Bump klauspost/compress to v1.18.7

[JAORMX]

Summary

Go Vulnerability Check is currently red on main and on every open PR. This unblocks it.

GO-2026-5841 (GHSA-259r-337f-4rfw) is an out-of-bounds read in github.com/klauspost/compress/s2, fixed in v1.18.7. We were pinned at v1.18.6.

The advisory is newly published, not newly introduced. The same check passed on #6031 at 17:08 and failed at 17:52 on a test-only delta. govulncheck queries the advisory database at run time, so nothing in the tree changed — the database did. That is worth stating because a red security check on an unrelated PR reads as that PR's fault until someone opens the log.

Why bump rather than exclude

The workflow's IGNORED_VULNS list exists and would have been faster, but it is reserved for advisories that cannot be fixed, each with a written justification:

• GO-2026-5932 — x/crypto/openpgp, deprecated-by-design, no fixed version exists or is planned
• GO-2026-5037/38/39 — Go stdlib, fixed in go1.26.4 but setup-go: stable still resolves to go1.26.3 because the actions/go-versions manifest lags

GO-2026-5841 has a fixed version available today, so adding it there would misuse that mechanism and leave a real advisory silently suppressed.

Scope

The dependency remains indirect — it reaches us via prometheus/client_golang → klauspost/compress/zstd. Only zstd is used, not the affected s2 package, so actual exposure was low. I am not leaning on that: the fix is one line, so reachability does not need arguing.

Type of change

• Dependency update

Test plan

• go build ./... — pass
• go mod tidy — clean, and the bump survived it, which is the non-obvious risk here: tidy recomputes MVS minimums and can silently revert an indirect-dependency bump. Verified go.mod still reads v1.18.7 afterwards.
• Diff scope confirmed: go.mod (1 line) + go.sum (2 lines), nothing else
• govulncheck — could not run locally (not installed in my environment). CI's Go Vulnerability Check is the verification, and it is the check this PR exists to fix.

I have deliberately not claimed to have confirmed the advisory is cleared. The fixed version comes from the Go vulnerability database entry for GO-2026-5841 (affected[].ranges[].events[].fixed = 1.18.7), and CI will confirm.

API Compatibility

• This PR does not break the v1beta1 API.

No first-party code changes.

Does this introduce a user-facing change?

No.

Special notes for reviewers

Renovate would normally own this, but renovate.json extends config:recommended and this is an indirect dependency, so a bump is not guaranteed to be proposed promptly — and main is red until it lands.

Unrelated observation while verifying, flagged rather than fixed here to keep this PR single-purpose: main now reports 4 paralleltest/tparallel findings in pkg/authz/authorizers/cedar/core_test.go under golangci-lint 2.12.2 locally, which CI does not flag. That looks like a linter-version difference between local installs and the action's default, and it means local task lint is no longer clean on main for anyone. Worth a separate look.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.18%. Comparing base (e837d69) to head (c014fe3).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6041      +/-   ##
==========================================
+ Coverage   72.16%   72.18%   +0.01%     
==========================================
  Files         721      721              
  Lines       75069    75069              
==========================================
+ Hits        54174    54187      +13     
+ Misses      17033    17020      -13     
  Partials     3862     3862              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.