dancefinder/dancefetcher
5
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Activity
214 Commits 9 Branches 0 Tags
92e42f4e6166b2093bbc873eeaf1d4548078dc84
Commit Graph

30 Commits

Author SHA1 Message Date
renovate 92e42f4e61 chore(deps): update go toolchain directive to v1.26.4 [security] (#175)
dancefetcher / build (push) Successful in 11m53s
Details
dancefetcher / deploy-prod (push) Successful in 54s
Details 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [go](https://go.dev/) ([source](https://github.com/golang/go)) | toolchain | patch | `1.26.3` → `1.26.4` |

---

### Inefficient candidate hostname parsing in crypto/x509
[CVE-2026-27145](https://nvd.nist.gov/vuln/detail/CVE-2026-27145) / [GO-2026-5037](https://pkg.go.dev/vuln/GO-2026-5037)

<details>
<summary>More information</summary>

#### Details
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname.

With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

#### Severity
Unknown

#### References
- [https://go.dev/cl/783621](https://go.dev/cl/783621)
- [https://go.dev/issue/79694](https://go.dev/issue/79694)
- [https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw](https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw)

This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5037) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>

---

### Quadratic complexity in WordDecoder.DecodeHeader in mime
[CVE-2026-42504](https://nvd.nist.gov/vuln/detail/CVE-2026-42504) / [GO-2026-5038](https://pkg.go.dev/vuln/GO-2026-5038)

<details>
<summary>More information</summary>

#### Details
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79217](https://go.dev/issue/79217)
- [https://go.dev/cl/774481](https://go.dev/cl/774481)
- [https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw](https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw)

This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5038) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>

---

### Arbitrary inputs are included in errors without any escaping in net/textproto
[CVE-2026-42507](https://nvd.nist.gov/vuln/detail/CVE-2026-42507) / [GO-2026-5039](https://pkg.go.dev/vuln/GO-2026-5039)

<details>
<summary>More information</summary>

#### Details
When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79346](https://go.dev/issue/79346)
- [https://go.dev/cl/777060](https://go.dev/cl/777060)
- [https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw](https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw)

This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5039) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - ""
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIwMi4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=-->

