fix(deps): bump klauspost/compress to v1.18.7 (GO-2026-5841)

[bborbe]

make vulncheck fails at HEAD on GO-2026-5841 — an out-of-bounds read in github.com/klauspost/compress/s2. The dependency is indirect and a fixed version exists (v1.18.7), so this is a straight bump.

Found while piloting a repo-review pipeline against this repo: dark-factory refuses to execute fix prompts against a red baseline, so this blocked all downstream work.

make precommit passes on the branch (tests, golangci-lint, gosec, trivy, osv-scanner, govulncheck all green).

[ben-s-pull-request-reviewer]

Now I have enough to adjudicate. Let me analyze the changed files against the applicable judgment rules:

CLASSIFY (Step 4c-sel):

• changelog/conventional-prefix-required → applicable — diff touches CHANGELOG.md, rule checks ## Unreleased bullets for conventional prefix
• go-mod-dependency-fix/tidy-after-get-update → applicable — diff touches go.mod+go.sum together, rule checks whether go mod tidy was omitted after go get
• go-mod-dependency-fix/exclude-over-cross-repo-replace → skipped — diff reformats exclude directive from single-line to multi-line; no new replace directive added, so condition does not apply

ADJUDICATE (Step 4d-sel):

1. changelog/conventional-prefix-required — The CHANGELOG entry is:

   - fix(deps): bump klauspost/compress v1.18.7 (GO-2026-5841, OOB read in s2) — restores a green `make vulncheck` baseline
   

   The prefix is fix(deps): where fix: is a valid conventional prefix. No violation.

2. go-mod-dependency-fix/tidy-after-get-update — Both go.mod and go.sum were updated together in this PR (not just go.mod alone). The go.sum shows new hashes for v1.18.7, consistent with go get + go mod tidy. No violation.

3. The exclude directive reformatted from single-line exclude cloud.google.com/go v0.26.0 to multi-line parenthetical form — this is purely stylistic, no replace directive added. Not a violation.

MECHANICAL FINDINGS: 0 findings from ast-grep-runner.

Step 3a: LICENSE file — Checked and present (already on master).

---

Must Fix (Critical)

None.

Should Fix (Important)

None.

Nice to Have (Optional)

None.

---

Selector Mode Traceability

• Candidates: 3 judgment rules matched by Step 4b-i glob filter
• Applicable: 2 rules selected by Step 4c-sel
• Skipped:
  • go-mod-dependency-fix/exclude-over-cross-repo-replace → exclude reformatted to multi-line; no replace directive added

---

Notes: This is a clean dependency security fix (GO-2026-5841 OOB read in s2). The CHANGELOG entry uses the correct fix(deps): prefix, both go.mod and go.sum updated together (consistent with go mod tidy), and the exclude directive reformatting is cosmetic. precommit skipped (selector mode) — CI covers lint+test.

{
"verdict": "approve",
"summary": "Clean dependency security bump: klauspost/compress v1.18.6 → v1.18.7 fixes OOB read in s2 (GO-2026-5841). CHANGELOG uses correct fix(deps): prefix, go.mod+go.sum updated together (go mod tidy applied), exclude directive reformatting is cosmetic only. Zero mechanical findings.",
"comments": [],
"concerns_addressed": [
"security: bump klauspost/compress v1.18.7 fixes OOB read in s2 (GO-2026-5841) — addressed in go.mod:69",
"correctness: exclude directive reformatted from single-line to multi-line parenthetical; no functional change — cosmetic only"
]
}