build(deps): update module github.com/klauspost/compress to v1.18.7 [security] by renovate[bot] · Pull Request #411 · bangumi/submit-patch

s2: Fix amd64 stack frame corruption by @klauspost in #1145
gzhttp: Canonicalize ETag header by @justinmayhew in #1139
perf: pool hash tables in Go encode paths to reduce allocations by @huynhanx03 in #1143

New Contributors

@justinmayhew made their first contribution in #1139
@huynhanx03 made their first contribution in #1143
@thaJeztah made their first contribution in #1144

Full Changelog: klauspost/compress@v1.18.5...v1.18.6

`v1.18.5`

Compare Source

What's Changed

zstd: Fix crash when changing encoder dictionary with same ID by @klauspost in #1135
zstd: Default to full zero frames by @klauspost in #1134
flate: Clean up histogram order by @klauspost in #1133

Full Changelog: klauspost/compress@v1.18.4...v1.18.5

`v1.18.4`

Compare Source

What's Changed

gzhttp: Add zstandard to server handler wrapper by @klauspost in #1121
zstd: Add ResetWithOptions to encoder/decoder by @klauspost in #1122
gzhttp: preserve qvalue when extra parameters follow in Accept-Encoding by @analytically in #1116

New Contributors

@analytically made their first contribution in #1116
@ethaizone made their first contribution in #1124
@zwass made their first contribution in #1125

Full Changelog: klauspost/compress@v1.18.2...v1.18.4

`v1.18.3`

Compare Source

Downstream CVE-2025-61728

See golang/go#77102

Full Changelog: klauspost/compress@v1.18.2...v1.18.3

`v1.18.2`

Compare Source

What's Changed

flate: Fix invalid encoding on level 9 with single value input by @klauspost in #1115
flate: reduce stateless allocations by @RXamzin in #1106
build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 in the github-actions group by @dependabot[bot] in #1111

v1.18.1 is marked "retracted" due to invalid flate/zip/gzip encoding.

New Contributors

@RXamzin made their first contribution in #1106

Full Changelog: klauspost/compress@v1.18.1...v1.18.2

`v1.18.1`

Compare Source

What's Changed

zstd: Fix incorrect buffer size in dictionary encodes by @klauspost in #1059
s2: check for cap, not len of buffer in EncodeBetter/Best by @vdarulis in #1080
zstd: Add simple zstd EncodeTo/DecodeTo functions by @klauspost in #1079
zlib: Avoiding extra allocation in zlib.reader.Reset by @travelpolicy in #1086
gzhttp: remove redundant err check in zstdReader by @ryanfowler in #1090
Run modernize. Deprecate Go 1.22 by @klauspost in #1095
flate: Simplify matchlen by @klauspost in #1101
flate: Add examples by @klauspost in #1102
flate: Use exact sizes for huffman tables by @klauspost in #1103
flate: Faster load+store by @klauspost in #1104
Add notice to S2 about MinLZ by @klauspost in #1065

New Contributors

@wooffie made their first contribution in #1069
@vdarulis made their first contribution in #1080
@travelpolicy made their first contribution in #1086
@ryanfowler made their first contribution in #1090

Full Changelog: klauspost/compress@v1.18.0...v1.18.1

`v1.18.0`

Compare Source

What's Changed

Deprecate Go 1.21 and add 1.24 by @klauspost in #1055
Add unsafe little endian loaders by @klauspost in #1036
fix: check r.err != nil but return a nil value error err by @alingse in #1028
refactor: use built-in min function by @Juneezee in #1038
zstd: use slices.Max for max value in slice by @Juneezee in #1041
flate: Simplify L4-6 loading by @klauspost in #1043
flate: Simplify matchlen (remove asm) by @klauspost in #1045
s2: Add block decode fuzzer by @klauspost in #1044
s2: Improve small block compression speed w/o asm by @klauspost in #1048
flate: Fix matchlen L5+L6 by @klauspost in #1049
flate: Cleanup & reduce casts by @klauspost in #1050

New Contributors

@tcpdumppy made their first contribution in #1021
@sam9291 made their first contribution in #1022
@dezza made their first contribution in #1023
@alingse made their first contribution in #1028
@hyunsooda made their first contribution in #1031
@Juneezee made their first contribution in #1038
@Bbulatov made their first contribution in #1052

Full Changelog: klauspost/compress@v1.17.11...v1.18.0

`v1.17.11`

Compare Source

What's Changed

zstd: Fix extra CRC written with multiple Close calls by @klauspost in #1017
s2: Don't use stack for index tables by @klauspost in #1014
gzhttp: No content-type on no body response code by @juliens in #1011
gzhttp: Do not set the content-type when response has no body by @kevinpollet in #1013

