chore(deps): bump lz4_flex from 0.11.5 to 0.13.1 in /oku-core

[dependabot]

Bumps lz4_flex from 0.11.5 to 0.13.1.

Release notes

Sourced from lz4_flex's releases.

0.13.1

What's Changed

• Fix panic in Fromio::Error implementation for frame::Error by @​phoerious in PSeitz/lz4_flex#221
• fix: handle short compression dictionaries by @​PSeitz in PSeitz/lz4_flex#222

New Contributors

• @​dglittle made their first contribution in PSeitz/lz4_flex#205
• @​phoerious made their first contribution in PSeitz/lz4_flex#221

Full Changelog: PSeitz/lz4_flex@0.13.0...0.13.1

0.13.0

What's Changed

• add minimal security policy by @​Marcono1234 in PSeitz/lz4_flex#203
• Fix get_maximum_output_size overflow on 32-bit targets by @​dglittle in PSeitz/lz4_flex#205
• lz4_block exposes option to reuse compression dict by @​matthewfollegot in PSeitz/lz4_flex#207

New Contributors

• @​Marcono1234 made their first contribution in PSeitz/lz4_flex#203
• @​dglittle made their first contribution in PSeitz/lz4_flex#205
• @​matthewfollegot made their first contribution in PSeitz/lz4_flex#207

Full Changelog: PSeitz/lz4_flex@0.12.0...0.13.0

0.12.0

What's Changed

• Fix integer overflows when decoding large payloads by @​teh-cmc in PSeitz/lz4_flex#192
• chore(readme): add python binding impl by @​LVivona in PSeitz/lz4_flex#190

New Contributors

• @​teh-cmc made their first contribution in PSeitz/lz4_flex#192
• @​LVivona made their first contribution in PSeitz/lz4_flex#190

Full Changelog: PSeitz/lz4_flex@0.11.5...0.12.0

Changelog

Sourced from lz4_flex's changelog.

0.13.1 (2026-05-09)

Fixes

• Fix compression with short dictionaries (less than 4 bytes), avoiding a panic/out-of-bounds read #222

Compression with dictionaries shorter than the minimum match length of 4 now falls
back to compression without a dictionary instead of panicking or reading past
the dictionary. 
This is a security fix for unsafe compression with untrusted dictionaries.

Users on 0.13.0 should upgrade to 0.13.1.

• Fix panic in From<io::Error> implementation for frame::Error #221 (thanks @​phoerious)

0.13.0 (2026-03-15)

Features

• Add option to reuse compression dict #207 (thanks @​matthewfollegot)

Fixes

• Fix handling of invalid match offsets during decompression #055502e (thanks @​Marcono1234)

Invalid match offsets (offset == 0) during decompression were not properly
handled, which could lead to invalid memory reads. This is a security fix
that was also backported to 0.12.1 and 0.11.6.

• Fix get_maximum_output_size overflow on 32-bit targets #205 (thanks @​dglittle)

Cast input_len to u64 before multiplying by 110, avoiding overflow on
32-bit targets (e.g. wasm32) where input_len * 110 overflows usize
when input_len > ~39MB.

0.12.2 (2026-05-09)

Fixes

• Fix compression with short dictionaries (less than 4 bytes), avoiding a panic/out-of-bounds read #222

Compression with dictionaries shorter than the minimum match length of 4 now falls
back to compression without a dictionary instead of panicking or reading past
the dictionary. 
This is a security fix for unsafe compression with untrusted dictionaries.

Users on 0.12.1 should upgrade to 0.12.2.

0.12.1 (2026-03-14)

Security Fix

• Fix handling of invalid match offsets during decompression #a0b9154 (thanks @​Marcono1234)

... (truncated)

Commits

• 8507d2e bump version
• 5a1962c update CHANGELOG
• ce548ab fix: handle short compression dictionaries
• 1756d13 Fix panic in From<io::Error> implementation for frame::Error
• a513030 update binggan
• 0b9bd1d check fmt in CI
• c5b546f release 0.13.0
• 055502e fix handling of invalid match offsets during decompression
• 7191df8 make hashtable visibility crate public
• 1bdafca add doc comments
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.