Fix: Upgrade spdystream to v0.5.1 to address DoS vulnerability

[plural-copilot]

Summary

This PR upgrades github.com/moby/spdystream from v0.5.0 to v0.5.1 in the kubernetes-agent modules (api and kas) to address a critical denial of service vulnerability.

Vulnerability Details:

• Component: spdystream (SPDY multiplexing library)
• Versions Affected: 0.5.0 and below
• Fixed Version: 0.5.1
• Severity: Critical DoS vulnerability
• Attack Vector: Remote peer can send crafted SPDY frames to exhaust process memory

The SPDY/3 frame parser in versions ≤0.5.0 did not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths were affected:

1. SETTINGS frame entry count
2. Header count in parseHeaderValueBlock
3. Individual header field sizes

Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values, allowing memory exhaustion with a single crafted control frame.

Changes

• go/kubernetes-agent/api/go.mod: Updated spdystream dependency to v0.5.1
• go/kubernetes-agent/api/go.sum: Updated checksums for v0.5.1
• go/kubernetes-agent/kas/go.mod: Updated spdystream dependency to v0.5.1
• go/kubernetes-agent/kas/go.sum: Updated checksums for v0.5.1

Test Plan

• Dependency checksums verified against official Go module proxy
• CI build pipeline will verify compilation
• CI test suite will verify no regressions
• Docker image builds successfully with updated dependencies

Security Impact

This upgrade prevents potential denial of service attacks against the Kubernetes agent components that communicate via SPDY protocol.

🤖 Generated with Claude Code

[plural-copilot]

This PR was generated by the claude Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Security scanners have found the following vulnerability in our cluster:...
🔗 Run history	View run history

[greptile-apps]

Greptile Summary

This PR upgrades github.com/moby/spdystream from v0.5.0 to v0.5.1 in the kubernetes-agent/api and kubernetes-agent/kas Go modules to patch a critical DoS vulnerability where crafted SPDY frames could exhaust process memory.

• go/helm-test/go.mod (and its go.sum) still references the vulnerable v0.5.0 — the fix is incomplete without updating this module as well.

Confidence Score: 3/5

Partially safe — the targeted modules are fixed, but the vulnerable dependency persists in a third module.

A P1 finding (incomplete security remediation) prevents a higher score. The two updated modules are correct, but go/helm-test still carries the vulnerable v0.5.0, leaving the fix incomplete.

go/helm-test/go.mod and go/helm-test/go.sum need to be updated to spdystream v0.5.1

Security Review

• Incomplete vulnerability remediation: go/helm-test/go.mod retains github.com/moby/spdystream v0.5.0, the version vulnerable to the DoS attack described in the PR. Any component using the helm-test module remains exposed to memory exhaustion via crafted SPDY frames.

Important Files Changed

Filename	Overview
go/kubernetes-agent/api/go.mod	Correctly bumps github.com/moby/spdystream from v0.5.0 to v0.5.1 to address the DoS vulnerability
go/kubernetes-agent/api/go.sum	Checksums correctly updated for spdystream v0.5.1; go.mod hash matching v0.5.0 is expected if the module's go.mod file was unchanged between releases
go/kubernetes-agent/kas/go.mod	Correctly bumps github.com/moby/spdystream from v0.5.0 to v0.5.1 to address the DoS vulnerability
go/kubernetes-agent/kas/go.sum	Checksums correctly updated for spdystream v0.5.1

Comments Outside Diff (1)

1. go/helm-test/go.mod, line 90 (link)

   Vulnerable version not updated in helm-test module

   go/helm-test/go.mod still pins github.com/moby/spdystream v0.5.0, the version with the DoS vulnerability this PR aims to fix. The go/helm-test/go.sum and go/tools/go.sum also still carry v0.5.0 checksums. This module needs the same bump to v0.5.1 to be fully remediated.

_{Reviews (1): Last reviewed commit: "fix: upgrade moby/spdystream to v0.5.1 t..." | Re-trigger Greptile}