[dependabot]

Bumps the go-dependencies group with 3 updates: github.com/klauspost/compress, github.com/open-policy-agent/opa and google.golang.org/api.

Updates github.com/klauspost/compress from 1.20.3 to 1.20.4

Release notes

Sourced from github.com/klauspost/compress's releases.

v1.20.4

What's Changed

• zstd: don't reuse a literal table that was not written by @​klauspost in klauspost/compress#1299
• zstd: preserve stream state when resetting options by @​Grivn in klauspost/compress#1266
• zstd, huff0, s2: bump the avo arm64 lowering; keep zstd stack slots in registers by @​lizthegrey in klauspost/compress#1248
• zstd, huff0: faster pure-Go decoders by @​lizthegrey in klauspost/compress#1256
• zstd: Don't retain pointers to decoded inputs in DecodeAll by @​Jille in klauspost/compress#1273
• zstd: inline the best encoder's reject path; cap concurrent-blocks job size by @​bd-dstodolsky in klauspost/compress#1293
• zstd: copy non-overlapping matches in 32-byte blocks by @​lizthegrey in klauspost/compress#1295
• zstd: cap DecodeAll preallocation to what the input can decode to by @​Raghuvardhan-Reddy78 in klauspost/compress#1291
• flate: build unrestricted Huffman trees before limiting lengths by @​klauspost in klauspost/compress#1219
• flate: Fix stateless EOF on large writes. by @​klauspost in klauspost/compress#1265
• flate: keep match history across small flushes by @​klauspost in klauspost/compress#1282
• gzip: write and read a zero MTIME for a zero ModTime by @​spicysharkco in klauspost/compress#1268
• zip: accept 0xFFFFFFFF sizes and offsets without a Zip64 extra by @​ybai08 in klauspost/compress#1267
• zip: backport the standard library's writer-side Zip64 fixes by @​ybai08 in klauspost/compress#1287
• gzip: backport two standard library fixes (truncated header EOF, Write count) by @​ybai08 in klauspost/compress#1270
• gzhttp: let "*" in Accept-Encoding select gzip or zstd by @​Shaisolaris in klauspost/compress#1263
• gzhttp: flush and hijack through http.ResponseController by @​Neffi42 in klauspost/compress#1272
• gzhttp: keep Vary: Accept-Encoding when the handler sets Vary by @​wleeaf in klauspost/compress#1284
• gzhttp: don't pool a decoder while a Read is still using it by @​Raghuvardhan-Reddy78 in klauspost/compress#1288
• gzhttp: clear Content-Length when decoding a compressed request by @​Raghuvardhan-Reddy78 in klauspost/compress#1301
• huff0: promote the 4X loop's input pointers to registers on arm64 by @​lizthegrey in klauspost/compress#1277
• s2: verify the CRC of chunk data kept after Skip by @​Raghuvardhan-Reddy78 in klauspost/compress#1286
• s2: don't read past src when converting LZ4 blocks by @​Raghuvardhan-Reddy78 in klauspost/compress#1294
• s2: fix LZ4 converter length overflow (32-bit only) by @​klauspost in klauspost/compress#1300
• s2: return ErrDstTooSmall for an LZ4 conversion into a nil dst by @​yxshee in klauspost/compress#1307
• s2: keep ErrCorrupt when Skip rejects an oversized chunk by @​CJstate in klauspost/compress#1303

New Contributors

• @​Shaisolaris made their first contribution in klauspost/compress#1263
• @​Grivn made their first contribution in klauspost/compress#1266
• @​spicysharkco made their first contribution in klauspost/compress#1268
• @​ybai08 made their first contribution in klauspost/compress#1267
• @​Neffi42 made their first contribution in klauspost/compress#1272
• @​wleeaf made their first contribution in klauspost/compress#1284
• @​oddharsh made their first contribution in klauspost/compress#1290
• @​bd-dstodolsky made their first contribution in klauspost/compress#1293
• @​yxshee made their first contribution in klauspost/compress#1307
• @​CJstate made their first contribution in klauspost/compress#1303

Full Changelog: klauspost/compress@v1.20.3...v1.20.4

Commits

• 361b808 s2: keep ErrCorrupt when Skip rejects an oversized chunk (#1303)
• 7556d8a s2: return ErrDstTooSmall for an LZ4 conversion into a nil dst (#1307)
• 5763a8d gzhttp: clear Content-Length when decoding a compressed request (#1301)
• d8a2412 zstd: don't reuse a literal table that was not written (#1299)
• a4c846b s2: fix LZ4 converter length overflow (32-bit only) (#1300)
• de5f3e2 zstd: cap DecodeAll preallocation to what the input can decode to (#1291)
• 1e5ae79 zip: backport the standard library's writer-side Zip64 fixes (#1287)
• b143364 s2: don't read past src when converting LZ4 blocks (#1294)
• b660d6d zstd: copy non-overlapping matches in 32-byte blocks (#1295)
• f2783fb zstd: inline the best encoder's reject path; cap concurrent-blocks job size (...
• Additional commits viewable in compare view

Updates github.com/open-policy-agent/opa from 1.22.3 to 1.22.4

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.22.4

This is a fix release for a vulnerability (CVE-2026-97054) in Go's HTTP/1 server:

https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM

net/http: HTTP/1 server crash due to MaxBytesReader header race

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.

Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.

This is CVE-2026-97054 and Go issue https://go.dev/issue/82563.

Note that our security guidance includes not running OPA with its interfaces exposed to adversarial actors, like the public internet. This is fixed regardless, if only to avoid too many spurious vulnerability checker reports.

