[closer-claudio]

🎯 Why: the pre-release upstream catch-up @apostasie asked for. Upstream ulikunitz/xz has six commits the fork lacks (v0.5.16, v0.5.17); one is a fix the fork needs.

🛠️ What: lzma.ByteReader's ReadByte retries (0, nil) reads, up to 100, then returns io.ErrNoProgress; a regression test at the xz level, a bound test in lzma, and a CHANGELOG entry. UPSTREAM.md records the fork point and where each upstream commit since then went, in the format every forkcloser fork now uses.

🧪 How:

1. lzma: retry (0, nil) reads in ByteReader instead of failing. V: TestReaderZeroNilReads (xz.NewReader over a reader returning (0, nil) before every read) fails on main with the old error and passes with the fix; TestByteReaderNoProgress fails on main and passes. The lzma-level form of upstream's test passes on main too (the fork already puts plain input behind bufio), so the test lives where the fork failed. just lint (every lane but links) and just test green locally. U: links (sandbox).
2. UPSTREAM.md: record the fork point and every upstream commit since. V: the six upstream commits after b371040, per GitHub's compare of main against ulikunitz:master, each sit in exactly one table, and the Here links resolve. Green locally as above.

📝 Upstream's other five commits need nothing here. internal/term's non-terminal fallback is already in the fork (its narrower build tags are the fork's). The rest is upstream's own release bookkeeping: version strings, relnotes and TODO.md.

[closer-claudio]

✅ Ready at e1bbb78: upstream v0.5.17's fix ported, lzma.ByteReader retries (0, nil) reads, which io.Reader permits, up to 100 times before returning io.ErrNoProgress, instead of failing xz.NewReader with "no data"; 12/12 checks green including the gate.

🔍 Verified last: diff read at e1bbb78, four files. ReadByte returns the byte on any progress, the reader's error when it has one, and io.ErrNoProgress after the bound, the stdlib's convention for this case; errNoData and the errors import go with the old path. TestReaderZeroNilReads drives xz.NewReader over a reader that returns (0, nil) before every read and checks the round trip; TestByteReaderNoProgress checks the bound. The CHANGELOG entry credits upstream. Upstream's other five commits were not re-read here; the body says they need nothing. Body in #217's shape.

[closer-claudio]

✅ Ready at 9aeb1da: the reviewed port (now 4c88e4f, same code, its message naming upstream by commit URL as limen#240 asks) plus UPSTREAM.md, which records the fork point, the reviewed-through commit, and every upstream commit since in exactly one table; 12/12 checks green including the gate.

🔍 Verified last: ulikunitz/xz's history after b371040 is exactly the six commits listed (82b346c, ba40d80, 024f909, 591e09e, f5969eb, 6ead826), each in one table, and 6ead826 is upstream's head; the header now says which date is the commit's and which the review's. The port of 591e09e, 4c88e4f, carries the code reviewed at e1bbb78, and UPSTREAM.md's Here link follows it. Body in #217's shape.