From 988367965b31dab31f32fe151244003a7d188ae1 Mon Sep 17 00:00:00 2001 From: Dwi Siswanto Date: Mon, 9 Nov 2026 01:14:46 +0000 Subject: [PATCH] fix(deps): bump github.com/yuin/goldmark to v1.7.17 govulncheck reports GO-2026-5320, cross-site scripting in the goldmark HTML renderer, as reachable from runner.GetUpdateCallback through the update check in github.com/projectdiscovery/utils, which renders release notes with github.com/charmbracelet/glamour. dev pulls in github.com/yuin/goldmark v1.7.4 that way. Bump goldmark to v1.7.17, which fixes it. The go directive stays at 1.26.10, and no other requirement changes. The findings in #219 don't apply to dev. Its dependency graph no longer includes github.com/ulikunitz/xz, github.com/mholt/archiver, or github.com/nwaples/rardecode, so govulncheck reports none of GO-2025-3922, GO-2020-0016, GO-2025-4020, GO-2025-3605, or GO-2024-2698 there. It still lists advisories in golang.org/x/net v0.58.0 and golang.org/x/crypto v0.55.0 whose vulnerable code isn't called. Fixes: #219 Signed-off-by: Dwi Siswanto --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 1d8c924..b9972f8 100644 --- a/go.mod +++ b/go.mod @@ -61,7 +61,7 @@ require ( github.com/tidwall/pretty v1.2.1 // indirect github.com/tklauser/go-sysconf v0.3.16 // indirect github.com/tklauser/numcpus v0.11.0 // indirect - github.com/yuin/goldmark v1.7.4 // indirect + github.com/yuin/goldmark v1.7.17 // indirect github.com/yuin/goldmark-emoji v1.0.3 // indirect github.com/yusufpapurcu/wmi v1.2.4 // indirect github.com/zcalusic/sysinfo v1.0.2 // indirect diff --git a/go.sum b/go.sum index ff08f41..cb6eabd 100644 --- a/go.sum +++ b/go.sum @@ -139,8 +139,8 @@ github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7 github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw= github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ= github.com/yuin/goldmark v1.7.1/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E= -github.com/yuin/goldmark v1.7.4 h1:BDXOHExt+A7gwPCJgPIIq7ENvceR7we7rOS9TNoLZeg= -github.com/yuin/goldmark v1.7.4/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E= +github.com/yuin/goldmark v1.7.17 h1:p36OVWwRb246iHxA/U4p8OPEpOTESm4n+g+8t0EE5uA= +github.com/yuin/goldmark v1.7.17/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg= github.com/yuin/goldmark-emoji v1.0.3 h1:aLRkLHOuBR2czCY4R8olwMjID+tENfhyFDMCRhbIQY4= github.com/yuin/goldmark-emoji v1.0.3/go.mod h1:tTkZEbwu5wkPmgTcitqddVxY9osFZiavD+r4AzQrh1U= github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=