[WIP] Fix denial of service vulnerability in jsonparser

[Claude]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input</issue_title>
<issue_description>tools/fleet-mcp/go.mod:1
module fleet-mcp
Error
github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input
Package: github.com/buger/jsonparser
Installed Version: v1.1.2-0.20220418200129-61b32cfdfa0f
Vulnerability CVE-2026-32285
Severity: HIGH
Fixed Version: 1.1.2
Link: CVE-2026-32285
Trivy

go 1.26.2

Rule
Tool
Trivy
Rule ID
CVE-2026-32285
Description
Vulnerability CVE-2026-32285

Severity Package Fixed Version Link
HIGH github.com/buger/jsonparser 1.1.2 CVE-2026-32285
The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.</issue_description>

<agent_instructions>We're getting this code scanning alert. Can you fix it? </agent_instructions>

Comments on the Issue (you are @claude[agent] in this section)

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[Copilot]

Pull request overview

Updates the tools/fleet-mcp module dependencies to address the Trivy-reported DoS vulnerability (CVE-2026-32285) in github.com/buger/jsonparser by moving off the vulnerable pseudo-version and pinning the fixed release.

Changes:

• Bump github.com/buger/jsonparser to v1.1.2 (fixed version for CVE-2026-32285).
• Promote golang.org/x/time v0.15.0 from indirect to a direct dependency (it’s imported by tools/fleet-mcp/rate_limit.go).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
tools/fleet-mcp/go.mod	Updates dependency requirements, pinning jsonparser to v1.1.2 and making x/time a direct require.
tools/fleet-mcp/go.sum	Updates module checksums to match the jsonparser v1.1.2 version change.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.