Repository navigation
fix(deps): bump github.com/yuin/goldmark to v1.7.17 - #220
Merged
Mzack9999 merged 1 commit intoNov 9, 2026
Merged
Conversation
dwisiswant0
force-pushed
the
dwisiswant0/fix/deps/bump-github-com-ulikunitz-xz-to-v0-5-15
branch
from
November 9, 2026 01:14
b67cb30 to
1b6ba4d
Compare
dwisiswant0
changed the title
govulncheck reports GO-2026-5320, cross-site scripting in the goldmark HTML renderer, as reachable from runner.GetUpdateCallback through the update check in github.com/projectdiscovery/utils, which renders release notes with github.com/charmbracelet/glamour. dev pulls in github.com/yuin/goldmark v1.7.4 that way. Bump goldmark to v1.7.17, which fixes it. The go directive stays at 1.26.10, and no other requirement changes. The findings in #219 don't apply to dev. Its dependency graph no longer includes github.com/ulikunitz/xz, github.com/mholt/archiver, or github.com/nwaples/rardecode, so govulncheck reports none of GO-2025-3922, GO-2020-0016, GO-2025-4020, GO-2025-3605, or GO-2024-2698 there. It still lists advisories in golang.org/x/net v0.58.0 and golang.org/x/crypto v0.55.0 whose vulnerable code isn't called. Fixes: #219 Signed-off-by: Dwi Siswanto <git@dw1.io>
dwisiswant0
force-pushed
the
dwisiswant0/fix/deps/bump-github-com-ulikunitz-xz-to-v0-5-15
branch
from
November 9, 2026 01:40
1b6ba4d to
9883679
Compare
Mzack9999
approved these changes
Nov 9, 2026
Mzack9999
deleted the
dwisiswant0/fix/deps/bump-github-com-ulikunitz-xz-to-v0-5-15
branch
November 9, 2026 10:27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
govulncheck reports GO-2026-5320, cross-site scripting in the goldmark
HTML renderer, as reachable from runner.GetUpdateCallback through the
update check in github.com/projectdiscovery/utils, which renders
release notes with github.com/charmbracelet/glamour. dev pulls in
github.com/yuin/goldmark v1.7.4 that way.
Bump goldmark to v1.7.17, which fixes it. The go directive stays at
1.26.10, and no other requirement changes.
The findings in #219 don't apply to dev. Its dependency graph no
longer includes github.com/ulikunitz/xz, github.com/mholt/archiver, or
github.com/nwaples/rardecode, so govulncheck reports none of
GO-2025-3922, GO-2020-0016, GO-2025-4020, GO-2025-3605, or
GO-2024-2698 there. It still lists advisories in golang.org/x/net
v0.58.0 and golang.org/x/crypto v0.55.0 whose vulnerable code isn't
called.
Fixes: #219