kreativmonkey/goloom
1
0
Fork 0
Code Issues 3 Pull requests 10 Projects Releases Packages 1 Wiki Activity Actions

fix(deps): update module github.com/mmcdole/gofeed to v1.4.0 #126

Open
Renovate wants to merge 1 commit from renovate/github.com-mmcdole-gofeed-1.x into main
pull from: renovate/github.com-mmcdole-gofeed-1.x
merge into: kreativmonkey:main
Conversation 1 Commits 1 Files changed 2 +18 -5
Renovate commented 2026-07-11 06:02:41 +02:00
Collaborator
Copy link

This PR contains the following updates:

Package Change Age Confidence
github.com/mmcdole/gofeed v1.3.0 → v1.4.0 age confidence

Release Notes

mmcdole/gofeed (github.com/mmcdole/gofeed)

v1.4.0

Compare Source

This release focuses on bug fixes for malformed and off-spec feeds. Illegal XML control characters, unusual date formats, incorrectly typed JSON Feed fields, and unescaped ampersands in URLs could previously break a parse or silently drop content. The parser now handles these cases without failing the feed or losing the affected content.

It also fixes a lazy-initialization data race when a default-configured Parser is reused across goroutines (#​278). Three new options give callers more control over resource use: an HTTP response-size limit, optional retention of the original source feed, and a switch to disable RSS content-image scanning.

For RSS and Atom, the universal Parser.Parse method no longer holds two complete copies of the raw feed in memory during format detection. It examines the first 4 KiB, detects the format, and then parses directly from the reader. The returned Feed is still fully materialized, so this is not a streaming API. JSON Feed decoding still buffers the complete document.

Compatibility

  • Go 1.25 or newer is required. v1.4.0 updates golang.org/x/net from v0.4.0 to v0.56.0 to resolve 22 reachable vulnerabilities reported by govulncheck; that release and its golang.org/x/text dependency require Go 1.25.
  • ParseURL now applies a 30-second request timeout. ParseURLWithContext continues to use the caller's context.
  • Parse now examines only the first 4 KiB to detect the feed type. RSS and Atom roots must begin within that window. In v1.4.0, a JSON Feed whose complete document does not fit within the window is not detected by the universal Parser and returns ErrFeedTypeNotDetected.
  • The text returned by ErrFeedTypeNotDetected.Error() now begins with lowercase failed.
  • No exported v1 identifier was removed. Feed now has private storage for the original source feed, so external positional Feed{...} literals no longer compile; keyed literals are unaffected.

Added

  • Add Parser.MaxByteSize and ErrResponseTooLarge to limit response bodies fetched by ParseURL and ParseURLWithContext. (#​286)
  • Add Parser.KeepOriginalFeed and Feed.OriginalFeed() for access to the parsed *rss.Feed, *atom.Feed, or *json.Feed. (#​289)
  • Add DefaultRSSTranslator.DisableContentImageScan to skip the HTML image fallback on large feeds while preserving existing behavior by default. (#​330)

Parsing and translation fixes

  • Fix a data race when the same default-configured Parser is reused across goroutines. (#​278)
  • Limit universal-parser format detection to a 4 KiB lookahead, parse RSS and Atom directly from the reader without retaining two complete raw copies, and propagate reader I/O errors. (#​327)
  • Preserve parse errors when closing an HTTP response also returns an error.
  • Tolerate non-HTTP URI schemes and resolve RSS and Atom xml:base values without mutating sibling scope. (#​240, #​283, #​290)
  • Resolve every URI-bearing HTML attribute, including elements with multiple URI attributes. (#​323)
  • Preserve ordinary Atom content that merely looks like base64 and trim whitespace-prefixed Atom links. (#​238, #​283)
  • Promote embedded Atom author, date, content, summary, and category elements from RSS into universal fields. (#​292)
  • Correct RSS guid isPermaLink handling and replace the invalid itunes:subtitle feed-link fallback with atom:link. (#​283, #​322)
  • Handle illegal C0 XML controls, mixed CDATA content, namespace whitespace, <cloud> children, and non-content <encoded> elements without losing the feed. (#​284, #​295, #​317, #​318, #​325)
  • Continue entity decoding after bare ampersands without corrupting query parameters that resemble legacy HTML entities. (#​319, #​321)
  • Correct named timezone offsets and additional date layouts. (#​234, #​282, #​324)
  • Tolerate off-spec JSON Feed IDs, booleans, attachment sizes, and durations; use attachment byte size for Enclosure.Length; and reject out-of-range numeric sizes safely. (#​279, #​326)
  • Prevent sorting panics when items have nil parsed publication dates.

