fix(security/UNKNOWN/operator): Update module github.com/klauspost/compress to v1.18.7 [SECURITY] (release-3.7.x) by renovate-sh-app[bot] · Pull Request #23613 · grafana/loki

s2: Fix amd64 stack frame corruption by @klauspost in #1145
gzhttp: Canonicalize ETag header by @justinmayhew in #1139
perf: pool hash tables in Go encode paths to reduce allocations by @huynhanx03 in #1143

New Contributors

@justinmayhew made their first contribution in #1139
@huynhanx03 made their first contribution in #1143
@thaJeztah made their first contribution in #1144

Full Changelog: klauspost/compress@v1.18.5...v1.18.6

`v1.18.5`

Compare Source

What's Changed

zstd: Fix crash when changing encoder dictionary with same ID by @klauspost in #1135
zstd: Default to full zero frames by @klauspost in #1134
flate: Clean up histogram order by @klauspost in #1133

Full Changelog: klauspost/compress@v1.18.4...v1.18.5

`v1.18.4`

Compare Source

What's Changed

gzhttp: Add zstandard to server handler wrapper by @klauspost in #1121
zstd: Add ResetWithOptions to encoder/decoder by @klauspost in #1122
gzhttp: preserve qvalue when extra parameters follow in Accept-Encoding by @analytically in #1116

New Contributors

@analytically made their first contribution in #1116
@ethaizone made their first contribution in #1124
@zwass made their first contribution in #1125

Full Changelog: klauspost/compress@v1.18.2...v1.18.4

`v1.18.3`

Compare Source

Downstream CVE-2025-61728

See golang/go#77102

Full Changelog: klauspost/compress@v1.18.2...v1.18.3

`v1.18.2`

Compare Source

What's Changed

flate: Fix invalid encoding on level 9 with single value input by @klauspost in #1115
flate: reduce stateless allocations by @RXamzin in #1106
build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 in the github-actions group by @dependabot[bot] in #1111

v1.18.1 is marked "retracted" due to invalid flate/zip/gzip encoding.

New Contributors

@RXamzin made their first contribution in #1106

Full Changelog: klauspost/compress@v1.18.1...v1.18.2

`v1.18.1`

Compare Source

What's Changed

zstd: Fix incorrect buffer size in dictionary encodes by @klauspost in #1059
s2: check for cap, not len of buffer in EncodeBetter/Best by @vdarulis in #1080
zstd: Add simple zstd EncodeTo/DecodeTo functions by @klauspost in #1079
zlib: Avoiding extra allocation in zlib.reader.Reset by @travelpolicy in #1086
gzhttp: remove redundant err check in zstdReader by @ryanfowler in #1090
Run modernize. Deprecate Go 1.22 by @klauspost in #1095
flate: Simplify matchlen by @klauspost in #1101
flate: Add examples by @klauspost in #1102
flate: Use exact sizes for huffman tables by @klauspost in #1103
flate: Faster load+store by @klauspost in #1104
Add notice to S2 about MinLZ by @klauspost in #1065

New Contributors

@wooffie made their first contribution in #1069
@vdarulis made their first contribution in #1080
@travelpolicy made their first contribution in #1086
@ryanfowler made their first contribution in #1090

Full Changelog: klauspost/compress@v1.18.0...v1.18.1

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

renovate-sh-app · 2026-07-27T21:27:33Z

ℹ️ Artifact update notice

File name: operator/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

7 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.25.0` -> `1.26.5`
`golang.org/x/crypto`	`v0.49.0` -> `v0.51.0`
`golang.org/x/mod`	`v0.33.0` -> `v0.35.0`
`golang.org/x/net`	`v0.52.0` -> `v0.55.0`
`golang.org/x/sys`	`v0.42.0` -> `v0.45.0`
`golang.org/x/term`	`v0.41.0` -> `v0.43.0`
`golang.org/x/text`	`v0.35.0` -> `v0.37.0`
`golang.org/x/tools`	`v0.42.0` -> `v0.44.0`

