[claude]

Summary

Upgrades the indirect dependency github.com/klauspost/compress from v1.17.11 to v1.18.7, which fixes CVE-2026-63209: a signed integer overflow in s2.NewDict that can cause an out-of-bounds memory access (HIGH).

• The module comes in transitively through github.com/prometheus/client_golang, which requires v1.17.9. It was already pinned as an indirect requirement in go.mod, so the fix is a one-line bump of that pin plus the matching go.sum update. No other modules changed.

Verification

• go list -m all resolves only github.com/klauspost/compress v1.18.7
• go mod verify: all modules verified
• go build ./...: passes
• go test ./... -short: all packages pass except internal/e2e. Its ctags-based scoring tests (TestBM25, TestGo, TestJava, …, TestRepoRanks) fail because universal-ctags and scip-ctags are not installed in this environment. The same tests fail on main without this change.

Fixes SOU-2738

🤖 Generated with Claude Code

---

Note

Low Risk
Dependency-only security patch with no source changes; behavior change is limited to the upgraded compression library version.

Overview
Bumps the pinned indirect dependency github.com/klauspost/compress from v1.17.11 to v1.18.7 in go.mod and go.sum, addressing CVE-2026-63209 (signed integer overflow in s2.NewDict that can lead to out-of-bounds memory access). No application code or other modules change—only the dependency pin and checksums.

^{Reviewed by Cursor Bugbot for commit 10f20ae. Bugbot is set up for automated code reviews on this repo. Configure here.}