From 9710524cedcfe3fefc3330d1dcfd74c80dcc52de Mon Sep 17 00:00:00 2001 From: tiennm99 Date: Fri, 14 Aug 2026 10:44:26 +0700 Subject: [PATCH] fix(ci): require the Go release that patches encoding/xml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit govulncheck fails the pipeline on GO-2026-6088: encoding/xml decodes without a recursion depth guard, reachable from excelize's OpenFile, GetRows and GetSheetList and from buildCRFixups directly. The parser is fed spreadsheets downloaded over the network by the crawler, so the path is real. Raising the go directive to 1.26.6 in all three modules puts the fix below every build rather than leaving it to whichever patch release the runner happens to install. govulncheck is clean on all three modules, and every suite passes on the new toolchain — including the reader fidelity sweep, which matters here because buildCRFixups depends on how encoding/xml normalises line endings. --- assembler/go.mod | 2 +- crawler/go.mod | 2 +- parser/go.mod | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/assembler/go.mod b/assembler/go.mod index 481fa27..867543a 100644 --- a/assembler/go.mod +++ b/assembler/go.mod @@ -1,6 +1,6 @@ module github.com/tiennm99/thptqg/assembler -go 1.26.5 +go 1.26.6 require modernc.org/sqlite v1.56.0 diff --git a/crawler/go.mod b/crawler/go.mod index 218e045..6d258e6 100644 --- a/crawler/go.mod +++ b/crawler/go.mod @@ -1,6 +1,6 @@ module github.com/tiennm99/thptqg/crawler -go 1.26.5 +go 1.26.6 require ( golang.org/x/net v0.58.0 diff --git a/parser/go.mod b/parser/go.mod index 7ad9076..dc64899 100644 --- a/parser/go.mod +++ b/parser/go.mod @@ -1,6 +1,6 @@ module github.com/tiennm99/thptqg/parser -go 1.26.5 +go 1.26.6 require ( github.com/pbnjay/grate v0.0.0-20231006022435-3f8e65d74a14