Repository navigation
chore(deps): bump github.com/klauspost/compress from 1.17.11 to 1.18.7 - #6214
Conversation
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.17.11 to 1.18.7. - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](klauspost/compress@v1.17.11...v1.18.7) --- updated-dependencies: - dependency-name: github.com/klauspost/compress dependency-version: 1.18.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a fluid-cloudnative member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
There was a problem hiding this comment.
🟡 Changes recommended
The new reset APIs retain stale decoder settings and mutate shared codec state before background workers finish.
No open issues 🎉
What changed in this PR
Updates Fluid’s indirect github.com/klauspost/compress dependency from v1.17.11 to v1.18.7 and refreshes its vendored source, incorporating upstream security fixes and compression improvements.
Changes:
- Updates dependency metadata, checksums, and the vendored Go requirement.
- Imports Zstandard reset APIs, dictionary fixes, and optimized byte-loading helpers.
- Refreshes upstream documentation and release configuration.
| File | Description |
|---|---|
| vendor/modules.txt | Records v1.18.7, Go 1.24, and the new helper package. |
| vendor/github.com/klauspost/compress/zstd/zstd.go | Uses little-endian loading helpers. |
| vendor/github.com/klauspost/compress/zstd/zip.go | Modernizes pool callback typing. |
| vendor/github.com/klauspost/compress/zstd/snappy.go | Corrects write-error propagation. |
| vendor/github.com/klauspost/compress/zstd/simple_go124.go | Adds reusable encoding and decoding helpers. |
| vendor/github.com/klauspost/compress/zstd/seqenc.go | Removes obsolete compiler comments. |
| vendor/github.com/klauspost/compress/zstd/seqdec.go | Uses cursor-based decoding checks. |
| vendor/github.com/klauspost/compress/zstd/seqdec_generic.go | Updates generic decoding checks. |
| vendor/github.com/klauspost/compress/zstd/seqdec_amd64.s | Aligns assembly with the bit-reader layout. |
| vendor/github.com/klauspost/compress/zstd/seqdec_amd64.go | Simplifies block-size limits. |
| vendor/github.com/klauspost/compress/zstd/README.md | Documents assembly and unsafe opt-outs. |
| vendor/github.com/klauspost/compress/zstd/matchlen_generic.go | Optimizes generic prefix matching. |
| vendor/github.com/klauspost/compress/zstd/matchlen_amd64.go | Removes legacy build tags. |
| vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_other.go | Removes legacy build tags. |
| vendor/github.com/klauspost/compress/zstd/fse_encoder.go | Modernizes table-building loops. |
| vendor/github.com/klauspost/compress/zstd/fse_decoder_generic.go | Removes legacy build tags. |
| vendor/github.com/klauspost/compress/zstd/fse_decoder_amd64.go | Removes legacy build tags. |
| vendor/github.com/klauspost/compress/zstd/framedec.go | Simplifies minimum-window calculation. |
| vendor/github.com/klauspost/compress/zstd/encoder.go | Adds option-aware reset and writer checks. |
| vendor/github.com/klauspost/compress/zstd/encoder_options.go | Defines reset options and updates defaults. |
| vendor/github.com/klauspost/compress/zstd/enc_fast.go | Refreshes dictionary tables when dictionaries change. |
| vendor/github.com/klauspost/compress/zstd/enc_dfast.go | Fixes dictionary table sizing and refresh. |
| vendor/github.com/klauspost/compress/zstd/enc_better.go | Refreshes both dictionary lookup tables. |
| vendor/github.com/klauspost/compress/zstd/enc_best.go | Updates dictionary tracking and bounds calculations. |
| vendor/github.com/klauspost/compress/zstd/enc_base.go | Adjusts dictionary shards and identity tracking. |
| vendor/github.com/klauspost/compress/zstd/dict.go | Modernizes dictionary-building code. |
| vendor/github.com/klauspost/compress/zstd/decoder.go | Adds option-aware reset and updates dictionary storage. |
