go: bump github.com/gopacket/gopacket from 1.7.0 to 1.7.1

[dependabot]

Bumps github.com/gopacket/gopacket from 1.7.0 to 1.7.1.

Release notes

Sourced from github.com/gopacket/gopacket's releases.

v1.7.1

Security release. All versions up to and including v1.7.0 are affected — upgrade is recommended for anyone decoding untrusted packets or capture files.

Security fixes

Crafted input caused runtime panics (out-of-bounds slice/index, or unsigned underflow producing an inverted range) in a number of layers/ decoders. Each is now bounded against the buffer, returning a decode error and setting SetTruncated() instead of crashing.

Advisory	Area
CVE-2026-65819	TLS, DHCPv4, sFlow, IPSecAH, VRRPv2, Diameter, GTPv1U, ERSPAN, LCM, RadioTap, Dot11IE — the fix for this shipped in no prior release
GHSA-6h9g-cjv3-pg2c	TCP MPTCP options — on the ordinary Ethernet→IP→TCP path, so any consumer decoding untrusted TCP was exposed
GHSA-25xj-ggj7-jqgf	SIP header folding (port-auto-selected, single UDP datagram)
GHSA-cxrr-2gv2-m94w	EtherIP, AGUEVar0, UDPLite, MPLS, EthernetCTP, PFLog, LinuxSLL, LinuxSLL2, PktapV1, Prism, PPP, FDDI

Note on exposure: gopacket.NewPacket with default options and DecodingLayerParser with IgnorePanic: false both recover, so those callers previously saw a decode error rather than a crash. A process crash landed on a direct DecodeFromBytes call, IgnorePanic: true, or SkipDecodeRecovery: true.

The GHSA-cxrr decoders split by trust model: the first five carry remote-attacker-controlled bytes, while PFLog, LinuxSLL/SLL2, PktapV1, Prism, PPP and FDDI are written by the host's own capture stack, making a crafted pcap from an untrusted source the realistic input rather than a packet off the wire.

Other fixes

• Protocol decoder length checks across arp, ipsec, pppoe, rudp, sctp and vrrp (#163)
• MDNS name serialization fix (#157)
• Regression tests for DNS decodeSVCB truncated SvcParams, and for every advisory above

Credits

CVE-2026-65819 reported by @​mosajjal (Fenko). The three GHSAs above reported by zx (Jace) (@​manus-use) and validated by @​FoxhoundAI.

Commits

• 2220269 test(layers): add regression tests for the decoder panic advisories
• de853ae layers:various: add length checks to twelve link and tunnel decoders
• 888f295 layers/sip: reject a header continuation line before any header
• 7cfad9e layers/tcp: bound MPTCP option length before subtype dispatch
• f87e843 build(deps): bump actions/setup-go from 6 to 7 (#164)
• 1c51bb8 test(dns): add regression test for decodeSVCB truncated-SvcParams panic
• f8b2b11 fix MDNS name serialization (#157)
• b772f56 layers:various: add protocol decoder length checks (#163)
• 210f25f Merge commit from fork
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)