What the developer wrote
Authored by ziggie
mod: remove stale xz replace
The github.com/ulikunitz/xz replacement was added for CVE-2021-29482
when an older embedded-postgres dependency chain pulled in the affected
module indirectly.
That module is no longer part of the selected dependency graph: go mod
why reports that the main module does not need it, and go list -m
reports it is not a known dependency. Keeping the replacement no longer
affects builds.
What changed, and why it matters
This commit removes an old workaround in LND's dependency file (go.mod) that pinned a safe version of the 'xz' compression library. The workaround was originally added because another dependency once pulled in a vulnerable version of xz. The commit message says that dependency is no longer in LND's build graph, so the pin no longer does anything. There is no code change that introduces a vulnerability; it is cleanup of a stale configuration line.
No immediate action is required. Reviewers may verify the commit's claim by running 'go mod why github.com/ulikunitz/xz' and 'go list -m github.com/ulikunitz/xz' on the commit to confirm the module is absent from the selected dependency graph. If the module were to reappear later without the replace directive, the vulnerable version should not be selected because Go's minimal version selection would prefer newer versions, but this should still be confirmed in any future dependency update.
Security signals we found
Removal of a dependency override that was a security mitigation for CVE-2021-29482
Commit explicitly references the original GHSA advisory (GHSA-25xm-hr59-7c27)
No actual downgrade or re-introduction of the vulnerable module is visible in the diff
Only go.mod is touched; no executable code changes
Evidence from the diff
The diff deletes a single ‘replace’ directive from go.mod: ‘replace github.com/ulikunitz/xz => github.com/ulikunitz/xz v0.5.11’. This directive forced the xz module to a patched version (v0.5.11) to avoid CVE-2021-29482. The commit message states that go mod why shows the main module no longer requires github.com/ulikunitz/xz and go list -m shows it is not a selected dependency, so the replace directive is inert. No other dependencies are changed, and no source code is modified.
Changed components
go.mod dependency managementgithub.com/ulikunitz/xz replace directiveInspect captured patch +0 / −3
diff --git a/go.mod b/go.mod
index 9f54e67..c0f47b1 100644
--- a/go.mod
+++ b/go.mod
@@ -200,9 +200,6 @@ require (
// TODO(elle): remove once the gossip V2 sqldb changes have been made.
replace github.com/lightningnetwork/lnd/sqldb => ./sqldb
-// This replace is for https://github.com/advisories/GHSA-25xm-hr59-7c27
-replace github.com/ulikunitz/xz => github.com/ulikunitz/xz v0.5.11
-
// We want to format raw bytes as hex instead of base64. The forked version
// allows us to specify that as an option.
replace google.golang.org/protobuf => github.com/lightninglabs/protobuf-go-hex-display v1.33.0-hex-display
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.