go-feature-server image includes an outdated brotli package (DSA-6582-1) #7094

Description

The feastdev/go-feature-server:0.67.0 image includes an outdated brotli package in its Debian base layer with a known vulnerability (DSA-6582-1). DSA-6582-1 is a critical Debian Security Advisory released on October 23, 2026, addressing a major vulnerability in the brotli compression suite. Since this is inherited from the base image rather than user-installed, downstream consumers cannot remediate it independently.

Affected image

• quay.io/feastdev/go-feature-server:0.67.0
• Vulnerable package: brotli / libbrotli1

Advisories detected

Steps to reproduce

1. Pull the image: docker pull feastdev/go-feature-server:0.67.0
2. Check package version:

   docker run --rm feastdev/go-feature-server:0.67.0 dpkg -s libbrotli1 | grep Version

Expected behavior

The image scans clean without triggering DSA-6582-1.

Environment

• Feast version: 0.67.0
• Image: feastdev/go-feature-server:0.67.0