fix(deps): update module github.com/klauspost/compress to v1.20.3
Metadata
Current evaluation
Renovate PR updating github.com/klauspost/compress from v1.20.1 to v1.20.3, including security fixes. Awaiting maintainer review with some CI checks pending.
Suggested action: needs review
Reason: Standard Renovate dependency update with security fixes (v1.20.2 fixed a zstd crash vulnerability GHSA-fpmh-frq8-7rj8). The diff is minimal (+3/-1 lines) and routine. CI has one failing check (OSV-scanner) and several pending, which is typical for Renovate PRs and warrants maintainer review before merge.
Evaluated by: mr-cal-bot
Impact:
40
Quick Win:
22
Complexity:
10
Confidence:
80
Actionability:
60
Issue body
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [github.com/klauspost/compress](https://redirect.github.com/klauspost/compress) | `v1.20.1` → `v1.20.3` |  |  |
---
### Release Notes
<details>
<summary>klauspost/compress (github.com/klauspost/compress)</summary>
### [`v1.20.3`](https://redirect.github.com/klauspost/compress/releases/tag/v1.20.3)
[Compare Source](https://redirect.github.com/klauspost/compress/compare/v1.20.2...v1.20.3)
#### What's Changed
- zstd: two-pass decode with match-source prefetch on arm64 (largest win decoding SpeedBestCompression-class data) by [@​lizthegrey](https://redirect.github.com/lizthegrey) in [#​1212](https://redirect.github.com/klauspost/compress/pull/1212)
- zstd: speed up better encoder hashing, primes in registers on arm64 by [@​lizthegrey](https://redirect.github.com/lizthegrey) in [#​1230](https://redirect.github.com/klauspost/compress/pull/1230)
- zstd: reuse dictionary sequence tables in the encoder by [@​lizthegrey](https://redirect.github.com/lizthegrey) in [#​1233](https://redirect.github.com/klauspost/compress/pull/1233)
- zstd: close most of the decode gap to libzstd on real corpora by [@​lizthegrey](https://redirect.github.com/lizthegrey) in [#​1232](https://redirect.github.com/klauspost/compress/pull/1232)
- huff0: align the decode inner loops to 64 bytes by [@​lizthegrey](https://redirect.github.com/lizthegrey) in [#​1236](https://redirect.github.com/klauspost/compress/pull/1236)
- zstd: keep default-encoder hash primes in registers on arm64 by [@​lizthegrey](https://redirect.github.com/lizthegrey) in [#​1241](https://redirect.github.com/klauspost/compress/pull/1241)
- zstd: align the sequence decode and execute loops to 64 bytes by [@​lizthegrey](https://redirect.github.com/lizthegrey) in [#​1240](https://redirect.github.com/klauspost/compress/pull/1240)
- zstd, huff0: cheaper per-block table setup by [@​lizthegrey](https://redirect.github.com/lizthegrey) in [#​1234](https://redirect.github.com/klauspost/compress/pull/1234)
- zstd, s2, flate: smoke-test Silesia in CI, add real-corpus benchmarks by [@​lizthegrey](https://redirect.github.com/lizthegrey) in [#​1237](https://redirect.github.com/klauspost/compress/pull/1237)
- zip: reject entries named "." in ReadDir to stop infinite fs.WalkDir by [@​Raghuvardhan-Reddy78](https://redirect.github.com/Raghuvardhan-Reddy78) in [#​1249](https://redirect.github.com/klauspost/compress/pull/1249)
- zstd: decode at full speed into exact-size destinations by [@​lizthegrey](https://redirect.github.com/lizthegrey) in [#​1246](https://redirect.github.com/klauspost/compress/pull/1246)
- s2: Reject short index chunk in RemoveIndexHeaders by [@​Raghuvardhan-Reddy78](https://redirect.github.com/Raghuvardhan-Reddy78) in [#​1254](https://redirect.github.com/klauspost/compress/pull/1254)
- zstd, huff0: keep the encoder bit writers in registers by [@​lizthegrey](https://redirect.github.com/lizthegrey) in [#​1245](https://redirect.github.com/klauspost/compress/pull/1245)
- huff0: reuse Scratch across inputs in the fuzzers by [@​lizthegrey](https://redirect.github.com/lizthegrey) in [#​1257](https://redirect.github.com/klauspost/compress/pull/1257)
#### New Contributors
- [@​Raghuvardhan-Reddy78](https://redirect.github.com/Raghuvardhan-Reddy78) made their first contribution in [#​1235](https://redirect.github.com/klauspost/compress/pull/1235)
- [@​SulimanAbdulrazzaq](https://redirect.github.com/SulimanAbdulrazzaq) made their first contribution in [#​1255](https://redirect.github.com/klauspost/compress/pull/1255)
**Full Changelog**: <https://github.com/klauspost/compress/compare/v1.20.1...v1.20.3>
### [`v1.20.2`](https://redirect.github.com/klauspost/compress/releases/tag/v1.20.2)
[Compare Source](https://redirect.github.com/klauspost/compress/compare/v1.20.1...v1.20.2)
- zstd: Fix DecodeAll crash on specially crafted input. [GHSA-fpmh-frq8-7rj8](https://redirect.github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8).
