Update module github.com/pkg/sftp to v1.13.11

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/pkg/sftp	v1.13.6 → v1.13.11

---

Release Notes

pkg/sftp (github.com/pkg/sftp)

v1.13.11: - maintenance release

Compare Source

This release bounds an unchecked pre-allocation in the SSH_FILEXFER_ATTRS decoder, updates dependencies, and includes minor code cleanups.

Security/robustness

The attribute decoder (unmarshalFileStat) allocated the extended-attribute slice directly from the wire-supplied extended_count without bounding it against the available bytes. A peer could advertise a huge extended_count in a small packet and force a multi-gigabyte allocation up front, crashing the process with fatal error: out of memory before a single entry was parsed.

What's Changed

• fix: ineffective assignments by @​alrs in #​650
• refactor: replace interface{} with any (Go 1.18+) by @​MD-Mushfiqur123 in #​652
• fix: bound extended-count pre-allocation in unmarshalFileStat by @​drakkan (co-authored by @​mjbommar)

New Contributors

• @​alrs made their first contribution in #​650
• @​MD-Mushfiqur123 made their first contribution in #​652

Full Changelog: pkg/sftp@v1.13.10...v1.13.11

v1.13.10: - maintenance release

Compare Source

We’ve made a bunch of little fixes here and there, and I imagine the tests alone could benefit from a proper release to various systems automations.

What's Changed

• Update crypto version to v0.35.0 sftp#625 by @​kbutz in #​626
• go.mod: set the minimum version to 1.23.0 as x/crypto by @​drakkan in #​628
• run go mod tidy by @​drakkan in #​629
• Fix SSH subsystemrequest usage by @​puellanivis in #​632
• Updating go packages by @​Farokhcpu in #​635
• add security policy by @​drakkan in #​637
• Fix typos in InMemHandler comments by @​KleeKitz in #​640
• Don't use LICENSE as a self-test sample file by @​jas4711 in #​638
• Accept '-' in usernames for ls self-test by @​jas4711 in #​639

New Contributors

• @​kbutz made their first contribution in #​626
• @​Farokhcpu made their first contribution in #​635
• @​KleeKitz made their first contribution in #​640
• @​jas4711 made their first contribution in #​638

Full Changelog: pkg/sftp@v1.13.9...v1.13.10

v1.13.9: - better Remove errors, short-circuit unsupported fsync, and ReadFull for readfrom

Compare Source

What's Changed

• Backport v2/Client.Remove and File.Sync by @​puellanivis in #​618
• perf: ensure full write buffer for *File.ReadFrom by @​justfalter in #​623

New Contributors

• @​justfalter made their first contribution in #​623

Full Changelog: pkg/sftp@v1.13.8...v1.13.9

v1.13.8: - readAt bug fix and drive enumeration for Windows

Compare Source

What's Changed

• Bump golang.org/x/crypto from 0.17.0 to 0.31.0 by @​dependabot in #​607
• server.go: "/" for windows by @​powellnorma in #​571
• Issue #​609 - clarify what 'path contains a regular file' actually means by @​puellanivis in #​611
• fix: readAt() occasional hang in concurrent reads by @​cloudsbit in #​621

New Contributors

• @​powellnorma made their first contribution in #​571
• @​cloudsbit made their first contribution in #​621

Full Changelog: pkg/sftp@v1.13.7...v1.13.8

v1.13.7: - z/OS support

Compare Source

What's Changed

• Fix typo in request-interfaces.go by @​Lilja in #​558
• fix: remove ioutil and use io/os libraries by @​urko-b in #​560
• fix: sftp client hang when exit in sftp server example by @​wwcd in #​564
• Cancelable ReadDirContext by @​ungerik in #​565
• Bump golang.org/x/crypto from 0.1.0 to 0.17.0 by @​dependabot in #​568
• Rework client to prevent after-Close usage, and support perm at Open by @​puellanivis in #​574
• Add support for z/OS by @​puellanivis in #​580
• Add support for zos/s390x by @​dustin-ward in #​582
• add CloserListerAt by @​drakkan in #​577
• Add SetExtendedAttrs to Client by @​peterverraedt in #​583
• Add WithMaxTxPacket server option by @​peterverraedt in #​584
• update ReadFrom and ReadFromWithConcurrency docs by @​emar-kar in #​588

New Contributors

• @​Lilja made their first contribution in #​558
• @​urko-b made their first contribution in #​560
• @​wwcd made their first contribution in #​564
• @​ungerik made their first contribution in #​565
• @​dependabot made their first contribution in #​568
• @​dustin-ward made their first contribution in #​582
• @​emar-kar made their first contribution in #​588

Full Changelog: pkg/sftp@v1.13.6...v1.13.7

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.21 -> 1.23.0
golang.org/x/crypto	v0.26.0 -> v0.41.0
golang.org/x/sys	v0.23.0 -> v0.35.0