Also note that if you build your OPA binaries yourself, this patch release does not apply to you, as you control the version of Go that's used. This patch release affects the published binaries and docker images of OPA.

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

Change Log

All notable changes to this project will be documented in this file. This project adheres to Semantic Versioning.

Unreleased

Bundles are rooted at their .manifest file (#9459)

Breaking change: OPA now treats the directory containing a bundle's .manifest file as the bundle root, as the bundle documentation describes. Previously, the root depended on the path a bundle was loaded from, which made bundle contents, data placement, and signatures depend on how a path was typed.

• Bundle directories (opa build -b, opa run -b, opa eval -b, opa sign --bundle, ...) are rooted at the directory containing .manifest, even when it is nested below the provided path. Files above it are not part of the bundle. opa build and opa sign warn about policy and data files they leave out, but other commands do not, so keep other .manifest files (e.g., test fixtures) out of directories loaded as bundles.
• Bundle tarballs loaded from disk must have .manifest at the root of the archive. opa build always writes it there.
• Signatures: file names in .signatures.json are relative to the bundle root, with / separators on every platform. Bundles signed by opa sign <dir> or opa build -b <dir> with older OPA versions must be re-signed, and --exclude-files-verify patterns may need updating.
• opa build with multiple bundles places each bundle's files under the path it was given with -b, with a new .manifest at the root. Leading .. segments are replaced with the name of the directory they refer to. Merging fails when two bundles would be placed under the same path. opa sign with multiple bundle paths names files under each bundle's path, like opa build does when merging. A merged opa build output has its own new .manifest, so signatures from multiple separate source bundles cannot be used to verify a merged build.
• opa build -t plan and -t wasm replace any plan, or wasm resolvers that were carried in from the input bundles.
• .manifest, .signatures.json, and patch.json must be at the bundle root, and only files named exactly .manifest are treated as manifests.

For example, consider this tarball, built without opa build:

$ tar tzf bundle.tar.gz
bundle/.manifest
bundle/data.json
bundle/authz.rego

Previously, opa run -b bundle.tar.gz loaded it with bundle/data.json placed under data.bundle. It is now rejected because .manifest is not at the root of the archive. Running opa build -b bundle/ on the extracted directory produces a bundle rooted at bundle/, with data.json placed at the root of data.

To avoid breaking existing deployments, bundles that the bundle plugin downloads over HTTP or from an OCI registry (and their persisted copies) are still loaded as before, and OPA logs a warning each time a bundle with a misplaced .manifest, .signatures.json, or patch.json is loaded. These bundles will fail to load in a future OPA release. Rebuild them with opa build to place the manifest at the root.

... (truncated)

Commits

• ba39415 Release v1.22.4
• bf378a3 build(go): bump to 1.27.4
• See full diff in compare view

Updates google.golang.org/api from 0.312.0 to 0.313.0

Release notes

Sourced from google.golang.org/api's releases.

v0.313.0

0.313.0 (2026-11-11)

Features

• all: Auto-regenerate discovery clients (#3817) (a1b2b18)

Changelog

Sourced from google.golang.org/api's changelog.

0.313.0 (2026-11-11)

Features

• all: Auto-regenerate discovery clients (#3817) (a1b2b18)

Commits

• bfc6507 chore(main): release 0.313.0 (#3818)
• a1b2b18 feat(all): auto-regenerate discovery clients (#3817)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

Claude finished @dependabot[bot]'s task in 34s —— View job

---

Dependency review: patch/minor bumps, low risk ✅

No builder-image.md was present, so this review covers only the Go module changes in go.mod and go.sum.

Module	Change	Used in	Risk
github.com/klauspost/compress	1.20.3 → 1.20.4 (patch)	internal/intoto/github.go (snappy.DecodedLen / snappy.Decode)	Low
github.com/open-policy-agent/opa	1.22.3 → 1.22.4 (patch)	internal/evaluate/rego.go (v1/ast, v1/rego, v1/storage/inmem)	Very low
google.golang.org/api	0.312.0 → 0.313.0 (minor)	internal/gke/gke.go, internal/cloudrun/cloudrun.go (iterator only)	Very low

Notes

klauspost/compress

• The release is bug fixes and performance work in zstd, flate, gzip, zip, s2 and gzhttp. None of it is listed as a breaking API change.
• Kosli uses only the snappy package, to decode GitHub attestation bundles in downloadBundle (internal/intoto/github.go:218-229). The s2 fixes ("don't read past src when converting LZ4", "verify CRC after Skip", "keep ErrCorrupt") cover streaming and LZ4 paths that the block-level snappy.Decode call doesn't use.
• The code still checks DecodedLen against maxBytes before it decodes, so the allocation limit is unchanged.

OPA

• 1.22.4 changes only the Go toolchain used to build OPA's published binaries (fix for CVE-2026-97054 in net/http). The library code is unchanged.
• The changelog's "bundles are rooted at their .manifest" breaking change is under Unreleased, so this bump doesn't include it. When it ships, it won't affect the CLI: internal/evaluate/rego.go evaluates policy text through rego/ast with in-memory storage and doesn't load OPA bundles.

google.golang.org/api

• This release only regenerates the discovery clients. The CLI imports only the stable iterator package.

Suggested checks

• Let CI's build and integration tests run as usual. internal/intoto (snappy decode) and internal/evaluate (Rego) are the packages to watch.
• I couldn't run go build or tests in this job because the commands needed approval. The review comes from the diff, the release notes and a search of where each module is used.
• I posted this through the Claude comment instead of gh pr comment --edit-last because writing the comment body to a temp file needed a permission this job doesn't have.

No blocking concerns. Fine to merge once CI is green.