Hi,
After researching a bit, I found that google.golang.org/api@v0.44.0 is cascading to using at least 3 different versions of github.com/yuin/goldmark v1.1.x which leads to this Nexus IQ vulnerability (yuin/goldmark#145)
yuin states that version 1.2.x of goldmark is fixing the issue. And Google has released version 0.50.0 (https://pkg.go.dev/google.golang.org/api)
which we hope uses the latest release of goldmark.
Hope this helps,
Thanks for the amazing work, we all benefit from it!