New Contributors

@juliens made their first contribution in #1011
@kevinpollet made their first contribution in #1013

Full Changelog: klauspost/compress@v1.17.10...v1.17.11

`v1.17.10`

Compare Source

What's Changed

gzhttp: Add TransportAlwaysDecompress option. by @klauspost in #978
s2: Add EncodeBuffer buffer recycling callback by @klauspost in #982
zstd: Improve memory usage on small streaming encodes by @klauspost in #1007
gzhttp: Add supported decompress request body by @mirecl in #1002
flate: read data written with partial flush by @vajexal in #996
ci: Upgrade Go & other by @klauspost in #1008
docs: Small typofix in comment by @Jille in #976
build(deps): bump the github-actions group with 2 updates by @dependabot in #979
docs: Fix URL typo when installing builddict by @Wikidepia in #980
build(deps): bump the github-actions group with 2 updates by @dependabot in #985
Fix typos by @deining in #986
build(deps): bump github/codeql-action from 3.25.15 to 3.26.6 in the github-actions group by @dependabot in #997

New Contributors

@Wikidepia made their first contribution in #980
@deining made their first contribution in #986
@vajexal made their first contribution in #996
@mirecl made their first contribution in #1002

Full Changelog: klauspost/compress@v1.17.9...v1.17.10

`v1.17.9`

Compare Source

What's Changed

s2: Reduce ReadFrom temporary allocations by @klauspost in #949
Fix arm64 vet issues by @klauspost in #964
flate, zstd: Shave some bytes off amd64 matchLen by @greatroar in #963
Upgrade zip to 1.22.4 upstream by @klauspost in #970
zstd: BuildDict fails with RLE table by @klauspost in #951
Upgrade zlib to upstream by @klauspost in #971

Full Changelog: klauspost/compress@v1.17.8...v1.17.9

`v1.17.8`

Compare Source

What's Changed

zstd: Reject blocks where reserved values are not 0 by @klauspost in #885
zstd: Add RLE detection+encoding by @klauspost in #938

New Contributors

@ankon made their first contribution in #932
@kindhuge made their first contribution in #946

Full Changelog: klauspost/compress@v1.17.7...v1.17.8

`v1.17.7`

Compare Source

What's Changed

s2: Add AsyncFlush method: Complete the block without flushing by @Jille in #927
s2: Fix literal+repeat exceeds dst crash by @klauspost in #930

Full Changelog: klauspost/compress@v1.17.6...v1.17.7

`v1.17.6`

Compare Source

What's Changed

zstd: Fix incorrect repeat coding in best mode by @klauspost in #923
s2: Fix DecodeConcurrent deadlock on errors by @klauspost in #925
build: Remove garble compiler by @klauspost in #924

Full Changelog: klauspost/compress@v1.17.5...v1.17.6

`v1.17.5`

Compare Source

What's Changed

flate: Fix reset with dictionary on custom window encodes by @klauspost in #912
zstd: Limit better/best default window to 8MB by @klauspost in #913
zstd: Shorter and faster asm for decSymbol.newState by @greatroar in #896
zstd: Add Frame header encoding and stripping by @klauspost in #908
zstd: Tweak noasm FSE decoder by @greatroar in #910
s2: Fix callbacks for skippable blocks and disallow 0xfe (Padding) for custom use by @Jille in #916
s2: Fix incorrect length encoded by writer.AddSkippableBlock by @Jille in #917
s2: Fix up AddSkippableBlock more by @klauspost in #919
s2: Document and test how to peek the stream for skippable blocks by @Jille in #918
internal/race,s2: add some race instrumentation by @egonelbre in #903
build(deps): bump the github-actions group with 4 updates by @dependabot in #900
CI: Hash pin sensitive actions and configure Dependabot to automatically update them by @diogoteles08 in #899
Update generator and executable go.mod by @klauspost in #904
Update README.md by @pelenium in #905
build(deps): bump the github-actions group with 1 update by @dependabot in #906

New Contributors

@pelenium made their first contribution in #905
@Jille made their first contribution in #916

Full Changelog: klauspost/compress@v1.17.4...v1.17.5

`v1.17.4`

Compare Source

What's Changed

huff0: Speed up symbol counting by @greatroar in #887
huff0: Remove byteReader by @greatroar in #886
gzhttp: Allow overriding decompression on transport by @klauspost in #892
gzhttp: Clamp compression level by @klauspost in #890
gzip: Error out if reserved bits are set by @klauspost in #891