| vendor/github.com/klauspost/compress/zstd/decoder_options.go | Adds dictionary removal and reset-option controls. |
| vendor/github.com/klauspost/compress/zstd/blockenc.go | Clears dictionary state and simplifies histograms. |
| vendor/github.com/klauspost/compress/zstd/blockdec.go | Removes disabled debugging code. |
| vendor/github.com/klauspost/compress/zstd/bitwriter.go | Modernizes byte-flushing loops. |
| vendor/github.com/klauspost/compress/zstd/bitreader.go | Introduces cursor-based byte loading. |
| vendor/github.com/klauspost/compress/s2sx.mod | Updates the auxiliary Go requirement. |
| vendor/github.com/klauspost/compress/README.md | Refreshes upstream usage guidance and changelog. |
| vendor/github.com/klauspost/compress/internal/snapref/encode.go | Reuses destination capacity. |
| vendor/github.com/klauspost/compress/internal/snapref/decode.go | Modernizes signature-checking loops. |
| vendor/github.com/klauspost/compress/internal/le/unsafe_enabled.go | Adds unsafe little-endian loads and stores. |
| vendor/github.com/klauspost/compress/internal/le/unsafe_disabled.go | Adds bounds-checked loading and storing alternatives. |
| vendor/github.com/klauspost/compress/internal/le/le.go | Defines supported index types. |
| vendor/github.com/klauspost/compress/internal/cpuinfo/cpuinfo_amd64.go | Removes legacy build tags. |
| vendor/github.com/klauspost/compress/huff0/README.md | Normalizes Markdown line endings. |
| vendor/github.com/klauspost/compress/huff0/huff0.go | Modernizes Huffman table loops. |
| vendor/github.com/klauspost/compress/huff0/decompress.go | Simplifies decoding loops and bounds. |
| vendor/github.com/klauspost/compress/huff0/decompress_generic.go | Removes legacy build tags. |
| vendor/github.com/klauspost/compress/huff0/decompress_amd64.go | Modernizes loops and output bounds. |
| vendor/github.com/klauspost/compress/huff0/compress.go | Modernizes block-compression loops. |
| vendor/github.com/klauspost/compress/huff0/bitwriter.go | Modernizes byte-flushing loops. |
| vendor/github.com/klauspost/compress/huff0/bitreader.go | Uses optimized little-endian loaders. |
| vendor/github.com/klauspost/compress/fse/README.md | Normalizes Markdown line endings. |
| vendor/github.com/klauspost/compress/fse/compress.go | Modernizes table-building loops. |
| vendor/github.com/klauspost/compress/fse/bitwriter.go | Modernizes byte-flushing loops. |
| vendor/github.com/klauspost/compress/.goreleaser.yml | Updates platform exclusions and archive configuration. |
| vendor/github.com/klauspost/compress/.gitattributes | Enforces LF endings for Markdown. |
| go.sum | Updates dependency checksums. |
| go.mod | Selects compress v1.18.7. |
Review effort: Balanced
cheyang
left a comment
cheyang
left a comment
There was a problem hiding this comment.
Reviewed the Dependabot bump of klauspost/compress 1.17.11 -> 1.18.7 (go.mod, go.sum, vendored tree only — no Fluid source changes) with two independent verification harnesses, and both reach the same conclusion: it's clean. The committed vendor tree regenerates byte-identical (go mod vendor diff empty, go mod verify OK), go build ./... exits 0 on the repo's pinned go1.25.12 toolchain (the module's new go 1.24 floor is satisfied), and the only compiled consumer — promhttp zstd compression on the controllers' metrics endpoints, via controller-runtime — passes contract tests on both base and head, including 16 concurrent scrapes under -race.
One calibration note for whoever merges: the advisory this bump closes (GHSA-259r-337f-4rfw, s2 OOB read) lives in the s2 package, which Fluid neither vendors nor imports, so this is routine alert hygiene plus the zstd-side fixes rather than a live security patch for Fluid binaries. The only base->head behavior delta is in the fix direction: v1.17.11 emitted a zero-byte body for an empty zstd stream (benign for the klauspost decoder, which reads it back as empty); v1.18.7 emits a well-formed frame.
