mirror of
https://github.com/tiennm99/thptqg.git
synced 2026-08-14 09:23:27 +00:00
tiennm99
9710524ced
govulncheck fails the pipeline on GO-2026-6088: encoding/xml decodes without a recursion depth guard, reachable from excelize's OpenFile, GetRows and GetSheetList and from buildCRFixups directly. The parser is fed spreadsheets downloaded over the network by the crawler, so the path is real. Raising the go directive to 1.26.6 in all three modules puts the fix below every build rather than leaving it to whichever patch release the runner happens to install. govulncheck is clean on all three modules, and every suite passes on the new toolchain — including the reader fidelity sweep, which matters here because buildCRFixups depends on how encoding/xml normalises line endings.
18 lines
534 B
AMPL
18 lines
534 B
AMPL
module github.com/tiennm99/thptqg/assembler
|
|
|
|
go 1.26.6
|
|
|
|
require modernc.org/sqlite v1.56.0
|
|
|
|
require (
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/mattn/go-isatty v0.0.24 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
golang.org/x/sys v0.47.0 // indirect
|
|
modernc.org/libc v1.74.4 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
)
|