Skip to content

Commit f07d878

Browse files
pulumi-renovate[bot]pulumi-renovate[bot]
authored
Update module github.com/klauspost/compress to v1.18.7 [SECURITY] (#767)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/klauspost/compress](https://redirect.github.com/klauspost/compress) | `v1.18.0` → `v1.18.7` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fklauspost%2fcompress/v1.18.7?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fklauspost%2fcompress/v1.18.0/v1.18.7?slim=true) | --- ### OOB read in github.com/klauspost/compress/s2 [GHSA-259r-337f-4rfw](https://redirect.github.com/advisories/GHSA-259r-337f-4rfw) / [GO-2026-5841](https://pkg.go.dev/vuln/GO-2026-5841) <details> <summary>More information</summary> #### Details Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds. #### Severity Unknown #### References - [https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw](https://redirect.github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw) - [https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa](https://redirect.github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5841) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Release Notes <details> <summary>klauspost/compress (github.com/klauspost/compress)</summary> ### [`v1.18.7`](https://redirect.github.com/klauspost/compress/releases/tag/v1.18.7) [Compare Source](https://redirect.github.com/klauspost/compress/compare/v1.18.6...v1.18.7) - Fix s2.NewDict OOB read. Security release without other changes. **Full Changelog**: <klauspost/compress@v1.18.6...v1.18.7> ### [`v1.18.6`](https://redirect.github.com/klauspost/compress/releases/tag/v1.18.6) [Compare Source](https://redirect.github.com/klauspost/compress/compare/v1.18.5...v1.18.6) ##### What's Changed - s2: Fix amd64 stack frame corruption by [@&#8203;klauspost](https://redirect.github.com/klauspost) in [#&#8203;1145](https://redirect.github.com/klauspost/compress/pull/1145) - gzhttp: Canonicalize ETag header by [@&#8203;justinmayhew](https://redirect.github.com/justinmayhew) in [#&#8203;1139](https://redirect.github.com/klauspost/compress/pull/1139) - perf: pool hash tables in Go encode paths to reduce allocations by [@&#8203;huynhanx03](https://redirect.github.com/huynhanx03) in [#&#8203;1143](https://redirect.github.com/klauspost/compress/pull/1143) ##### New Contributors - [@&#8203;justinmayhew](https://redirect.github.com/justinmayhew) made their first contribution in [#&#8203;1139](https://redirect.github.com/klauspost/compress/pull/1139) - [@&#8203;huynhanx03](https://redirect.github.com/huynhanx03) made their first contribution in [#&#8203;1143](https://redirect.github.com/klauspost/compress/pull/1143) - [@&#8203;thaJeztah](https://redirect.github.com/thaJeztah) made their first contribution in [#&#8203;1144](https://redirect.github.com/klauspost/compress/pull/1144) **Full Changelog**: <klauspost/compress@v1.18.5...v1.18.6> ### [`v1.18.5`](https://redirect.github.com/klauspost/compress/releases/tag/v1.18.5) [Compare Source](https://redirect.github.com/klauspost/compress/compare/v1.18.4...v1.18.5) ##### What's Changed - zstd: Fix crash when changing encoder dictionary with same ID by [@&#8203;klauspost](https://redirect.github.com/klauspost) in [#&#8203;1135](https://redirect.github.com/klauspost/compress/pull/1135) - zstd: Default to full zero frames by [@&#8203;klauspost](https://redirect.github.com/klauspost) in [#&#8203;1134](https://redirect.github.com/klauspost/compress/pull/1134) - flate: Clean up histogram order by [@&#8203;klauspost](https://redirect.github.com/klauspost) in [#&#8203;1133](https://redirect.github.com/klauspost/compress/pull/1133) **Full Changelog**: <klauspost/compress@v1.18.4...v1.18.5> ### [`v1.18.4`](https://redirect.github.com/klauspost/compress/releases/tag/v1.18.4) [Compare Source](https://redirect.github.com/klauspost/compress/compare/v1.18.3...v1.18.4) ##### What's Changed - gzhttp: Add zstandard to server handler wrapper by [@&#8203;klauspost](https://redirect.github.com/klauspost) in [#&#8203;1121](https://redirect.github.com/klauspost/compress/pull/1121) - zstd: Add ResetWithOptions to encoder/decoder by [@&#8203;klauspost](https://redirect.github.com/klauspost) in [#&#8203;1122](https://redirect.github.com/klauspost/compress/pull/1122) - gzhttp: preserve qvalue when extra parameters follow in Accept-Encoding by [@&#8203;analytically](https://redirect.github.com/analytically) in [#&#8203;1116](https://redirect.github.com/klauspost/compress/pull/1116) ##### New Contributors - [@&#8203;analytically](https://redirect.github.com/analytically) made their first contribution in [#&#8203;1116](https://redirect.github.com/klauspost/compress/pull/1116) - [@&#8203;ethaizone](https://redirect.github.com/ethaizone) made their first contribution in [#&#8203;1124](https://redirect.github.com/klauspost/compress/pull/1124) - [@&#8203;zwass](https://redirect.github.com/zwass) made their first contribution in [#&#8203;1125](https://redirect.github.com/klauspost/compress/pull/1125) **Full Changelog**: <klauspost/compress@v1.18.2...v1.18.4> ### [`v1.18.3`](https://redirect.github.com/klauspost/compress/releases/tag/v1.18.3) [Compare Source](https://redirect.github.com/klauspost/compress/compare/v1.18.2...v1.18.3) Downstream CVE-2025-61728 See [golang/go#77102](https://redirect.github.com/golang/go/issues/77102) **Full Changelog**: <klauspost/compress@v1.18.2...v1.18.3> ### [`v1.18.2`](https://redirect.github.com/klauspost/compress/releases/tag/v1.18.2) [Compare