Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update transitive markdown parser dependency (#12)
Using https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck to validate [the CVE] it notes that: ``` Scanning your code and 340 packages across 57 dependent modules for known vulnerabilities... === Informational === Found 1 vulnerability in packages that you import, but there are no call stacks leading to the use of this vulnerability. You may not need to take any action. See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck for details. Vulnerability #1: GO-2023-2074 Parser out-of-bounds read vulnerability caused by a malformed markdown input More info: https://pkg.go.dev/vuln/GO-2023-2074 Module: github.com/gomarkdown/markdown Found in: github.com/gomarkdown/[email protected] Fixed in: github.com/gomarkdown/[email protected] No vulnerabilities found. Share feedback at https://go.dev/s/govulncheck-feedback. ``` This means that for most users of this package, they are unaffected, but to make sure that we keep this package CVE free, we can update the transitive dependency. We cannot update Iris, which pulls in this dependency, due to it now requiring Go 1.21, and we do not want to require Go 1.21 for consumers. Co-authored-by: Paul Imbert <[email protected]> Co-authored-by: Jamie Tanna <[email protected]> [the CVE]: https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOMARKDOWNMARKDOWNPARSER-5916451
- Loading branch information