…mpress to v1.18.7 [SECURITY] | datasource | package | from | to | | ---------- | ----------------------------- | ------- | ------- | | go | github.com/klauspost/compress | v1.18.0 | v1.18.7 | Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>

loki 3.7.5 Created-by: HarmonybrewBot Commit-by: HarmonybrewBot Merged-by: HarmonybrewBot Description: Created by `brew bump` --- Created with `brew bump-formula-pr`.<details> <summary>release notes</summary> <pre>## [3.7.5](grafana/loki@v3.7.4...v3.7.5) (2026-08-05) ### Bug Fixes * Build deb/rpm packages again in the release workflow ([#23598](grafana/loki#23598)) ([6f49272](grafana/loki@6f49272)) * **ci:** Disable docker plugin publishing on release-3.7.x ([#23440](grafana/loki#23440)) ([6095f71](grafana/loki@6095f71)) * **ingester:** Fix flush race in ingester [release-3.7.x] ([#23682](grafana/loki#23682)) ([ff152dc](grafana/loki@ff152dc)) * **security/UNKNOWN/cmd/chunks-inspect:** Update module github.com/klauspost/compress to v1.18.7 [SECURITY] (release-3.7.x) ([#23611](grafana/loki#23611)) ([11c4b29](grafana/loki@11c4b29)) * **security/UNKNOWN/cmd/dataobj-inspect:** Update module github.com/klauspost/compress to v1.18.7 [SECURITY] (release-3.7.x) ([#23612](grafana/loki#23612)) ([1e3108e](grafana/loki@1e3108e)) * **security/UNKNOWN/cmd/dataobj-inspect:** Update module go.opentelemetry.io/otel to v1.42.0 [SECURITY] (release-3.7.x) ([#23518](grafana/loki#23518)) ([28917d3](grafana/loki@28917d3)) * **security/UNKNOWN/cmd/dataobj-inspect:** Update module golang.org/x/text to v0.39.0 [SECURITY] (release-3.7.x) ([#23419](grafana/loki#23419)) ([5d2b9d4](grafana/loki@5d2b9d4)) * **security/UNKNOWN/operator:** Update module github.com/klauspost/compress to v1.18.7 [SECURITY] (release-3.7.x) ([#23613](grafana/loki#23613)) ([8d71c59](grafana/loki@8d71c59)) * **security/UNKNOWN/:** Update module github.com/klauspost/compress to v1.18.7 [SECURITY] (release-3.7.x) ([#23610](grafana/loki#23610)) ([941b557](grafana/loki@941b557)) * **security/UNKNOWN/:** Update module golang.org/x/text to v0.39.0 [SECURITY] (release-3.7.x) ([#23418](grafana/loki#23418)) ([2347a9a](grafana/loki@2347a9a)) * **security/UNKNOWN/:** Update module google.golang.org/grpc to v1.82.1 [SECURITY] (release-3.7.x) ([#23405](grafana/loki#23405)) ([f290af0](https://github.com/grafana/loki/commit/f290af0357a9162ab9bb8209ac4dd2426e17a36a))</pre> <p>View the full release notes at <a href="https://github.com/grafana/loki/releases/tag/v3.7.5">https://github.com/grafana/loki/releases/tag/v3.7.5</a>.</p> </details> <hr> See merge request: Harmonybrew/homebrew-core!15969

logcli 3.7.5 Created-by: HarmonybrewBot Commit-by: HarmonybrewBot Merged-by: HarmonybrewBot Description: Created by `brew bump` --- Created with `brew bump-formula-pr`.<details> <summary>release notes</summary> <pre>## [3.7.5](grafana/loki@v3.7.4...v3.7.5) (2026-08-05) ### Bug Fixes * Build deb/rpm packages again in the release workflow ([#23598](grafana/loki#23598)) ([6f49272](grafana/loki@6f49272)) * **ci:** Disable docker plugin publishing on release-3.7.x ([#23440](grafana/loki#23440)) ([6095f71](grafana/loki@6095f71)) * **ingester:** Fix flush race in ingester [release-3.7.x] ([#23682](grafana/loki#23682)) ([ff152dc](grafana/loki@ff152dc)) * **security/UNKNOWN/cmd/chunks-inspect:** Update module github.com/klauspost/compress to v1.18.7 [SECURITY] (release-3.7.x) ([#23611](grafana/loki#23611)) ([11c4b29](grafana/loki@11c4b29)) * **security/UNKNOWN/cmd/dataobj-inspect:** Update module github.com/klauspost/compress to v1.18.7 [SECURITY] (release-3.7.x) ([#23612](grafana/loki#23612)) ([1e3108e](grafana/loki@1e3108e)) * **security/UNKNOWN/cmd/dataobj-inspect:** Update module go.opentelemetry.io/otel to v1.42.0 [SECURITY] (release-3.7.x) ([#23518](grafana/loki#23518)) ([28917d3](grafana/loki@28917d3)) * **security/UNKNOWN/cmd/dataobj-inspect:** Update module golang.org/x/text to v0.39.0 [SECURITY] (release-3.7.x) ([#23419](grafana/loki#23419)) ([5d2b9d4](grafana/loki@5d2b9d4)) * **security/UNKNOWN/operator:** Update module github.com/klauspost/compress to v1.18.7 [SECURITY] (release-3.7.x) ([#23613](grafana/loki#23613)) ([8d71c59](grafana/loki@8d71c59)) * **security/UNKNOWN/:** Update module github.com/klauspost/compress to v1.18.7 [SECURITY] (release-3.7.x) ([#23610](grafana/loki#23610)) ([941b557](grafana/loki@941b557)) * **security/UNKNOWN/:** Update module golang.org/x/text to v0.39.0 [SECURITY] (release-3.7.x) ([#23418](grafana/loki#23418)) ([2347a9a](grafana/loki@2347a9a)) * **security/UNKNOWN/:** Update module google.golang.org/grpc to v1.82.1 [SECURITY] (release-3.7.x) ([#23405](grafana/loki#23405)) ([f290af0](https://github.com/grafana/loki/commit/f290af0357a9162ab9bb8209ac4dd2426e17a36a))</pre> <p>View the full release notes at <a href="https://github.com/grafana/loki/releases/tag/v3.7.5">https://github.com/grafana/loki/releases/tag/v3.7.5</a>.</p> </details> <hr> See merge request: Harmonybrew/homebrew-core!15968