- s2: fix LZ4 block conversion writing past dst by [@​klauspost](https://redirect.github.com/klauspost) in [#​1244](https://redirect.github.com/klauspost/compress/pull/1244)
- dict: Stricter input validation by [@​klauspost](https://redirect.github.com/klauspost) in [#​1250](https://redirect.github.com/klauspost/compress/pull/1250)
- zstd: reject snappy copy shorter than minimum match by [@​Raghuvardhan-Reddy78](https://redirect.github.com/Raghuvardhan-Reddy78) in [#​1235](https://redirect.github.com/klauspost/compress/pull/1235)
**Full Changelog**: <https://github.com/klauspost/compress/compare/v1.20.1...v1.20.2>
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/fetch-service).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b |
Impact:
40
Quick Win:
22
Complexity:
10
Confidence:
80
Actionability:
60
|
needs review | Renovate PR updating github.com/klauspost/compress from v1.20.1 to v1.20.3, including security fixes. Awaiting maintainer review with some CI checks pending. | |
| qwen/qwen3.6-35b-a3b |
Impact:
55
Quick Win:
30
Complexity:
10
Confidence:
85
Actionability:
60
|
needs review | Renovate PR updating github.com/klauspost/compress from v1.20.1 to v1.20.3, including security fixes for zstd crash (GHSA-fpmh-frq8-7rj8). CI partially passing with OSV-scanner failing and snap tests pending. |
Update history
| Date | Change |
|---|---|
| updated | |
| created |
Related work
-
Related To:
fetch-service#657
(confidence 95%)
Previous update to v1.20.1, which this PR supersedes.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #657 fix(deps): update module github.com/klauspost/compress to v1.20.1 | fetch-service | closed | Renovate PR #657 was merged, updating github.com/klauspost/compress from v1.20.0 to v1.20.1 in commit dfadde3. | |
| #340 fix(deps): update module github.com/klauspost/compress to v1.18.0 | fetch-service | merged | Renovate bump merged as commit c549c4b, updating github.com/klauspost/compress from v1.17.11 to v1.18.0 after two approvals. | |
| #479 fix(deps): update module github.com/klauspost/compress to v1.18.1 | fetch-service | merged | Renovate dependency bump of klauspost/compress v1.18.0 to v1.18.1 merged as commit 315c39c; all CI checks passed and follow-up bumps (#539, #559, #587) moved it to v1.20.1. | |
| #642 fix(deps): update module github.com/klauspost/compress to v1.20.0 | fetch-service | closed | Merged into main via commit 59af262, updating github.com/klauspost/compress from v1.19.2 to v1.20.0. A later v1.20.1 bump landed in #657. | |
| #559 fix(deps): update module github.com/klauspost/compress to v1.18.4 | fetch-service | merged | Renovate PR #559 bumping github.com/klauspost/compress v1.18.2 -> v1.18.4 was merged to main as commit 8fa0ac6 (+3/-1, go.mod/go.sum), 2 approvals; later superseded by v1.18.5 (#587) and v1.20.1 (#657). | |
| #48 fix(deps): update module github.com/klauspost/compress to v1.17.8 | fetch-service | closed | Closed unmerged after a manual change was required; klauspost/compress was later upgraded to v1.17.9 by merged PR #116 (commit b91d17a). | |
| #629 fix(deps): update module github.com/klauspost/compress to v1.19.0 | fetch-service | merged | Renovate PR merged as commit e81c1bd, bumping github.com/klauspost/compress v1.18.6 -> v1.19.0 in go.mod/go.sum (approved, all CI green). Later superseded by #637 (v1.19.2), #642 (v1.20.0) and #657 (v1.20.1). | |
| #587 fix(deps): update module github.com/klauspost/compress to v1.18.5 | fetch-service | merged | Renovate PR #587 merged via commit 2cb4c4b, bumping github.com/klauspost/compress from v1.18.4 to v1.18.5 in go.mod/go.sum. All CI checks passed; later bumps (#602, #629, #642, #657) moved it to v1.20.1. | |
| #227 fix(deps): update module github.com/klauspost/compress to v1.17.10 | fetch-service | merged | Renovate dependency bump of github.com/klauspost/compress v1.17.9 -> v1.17.10 approved (2 reviewers) and merged to main as commit 629a102, updating go.mod/go.sum. | |
| #637 fix(deps): update module github.com/klauspost/compress to v1.19.2 | fetch-service | merged | Renovate PR #637 merged as commit d542773, bumping github.com/klauspost/compress v1.19.0 -> v1.19.2 in go.mod/go.sum. Later superseded by #642 (v1.20.0) and #657 (v1.20.1). |