From 8f3a8eaf0887a666474cbb32bc9409511771019e Mon Sep 17 00:00:00 2001 From: tannevaled Date: Sun, 11 Oct 2026 18:45:35 +0200 Subject: [PATCH] build: bump github.com/go-webengine/engine to v0.5.6 Picks up three CSS-parser DoS fixes directly reachable through this proxy: calc() paren-nesting, :not()/:has()/:host() nesting, and :is()/:where()/:matches() combinatorial expansion all recursed or expanded on attacker-controlled nesting depth with no guard, reachable through a page's own CSS text alone -- no JS required. Co-Authored-By: Claude Sonnet 5 --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 8e8a5c9..7d06bf0 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/go-webengine/browserproxy go 1.27.2 require ( - github.com/go-webengine/engine v0.5.5 + github.com/go-webengine/engine v0.5.6 github.com/grpc-transports/websocket v0.4.0 google.golang.org/grpc v1.86.0-dev google.golang.org/protobuf v1.36.12 diff --git a/go.sum b/go.sum index ed0e8b8..1ce6588 100644 --- a/go.sum +++ b/go.sum @@ -34,8 +34,8 @@ github.com/go-opentype/opentype v0.13.1-0.20260927180318-ae6327b14eac h1:mpzfJQe github.com/go-opentype/opentype v0.13.1-0.20260927180318-ae6327b14eac/go.mod h1:UjZOTCMtkHheDPzfP0ZghDoQ7wIr6L72T/kuC9Ph1hw= github.com/go-sourcemap/sourcemap v2.1.4+incompatible h1:a+iTbH5auLKxaNwQFg0B+TCYl6lbukKPc7b5x0n1s6Q= github.com/go-sourcemap/sourcemap v2.1.4+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg= -github.com/go-webengine/engine v0.5.5 h1:OkMDpmvwdFRMYXKPS7Z4xbKl7akvgnI3wb6LV1MSPWM= -github.com/go-webengine/engine v0.5.5/go.mod h1:wSZ/zIfN7rvvWjHtzguSm+2AcUj7U6CrtKyJhIYjEFc= +github.com/go-webengine/engine v0.5.6 h1:ffjFkjtOrtj0UhBSzh//Ri37cg3ffXe25Jqw7bg5M+4= +github.com/go-webengine/engine v0.5.6/go.mod h1:wSZ/zIfN7rvvWjHtzguSm+2AcUj7U6CrtKyJhIYjEFc= github.com/go-webengine/esbuildsandbox v0.1.0 h1:1LdmX+0/yJarQlxZgJ7JIMu+Qy6P7Yzu4NFcX9+jFl8= github.com/go-webengine/esbuildsandbox v0.1.0/go.mod h1:za8oj1vbDfVkTpHLeRk7JfEQjmJfj+GHNq4R47681vQ= github.com/go-widgets/painter v0.13.0 h1:xBPbopFuYfeDVbQKUKviU6HnP2mAhztJ+BpasahlJLU=