[cppla]

Summary

• Upgrade github.com/klauspost/compress from v1.20.1 to v1.20.2 for GHSA-fpmh-frq8-7rj8.
• Refresh module checksums and regenerate THIRD_PARTY_NOTICES.md with the repository generator.
• Keep all other dependencies, test assertions and handshake profiles unchanged.

Validation

Tested the exact patch on main 8395e72090cf32d792e0aada4dfec99615dc6c17 with Go 1.27.3 and GOTOOLCHAIN=local:

• go mod verify
• make check
• make race
• make build
• make cross-build for linux/amd64, linux/arm64, darwin/arm64 and windows/amd64
• ./scripts/govulncheck.sh: zero reachable and imported-package vulnerabilities
• Original uTLS and official QUIC source-lineage advisory queries and checks: no OSV records
• git diff --check

The scanner still reports three module-only findings in unused x/net HTML and x/crypto OpenPGP packages. This PR does not claim all dependencies are vulnerability-free. #93 already proposes the x/net update and has separate notices and pacing-test follow-up work.

The first local fixture build hit invalid Git metadata in the environment's default temporary directory. Re-running with an isolated temporary workspace passed the focused fixture test and all aggregate checks, without changing source or disabling a test. Native macOS/Windows tests and container integration are left to CI; cross-builds do not establish runtime compatibility.

CI runner compatibility follow-up

The first CI attempt and a retry cancelled the macOS job before any test steps with The configuration 'macos-14-arm64-us-default' is not supported. GitHub retired all macOS 14 runners on November 2, 2026.

A separate commit changes only that job's runner label to the recommended macos-15. Go 1.27.3, ARM64 architecture and the full test command remain unchanged. The YAML parses and the retained compiler/test command were checked locally. All 14 checks passed on final head 6a877c8dc9cdbe52e0cd81c5bbd517118f0cc888, including native macOS/Windows testing, race, vulnerability checks, container integration/builds, netem and CodeQL.

Final runs: CI, Linux netem integration, CodeQL.

[Copilot]

🟢 Approval recommended

No active review issues block the targeted dependency security update.

No open issues 🎉

What changed in this PR

Updates the indirect github.com/klauspost/compress dependency from v1.20.1 to v1.20.2 to address GHSA-fpmh-frq8-7rj8, without changing application code or other dependencies.

Changes:

• Bumps the dependency and refreshes its module checksums.
• Updates the generated third-party notices to match the new version.
• Leaves test assertions and handshake profiles unchanged; the broader dependency updates remain separate in #93.

File	Description
THIRD_PARTY_NOTICES.md	Updates the compress version in the license notices.
go.sum	Replaces the compress checksums with v1.20.2 entries.
go.mod	Pins the indirect compress dependency to v1.20.2.

_{Review effort: Balanced}