fix: require patched Go version for CVE-2023-39318

[Akash3121]

What is the motivation?

CVE-2023-39318 / GO-2023-2041 is reported for this repository on the LFX Insights security page because  go.mod  declares Go 1.19.

The vulnerability affects Go’s  html/template  package. Versions before Go 1.20.8 can improperly handle HTML-like and hashbang comments inside  <script>  contexts, potentially causing incorrect contextual escaping and cross-site scripting under specific template conditions.

This is one of several LFX Insights findings. I will address other vulnerabilities in seperate focused pull requests.

What does this change do?

Updates the minimum Go version declared in  go.mod  to 1.20.8

Go 1.20.8 is the first patched release in the Go 1.20 series for CVE-2023-39318.

This is intentionally a minimal change. It does not update Hugo, Docsy, module dependencies, generated documentation, or lockfiles. The repository’s locked Hugo Extended 0.123.8 binary was built with Go 1.22.0 and already contains the corrected  html/template  implementation. This change aligns the module’s declared minimum Go version with a patched release and addresses the version-based LFX Insights finding.

What is your testing strategy?

• Running  go mod verify  successfully.
• Confirming the module reports  GoVersion=1.20.8 .
• Building the complete Hugo site successfully with the repository’s locked Hugo Extended 0.123.8 release.
• Confirming Hugo Extended 0.123.8 embeds Go 1.22.0, which is not affected by this vulnerability.
• Confirming that only  go.mod  changed.

Is this related to any issues?

• CVE-2023-39318
• GO-2023-2041: https://pkg.go.dev/vuln/GO-2023-2041

Have you read the Contributing Guidelines?

• I have read the Contributing Guidelines

[Akash3121]

Hi @mathieu, I'm planning to address vulnerabilities reported in LFX Insights. This is the first fix - please review it when you get a chance. Thanks!