[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/antchfx/xpath	v1.3.5 → v1.3.6

---

XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustion

CVE-2026-32287 / GHSA-65xw-vw82-r86x

More information

Details

Boolean expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-32287
• https://github.com/antchfx/xpath/issues/121
• https://github.com/golang/vulndb/issues/4526
• https://github.com/antchfx/xpath/commit/afd4762cc342af56345a3fb4002a59281fcab494
• https://pkg.go.dev/vuln/GO-2026-4526
• https://securityinfinity.com/research/infinite-loop-dos-in-antchfx-xpath-logicalquery-select
• https://github.com/advisories/GHSA-65xw-vw82-r86x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

antchfx/xpath (github.com/antchfx/xpath)

v1.3.6

Compare Source

Merged PR:

• #​120(@mislav) - Fix last() predicate on grouped expr.

Fixed:

• #​121

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: macewindu/go.sum

go: downloading github.com/gin-gonic/gin v1.12.0
go: downloading github.com/gocolly/colly/v2 v2.3.0
go: downloading github.com/heroku/x v0.7.0
go: downloading github.com/gin-contrib/sse v1.1.0
go: downloading github.com/mattn/go-isatty v0.0.20
go: downloading github.com/quic-go/quic-go v0.59.0
go: downloading golang.org/x/net v0.55.0
go: downloading github.com/PuerkitoBio/goquery v1.11.0
go: downloading github.com/antchfx/htmlquery v1.3.5
go: downloading github.com/antchfx/xmlquery v1.5.0
go: downloading github.com/gobwas/glob v0.2.4-0.20180402141543-f00a7392b439
go: downloading github.com/kennygrant/sanitize v1.2.4
go: downloading github.com/nlnwa/whatwg-url v0.6.2
go: downloading github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d
go: downloading github.com/temoto/robotstxt v1.1.2
go: downloading google.golang.org/appengine v1.6.8
go: downloading github.com/go-playground/validator/v10 v10.30.1
go: downloading github.com/goccy/go-yaml v1.19.2
go: downloading github.com/pelletier/go-toml/v2 v2.2.4
go: downloading github.com/ugorji/go/codec v1.3.1
go: downloading go.mongodb.org/mongo-driver/v2 v2.5.0
go: downloading google.golang.org/protobuf v1.36.11
go: downloading github.com/bytedance/sonic v1.15.0
go: downloading github.com/goccy/go-json v0.10.5
go: downloading github.com/json-iterator/go v1.1.12
go: downloading golang.org/x/sys v0.45.0
go: downloading github.com/quic-go/qpack v0.6.0
go: downloading github.com/andybalholm/cascadia v1.3.3
go: downloading github.com/antchfx/xpath v1.3.6
go: downloading github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8
go: downloading github.com/bits-and-blooms/bitset v1.24.4
go: downloading golang.org/x/text v0.37.0
go: downloading github.com/golang/protobuf v1.5.4
go: downloading github.com/gabriel-vasile/mimetype v1.4.12
go: downloading github.com/go-playground/universal-translator v0.18.1
go: downloading github.com/leodido/go-urn v1.4.0
go: downloading golang.org/x/crypto v0.52.0
go: downloading github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
go: downloading github.com/modern-go/reflect2 v1.0.2
go: downloading github.com/go-playground/locales v0.14.1
go: downloading github.com/bytedance/gopkg v0.1.3
go: downloading github.com/cloudwego/base64x v0.1.6
go: downloading golang.org/x/arch v0.22.0
go: downloading github.com/klauspost/cpuid/v2 v2.3.0
go: downloading github.com/bytedance/sonic/loader v0.5.0
go: downloading github.com/twitchyliquid64/golang-asm v0.15.1
go: module . listed in go.work file requires go >= 1.25.0, but go.work lists go 1.24.0; to download and use go 1.25.0:
	go work use
go: module ../pdfstar listed in go.work file requires go >= 1.25.0, but go.work lists go 1.24.0; to download and use go 1.25.0:
	go work use