build(deps): bump github.com/pkg/sftp from 1.13.10 to 1.13.11

[dependabot]

Bumps github.com/pkg/sftp from 1.13.10 to 1.13.11.

Release notes

Sourced from github.com/pkg/sftp's releases.

v1.13.11 - maintenance release

This release bounds an unchecked pre-allocation in the SSH_FILEXFER_ATTRS decoder, updates dependencies, and includes minor code cleanups.

Security/robustness

The attribute decoder (unmarshalFileStat) allocated the extended-attribute slice directly from the wire-supplied extended_count without bounding it against the available bytes. A peer could advertise a huge extended_count in a small packet and force a multi-gigabyte allocation up front, crashing the process with fatal error: out of memory before a single entry was parsed.

What's Changed

• fix: ineffective assignments by @​alrs in pkg/sftp#650
• refactor: replace interface{} with any (Go 1.18+) by @​MD-Mushfiqur123 in pkg/sftp#652
• fix: bound extended-count pre-allocation in unmarshalFileStat by @​drakkan (co-authored by @​mjbommar)

New Contributors

• @​alrs made their first contribution in pkg/sftp#650
• @​MD-Mushfiqur123 made their first contribution in pkg/sftp#652

Full Changelog: pkg/sftp@v1.13.10...v1.13.11

Commits

• fc82c35 CI: run tests on macOS with the latest Go version
• c1bc2ff fix: bound extended-count pre-allocation in unmarshalFileStat
• fe6029a CI: update Go version and GitHub Actions
• 208320f update deps
• dda3848 Merge pull request #652 from MD-Mushfiqur123/refactor/interface-to-any
• 26bf701 refactor: replace interface{} with any (Go 1.18+)
• ef1dc72 Merge pull request #650 from alrs/ineffective-functions
• dbf7c75 fix: ineffective assignments
• ab3b1a3 Merge pull request #641 from pkg/dependabot/go_modules/golang.org/x/crypto-0....
• 4583fed Bump golang.org/x/crypto from 0.41.0 to 0.45.0
• See full diff in compare view