build(deps): bump lz4_flex from 0.11.6 to 0.13.1

[dependabot]

Bumps lz4_flex from 0.11.6 to 0.13.1.

Release notes

Sourced from lz4_flex's releases.

0.13.1

What's Changed

• Fix panic in Fromio::Error implementation for frame::Error by @​phoerious in PSeitz/lz4_flex#221
• fix: handle short compression dictionaries by @​PSeitz in PSeitz/lz4_flex#222

New Contributors

• @​dglittle made their first contribution in PSeitz/lz4_flex#205
• @​phoerious made their first contribution in PSeitz/lz4_flex#221

Full Changelog: PSeitz/lz4_flex@0.13.0...0.13.1

0.13.0

What's Changed

• add minimal security policy by @​Marcono1234 in PSeitz/lz4_flex#203
• Fix get_maximum_output_size overflow on 32-bit targets by @​dglittle in PSeitz/lz4_flex#205
• lz4_block exposes option to reuse compression dict by @​matthewfollegot in PSeitz/lz4_flex#207

New Contributors

• @​Marcono1234 made their first contribution in PSeitz/lz4_flex#203
• @​dglittle made their first contribution in PSeitz/lz4_flex#205
• @​matthewfollegot made their first contribution in PSeitz/lz4_flex#207

Full Changelog: PSeitz/lz4_flex@0.12.0...0.13.0

0.12.0

What's Changed

• Fix integer overflows when decoding large payloads by @​teh-cmc in PSeitz/lz4_flex#192
• chore(readme): add python binding impl by @​LVivona in PSeitz/lz4_flex#190

New Contributors

• @​teh-cmc made their first contribution in PSeitz/lz4_flex#192
• @​LVivona made their first contribution in PSeitz/lz4_flex#190

Full Changelog: PSeitz/lz4_flex@0.11.5...0.12.0

Changelog

Sourced from lz4_flex's changelog.

0.13.1 (2026-05-09)

Fixes

• Fix compression with short dictionaries (less than 4 bytes), avoiding a panic/out-of-bounds read #222

Compression with dictionaries shorter than the minimum match length of 4 now falls
back to compression without a dictionary instead of panicking or reading past
the dictionary. 
This is a security fix for unsafe compression with untrusted dictionaries.

Users on 0.13.0 should upgrade to 0.13.1.

• Fix panic in From<io::Error> implementation for frame::Error #221 (thanks @​phoerious)

0.13.0 (2026-03-15)

Features

• Add option to reuse compression dict #207 (thanks @​matthewfollegot)

Fixes

• Fix handling of invalid match offsets during decompression #055502e (thanks @​Marcono1234)

Invalid match offsets (offset == 0) during decompression were not properly
handled, which could lead to invalid memory reads. This is a security fix
that was also backported to 0.12.1 and 0.11.6.

• Fix get_maximum_output_size overflow on 32-bit targets #205 (thanks @​dglittle)

Cast input_len to u64 before multiplying by 110, avoiding overflow on
32-bit targets (e.g. wasm32) where input_len * 110 overflows usize
when input_len > ~39MB.

0.12.2 (2026-05-09)

Fixes

• Fix compression with short dictionaries (less than 4 bytes), avoiding a panic/out-of-bounds read #222

Compression with dictionaries shorter than the minimum match length of 4 now falls
back to compression without a dictionary instead of panicking or reading past
the dictionary. 
This is a security fix for unsafe compression with untrusted dictionaries.

Users on 0.12.1 should upgrade to 0.12.2.

0.12.1 (2026-03-14)

Security Fix

• Fix handling of invalid match offsets during decompression #a0b9154 (thanks @​Marcono1234)

... (truncated)

Commits

• 8507d2e bump version
• 5a1962c update CHANGELOG
• ce548ab fix: handle short compression dictionaries
• 1756d13 Fix panic in From<io::Error> implementation for frame::Error
• a513030 update binggan
• 0b9bd1d check fmt in CI
• c5b546f release 0.13.0
• 055502e fix handling of invalid match offsets during decompression
• 7191df8 make hashtable visibility crate public
• 1bdafca add doc comments
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Dependabot can't resolve your Rust dependency files. Because of this, Dependabot cannot update this pull request.

[dependabot]

Dependabot can't resolve your Rust dependency files. Because of this, Dependabot cannot update this pull request.