New Contributors

@teikjun made their first contribution in #889

Full Changelog: klauspost/compress@v1.17.3...v1.17.4

`v1.17.3`

Compare Source

What's Changed

fse: Fix max header size by @klauspost in #881
zstd: Improve better/best compression by @klauspost in #877
gzhttp: Fix missing content type on Close by @klauspost in #883

Full Changelog: klauspost/compress@v1.17.2...v1.17.3

`v1.17.2`

Compare Source

What's Changed

zstd: Fix corrupted output in "best" by @klauspost in #876

Full Changelog: klauspost/compress@v1.17.1...v1.17.2

`v1.17.1`

Compare Source

What's Changed

s2: Fix S2 "best" dictionary wrong encoding by @klauspost in #871
flate: Reduce allocations in decompressor and minor code improvements by @fakefloordiv in #869
s2: Fix EstimateBlockSize on 6&7 length input by @klauspost in #867
tests: Fuzzing Coverage Expansion by @viktoriia-lsg in #866
tests: Set FSE decompress fuzzer max limit by @klauspost in #868
tests: Fuzzing Coverage Expansion (#2) by @viktoriia-lsg in #870

New Contributors

@viktoriia-lsg made their first contribution in #866
@fakefloordiv made their first contribution in #869

Full Changelog: klauspost/compress@v1.17.0...v1.17.1

`v1.17.0`

Compare Source

What's Changed

Add dictionary builder by @klauspost in #853
Add xerial snappy read/writer by @klauspost in #838
flate: Add limited window compression by @klauspost in #843
s2: Do 2 overlapping match checks by @klauspost in #839
flate: Add amd64 assembly matchlen by @klauspost in #837
gzip: Copy bufio.Reader on Reset by @thatguystone in #860
zstd: Remove offset from bitReader by @greatroar in #854
fse, huff0, zstd: Remove always-nil error returns by @greatroar in #857
tests: unnecessary use of fmt.Sprintf by @testwill in #836
tests: Fix OSS fuzzer t.Run by @klauspost in #852
tests: Use Go 1.21.x by @klauspost in #851

New Contributors

@testwill made their first contribution in #836
@thatguystone made their first contribution in #860

Full Changelog: klauspost/compress@v1.16.7...v1.17.0

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

Branch creation
- At any time (no schedule defined)
Automerge
- On day 4, 5, 6, 7, and 8 of the month (* * 4,5,6,7,8 * *)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

…security]

mergify · 2026-10-02T18:28:08Z

Queued — the merge queue status continues in this comment ↓.

mergify · 2026-10-02T18:31:35Z

Merge Queue Status

✅ Entered queue — 2026-10-02 18:31 UTC · Rule: renovate · triggered by rule Automatic merge on approval
✅ Checks passed · in-place
✅ Merged — 2026-10-02 18:37 UTC · at f9f89d499e017960f01decf649cb380ae483e209

This pull request spent 6 minutes 18 seconds in the queue, including 1 minute 46 seconds running CI.

Required conditions to merge

…vulnerability

build(deps): update module github.com/klauspost/compress to v1.18.7 […

ca23ad3

…security]

renovate Bot added ci:auto-merge dependencies labels Oct 2, 2026

renovate Bot assigned trim21 Oct 2, 2026

mergify Bot added the ci:queued label Oct 2, 2026

Merge branch 'master' into renovate/go-github.com-klauspost-compress-…

ba8186e

…vulnerability

mergify Bot merged commit f9f89d4 into master Oct 2, 2026
8 checks passed

mergify Bot deleted the renovate/go-github.com-klauspost-compress-vulnerability branch October 2, 2026 18:37

mergify Bot removed the ci:queued label Oct 2, 2026

Navigation Menu

Repository navigation

build(deps): update module github.com/klauspost/compress to v1.18.7 [security] - #411

build(deps): update module github.com/klauspost/compress to v1.18.7 [security]#411
mergify[bot] merged 2 commits into
masterfrom
renovate/go-github.com-klauspost-compress-vulnerability

renovate Bot commented Oct 2, 2026

Uh oh!

mergify Bot commented Oct 2, 2026 •

edited

Loading

Uh oh!

mergify Bot commented Oct 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Oct 2, 2026

OOB read in github.com/klauspost/compress/s2

Details

Severity

References

Release Notes

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

Configuration

Uh oh!

mergify Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mergify Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

mergify Bot commented Oct 2, 2026 •

edited

Loading

mergify Bot commented Oct 2, 2026 •

edited

Loading