our build.

It is consumed by the API Platform Gateway policy engine (gateway-runtime/policy-engine) in internal/kernel/decompression.go, which transparently decodes and re-encodes HTTP request/response bodies so that body-inspecting policies can operate on plaintext. The kernel already handles gzip, deflate (both zlib-wrapped and raw), br, and identity; this dependency supplies the zstd content coding, which is now advertised by mainstream clients and backends. Decoder/encoder concurrency is pinned to 1 goroutine per stream so a proxy handling many concurrent bodies does not spawn GOMAXPROCS workers per body.

2. Technical Justification

Explain why this cannot be achieved without introducing a new third-party library:

The Go standard library has no Zstandard implementation — compress/* covers only gzip, zlib, flate, bzip2, and lzw. There is no approved registry entry that provides zstd either: github.com/andybalholm/brotli (already in use in the same file) covers only Brotli.

The alternatives were:

• cgo bindings to libzstd (e.g. DataDog/zstd, valyala/gozstd) — rejected; the gateway ships as a statically linked, cgo-free, distroless container image and adding a C toolchain dependency changes the build and hardening story.
• Not supporting zstd — rejected; a client or backend negotiating Content-Encoding: zstd would otherwise bypass body-based policies (or force the gateway to strip the encoding and lose upstream compression).
• Writing our own zstd codec — not a reasonable undertaking for a format of this complexity.

klauspost/compress is the de facto standard pure-Go zstd implementation and is already present in the module graph transitively — seven other modules in the api-platform workspace (gateway/gateway-controller, gateway/it, event-gateway/gateway-runtime, event-gateway/it, kubernetes/gateway-operator, sdk/ai) carry it as v1.18.6 // indirect. This promotes an existing transitive dependency to a direct one rather than expanding the supply chain surface.

Scope of usage: deliberately narrow, and verified rather than assumed. Across the entire api-platform workspace there is exactly one import of this library:

gateway/gateway-runtime/policy-engine/internal/kernel/decompression.go:32: "github.com/klauspost/compress/zstd"

go list -deps -test ./... on the policy-engine confirms the reachable set is zstd and its own internal support packages only. The library's other codecs (s2, flate, zip, gzhttp, …) are not linked, and the standard library remains the implementation for gzip/deflate/zlib.

The other seven workspace modules hold it only as // indirect, which the registry validator (scripts/validate-go-dependencies.sh) skips — so >=v1.19.2 does not need to accommodate their v1.18.6.

3. Dependency Health & Security Validation

By checking the boxes below, you confirm that you have evaluated the dependency against WSO2 engineering standards:

• Active Maintenance: Actively maintained by Klaus Post with a long, continuous release history and frequent patch releases; widely depended on across the Go ecosystem (Kubernetes, MinIO, Prometheus, containerd and the Docker/OCI toolchain all pull it in).
• License Compliance: Apache-2.0, with portions under BSD-3-Clause (derived from the Go standard library) and MIT (derived from golang/snappy and cespare/xxhash) — all Apache-2.0-compatible. No copyleft components.
• Security Posture: No known unpatched CVEs against v1.19.2 (the historical advisories — GHSA-c5q2-7r4c-mv6g / CVE-2022-30631 class issues in the zip/s2 readers — are fixed well below this version and affect packages we do not import). The library has zero non-test module dependencies, so its transitive tree adds nothing further to the supply chain.

Requested version and scope

• Version notation: >=v1.19.2 — matches the version pinned as a direct require in gateway/gateway-runtime/policy-engine/go.mod and allows routine patch/minor upgrades.
• Scope: api-platform only. Not requested globally — gzip/deflate needs elsewhere are served by the standard library, and zstd is specific to the gateway's content-coding path.

Downstream PR blocked by this

The API Platform Gateway PR refactoring zstd support to the policy-engine kernel fails dependency validation with Module not found in dependency registry until this is merged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1df7c02b-e721-49e1-a908-1be8c60d7c38

📥 Commits

Reviewing files that changed from the base of the PR and between fdc7bd5 and 17f6bd1.

📒 Files selected for processing (1)

• dependency-registry/go.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Summary

• Added github.com/klauspost/compress version >=v1.19.2 to dependency-registry/go.yaml.
• Restricted the dependency to the api-platform scope.
• Enables pure-Go Zstandard support for API Platform Gateway body processing.

Walkthrough

The Go dependency registry adds github.com/klauspost/compress with a minimum version of v1.19.2. The entry applies only to the api-platform scope. No existing registry entries or exported entities change.

Suggested reviewers: ddh13, brionmario

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description covers the dependency purpose, technical justification, health and security validation, requested scope, version, and downstream impact.
Title check	✅ Passed	The title clearly and concisely identifies the dependency, minimum version, and scope added by the pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Registry Analysis Report

Summary

Total Registry Entries Changed: 1
Added: 1 | Updated: 0 | Removed: 0
Security Status: All dependencies are secure with no active vulnerabilities
Licenses Found: Apache-2.0 (Apache 2.0 compatible), BSD-3-Clause (Apache 2.0 compatible), MIT (Apache 2.0 compatible)

See detailed analysis for more information

---

github.com/klauspost/compress: >=v1.19.2 - New

Added Entry:

module: github.com/klauspost/compress
version: ">=v1.19.2"
allowed_scopes: ["api-platform"]

• License: Apache-2.0, BSD-3-Clause, MIT (Apache 2.0 compatible)
• Version status: Minimum version v1.19.2 is current (Latest stable: v1.19.2, released August 2026)
• Security: No known CVEs affecting v1.19.2
• Transitive Dependencies: Zero non-test module dependencies analyzed, all secure

Security Analysis

Historical Vulnerability Check

• GHSA-259r-337f-4rfw (Integer Overflow/OOB Write in s2): Affected v1.16.0 through v1.18.6, fixed in v1.18.7 — NOT affecting v1.19.2
• Downstream references to CVE-2025-61728 and security audits relate to dependent packages (go-grpc-compression), not to klauspost/compress itself

Current Status for v1.19.2

No active or unpatched vulnerabilities detected. The constraint >=v1.19.2 safely excludes all known vulnerable versions.

• Repository Activity: Actively maintained — v1.19.0 released July 1, 2026; v1.19.2 released August 2026 with arm64 assembly optimizations for huff0. Sustained development with frequent patch releases across the Go ecosystem (widely used in Kubernetes, MinIO, Prometheus, containerd, Docker/OCI toolchain).

References

• Repository: https://github.com/klauspost/compress
• Documentation: https://pkg.go.dev/github.com/klauspost/compress
• License: https://github.com/klauspost/compress/blob/master/LICENSE (multi-license: Apache-2.0, BSD-3-Clause derived from Go stdlib, MIT derived from golang/snappy and cespare/xxhash)

---

Note: This entry is NEW to the registry. The submitter has confirmed that the library has zero non-test module dependencies, minimizing transitive supply chain exposure. Usage is scoped to api-platform only, specifically for Zstandard (zstd) content-encoding support in the policy engine's request/response decompression path.

---

Analysis completed on 2026-08-20
Analyzed PR #37 | Repository: wso2/engineering-governance

[renuka-fernando]

+1 from me.

Go Mod of the library: https://github.com/klauspost/compress/blob/master/go.mod

cc: @pubudu538