release 0.13.0

PSeitz · PSeitz · commit bfaae84cd413 · 2026-03-15T15:51:02.000+01:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,32 @@
+0.13.0 (2026-03-15)
+==================
+### Features
+- Add option to reuse compression dict [#207](https://github.com/PSeitz/lz4_flex/pull/207)  (thanks @matthewfollegot)
+
+### Fixes
+- Fix handling of invalid match offsets during decompression [#055502e](https://github.com/PSeitz/lz4_flex/commit/055502e) (thanks @Marcono1234)
+```
+Invalid match offsets (offset == 0) during decompression were not properly
+handled, which could lead to invalid memory reads. This is a security fix
+that was also backported to 0.12.1 and 0.11.6.
+```
+- Fix `get_maximum_output_size` overflow on 32-bit targets [#205](https://github.com/PSeitz/lz4_flex/pull/205) (thanks @dglittle)
+```
+Cast input_len to u64 before multiplying by 110, avoiding overflow on
+32-bit targets (e.g. wasm32) where input_len * 110 overflows usize
+when input_len > ~39MB.
+```
+
+0.12.1 (2026-03-14)
+==================
+### Security Fix
+- Fix handling of invalid match offsets during decompression [#a0b9154](https://github.com/PSeitz/lz4_flex/commit/a0b9154) (thanks @Marcono1234)
+```
+Invalid match offsets (offset == 0) during decompression were not properly
+handled, which could lead to invalid memory reads on untrusted input.
+Users on 0.12.x should upgrade to 0.12.1.
+```
+
 0.12.0 (2025-11-11)
 ==================
 - Fix integer overflows when decoding large payloads [#192](https://github.com/PSeitz/lz4_flex/pull/192) (thanks @teh-cmc)
@@ -10,6 +39,16 @@ This change also removes a unsafe fast-path for write_integer to simplify the co
 The performance impact is on incompressible data, which is already fast enough.
 ```
 
+0.11.6 (2026-03-14)
+==================
+### Security Fix
+- Fix handling of invalid match offsets during decompression [#84cdafb](https://github.com/PSeitz/lz4_flex/commit/84cdafb) (thanks @Marcono1234)
+```
+Invalid match offsets (offset == 0) during decompression were not properly
+handled, which could lead to invalid memory reads on untrusted input.
+Users on 0.11.x should upgrade to 0.11.6.
+```
+
 0.11.5 (2025-06-19)
 ==================
 - Fix incorrect rust-version field name in Cargo.toml [#187](https://github.com/PSeitz/lz4_flex/pull/187)
diff --git a/Cargo.toml b/Cargo.toml
@@ -8,7 +8,7 @@ homepage = "https://github.com/pseitz/lz4_flex"
 repository = "https://github.com/pseitz/lz4_flex"
 readme = "README.md"
 license = "MIT"
-version = "0.12.0"
+version = "0.13.0"
 include = ["src/*.rs", "src/frame/**/*", "src/block/**/*", "README.md", "LICENSE"]
 rust-version = "1.81"
 
diff --git a/_typos.toml b/_typos.toml
