[dependabot]

Bumps github.com/pkg/sftp from 1.13.10 to 1.13.12.

Release notes

Sourced from github.com/pkg/sftp's releases.

v1.13.12

What's Changed

• fix flaky TestClientStatVFS on macOS by @​drakkan in pkg/sftp#666
• harden client reply parsers against malformed server replies by @​drakkan in pkg/sftp#655
• fix flaky TestRequestStatVFS by @​christhomas in pkg/sftp#676
• return write error for short final chunk in File.ReadFrom by @​christhomas in pkg/sftp#670
• reject hardlink and create/truncate opens on a read-only server by @​likitha011 in pkg/sftp#682
• server: do not dispatch packets that failed to unmarshal by @​likitha011 in pkg/sftp#694
• return the reader's io.ErrUnexpectedEOF from File.ReadFrom by @​christhomas in pkg/sftp#674
• [v1] send exit-status from the example servers by @​christhomas in pkg/sftp#686

New Contributors

• @​likitha011 made their first contribution in pkg/sftp#682

Full Changelog: pkg/sftp@v1.13.11...v1.13.12

v1.13.11 - maintenance release

This release bounds an unchecked pre-allocation in the SSH_FILEXFER_ATTRS decoder, updates dependencies, and includes minor code cleanups.

Security/robustness

The attribute decoder (unmarshalFileStat) allocated the extended-attribute slice directly from the wire-supplied extended_count without bounding it against the available bytes. A peer could advertise a huge extended_count in a small packet and force a multi-gigabyte allocation up front, crashing the process with fatal error: out of memory before a single entry was parsed.

What's Changed

• fix: ineffective assignments by @​alrs in pkg/sftp#650
• refactor: replace interface{} with any (Go 1.18+) by @​MD-Mushfiqur123 in pkg/sftp#652
• fix: bound extended-count pre-allocation in unmarshalFileStat by @​drakkan (co-authored by @​mjbommar)

New Contributors

• @​alrs made their first contribution in pkg/sftp#650
• @​MD-Mushfiqur123 made their first contribution in pkg/sftp#652

Full Changelog: pkg/sftp@v1.13.10...v1.13.11

Commits

• 4b4c6a4 Merge commit from fork
• 4778ed9 Merge pull request #686 from christhomas/example-exit-status
• 6cc5209 Merge pull request #674 from christhomas/fix-readfrom-source-error
• 28b6c43 Wrap readFull comment at semantic line breaks
• 5771a0d Merge pull request #694 from likitha011/server-drop-malformed-packets
• de6aa98 Merge pull request #682 from likitha011/readonly-hardlink-creat-trunc
• 9336ec5 reject hardlink and create/truncate opens on a read-only server
• efa1d9b RemoveAll: do not follow a symlink at the given path
• f79a590 Merge pull request #670 from christhomas/fix-readfrom-final-chunk-error
• 5c81370 server: do not dispatch packets that failed to unmarshal
• Additional commits viewable in compare view