Source](https://redirect.github.com/klauspost/compress/compare/v1.18.1...v1.18.2) ##### What's Changed - flate: Fix invalid encoding on level 9 with single value input by [@&#8203;klauspost](https://redirect.github.com/klauspost) in [#&#8203;1115](https://redirect.github.com/klauspost/compress/pull/1115) - flate: reduce stateless allocations by [@&#8203;RXamzin](https://redirect.github.com/RXamzin) in [#&#8203;1106](https://redirect.github.com/klauspost/compress/pull/1106) - build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 in the github-actions group by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;1111](https://redirect.github.com/klauspost/compress/pull/1111) `v1.18.1` is marked "retracted" due to invalid flate/zip/gzip encoding. ##### New Contributors - [@&#8203;RXamzin](https://redirect.github.com/RXamzin) made their first contribution in [#&#8203;1106](https://redirect.github.com/klauspost/compress/pull/1106) **Full Changelog**: <klauspost/compress@v1.18.1...v1.18.2> ### [`v1.18.1`](https://redirect.github.com/klauspost/compress/releases/tag/v1.18.1) [Compare Source](https://redirect.github.com/klauspost/compress/compare/v1.18.0...v1.18.1) ##### What's Changed - zstd: Fix incorrect buffer size in dictionary encodes by [@&#8203;klauspost](https://redirect.github.com/klauspost) in [#&#8203;1059](https://redirect.github.com/klauspost/compress/pull/1059) - s2: check for cap, not len of buffer in EncodeBetter/Best by [@&#8203;vdarulis](https://redirect.github.com/vdarulis) in [#&#8203;1080](https://redirect.github.com/klauspost/compress/pull/1080) - zstd: Add simple zstd EncodeTo/DecodeTo functions by [@&#8203;klauspost](https://redirect.github.com/klauspost) in [#&#8203;1079](https://redirect.github.com/klauspost/compress/pull/1079) - zlib: Avoiding extra allocation in zlib.reader.Reset by [@&#8203;travelpolicy](https://redirect.github.com/travelpolicy) in [#&#8203;1086](https://redirect.github.com/klauspost/compress/pull/1086) - gzhttp: remove redundant err check in zstdReader by [@&#8203;ryanfowler](https://redirect.github.com/ryanfowler) in [#&#8203;1090](https://redirect.github.com/klauspost/compress/pull/1090) - Run modernize. Deprecate Go 1.22 by [@&#8203;klauspost](https://redirect.github.com/klauspost) in [#&#8203;1095](https://redirect.github.com/klauspost/compress/pull/1095) - flate: Simplify matchlen by [@&#8203;klauspost](https://redirect.github.com/klauspost) in [#&#8203;1101](https://redirect.github.com/klauspost/compress/pull/1101) - flate: Add examples by [@&#8203;klauspost](https://redirect.github.com/klauspost) in [#&#8203;1102](https://redirect.github.com/klauspost/compress/pull/1102) - flate: Use exact sizes for huffman tables by [@&#8203;klauspost](https://redirect.github.com/klauspost) in [#&#8203;1103](https://redirect.github.com/klauspost/compress/pull/1103) - flate: Faster load+store by [@&#8203;klauspost](https://redirect.github.com/klauspost) in [#&#8203;1104](https://redirect.github.com/klauspost/compress/pull/1104) - Add notice to S2 about MinLZ by [@&#8203;klauspost](https://redirect.github.com/klauspost) in [#&#8203;1065](https://redirect.github.com/klauspost/compress/pull/1065) ##### New Contributors - [@&#8203;wooffie](https://redirect.github.com/wooffie) made their first contribution in [#&#8203;1069](https://redirect.github.com/klauspost/compress/pull/1069) - [@&#8203;vdarulis](https://redirect.github.com/vdarulis) made their first contribution in [#&#8203;1080](https://redirect.github.com/klauspost/compress/pull/1080) - [@&#8203;travelpolicy](https://redirect.github.com/travelpolicy) made their first contribution in [#&#8203;1086](https://redirect.github.com/klauspost/compress/pull/1086) - [@&#8203;ryanfowler](https://redirect.github.com/ryanfowler) made their first contribution in [#&#8203;1090](https://redirect.github.com/klauspost/compress/pull/1090) **Full Changelog**: <klauspost/compress@v1.18.0...v1.18.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - Monday through Friday (`* * * * 1-5`) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19--> Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
1 parent 5f2054f commit f07d878

2 files changed

Lines changed: 3 additions & 3 deletions

File tree

‎tests/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ require (
122122
github.com/inconshreveable/mousetrap v1.1.0 // indirect
123123
github.com/json-iterator/go v1.1.12 // indirect
124124
github.com/kevinburke/ssh_config v1.6.0 // indirect
125-
github.com/klauspost/compress v1.18.0 // indirect
125+
github.com/klauspost/compress v1.18.7 // indirect
126126
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
127127
github.com/kylelemons/godebug v1.1.0 // indirect
128128
github.com/lucasb-eyer/go-colorful v1.4.0 // indirect

‎tests/go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -276,8 +276,8 @@ github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXw
276276
github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
277277
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
278278
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
279-
github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
280-
github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
279+
github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
280+
github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
281281
github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
282282
github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
283283
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=

0 commit comments

Comments
 (0)