Reviewed-on: #175
Co-authored-by: Renovate Bot <renovate@unbound.se>
Co-committed-by: Renovate Bot <renovate@unbound.se>
 2026-06-03 05:40:03 +00:00
renovate 01380bfb07 chore(deps): update go toolchain directive to v1.26.3 (#172)
dancefetcher / build (push) Successful in 7m54s
Details
dancefetcher / deploy-prod (push) Successful in 47s
Details
2026-05-10 00:15:09 +00:00
renovate bea8a99de5 chore(deps): update dependency go to v1.26.2 (#169)
dancefetcher / build (push) Successful in 20m50s
Details
dancefetcher / deploy-prod (push) Successful in 1m6s
Details
2026-04-10 01:22:50 +00:00
renovate 45e6ef8802 chore(deps): update dependency go to v1.26.1 (#165)
dancefetcher / build (push) Successful in 5m42s
Details
dancefetcher / deploy-prod (push) Successful in 1m20s
Details
2026-03-06 01:16:31 +00:00
renovate 962d93784b chore(deps): update dependency go to v1.26.0 (#160)
dancefetcher / build (push) Successful in 6m24s
Details
dancefetcher / deploy-prod (push) Successful in 44s
Details
2026-02-10 20:27:15 +00:00
renovate b9f0dbe97e chore(deps): update dependency go to v1.25.7 (#158)
dancefetcher / build (push) Successful in 15m4s
Details
dancefetcher / deploy-prod (push) Successful in 43s
Details
2026-02-04 16:24:16 +00:00
renovate dd2633fb44 chore(deps): update dependency go to v1.25.6 (#155)
dancefetcher / build (push) Successful in 12m16s
Details
dancefetcher / deploy-prod (push) Successful in 37s
Details
2026-01-15 20:25:32 +00:00
Renovate 8650ba21b8 fix(deps): update module github.com/gocolly/colly/v2 to v2.3.0 2025-12-04 09:02:03 +00:00
Renovate 464173a4e7 chore(deps): update dependency go to v1.25.5 2025-12-02 17:16:28 +00:00
Renovate 3a0fe4e6d2 chore(deps): update dependency go to v1.25.4 2025-11-05 20:15:22 +00:00
Renovate c9e7040438 chore(deps): update dependency go to v1.25.3 2025-10-13 22:02:12 +00:00
Renovate 44af60df8b chore(deps): update dependency go to v1.25.2 2025-10-07 19:15:18 +00:00
Renovate 857a4e5335 chore(deps): update dependency go to v1.25.1 2025-09-03 19:01:53 +00:00
Renovate 8572bd7ddb chore(deps): update dependency go to v1.25.0 2025-08-12 21:02:29 +00:00
Renovate a8d864fbc5 chore(deps): update dependency go to v1.24.6 2025-08-06 19:02:41 +00:00
Renovate c11bcfb0ea chore(deps): update dependency go to v1.24.5 2025-07-08 17:58:46 +00:00
Renovate bbb43fe121 chore(deps): update dependency go to v1.24.4 2025-06-05 18:57:56 +00:00
Renovate 37a8ec6aea chore(deps): update dependency go to v1.24.3 2025-05-06 18:59:31 +00:00
Renovate f8cfb735ab chore(deps): update dependency go to v1.24.2 2025-04-01 16:59:48 +00:00
Renovate b18143f7a0 fix(deps): update module github.com/gocolly/colly/v2 to v2.2.0 2025-03-27 11:58:07 +00:00
argoyle 58f83d5a29 Chore(deps): bump github.com/goodsign/monday from 1.0.1 to 1.0.2 
Bumps [github.com/goodsign/monday](https://github.com/goodsign/monday) from 1.0.1 to 1.0.2.
- [Release notes](https://github.com/goodsign/monday/releases)
- [Commits](https://github.com/goodsign/monday/compare/v1.0.1...v1.0.2)
 2024-01-07 05:06:30 +00:00
argoyle b15f5186aa Chore(deps): bump github.com/alecthomas/kingpin/v2 from 2.3.2 to 2.4.0 
Bumps [github.com/alecthomas/kingpin/v2](https://github.com/alecthomas/kingpin) from 2.3.2 to 2.4.0.
- [Release notes](https://github.com/alecthomas/kingpin/releases)
- [Commits](https://github.com/alecthomas/kingpin/compare/v2.3.2...v2.4.0)
 2023-11-16 05:06:19 +00:00
argoyle 7f154b16b6 Chore(deps): [security] bump golang.org/x/net from 0.7.0 to 0.17.0 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.7.0 to 0.17.0. **This update includes security fixes.**
- [Commits](https://github.com/golang/net/compare/v0.7.0...v0.17.0)
 2023-10-12 05:06:27 +00:00
argoyle b52b0b88b6 Chore(deps): [security] bump github.com/antchfx/xmlquery 
Bumps [github.com/antchfx/xmlquery](https://github.com/antchfx/xmlquery) from 1.2.4 to 1.3.1. **This update includes a security fix.**
- [Release notes](https://github.com/antchfx/xmlquery/releases)
- [Commits](https://github.com/antchfx/xmlquery/compare/v1.2.4...v1.3.1)
 2023-05-23 18:07:59 +00:00
argoyle 0b1433173f Chore(deps): [security] bump golang.org/x/net 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.0.0-20200602114024-627f9648deb9 to 0.7.0. **This update includes security fixes.**
- [Commits](https://github.com/golang/net/commits/v0.7.0)
 2023-05-23 17:42:08 +00:00
argoyle b41d2ddc6f Chore(deps): [security] bump golang.org/x/text from 0.3.2 to 0.3.8 
Bumps [golang.org/x/text](https://github.com/golang/text) from 0.3.2 to 0.3.8. **This update includes security fixes.**
- [Release notes](https://github.com/golang/text/releases)
- [Commits](https://github.com/golang/text/compare/v0.3.2...v0.3.8)
 2023-05-23 17:35:13 +00:00
argoyle 95575b2891 ci: update kingpin dependency 2023-05-23 19:29:05 +02:00
argoyle 0a7f314dc0 Chore(deps): bump github.com/goodsign/monday 
Bumps [github.com/goodsign/monday](https://github.com/goodsign/monday) from 0.0.0-20191222141057-7672e75c119d to 1.0.1.
- [Release notes](https://github.com/goodsign/monday/releases)
- [Commits](https://github.com/goodsign/monday/commits/v1.0.1)
 2023-05-08 18:51:49 +00:00
argoyle 9461e2b2ba chore(deps): bump github.com/gocolly/colly/v2 from 2.0.1 to 2.1.0 
Bumps [github.com/gocolly/colly/v2](https://github.com/gocolly/colly) from 2.0.1 to 2.1.0.
- [Release notes](https://github.com/gocolly/colly/releases)
- [Changelog](https://github.com/gocolly/colly/blob/master/CHANGELOG.md)
- [Commits](https://github.com/gocolly/colly/compare/v2.0.1...v2.1.0)
 2021-11-05 06:45:55 +00:00
argoyle 3aaa69175c feat: initial version 2020-02-07 21:02:17 +01:00