chore(deps): update module github.com/klauspost/compress to v1.18.7 [security]

[alaudaa-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/klauspost/compress	v1.18.0 -> v1.18.7

---

OOB read in github.com/klauspost/compress/s2

GHSA-259r-337f-4rfw / GO-2026-5841

More information

Details

Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.

Severity

Unknown

References

• https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw
• https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

klauspost/compress (github.com/klauspost/compress)

v1.18.7

Compare Source

• Fix s2.NewDict OOB read.

Security release without other changes.

Full Changelog: klauspost/compress@v1.18.6...v1.18.7

v1.18.6

Compare Source

What's Changed

• s2: Fix amd64 stack frame corruption by @​klauspost in https://github.com/klauspost/compress/pull/1145
• gzhttp: Canonicalize ETag header by @​justinmayhew in https://github.com/klauspost/compress/pull/1139
• perf: pool hash tables in Go encode paths to reduce allocations by @​huynhanx03 in https://github.com/klauspost/compress/pull/1143

New Contributors

• @​justinmayhew made their first contribution in https://github.com/klauspost/compress/pull/1139
• @​huynhanx03 made their first contribution in https://github.com/klauspost/compress/pull/1143
• @​thaJeztah made their first contribution in https://github.com/klauspost/compress/pull/1144

Full Changelog: klauspost/compress@v1.18.5...v1.18.6

v1.18.5

Compare Source

What's Changed

• zstd: Fix crash when changing encoder dictionary with same ID by @​klauspost in https://github.com/klauspost/compress/pull/1135
• zstd: Default to full zero frames by @​klauspost in https://github.com/klauspost/compress/pull/1134
• flate: Clean up histogram order by @​klauspost in https://github.com/klauspost/compress/pull/1133

Full Changelog: klauspost/compress@v1.18.4...v1.18.5

v1.18.4

Compare Source

What's Changed

• gzhttp: Add zstandard to server handler wrapper by @​klauspost in https://github.com/klauspost/compress/pull/1121
• zstd: Add ResetWithOptions to encoder/decoder by @​klauspost in https://github.com/klauspost/compress/pull/1122
• gzhttp: preserve qvalue when extra parameters follow in Accept-Encoding by @​analytically in https://github.com/klauspost/compress/pull/1116

New Contributors

• @​analytically made their first contribution in https://github.com/klauspost/compress/pull/1116
• @​ethaizone made their first contribution in https://github.com/klauspost/compress/pull/1124
• @​zwass made their first contribution in https://github.com/klauspost/compress/pull/1125

Full Changelog: klauspost/compress@v1.18.2...v1.18.4

v1.18.3

Compare Source

Downstream CVE-2025-61728

See https://github.com/golang/go/issues/77102

Full Changelog: klauspost/compress@v1.18.2...v1.18.3

v1.18.2

Compare Source

What's Changed

• flate: Fix invalid encoding on level 9 with single value input by @​klauspost in https://github.com/klauspost/compress/pull/1115
• flate: reduce stateless allocations by @​RXamzin in https://github.com/klauspost/compress/pull/1106
• build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 in the github-actions group by @​dependabot[bot] inhttps://github.com/klauspost/compress/pull/11111

v1.18.1 is marked "retracted" due to invalid flate/zip/gzip encoding.

New Contributors

• @​RXamzin made their first contribution in https://github.com/klauspost/compress/pull/1106

Full Changelog: klauspost/compress@v1.18.1...v1.18.2

v1.18.1

Compare Source

What's Changed

• zstd: Fix incorrect buffer size in dictionary encodes by @​klauspost in https://github.com/klauspost/compress/pull/1059
• s2: check for cap, not len of buffer in EncodeBetter/Best by @​vdarulis in https://github.com/klauspost/compress/pull/1080
• zstd: Add simple zstd EncodeTo/DecodeTo functions by @​klauspost in https://github.com/klauspost/compress/pull/1079
• zlib: Avoiding extra allocation in zlib.reader.Reset by @​travelpolicy in https://github.com/klauspost/compress/pull/1086
• gzhttp: remove redundant err check in zstdReader by @​ryanfowler in https://github.com/klauspost/compress/pull/1090
• Run modernize. Deprecate Go 1.22 by @​klauspost in https://github.com/klauspost/compress/pull/1095
• flate: Simplify matchlen by @​klauspost in https://github.com/klauspost/compress/pull/1101
• flate: Add examples by @​klauspost in https://github.com/klauspost/compress/pull/1102
• flate: Use exact sizes for huffman tables by @​klauspost in https://github.com/klauspost/compress/pull/1103
• flate: Faster load+store by @​klauspost in https://github.com/klauspost/compress/pull/1104
• Add notice to S2 about MinLZ by @​klauspost in https://github.com/klauspost/compress/pull/1065

New Contributors

• @​wooffie made their first contribution in https://github.com/klauspost/compress/pull/1069
• @​vdarulis made their first contribution in https://github.com/klauspost/compress/pull/1080
• @​travelpolicy made their first contribution in https://github.com/klauspost/compress/pull/1086
• @​ryanfowler made their first contribution in https://github.com/klauspost/compress/pull/1090

Full Changelog: klauspost/compress@v1.18.0...v1.18.1

---

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.