build(deps): bump the go-minor-patch group across 1 directory with 6 updates

[dependabot]

Bumps the go-minor-patch group with 4 updates in the / directory: github.com/klauspost/compress, github.com/pkg/sftp, github.com/ulikunitz/xz and golang.org/x/tools.

Updates github.com/klauspost/compress from 1.18.7 to 1.19.1

Release notes

Sourced from github.com/klauspost/compress's releases.

v1.19.1

What's Changed

• zstd: Validate SnappyConverter literal copies by @​klauspost in klauspost/compress#1170
• flate: use Peek instead of ReadByte for the bufio.Reader decode path by @​joechenrh in klauspost/compress#1169
• zstd: bump avo pin, regenerate arm64 asm by @​lizthegrey in klauspost/compress#1167

New Contributors

• @​joechenrh made their first contribution in klauspost/compress#1169

Full Changelog: klauspost/compress@v1.19.0...v1.19.1

v1.19.0

What's Changed

• zstd: Add true concurrent stream encoding by @​klauspost in klauspost/compress#1136
• zstd: arm64 decoder asm by @​lizthegrey in klauspost/compress#1160
• zstd: avoid unused BuildDict encoder allocation by @​snissn in klauspost/compress#1147
• flate: Add inflate checkpoints by @​klauspost in klauspost/compress#1154
• snappy/s2: Limit length of varint in decodedLen by @​eustas in klauspost/compress#1148
• gzhttp: match qvalue parameter case-insensitively (RFC 7231) by @​z9z in klauspost/compress#1149
• zip: add NameDecoder callback for legacy encoding rewrite by @​SAY-5 in klauspost/compress#1150
• huff0: Allow building tables from histogram. by @​klauspost in klauspost/compress#1155
• huff0: Allow building table from oversized histogram. by @​klauspost in klauspost/compress#1156
• s2sx: Clean symlink targets by @​klauspost in klauspost/compress#1163

New Contributors

• @​snissn made their first contribution in klauspost/compress#1147
• @​eustas made their first contribution in klauspost/compress#1148
• @​z9z made their first contribution in klauspost/compress#1149
• @​SAY-5 made their first contribution in klauspost/compress#1150
• @​HNO3Miracle made their first contribution in klauspost/compress#1165

Full Changelog: klauspost/compress@v1.18.6...v1.19.0

Commits

• 2602f4a Update changelog for version 1.19.0
• 983acec add defensive checks
• 9960386 zstd: Validate SnappyConverter literal copies (#1170)
• e29d4d3 flate: use Peek instead of ReadByte for the bufio.Reader decode path (#...
• c0bbc84 zstd: bump avo pin, regenerate arm64 asm (#1167)
• efdb6ed build(deps): bump the github-actions group with 6 updates (#1166)
• f0953f9 flate: fix buffer formatting in tests (#1165)
• ab2e3cc zstd: Add arm64 decoder asm (#1160)
• bb2723d Merge commit from fork
• 539243b s2sx: Clean symlink targets (#1163)
• Additional commits viewable in compare view

Updates github.com/pkg/sftp from 1.13.10 to 1.13.11

Release notes

Sourced from github.com/pkg/sftp's releases.

v1.13.11 - maintenance release

This release bounds an unchecked pre-allocation in the SSH_FILEXFER_ATTRS decoder, updates dependencies, and includes minor code cleanups.

Security/robustness

The attribute decoder (unmarshalFileStat) allocated the extended-attribute slice directly from the wire-supplied extended_count without bounding it against the available bytes. A peer could advertise a huge extended_count in a small packet and force a multi-gigabyte allocation up front, crashing the process with fatal error: out of memory before a single entry was parsed.

What's Changed

• fix: ineffective assignments by @​alrs in pkg/sftp#650
• refactor: replace interface{} with any (Go 1.18+) by @​MD-Mushfiqur123 in pkg/sftp#652
• fix: bound extended-count pre-allocation in unmarshalFileStat by @​drakkan (co-authored by @​mjbommar)

New Contributors

• @​alrs made their first contribution in pkg/sftp#650
• @​MD-Mushfiqur123 made their first contribution in pkg/sftp#652

Full Changelog: pkg/sftp@v1.13.10...v1.13.11

Commits

• fc82c35 CI: run tests on macOS with the latest Go version
• c1bc2ff fix: bound extended-count pre-allocation in unmarshalFileStat
• fe6029a CI: update Go version and GitHub Actions
• 208320f update deps
• dda3848 Merge pull request #652 from MD-Mushfiqur123/refactor/interface-to-any
• 26bf701 refactor: replace interface{} with any (Go 1.18+)
• ef1dc72 Merge pull request #650 from alrs/ineffective-functions
• dbf7c75 fix: ineffective assignments
• ab3b1a3 Merge pull request #641 from pkg/dependabot/go_modules/golang.org/x/crypto-0....
• 4583fed Bump golang.org/x/crypto from 0.41.0 to 0.45.0
• See full diff in compare view

Updates github.com/ulikunitz/xz from 0.5.15 to 0.5.16

Commits

• 024f909 isterminal_fallback.go: ensure +build and go:build lines are consistent
• ba40d80 Prepare release v0.5.16
• 82b346c internal/term: add fallback option for unsupported operating systems
• b371040 dependabot.yml: fix the ecosystem
• 7de699b Enabled dependabot
• 62a9f09 Add CodeQL analysis workflow configuration
• 57ec7ec go-test-platforms.yml: add read permissions
• 7314c96 go.mod: Make go1.20 the supported compiler
• cdbb6ac go-test-platforms.yml: remove not necessary activities
• 87b9bf9 go-test-platforms.yml: add workflow-dispatch event
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.53.0 to 0.54.0

Commits

• cdce021 go.mod: update golang.org/x dependencies
• d9474cc openpgp: make the deprecation message more explicit
• 7626c50 ssh: verify declared key type matches decoded key in authorized_keys
• 0471e79 ssh/agent: enforce strict limits on DSA key parameters
• 6435c37 ssh: sanitize client disconnect messages
• 7d695da ssh/agent: drain channel stderr in agent forwarders
• 5b7f841 acme/autocert: fix data race in Manager.createCert
• 0b316e7 argon2: update RFC 9106 parameter recommendations
• 55aec0a x509roots/fallback: update bundle
• 5f2de1a internal: remove wycheproof tests
• See full diff in compare view

Updates golang.org/x/sync from 0.21.0 to 0.22.0

Commits

• 1eb64d4 semaphore: panic on negative weights
• See full diff in compare view

Updates golang.org/x/tools from 0.47.0 to 0.48.0

Commits

• 05f9cb5 go.mod: update golang.org/x dependencies
• 745d7ae gopls: add CompiledAsmFiles in cache.Package
• 797ee67 go/ssa: make Const(unsafe.Pointer, nil).IsNil() true
• 9751125 gopls/internal/test: Completion benchmarks use empty range
• 8786a96 internal/stdlib: update stdlib index for Go 1.27 Release Candidate 2
• 425085f gopls/internal/server: modify return of parseAction
• 30c4f87 go/analysis/passes/nilness: skip magic cgo functions
• 9e6441d gopls/internal/protocol/generate: remove manual rename overwritten
• df96841 gopls/internal/protocol: use Debug log level
• 278f062 gopls/internal/protocol: update to LSP 3.18
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions