[PR #7002] build(deps): bump github.com/pkg/sftp from 1.13.9 to 1.13.11 #30082

Open
opened 2026-08-05 08:10:01 -04:00 by saavagebueno · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/netbirdio/netbird/pull/7002
Author: @dependabot[bot]
Created: 7/30/2026
Status: 🔄 Open

Base: mainHead: dependabot/go_modules/github.com/pkg/sftp-1.13.11


📝 Commits (1)

  • d21958d build(deps): bump github.com/pkg/sftp from 1.13.9 to 1.13.11

📊 Changes

2 files changed (+3 additions, -31 deletions)

View changed files

📝 go.mod (+1 -1)
📝 go.sum (+2 -30)

📄 Description

Bumps github.com/pkg/sftp from 1.13.9 to 1.13.11.

Release notes

Sourced from github.com/pkg/sftp's releases.

v1.13.11 - maintenance release

This release bounds an unchecked pre-allocation in the SSH_FILEXFER_ATTRS decoder, updates dependencies, and includes minor code cleanups.

Security/robustness

The attribute decoder (unmarshalFileStat) allocated the extended-attribute slice directly from the wire-supplied extended_count without bounding it against the available bytes. A peer could advertise a huge extended_count in a small packet and force a multi-gigabyte allocation up front, crashing the process with fatal error: out of memory before a single entry was parsed.

What's Changed

New Contributors

Full Changelog: https://github.com/pkg/sftp/compare/v1.13.10...v1.13.11

v1.13.10 - maintenance release

We’ve made a bunch of little fixes here and there, and I imagine the tests alone could benefit from a proper release to various systems automations.

What's Changed

New Contributors

Full Changelog: https://github.com/pkg/sftp/compare/v1.13.9...v1.13.10

Commits
  • fc82c35 CI: run tests on macOS with the latest Go version
  • c1bc2ff fix: bound extended-count pre-allocation in unmarshalFileStat
  • fe6029a CI: update Go version and GitHub Actions
  • 208320f update deps
  • dda3848 Merge pull request #652 from MD-Mushfiqur123/refactor/interface-to-any
  • 26bf701 refactor: replace interface{} with any (Go 1.18+)
  • ef1dc72 Merge pull request #650 from alrs/ineffective-functions
  • dbf7c75 fix: ineffective assignments
  • ab3b1a3 Merge pull request #641 from pkg/dependabot/go_modules/golang.org/x/crypto-0....
  • 4583fed Bump golang.org/x/crypto from 0.41.0 to 0.45.0
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/netbirdio/netbird/pull/7002 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 7/30/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `dependabot/go_modules/github.com/pkg/sftp-1.13.11` --- ### 📝 Commits (1) - [`d21958d`](https://github.com/netbirdio/netbird/commit/d21958d152daced95efd5edec2ce7e0c2f225589) build(deps): bump github.com/pkg/sftp from 1.13.9 to 1.13.11 ### 📊 Changes **2 files changed** (+3 additions, -31 deletions) <details> <summary>View changed files</summary> 📝 `go.mod` (+1 -1) 📝 `go.sum` (+2 -30) </details> ### 📄 Description Bumps [github.com/pkg/sftp](https://github.com/pkg/sftp) from 1.13.9 to 1.13.11. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pkg/sftp/releases">github.com/pkg/sftp's releases</a>.</em></p> <blockquote> <h2>v1.13.11 - maintenance release</h2> <p>This release bounds an unchecked pre-allocation in the SSH_FILEXFER_ATTRS decoder, updates dependencies, and includes minor code cleanups.</p> <h3>Security/robustness</h3> <p>The attribute decoder (<code>unmarshalFileStat</code>) allocated the extended-attribute slice directly from the wire-supplied <code>extended_count</code> without bounding it against the available bytes. A peer could advertise a huge <code>extended_count</code> in a small packet and force a multi-gigabyte allocation up front, crashing the process with <code>fatal error: out of memory</code> before a single entry was parsed.</p> <h3>What's Changed</h3> <ul> <li>fix: ineffective assignments by <a href="https://github.com/alrs"><code>@​alrs</code></a> in <a href="https://redirect.github.com/pkg/sftp/pull/650">pkg/sftp#650</a></li> <li>refactor: replace interface{} with any (Go 1.18+) by <a href="https://github.com/MD-Mushfiqur123"><code>@​MD-Mushfiqur123</code></a> in <a href="https://redirect.github.com/pkg/sftp/pull/652">pkg/sftp#652</a></li> <li>fix: bound extended-count pre-allocation in unmarshalFileStat by <a href="https://github.com/drakkan"><code>@​drakkan</code></a> (co-authored by <a href="https://github.com/mjbommar"><code>@​mjbommar</code></a>)</li> </ul> <h3>New Contributors</h3> <ul> <li><a href="https://github.com/alrs"><code>@​alrs</code></a> made their first contribution in <a href="https://redirect.github.com/pkg/sftp/pull/650">pkg/sftp#650</a></li> <li><a href="https://github.com/MD-Mushfiqur123"><code>@​MD-Mushfiqur123</code></a> made their first contribution in <a href="https://redirect.github.com/pkg/sftp/pull/652">pkg/sftp#652</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pkg/sftp/compare/v1.13.10...v1.13.11">https://github.com/pkg/sftp/compare/v1.13.10...v1.13.11</a></p> <h2>v1.13.10 - maintenance release</h2> <p>We’ve made a bunch of little fixes here and there, and I imagine the tests alone could benefit from a proper release to various systems automations.</p> <h2>What's Changed</h2> <ul> <li>Update crypto version to v0.35.0 sftp#625 by <a href="https://github.com/kbutz"><code>@​kbutz</code></a> in <a href="https://redirect.github.com/pkg/sftp/pull/626">pkg/sftp#626</a></li> <li>go.mod: set the minimum version to 1.23.0 as x/crypto by <a href="https://github.com/drakkan"><code>@​drakkan</code></a> in <a href="https://redirect.github.com/pkg/sftp/pull/628">pkg/sftp#628</a></li> <li>run go mod tidy by <a href="https://github.com/drakkan"><code>@​drakkan</code></a> in <a href="https://redirect.github.com/pkg/sftp/pull/629">pkg/sftp#629</a></li> <li>Fix SSH subsystemrequest usage by <a href="https://github.com/puellanivis"><code>@​puellanivis</code></a> in <a href="https://redirect.github.com/pkg/sftp/pull/632">pkg/sftp#632</a></li> <li>Updating go packages by <a href="https://github.com/Farokhcpu"><code>@​Farokhcpu</code></a> in <a href="https://redirect.github.com/pkg/sftp/pull/635">pkg/sftp#635</a></li> <li>add security policy by <a href="https://github.com/drakkan"><code>@​drakkan</code></a> in <a href="https://redirect.github.com/pkg/sftp/pull/637">pkg/sftp#637</a></li> <li>Fix typos in InMemHandler comments by <a href="https://github.com/KleeKitz"><code>@​KleeKitz</code></a> in <a href="https://redirect.github.com/pkg/sftp/pull/640">pkg/sftp#640</a></li> <li>Don't use LICENSE as a self-test sample file by <a href="https://github.com/jas4711"><code>@​jas4711</code></a> in <a href="https://redirect.github.com/pkg/sftp/pull/638">pkg/sftp#638</a></li> <li>Accept '-' in usernames for ls self-test by <a href="https://github.com/jas4711"><code>@​jas4711</code></a> in <a href="https://redirect.github.com/pkg/sftp/pull/639">pkg/sftp#639</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/kbutz"><code>@​kbutz</code></a> made their first contribution in <a href="https://redirect.github.com/pkg/sftp/pull/626">pkg/sftp#626</a></li> <li><a href="https://github.com/Farokhcpu"><code>@​Farokhcpu</code></a> made their first contribution in <a href="https://redirect.github.com/pkg/sftp/pull/635">pkg/sftp#635</a></li> <li><a href="https://github.com/KleeKitz"><code>@​KleeKitz</code></a> made their first contribution in <a href="https://redirect.github.com/pkg/sftp/pull/640">pkg/sftp#640</a></li> <li><a href="https://github.com/jas4711"><code>@​jas4711</code></a> made their first contribution in <a href="https://redirect.github.com/pkg/sftp/pull/638">pkg/sftp#638</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pkg/sftp/compare/v1.13.9...v1.13.10">https://github.com/pkg/sftp/compare/v1.13.9...v1.13.10</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pkg/sftp/commit/fc82c354c0d87349411e30a08bef297c9f132105"><code>fc82c35</code></a> CI: run tests on macOS with the latest Go version</li> <li><a href="https://github.com/pkg/sftp/commit/c1bc2fffcb14f580c4d365ae9660fa149ec1dba5"><code>c1bc2ff</code></a> fix: bound extended-count pre-allocation in unmarshalFileStat</li> <li><a href="https://github.com/pkg/sftp/commit/fe6029a9018698a0533b8b978038c4654216ec90"><code>fe6029a</code></a> CI: update Go version and GitHub Actions</li> <li><a href="https://github.com/pkg/sftp/commit/208320fa10d3e2e17b840eb81c265106cd01630a"><code>208320f</code></a> update deps</li> <li><a href="https://github.com/pkg/sftp/commit/dda38481a0d1b25903d59ccfb2f044361d092c16"><code>dda3848</code></a> Merge pull request <a href="https://redirect.github.com/pkg/sftp/issues/652">#652</a> from MD-Mushfiqur123/refactor/interface-to-any</li> <li><a href="https://github.com/pkg/sftp/commit/26bf701b06bfb19a4d0245605b9e23141d428f2a"><code>26bf701</code></a> refactor: replace interface{} with any (Go 1.18+)</li> <li><a href="https://github.com/pkg/sftp/commit/ef1dc72596d67f71796f323a42fd648bca14c4e9"><code>ef1dc72</code></a> Merge pull request <a href="https://redirect.github.com/pkg/sftp/issues/650">#650</a> from alrs/ineffective-functions</li> <li><a href="https://github.com/pkg/sftp/commit/dbf7c752efad233b0c5cfc03e857d27d0e8ffe65"><code>dbf7c75</code></a> fix: ineffective assignments</li> <li><a href="https://github.com/pkg/sftp/commit/ab3b1a348110878ba49035ce91904cc41743feb0"><code>ab3b1a3</code></a> Merge pull request <a href="https://redirect.github.com/pkg/sftp/issues/641">#641</a> from pkg/dependabot/go_modules/golang.org/x/crypto-0....</li> <li><a href="https://github.com/pkg/sftp/commit/4583fed401bd4d0454867e7416a5a2e721a63b52"><code>4583fed</code></a> Bump golang.org/x/crypto from 0.41.0 to 0.45.0</li> <li>Additional commits viewable in <a href="https://github.com/pkg/sftp/compare/v1.13.9...v1.13.11">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pkg/sftp&package-manager=go_modules&previous-version=1.13.9&new-version=1.13.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
saavagebueno added the pull-request label 2026-08-05 08:10:01 -04:00
Sign in to join this conversation.
No Label pull-request
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#30082