Update module github.com/pkg/sftp to v1.13.11

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/pkg/sftp	v1.13.7 → v1.13.11

---

Release Notes

pkg/sftp (github.com/pkg/sftp)

v1.13.11: - maintenance release

Compare Source

This release bounds an unchecked pre-allocation in the SSH_FILEXFER_ATTRS decoder, updates dependencies, and includes minor code cleanups.

Security/robustness

The attribute decoder (unmarshalFileStat) allocated the extended-attribute slice directly from the wire-supplied extended_count without bounding it against the available bytes. A peer could advertise a huge extended_count in a small packet and force a multi-gigabyte allocation up front, crashing the process with fatal error: out of memory before a single entry was parsed.

What's Changed

• fix: ineffective assignments by @​alrs in #​650
• refactor: replace interface{} with any (Go 1.18+) by @​MD-Mushfiqur123 in #​652
• fix: bound extended-count pre-allocation in unmarshalFileStat by @​drakkan (co-authored by @​mjbommar)

New Contributors

• @​alrs made their first contribution in #​650
• @​MD-Mushfiqur123 made their first contribution in #​652

Full Changelog: pkg/sftp@v1.13.10...v1.13.11

v1.13.10: - maintenance release

Compare Source

We’ve made a bunch of little fixes here and there, and I imagine the tests alone could benefit from a proper release to various systems automations.

What's Changed

• Update crypto version to v0.35.0 sftp#625 by @​kbutz in #​626
• go.mod: set the minimum version to 1.23.0 as x/crypto by @​drakkan in #​628
• run go mod tidy by @​drakkan in #​629
• Fix SSH subsystemrequest usage by @​puellanivis in #​632
• Updating go packages by @​Farokhcpu in #​635
• add security policy by @​drakkan in #​637
• Fix typos in InMemHandler comments by @​KleeKitz in #​640
• Don't use LICENSE as a self-test sample file by @​jas4711 in #​638
• Accept '-' in usernames for ls self-test by @​jas4711 in #​639

New Contributors

• @​kbutz made their first contribution in #​626
• @​Farokhcpu made their first contribution in #​635
• @​KleeKitz made their first contribution in #​640
• @​jas4711 made their first contribution in #​638

Full Changelog: pkg/sftp@v1.13.9...v1.13.10

v1.13.9: - better Remove errors, short-circuit unsupported fsync, and ReadFull for readfrom

Compare Source

What's Changed

• Backport v2/Client.Remove and File.Sync by @​puellanivis in #​618
• perf: ensure full write buffer for *File.ReadFrom by @​justfalter in #​623

New Contributors

• @​justfalter made their first contribution in #​623

Full Changelog: pkg/sftp@v1.13.8...v1.13.9

v1.13.8: - readAt bug fix and drive enumeration for Windows

Compare Source

What's Changed

• Bump golang.org/x/crypto from 0.17.0 to 0.31.0 by @​dependabot in #​607
• server.go: "/" for windows by @​powellnorma in #​571
• Issue #​609 - clarify what 'path contains a regular file' actually means by @​puellanivis in #​611
• fix: readAt() occasional hang in concurrent reads by @​cloudsbit in #​621

New Contributors

• @​powellnorma made their first contribution in #​571
• @​cloudsbit made their first contribution in #​621

Full Changelog: pkg/sftp@v1.13.7...v1.13.8

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.24.3 -> 1.25.0
golang.org/x/crypto	v0.43.0 -> v0.54.0
golang.org/x/text	v0.30.0 -> v0.40.0
golang.org/x/net	v0.45.0 -> v0.56.0
golang.org/x/sys	v0.37.0 -> v0.47.0