Skip to content

github.com/yuin/goldmark v1.1.x is considered vulnerable #20

@martinmpoirier

Description

@martinmpoirier

Hi,
After researching a bit, I found that google.golang.org/api@v0.44.0 is cascading to using at least 3 different versions of github.com/yuin/goldmark v1.1.x which leads to this Nexus IQ vulnerability (yuin/goldmark#145)

yuin states that version 1.2.x of goldmark is fixing the issue. And Google has released version 0.50.0 (https://pkg.go.dev/google.golang.org/api)
which we hope uses the latest release of goldmark.

Hope this helps,

Thanks for the amazing work, we all benefit from it!

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions