mirror of
https://github.com/tiennm99/thptqg.git
synced 2026-08-25 07:27:19 +00:00
tiennm99
9710524ced
govulncheck fails the pipeline on GO-2026-6088: encoding/xml decodes without a recursion depth guard, reachable from excelize's OpenFile, GetRows and GetSheetList and from buildCRFixups directly. The parser is fed spreadsheets downloaded over the network by the crawler, so the path is real. Raising the go directive to 1.26.6 in all three modules puts the fix below every build rather than leaving it to whichever patch release the runner happens to install. govulncheck is clean on all three modules, and every suite passes on the new toolchain — including the reader fidelity sweep, which matters here because buildCRFixups depends on how encoding/xml normalises line endings.
31 lines
1.0 KiB
AMPL
31 lines
1.0 KiB
AMPL
module github.com/tiennm99/thptqg/parser
|
|
|
|
go 1.26.6
|
|
|
|
require (
|
|
github.com/pbnjay/grate v0.0.0-20231006022435-3f8e65d74a14
|
|
github.com/xuri/excelize/v2 v2.11.0
|
|
golang.org/x/text v0.41.0
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
modernc.org/sqlite v1.56.0
|
|
)
|
|
|
|
require (
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/mattn/go-isatty v0.0.24 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/richardlehane/mscfb v1.0.7 // indirect
|
|
github.com/richardlehane/msoleps v1.0.6 // indirect
|
|
github.com/tiendc/go-deepcopy v1.7.2 // indirect
|
|
github.com/xuri/efp v0.0.1 // indirect
|
|
github.com/xuri/nfp v0.0.2-0.20250530014748-2ddeb826f9a9 // indirect
|
|
golang.org/x/crypto v0.53.0 // indirect
|
|
golang.org/x/net v0.56.0 // indirect
|
|
golang.org/x/sys v0.47.0 // indirect
|
|
modernc.org/libc v1.74.4 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
)
|