Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
github.com/alecthomas/kong	v1.13.0 → v1.15.0			require	minor
github.com/klauspost/compress	v1.17.11 → v1.18.5			require	minor
gradle (source)	8.14.3 → 8.14.4				patch
undici (source)	6.24.1 → 6.25.0			overrides	minor

---

Release Notes

alecthomas/kong (github.com/alecthomas/kong)

v1.15.0

Compare Source

v1.14.0

Compare Source

klauspost/compress (github.com/klauspost/compress)

v1.18.5

Compare Source

What's Changed

• zstd: Fix crash when changing encoder dictionary with same ID by @​klauspost in #​1135
• zstd: Default to full zero frames by @​klauspost in #​1134
• flate: Clean up histogram order by @​klauspost in #​1133

Full Changelog: klauspost/compress@v1.18.4...v1.18.5

v1.18.4

Compare Source

What's Changed

• gzhttp: Add zstandard to server handler wrapper by @​klauspost in #​1121
• zstd: Add ResetWithOptions to encoder/decoder by @​klauspost in #​1122
• gzhttp: preserve qvalue when extra parameters follow in Accept-Encoding by @​analytically in #​1116

New Contributors

• @​analytically made their first contribution in #​1116
• @​ethaizone made their first contribution in #​1124
• @​zwass made their first contribution in #​1125

Full Changelog: klauspost/compress@v1.18.2...v1.18.4

v1.18.3

Compare Source

Downstream CVE-2025-61728

See golang/go#77102

Full Changelog: klauspost/compress@v1.18.2...v1.18.3

v1.18.2

Compare Source

What's Changed

• flate: Fix invalid encoding on level 9 with single value input by @​klauspost in #​1115
• flate: reduce stateless allocations by @​RXamzin in #​1106
• build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 in the github-actions group by @​dependabot[bot] in #​1111

v1.18.1 is marked "retracted" due to invalid flate/zip/gzip encoding.

New Contributors

• @​RXamzin made their first contribution in #​1106

Full Changelog: klauspost/compress@v1.18.1...v1.18.2

v1.18.1

Compare Source

What's Changed

• zstd: Fix incorrect buffer size in dictionary encodes by @​klauspost in #​1059
• s2: check for cap, not len of buffer in EncodeBetter/Best by @​vdarulis in #​1080
• zstd: Add simple zstd EncodeTo/DecodeTo functions by @​klauspost in #​1079
• zlib: Avoiding extra allocation in zlib.reader.Reset by @​travelpolicy in #​1086
• gzhttp: remove redundant err check in zstdReader by @​ryanfowler in #​1090
• Run modernize. Deprecate Go 1.22 by @​klauspost in #​1095
• flate: Simplify matchlen by @​klauspost in #​1101
• flate: Add examples by @​klauspost in #​1102
• flate: Use exact sizes for huffman tables by @​klauspost in #​1103
• flate: Faster load+store by @​klauspost in #​1104
• Add notice to S2 about MinLZ by @​klauspost in #​1065

New Contributors

• @​wooffie made their first contribution in #​1069
• @​vdarulis made their first contribution in #​1080
• @​travelpolicy made their first contribution in #​1086
• @​ryanfowler made their first contribution in #​1090

Full Changelog: klauspost/compress@v1.18.0...v1.18.1

v1.18.0

Compare Source

What's Changed

• Deprecate Go 1.21 and add 1.24 by @​klauspost in #​1055
• Add unsafe little endian loaders by @​klauspost in #​1036
• fix: check r.err != nil but return a nil value error err by @​alingse in #​1028
• refactor: use built-in min function by @​Juneezee in #​1038
• zstd: use slices.Max for max value in slice by @​Juneezee in #​1041
• flate: Simplify L4-6 loading by @​klauspost in #​1043
• flate: Simplify matchlen (remove asm) by @​klauspost in #​1045
• s2: Add block decode fuzzer by @​klauspost in #​1044
• s2: Improve small block compression speed w/o asm by @​klauspost in #​1048
• flate: Fix matchlen L5+L6 by @​klauspost in #​1049
• flate: Cleanup & reduce casts by @​klauspost in #​1050

New Contributors

• @​tcpdumppy made their first contribution in #​1021
• @​sam9291 made their first contribution in #​1022
• @​dezza made their first contribution in #​1023
• @​alingse made their first contribution in #​1028
• @​hyunsooda made their first contribution in #​1031
• @​Juneezee made their first contribution in #​1038
• @​Bbulatov made their first contribution in #​1052

Full Changelog: klauspost/compress@v1.17.11...v1.18.0

gradle/gradle (gradle)

v8.14.4

Compare Source

nodejs/undici (undici)

v6.25.0

Compare Source

What's Changed

Full Changelog: nodejs/undici@v6.24.1...v6.25.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: action/package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code EOVERRIDE
npm error Override for undici@6.25.0 conflicts with direct dependency
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-04-20T15_14_09_162Z-debug-0.log