chore(all): update module github.com/klauspost/compress to v1.18.7 [SECURITY] (#20726)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[github.com/klauspost/compress](https://redirect.github.com/klauspost/compress)
| `v1.18.6` → `v1.18.7` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fklauspost%2fcompress/v1.18.7?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fklauspost%2fcompress/v1.18.6/v1.18.7?slim=true)
|

---

### Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write
in compress
[CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) /
[GHSA-259r-337f-4rfw](https://redirect.github.com/advisories/GHSA-259r-337f-4rfw)

<details>
<summary>More information</summary>

#### Details
##### Signed Integer Overflow in s2.NewDict

##### Summary

A signed integer overflow vulnerability in `s2.NewDict()` allows an
attacker to bypass repeat index validation by supplying a dictionary
with a uvarint-encoded repeat value exceeding `MaxInt64`. When
`Dict.Encode()` is subsequently called, the overflowed negative repeat
value causes an out-of-bounds memory access via `unsafe.Pointer`
arithmetic, crashing the process with SIGSEGV.

##### Package

- **Name:** `github.com/klauspost/compress/s2`
- **Ecosystem:** Go
- **Affected versions:** <= v1.18.6 (all versions with `NewDict`
function)

##### Severity

**High (7.5)** — CVSS v3.1: `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

##### Vulnerability

##### Type
- CWE-190: Integer Overflow or Wraparound
- CWE-787: Out-of-bounds Write (via unsafe.Pointer)

##### Description

The `NewDict()` function reads a uvarint from dictionary data and
converts it to `int`:

```go
r, n := binary.Uvarint(dict)
// ...
d.repeat = int(r)
if d.repeat > len(dict) {
    return nil
}
```

When `r` exceeds `MaxInt64` (9223372036854775807), `int(r)` overflows to
a negative value. Since a negative number is never greater than a
positive length, the validation check is bypassed.

When `Dict.Encode()` is called, the negative `repeat` value causes an
integer overflow in `encodeBlockDictGo()`:

```go
repeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive
candidate := len(dict.dict) - repeat + s // underflows to negative
load32(dict.dict, candidate)             // OOB via unsafe.Pointer
```

`load32` calls `le.Load32` which uses `unsafe.Pointer` arithmetic
without bounds checking:

```go
func Load32[I Indexer](b []byte, i I) uint32 {
    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))
}
```

This causes a segmentation fault (SIGSEGV) when the negative index is
dereferenced.

##### PoC

```go
package main

import (
    "encoding/binary"
    "fmt"
    "github.com/klauspost/compress/s2"
)

func main() {
    var dictData []byte
    buf := make([]byte, binary.MaxVarintLen64)
    n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64
    dictData = append(dictData, buf[:n]...)
    dictData = append(dictData, make([]byte, 16)...) // minimum dict size

    dict := s2.NewDict(dictData)
    // dict is non-nil despite invalid repeat value (overflow bypassed validation)

    src := make([]byte, 64)
    for i := range src { src[i] = byte(i) }
    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer
}
```

##### Impact

- **Denial of Service:** The process crashes immediately with SIGSEGV

##### Attack Vector

Any application that:
1. Accepts user-supplied S2 dictionary data via `s2.NewDict()`
2. Calls `Dict.Encode()` on any data ≥32 bytes

##### Suggested Fix

Validate the uvarint value before converting to int:

```go
if r > math.MaxInt64 {
    return nil
}
d.repeat = int(r)
```

Or use `uint` for the repeat field and validate against
`uint(len(dict))`.

##### References

- Source: `s2/dict.go` lines 59-61 (vulnerability), `s2/encode_all.go`
line 947 (crash site)
- Commit: 539243b (v1.18.6 + 4 commits)

##### Credits
Christopher Linke / https://github.com/celinke97/

#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw](https://redirect.github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209)
-
[https://github.com/klauspost/compress/pull/1163](https://redirect.github.com/klauspost/compress/pull/1163)
-
[https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536](https://redirect.github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536)
-
[https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa](https://redirect.github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa)
-
[https://github.com/klauspost/compress/releases/tag/v1.18.7](https://redirect.github.com/klauspost/compress/releases/tag/v1.18.7)
-
[https://github.com/advisories/GHSA-259r-337f-4rfw](https://redirect.github.com/advisories/GHSA-259r-337f-4rfw)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-259r-337f-4rfw)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>klauspost/compress (github.com/klauspost/compress)</summary>

###
[`v1.18.7`](https://redirect.github.com/klauspost/compress/releases/tag/v1.18.7)

[Compare
Source](https://redirect.github.com/klauspost/compress/compare/v1.18.6...v1.18.7)

- Fix s2.NewDict OOB read.

Security release without other changes.

**Full Changelog**:
<https://github.com/klauspost/compress/compare/v1.18.6...v1.18.7>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/googleapis/google-cloud-go).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->