The two reviewers disagreed only on bookkeeping, not substance — whether the s2-unreachability note counts as PR-introduced (adjudicated: pre-existing, it describes the base branch's build graph) and how harshly to word the empty-stream impact (corrected per the decoder probe). Copilot reviewed this head and raised no findings. CI on b4d0c2f: every executed check green (unittest, build x2, lint, staticcheck, CodeQL, SonarCloud, DCO, kind-e2e and backward-compat across k8s v1.22–v1.33); tide is pending review approval, as designed. No blockers or majors.
Next round
[MUST]
(none — merge is not gated on any finding)
[SHOULD]
- Uplift a slim promhttp zstd-negotiation contract test into the repo (both reviewers built one on their verify branches) or file a tracking issue — F3, pre-existing, non-blocking.
[Filed]
(none)
Non-blocking observations (2) — not part of this round's ask; fix now, follow up, or file an issue as you see fit
- go.mod:123 [minor] — pre-existing, not introduced by this PR — Advisory scope of the bump does not reach Fluid's compiled code (alert hygiene, not a live security fix)
F1 (consensus; merges Claude F1 and Codex F1-security-scope-compiled-packages): the only advisory this bump closes (GHSA-259r-337f-4rfw / CVE-2026-63209 / GO-2026-5841, OOB read in the s2 package) affects code Fluid never compiles — s2 (and gzhttp, flate) are absent from vendor/modules.txt at base and head, and nothing in the graph imports them. The only klauspost code in Fluid binaries is zstd, used solely by prometheus/client_golang's promhttp (metrics-endpoint compression) via controller-runtime's metrics server; that path never sets dictionaries, so the v1.18.5 dict-same-ID crash fix is also off the executed path. Informational — no change requested; the merge justification is routine dependency hygiene plus the zstd-side fixes, not exploit closure for Fluid. Provenance adjudicated to preexisting: the s2-unreachability is a property of the base branch's build graph (identical at 86e3adf); the PR introduces only the security framing in its description. - pkg/utils [minor] — pre-existing, not introduced by this PR — No in-repo coverage of the promhttp zstd path this dependency feeds
F3 (Claude F3; Codex cross-critique CONFIRMs): nothing in Fluid's own test suites exercises the only compiled consumer of klauspost/compress — the promhttp/controller-runtime metrics endpoint's Accept-Encoding: zstd negotiation. A future regression in that integration (e.g. via a client_golang or controller-runtime bump) would not be caught by the unittest CI job. Both reviewers independently built passing contract suites on their verify branches (TestPromhttpZstdNegotiationContract / TestPromhttpZstdConcurrentScrapes under -race; TestPromhttpZstdRoundTrip / TestPromhttpZstdEmptyRegistry dual-pass). Suggestion: uplift a slim version into the repo or file a tracking issue. Non-blocking for a vendored indirect-dependency bump.
Verified review delta
- F1: open (preexisting)
- F2: fixed (preexisting)
- F3: open (preexisting)
Code: clear. CI: success; attribution: baseline. Required CI checks still apply.
cheyang
left a comment
cheyang
left a comment
There was a problem hiding this comment.
LGTM, routine dependency bump; CI green on the dual-review harness run.
Bumps github.com/klauspost/compress from 1.17.11 to 1.18.7.
Release notes
Sourced from github.com/klauspost/compress's releases.
... (truncated)
Commits
8668e35Merge commit from forkac2f5e8docs: use unix line-endings for markdown files (#1144)620d7b5s2: Fix amd64 stack frame corruption (#1145)1b63f2fbuild(deps): bump the github-actions group with 2 updates (#1141)3d86b89s2: pool hash tables in Go encode paths to reduce allocations (#1143)15967degzhttp: Canonicalize ETag header (#1139)c5e0077zstd: Fix encoder changing dictionary with same ID (#1135)fd3f23ezstd: Default to full zero frames (#1134)8233c58flate: Clean up histogram order (#1133)bcf0d12build(deps): bump the github-actions group with 3 updates (#1132)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.