renovate-sh-app Bot added automerge-security-update severity:UNKNOWN labels Jul 27, 2026

renovate-sh-app Bot requested a review from periklis as a code owner July 27, 2026 21:27

renovate-sh-app Bot added the update-patch label Jul 27, 2026

renovate-sh-app Bot requested review from a team, JoaoBraveCoding and xperimental as code owners July 27, 2026 21:27

renovate-sh-app Bot added automerge-security-update severity:UNKNOWN update-patch labels Jul 27, 2026

renovate-sh-app Bot force-pushed the deps-update/release-3.7.x-security-operator-github.comklauspostcompress branch 7 times, most recently from 684480d to 33c4dc5 Compare July 31, 2026 06:12

renovate-sh-app Bot force-pushed the deps-update/release-3.7.x-security-operator-github.comklauspostcompress branch from 33c4dc5 to 911a0ac Compare July 31, 2026 18:13

jnewbigin enabled auto-merge (squash) August 3, 2026 12:03

jnewbigin approved these changes Aug 3, 2026

View reviewed changes

jnewbigin merged commit 8d71c59 into release-3.7.x Aug 3, 2026
89 checks passed

jnewbigin deleted the deps-update/release-3.7.x-security-operator-github.comklauspostcompress branch August 3, 2026 12:04

loki-gh-app Bot mentioned this pull request Jul 31, 2026

chore(release-3.7.x): Release 3.7.5 #23400

Merged

BrewTestBot mentioned this pull request Aug 5, 2026

logcli loki 3.7.5 Homebrew/homebrew-core#297168

Merged

Navigation Menu

Repository navigation

fix(security/UNKNOWN/operator): Update module github.com/klauspost/compress to v1.18.7 [SECURITY] (release-3.7.x) - #23613

fix(security/UNKNOWN/operator): Update module github.com/klauspost/compress to v1.18.7 [SECURITY] (release-3.7.x)#23613
jnewbigin merged 1 commit into
release-3.7.xfrom
deps-update/release-3.7.x-security-operator-github.comklauspostcompress

renovate-sh-app Bot commented Jul 27, 2026

Uh oh!

renovate-sh-app Bot commented Jul 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate-sh-app Bot commented Jul 27, 2026

OOB read in github.com/klauspost/compress/s2

Details

Severity

References

Release Notes

v1.18.7

v1.18.6

What's Changed

New Contributors

v1.18.5

What's Changed

v1.18.4

What's Changed

New Contributors

v1.18.3

v1.18.2

What's Changed

New Contributors

v1.18.1

What's Changed

New Contributors

Configuration

Need help?

Uh oh!

renovate-sh-app Bot commented Jul 27, 2026

ℹ️ Artifact update notice

File name: operator/go.mod

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`v1.18.7`

`v1.18.6`

`v1.18.5`

`v1.18.4`

`v1.18.3`

`v1.18.2`

`v1.18.1`