[dwisiswant0]

govulncheck reports GO-2026-5320 (CVE-2026-5160, GHSA-c97m-vxhj-p7j6),
a cross-site scripting flaw in the HTML renderer of
github.com/yuin/goldmark v1.7.13, as called from urlfinder. The update
check in internal/runner reaches the renderer through
projectdiscovery/utils/update and charmbracelet/glamour.

Raise the indirect requirement to v1.7.17, the first fixed release.
No other requirement changes, and the go line stays at 1.26.10.

Fixes: #150

Summary by CodeRabbit

• Chores
  • This update contains no user-visible feature or workflow changes. Product behavior remains unchanged; the changes are limited to internal maintenance and do not affect how the product is used.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The indirect github.com/yuin/goldmark dependency is upgraded from v1.7.13 to v1.7.17.

Changes

Goldmark dependency update

Layer / File(s)	Summary
Update Goldmark version go.mod	The declared indirect Goldmark version changes from v1.7.13 to v1.7.17.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: dogancanbakir

Merge Risk: Minimal · up to 31e79

The update targets the reported vulnerability. No merge-blocking issue is identified; run the usual checks before merging.

Pre-merge checks: 4 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Linked Issues check		Issue #150 requires that govulncheck report no vulnerabilities in code that urlfinder calls. It reports GO-2026-5320 in github.com/yuin/goldmark v1.7.13, fixed in v1.7.17. The PR raises the indirect g…	Provide reviewable evidence that go.sum contains the module and go.mod hash entries for github.com/yuin/goldmark v1.7.17 and that the module graph resolves at the reviewed head. Alternatively, provide a govulncheck run at the reviewed head …

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title names the change: bumping the indirect dependency github.com/yuin/goldmark to v1.7.17. The raw summary confirms that go.mod changes only this requirement, from v1.7.13 to v1.7.17. The object…
Out of Scope Changes check		The only reviewable change is the indirect requirement bump of github.com/yuin/goldmark from v1.7.13 to v1.7.17 in go.mod (+1/-1). This change directly implements the fix named in issue #150 and in th…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…

Full details: Title check

Explanation

The title names the change: bumping the indirect dependency github.com/yuin/goldmark to v1.7.17. The raw summary confirms that go.mod changes only this requirement, from v1.7.13 to v1.7.17. The objectives link the bump to issue #150, which reports GO-2026-5320 in v1.7.13 with v1.7.17 as the fixed release. The title is specific and matches the changeset. The 'fix(deps)' prefix fits a security fix delivered as a dependency update.

Full details: Out of Scope Changes check

Explanation

The only reviewable change is the indirect requirement bump of github.com/yuin/goldmark from v1.7.13 to v1.7.17 in go.mod (+1/-1). This change directly implements the fix named in issue #150 and in the PR description. No unrelated code, configuration, or dependency change appears in the reviewable summary. The excluded go.sum file is expected to hold only the checksum entries that accompany this same dependency bump. Its contents were not inspected, per the ignored_files exclusion.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Linked Issues check

Explanation

Issue #150 requires that govulncheck report no vulnerabilities in code that urlfinder calls. It reports GO-2026-5320 in github.com/yuin/goldmark v1.7.13, fixed in v1.7.17. The PR raises the indirect goldmark requirement in go.mod from v1.7.13 to v1.7.17 (+1/-1). This is the coding change that addresses the reported finding. The PR does not change any other requirement, and the go line stays at 1.26.10. The go.sum file is excluded from review by the ignored_files rule '!**/*.sum' (path: go.sum). The requirement depends on go.sum: the build and govulncheck analysis need go.sum entries for goldmark v1.7.17 to resolve the module. These entries cannot be reviewed, so the result cannot be confirmed from the reviewable evidence.

Resolution

Provide reviewable evidence that go.sum contains the module and go.mod hash entries for github.com/yuin/goldmark v1.7.17 and that the module graph resolves at the reviewed head. Alternatively, provide a govulncheck run at the reviewed head that reports no GO-2026-5320 finding. Either source would allow this assessment to be decided.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit hops beside the code,
Goldmark takes a newer road.
One small line now marks the change,
No carrots lost along the range.
The bunny rests beneath the moon.}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 40c301b7-eac7-484c-ac73-10df1a29c21d

Commits

Reviewing files that changed from the base of the PR and between e79d210 and 31e7923.

Files ignored due to path filters: 1

• go.sum is excluded by !**/*.sum

Files selected for processing: 1

• go.mod

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

[dwisiswant0]

@Mzack9999 could you review this when you have a moment? I couldn't add you as a reviewer because I don't have permission to request reviews on this repo.