Context
Enabling Dependabot security alerts surfaced 23 advisories at once (9 high). All of them traced to four packages, none of them direct dependencies:
| Package |
Alerts |
Notes |
golang.org/x/net |
13 |
was pinned at 0.0.0-20190813141303 |
golang.org/x/image |
6 |
was pinned at 0.0.0-20191206065243 |
github.com/gomarkdown/markdown |
3 |
incl. CVE-2026-40890, OOB read in SmartypantsRenderer |
github.com/disintegration/imaging |
1 |
low, no patched release exists |
Fixed in 8cfbc14 by upgrading the three patchable ones directly in go.mod. 22 of 23 alerts cleared.
Root cause
github.com/MichaelMure/go-term-markdown v0.1.4 is unmaintained and its go.mod pins those versions. Our go.mod now overrides the pins transitively, which works, but the override is manual.
Why this will recur
Dependabot could not fix gomarkdown on its own — it reported security_update_not_found because the package is an indirect dependency. A plain go get github.com/gomarkdown/markdown@<patched> resolved it fine. So each future advisory in this subtree needs:
nix develop -c go get <pkg>@<patched-version>- Recompute
vendorHash in flake.nix: set it to pkgs.lib.fakeHash, run nix build, copy the got: hash.
- Verify:
nix develop -c go test ./... and nix build.
The nix build CI job (added in 5167be8) catches a stale vendorHash, so step 2 cannot be silently skipped.
Options, if this becomes tiresome
- Keep overriding pins as advisories appear (status quo, low effort per event).
- Fork or vendor
go-term-markdown with a refreshed go.mod.
- Replace it with a maintained renderer (e.g.
charmbracelet/glamour, already adjacent to the bubbletea/lipgloss stack in use). Largest change, but it retires this whole class of alert.
No action needed right now — CVE-2026-40890 and the rest are patched. Filed so the pattern is on record.
Context
Enabling Dependabot security alerts surfaced 23 advisories at once (9 high). All of them traced to four packages, none of them direct dependencies:
golang.org/x/net0.0.0-20190813141303golang.org/x/image0.0.0-20191206065243github.com/gomarkdown/markdownSmartypantsRenderergithub.com/disintegration/imagingFixed in 8cfbc14 by upgrading the three patchable ones directly in
go.mod. 22 of 23 alerts cleared.Root cause
github.com/MichaelMure/go-term-markdown v0.1.4is unmaintained and itsgo.modpins those versions. Ourgo.modnow overrides the pins transitively, which works, but the override is manual.Why this will recur
Dependabot could not fix
gomarkdownon its own — it reportedsecurity_update_not_foundbecause the package is an indirect dependency. A plaingo get github.com/gomarkdown/markdown@<patched>resolved it fine. So each future advisory in this subtree needs:nix develop -c go get <pkg>@<patched-version>vendorHashinflake.nix: set it topkgs.lib.fakeHash, runnix build, copy thegot:hash.nix develop -c go test ./...andnix build.The
nix buildCI job (added in 5167be8) catches a stalevendorHash, so step 2 cannot be silently skipped.Options, if this becomes tiresome
go-term-markdownwith a refreshedgo.mod.charmbracelet/glamour, already adjacent to the bubbletea/lipgloss stack in use). Largest change, but it retires this whole class of alert.No action needed right now — CVE-2026-40890 and the rest are patched. Filed so the pattern is on record.