chore(deps): update module github.com/klauspost/compress to v1.20.2 [security] (release-2.3) by crossplane-renovate[bot] · Pull Request #1257 · crossplane/crossplane-runtime

crossplane-renovate · 2026-11-06T08:17:48Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/klauspost/compress	`v1.18.7` → `v1.20.2`

Panic on two-block frames in github.com/klauspost/compress

CVE-2026-116591 / GHSA-fpmh-frq8-7rj8 / GO-2026-6865

More information

Details

Panic on two-block frames in github.com/klauspost/compress

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

klauspost/compress (github.com/klauspost/compress)

`v1.20.2`

Compare Source

zstd: Fix DecodeAll crash on specially crafted input. GHSA-fpmh-frq8-7rj8.
s2: fix LZ4 block conversion writing past dst by @klauspost in #1244
dict: Stricter input validation by @klauspost in #1250
zstd: reject snappy copy shorter than minimum match by @Raghuvardhan-Reddy78 in #1235

Full Changelog: klauspost/compress@v1.20.1...v1.20.2

`v1.20.1`

Compare Source

What's Changed

zstd: apply reset options to reused frame decoders by @pellared in #1226
flate: Report unexpected EOF for truncated Huffman extra bits by @rupayon123 in #1229
flate: avoid FMA in EstimatedBits for portable rounding by @malt3 in #1224
gzhttp: preserve caller request headers in Transport by @jakezwang in #1225
gzhttp: only decompress a request when gzip is the outermost coding by @youdie006 in #1223
zstd/huff0: Optimizations by @lizthegrey in #1203 #1205 #1207 #1204 #1208 #1211 #1209 #1210
flate: Speed improvements by @alex in #1220 #1218 #1216 #1215 #1214 #1217

New Contributors

@xingyaner made their first contribution in #1222
@jakezwang made their first contribution in #1225
@youdie006 made their first contribution in #1223
@pellared made their first contribution in #1226
@malt3 made their first contribution in #1224
@rupayon123 made their first contribution in #1229

Full Changelog: klauspost/compress@v1.20.0...v1.20.1

`v1.20.0`

Compare Source

What's Changed

Add lzw reader/writer by @klauspost in #1189
xpress: add Microsoft XPRESS (MS-XCA) decompression by @MP-GOWTHAM in #1195
s2: arm64 assembly encoders, lowered from the amd64 avo program by @lizthegrey in #1187
zstd, huff0: improved arm64 lowering, and narrow two table loads to MOVWQZX by @lizthegrey in #1175
gzhttp: limit jitter hash to jitterBuffer bytes by @VedantMadane in #1192
s2: clamp the Go EncodeBetter skip to match the assembly by @lizthegrey in #1190
xxhash: bound input of non-preemptive assembly by @AskAlexSharov in #1196
zstd/huff0: fold two ISA-gap x86 idioms in the avo arm64 lowering by @lizthegrey in #1199
ci: test against go1.27.x, drop go1.24.x by @lizthegrey in #1198
zstd/huff0: break false partial-register dependencies in seqdec/4X decoders by @lizthegrey in #1197
flate: Writer L7-9 with dictionary can emit the dictionary to stream by @klauspost in #1201

New Contributors

@VedantMadane made their first contribution in #1192
@AskAlexSharov made their first contribution in #1196
@MP-GOWTHAM made their first contribution in #1195

Full Changelog: klauspost/compress@v1.19.2...v1.20.0

`v1.19.2`

Compare Source

What's Changed

huff0: add arm64 assembly for Decompress4X/1X via avo lowering by @lizthegrey in #1172
zstd: Re-enable unsafe decodeSync memory copies (#1168) by @lizthegrey in #1171
zstd: fix arm64 asm frame offsets placing locals on the saved LR slot by @lizthegrey in #1176
zstd: avoid racing MaxDecodedSize write on shared dict litEnc by @zanarellidev in #1182
zstd: keep BuildDict recent-offsets positive and loadable by @zanarellidev in #1184
zstd: handle zero-literal BuildDict corpus by @cyphercodes in #1178
zstd: don't clear the registered dictionary when decoding past the window by @sueun-dev in #1177

New Contributors

@zanarellidev made their first contribution in #1183
@cyphercodes made their first contribution in #1178
@sueun-dev made their first contribution in #1177

Full Changelog: klauspost/compress@v1.19.1...v1.19.2

`v1.19.1`

Compare Source

What's Changed

zstd: Validate SnappyConverter literal copies by @klauspost in #1170
flate: use Peek instead of ReadByte for the bufio.Reader decode path by @joechenrh in #1169
zstd: bump avo pin, regenerate arm64 asm by @lizthegrey in #1167

