[NumaryBot]

This PR contains the following updates:

Package	Type	Update	Change
github.com/klauspost/compress	indirect	minor	v1.18.7 → v1.20.2

---

Panic on two-block frames in github.com/klauspost/compress

CVE-2026-116591 / GHSA-fpmh-frq8-7rj8 / GO-2026-6865

More information

Details

Panic on two-block frames in github.com/klauspost/compress

Severity

Unknown

References

• https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8
• https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d
• https://github.com/klauspost/compress/releases/tag/v1.20.2

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

klauspost/compress (github.com/klauspost/compress)

v1.20.2

Compare Source

• zstd: Fix DecodeAll crash on specially crafted input. GHSA-fpmh-frq8-7rj8.
• s2: fix LZ4 block conversion writing past dst by @​klauspost in #​1244
• dict: Stricter input validation by @​klauspost in #​1250
• zstd: reject snappy copy shorter than minimum match by @​Raghuvardhan-Reddy78 in #​1235

Full Changelog: klauspost/compress@v1.20.1...v1.20.2

v1.20.1

Compare Source

What's Changed

• zstd: apply reset options to reused frame decoders by @​pellared in #​1226
• flate: Report unexpected EOF for truncated Huffman extra bits by @​rupayon123 in #​1229
• flate: avoid FMA in EstimatedBits for portable rounding by @​malt3 in #​1224
• gzhttp: preserve caller request headers in Transport by @​jakezwang in #​1225
• gzhttp: only decompress a request when gzip is the outermost coding by @​youdie006 in #​1223
• zstd/huff0: Optimizations by @​lizthegrey in #​1203 #​1205 #​1207 #​1204 #​1208 #​1211 #​1209 #​1210
• flate: Speed improvements by @​alex in #​1220 #​1218 #​1216 #​1215 #​1214 #​1217

New Contributors

• @​xingyaner made their first contribution in #​1222
• @​jakezwang made their first contribution in #​1225
• @​youdie006 made their first contribution in #​1223
• @​pellared made their first contribution in #​1226
• @​malt3 made their first contribution in #​1224
• @​rupayon123 made their first contribution in #​1229

Full Changelog: klauspost/compress@v1.20.0...v1.20.1

v1.20.0

Compare Source

What's Changed

• Add lzw reader/writer by @​klauspost in #​1189
• xpress: add Microsoft XPRESS (MS-XCA) decompression by @​MP-GOWTHAM in #​1195
• s2: arm64 assembly encoders, lowered from the amd64 avo program by @​lizthegrey in #​1187
• zstd, huff0: improved arm64 lowering, and narrow two table loads to MOVWQZX by @​lizthegrey in #​1175
• gzhttp: limit jitter hash to jitterBuffer bytes by @​VedantMadane in #​1192
• s2: clamp the Go EncodeBetter skip to match the assembly by @​lizthegrey in #​1190
• xxhash: bound input of non-preemptive assembly by @​AskAlexSharov in #​1196
• zstd/huff0: fold two ISA-gap x86 idioms in the avo arm64 lowering by @​lizthegrey in #​1199
• ci: test against go1.27.x, drop go1.24.x by @​lizthegrey in #​1198
• zstd/huff0: break false partial-register dependencies in seqdec/4X decoders by @​lizthegrey in #​1197
• flate: Writer L7-9 with dictionary can emit the dictionary to stream by @​klauspost in #​1201

New Contributors

• @​VedantMadane made their first contribution in #​1192
• @​AskAlexSharov made their first contribution in #​1196
• @​MP-GOWTHAM made their first contribution in #​1195

Full Changelog: klauspost/compress@v1.19.2...v1.20.0

v1.19.2

Compare Source

What's Changed

• huff0: add arm64 assembly for Decompress4X/1X via avo lowering by @​lizthegrey in #​1172
• zstd: Re-enable unsafe decodeSync memory copies (#​1168) by @​lizthegrey in #​1171
• zstd: fix arm64 asm frame offsets placing locals on the saved LR slot by @​lizthegrey in #​1176
• zstd: avoid racing MaxDecodedSize write on shared dict litEnc by @​zanarellidev in #​1182
• zstd: keep BuildDict recent-offsets positive and loadable by @​zanarellidev in #​1184
• zstd: handle zero-literal BuildDict corpus by @​cyphercodes in #​1178
• zstd: don't clear the registered dictionary when decoding past the window by @​sueun-dev in #​1177

New Contributors

• @​zanarellidev made their first contribution in #​1183
• @​cyphercodes made their first contribution in #​1178
• @​sueun-dev made their first contribution in #​1177

Full Changelog: klauspost/compress@v1.19.1...v1.19.2

v1.19.1

Compare Source

What's Changed

• zstd: Validate SnappyConverter literal copies by @​klauspost in #​1170
• flate: use Peek instead of ReadByte for the bufio.Reader decode path by @​joechenrh in #​1169
• zstd: bump avo pin, regenerate arm64 asm by @​lizthegrey in #​1167

New Contributors

• @​joechenrh made their first contribution in #​1169

Full Changelog: klauspost/compress@v1.19.0...v1.19.1

v1.19.0

Compare Source

What's Changed

• zstd: Add true concurrent stream encoding by @​klauspost in #​1136
• zstd: arm64 decoder asm by @​lizthegrey in #​1160
• zstd: avoid unused BuildDict encoder allocation by @​snissn in #​1147
• flate: Add inflate checkpoints by @​klauspost in #​1154
• snappy/s2: Limit length of varint in decodedLen by @​eustas in #​1148
• gzhttp: match qvalue parameter case-insensitively (RFC 7231) by @​z9z in #​1149
• zip: add NameDecoder callback for legacy encoding rewrite by @​SAY-5 in #​1150
• huff0: Allow building tables from histogram. by @​klauspost in #​1155
• huff0: Allow building table from oversized histogram. by @​klauspost in #​1156
• s2sx: Clean symlink targets by @​klauspost in #​1163

New Contributors

• @​snissn made their first contribution in #​1147
• @​eustas made their first contribution in #​1148
• @​z9z made their first contribution in #​1149
• @​SAY-5 made their first contribution in #​1150
• @​HNO3Miracle made their first contribution in #​1165

Full Changelog: klauspost/compress@v1.18.6...v1.19.0

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.