fix: patch Snyk ghost dependency vulnerabilities

[josue]

Summary

• Replace directives for three ghost transitive dependencies flagged by Snyk — pins patched versions so Snyk resolves them as fixed:
  • github.com/go-jose/go-jose/v4: v4.1.3 → v4.1.4 (CVSS 8.7, Uncaught Exception)
  • golang.org/x/crypto: v0.38.0 → v0.50.0 (CVSS 6.9, Resource Allocation + OOB Read)
  • github.com/yuin/goldmark: v1.4.13 → v1.8.2 (CVSS 5.1, XSS)
• Extend .snyk msgpack ignores from 2026-07-03 to 2027-01-03 (no upstream fix available)
• Upgrade go-cty v1.18.0 → v1.18.1 (patch-level indirect dep bump)

Context

Snyk reports 6 open vulnerability alerts against go.mod. All three high-priority CVEs are ghost transitive dependencies — they appear in the Go module graph via parent packages (grpc, hcl/v2, x/tools) but are never imported or compiled into any binary (go mod why confirms). The parent packages are all at their latest stable versions, so the transitive deps cannot be upgraded via normal go get.

replace directives solve this by declaring the patched versions in go.mod. As a library module, these directives only apply to this repo's own CI/tests — consumers' builds are unaffected (Go ignores replace directives from dependencies). They should be removed once parent packages release versions that require the patched transitive deps.

Test plan

• go test ./ — unit tests pass
• cd _examples && go test ./. — integration tests pass
• make lint — no regressions (pre-existing SA1029 only)
• snyk test — 0 open vulnerabilities locally
• go mod tidy — replace directives survive
• go list -m — confirms patched versions resolve correctly
• Verify Snyk web UI re-scans and shows 0 open after merge

🤖 Generated with Claude Code

[flume-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

This PR addresses Snyk-reported “ghost” Go module vulnerabilities by pinning patched transitive dependency versions via replace directives, and updates Snyk ignore metadata for msgpack where no upstream fix is available.

Changes:

• Add replace directives to force patched versions of go-jose/v4, golang.org/x/crypto, and goldmark in both the root module and _examples.
• Bump indirect dependency github.com/zclconf/go-cty from v1.18.0 to v1.18.1 (and update go.sum files accordingly).
• Extend .snyk msgpack ignore expiry and record a “Last verified” date.

Reviewed changes

Copilot reviewed 3 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
go.mod	Bumps go-cty indirect version and adds replace pins for patched transitive deps.
go.sum	Updates checksums for go-cty v1.18.1.
_examples/go.mod	Mirrors root module dependency bump and adds the same replace pins.
_examples/go.sum	Updates checksums for go-cty v1.18.1 in examples module.
.snyk	Extends msgpack ignore expirations and adds “Last verified” notes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.