New Contributors

@joechenrh made their first contribution in #1169

Full Changelog: klauspost/compress@v1.19.0...v1.19.1

`v1.19.0`

Compare Source

What's Changed

zstd: Add true concurrent stream encoding by @klauspost in #1136
zstd: arm64 decoder asm by @lizthegrey in #1160
zstd: avoid unused BuildDict encoder allocation by @snissn in #1147
flate: Add inflate checkpoints by @klauspost in #1154
snappy/s2: Limit length of varint in decodedLen by @eustas in #1148
gzhttp: match qvalue parameter case-insensitively (RFC 7231) by @z9z in #1149
zip: add NameDecoder callback for legacy encoding rewrite by @SAY-5 in #1150
huff0: Allow building tables from histogram. by @klauspost in #1155
huff0: Allow building table from oversized histogram. by @klauspost in #1156
s2sx: Clean symlink targets by @klauspost in #1163

New Contributors

@snissn made their first contribution in #1147
@eustas made their first contribution in #1148
@z9z made their first contribution in #1149
@SAY-5 made their first contribution in #1150
@HNO3Miracle made their first contribution in #1165

Full Changelog: klauspost/compress@v1.18.6...v1.19.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

…security]

crossplane-renovate · 2026-11-06T08:17:52Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.mod

Command failed: crossplane-nix run .#generate
warning: Git tree '/tmp/renovate/repos/github/crossplane/crossplane-runtime' is dirty
these 4 derivations will be built:
  /nix/store/ca5vj38ann5hj3lkp9x5k62146sagrm9-controller-tools-0.20.1.drv
  /nix/store/h5n9w3j0lvfk5nxmfcmcs66qwrd7s4jx-protoc-gen-go-grpc-1.6.2.drv
  /nix/store/xfzinlhgk3jcfdxj41vfnrpnh1ml08b8-buf-1.73.0.drv
  /nix/store/rb19h9qrvbcxpw90zrx3c18z9vhzkwss-crossplane-runtime-generate.drv
building '/nix/store/xfzinlhgk3jcfdxj41vfnrpnh1ml08b8-buf-1.73.0.drv'...
error: builder for '/nix/store/xfzinlhgk3jcfdxj41vfnrpnh1ml08b8-buf-1.73.0.drv' failed with exit code 1;
       last 10 log lines:
       >             Messages:       failed to build docker plugin
       > --- FAIL: TestPushSuccess (0.00s)
       >     docker_test.go:59:
       >               Error Trace:    /tmp/nix-build-buf-1.73.0.drv-0/source/private/bufpkg/bufremoteplugin/bufremoteplugindocker/docker_test.go:59
       >          Error:          Expected nil, but got: &exec.Error{Name:"docker", Err:(*errors.errorString)(0xc683d0)}
       >                 Test:           TestPushSuccess
       >                Messages:       failed to build docker plugin
       > FAIL
       > FAIL       github.com/bufbuild/buf/private/bufpkg/bufremoteplugin/bufremoteplugindocker    0.005s
       > FAIL
       For full logs, run 'nix log /nix/store/xfzinlhgk3jcfdxj41vfnrpnh1ml08b8-buf-1.73.0.drv'.
error: 1 dependencies of derivation '/nix/store/rb19h9qrvbcxpw90zrx3c18z9vhzkwss-crossplane-runtime-generate.drv' failed to build

chore(deps): update module github.com/klauspost/compress to v1.20.2 […

087f68b

…security]

crossplane-renovate Bot requested a review from a team as a code owner November 6, 2026 08:17

crossplane-renovate Bot added the automated label Nov 6, 2026

crossplane-renovate Bot requested review from adamwg and removed request for a team November 6, 2026 08:17

crossplane-renovate Bot added the automated label Nov 6, 2026

Navigation Menu

Repository navigation

chore(deps): update module github.com/klauspost/compress to v1.20.2 [security] (release-2.3) - #1257

chore(deps): update module github.com/klauspost/compress to v1.20.2 [security] (release-2.3)#1257
crossplane-renovate[bot] wants to merge 1 commit into
release-2.3from
renovate/release-2.3-go-github.com-klauspost-compress-vulnerability

crossplane-renovate Bot commented Nov 6, 2026

Uh oh!

crossplane-renovate Bot commented Nov 6, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

crossplane-renovate Bot commented Nov 6, 2026

Panic on two-block frames in github.com/klauspost/compress

Details

Severity

References

Release Notes

v1.20.2

v1.20.1

What's Changed

New Contributors

v1.20.0

What's Changed

New Contributors

v1.19.2

What's Changed

New Contributors

v1.19.1

What's Changed

New Contributors

v1.19.0

What's Changed

New Contributors

Configuration

Uh oh!

crossplane-renovate Bot commented Nov 6, 2026

⚠️ Artifact update problem

File name: go.mod

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v1.20.2`

`v1.20.1`

`v1.20.0`

`v1.19.2`

`v1.19.1`

`v1.19.0`