Dependencies and maintenance

  • Replace jsoniter with encoding/json. (#​280)
  • Migrate to github.com/mmcdole/goxpp/v2 v2.0.0. (#​329)
  • Replace goquery and cascadia with direct x/net/html traversal. (#​330)
  • Upgrade golang.org/x/net and golang.org/x/text for security, and upgrade testify and urfave/cli.
  • Expand regression fixtures and consolidate parser and translator control flow. (#​332, #​333)
  • Add contributor guidance and test-fixture conventions. (#​331)
  • Modernize GitHub Actions with stable/oldstable builds, race-enabled shuffled tests, Staticcheck, govulncheck, Codecov, and Dependabot; remove the defunct Travis configuration. (#​297, #​335)

Contributors

Contributions in this release came from @​mmcdole, @​TypicalAM, @​oprudkyi, and @​akfaew.

Full changelog: https://github.com/mmcdole/gofeed/compare/v1.3.0...v1.4.0

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/mmcdole/gofeed](https://github.com/mmcdole/gofeed) | `v1.3.0` → `v1.4.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fmmcdole%2fgofeed/v1.4.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fmmcdole%2fgofeed/v1.3.0/v1.4.0?slim=true) | --- ### Release Notes <details> <summary>mmcdole/gofeed (github.com/mmcdole/gofeed)</summary> ### [`v1.4.0`](https://github.com/mmcdole/gofeed/releases/tag/v1.4.0) [Compare Source](https://github.com/mmcdole/gofeed/compare/v1.3.0...v1.4.0) This release focuses on bug fixes for malformed and off-spec feeds. Illegal XML control characters, unusual date formats, incorrectly typed JSON Feed fields, and unescaped ampersands in URLs could previously break a parse or silently drop content. The parser now handles these cases without failing the feed or losing the affected content. It also fixes a lazy-initialization data race when a default-configured `Parser` is reused across goroutines ([#&#8203;278](https://github.com/mmcdole/gofeed/issues/278)). Three new options give callers more control over resource use: an HTTP response-size limit, optional retention of the original source feed, and a switch to disable RSS content-image scanning. For RSS and Atom, the universal `Parser.Parse` method no longer holds two complete copies of the raw feed in memory during format detection. It examines the first 4 KiB, detects the format, and then parses directly from the reader. The returned `Feed` is still fully materialized, so this is not a streaming API. JSON Feed decoding still buffers the complete document. #### Compatibility - Go 1.25 or newer is required. v1.4.0 updates `golang.org/x/net` from v0.4.0 to v0.56.0 to resolve 22 reachable vulnerabilities reported by `govulncheck`; that release and its `golang.org/x/text` dependency require Go 1.25. - `ParseURL` now applies a 30-second request timeout. `ParseURLWithContext` continues to use the caller's context. - `Parse` now examines only the first 4 KiB to detect the feed type. RSS and Atom roots must begin within that window. In v1.4.0, a JSON Feed whose complete document does not fit within the window is not detected by the universal `Parser` and returns `ErrFeedTypeNotDetected`. - The text returned by `ErrFeedTypeNotDetected.Error()` now begins with lowercase `failed`. - No exported v1 identifier was removed. `Feed` now has private storage for the original source feed, so external positional `Feed{...}` literals no longer compile; keyed literals are unaffected. #### Added - Add `Parser.MaxByteSize` and `ErrResponseTooLarge` to limit response bodies fetched by `ParseURL` and `ParseURLWithContext`. ([#&#8203;286](https://github.com/mmcdole/gofeed/issues/286)) - Add `Parser.KeepOriginalFeed` and `Feed.OriginalFeed()` for access to the parsed `*rss.Feed`, `*atom.Feed`, or `*json.Feed`. ([#&#8203;289](https://github.com/mmcdole/gofeed/issues/289)) - Add `DefaultRSSTranslator.DisableContentImageScan` to skip the HTML image fallback on large feeds while preserving existing behavior by default. ([#&#8203;330](https://github.com/mmcdole/gofeed/issues/330)) #### Parsing and translation fixes - Fix a data race when the same default-configured `Parser` is reused across goroutines. ([#&#8203;278](https://github.com/mmcdole/gofeed/issues/278)) - Limit universal-parser format detection to a 4 KiB lookahead, parse RSS and Atom directly from the reader without retaining two complete raw copies, and propagate reader I/O errors. ([#&#8203;327](https://github.com/mmcdole/gofeed/issues/327)) - Preserve parse errors when closing an HTTP response also returns an error. - Tolerate non-HTTP URI schemes and resolve RSS and Atom `xml:base` values without mutating sibling scope. ([#&#8203;240](https://github.com/mmcdole/gofeed/issues/240), [#&#8203;283](https://github.com/mmcdole/gofeed/issues/283), [#&#8203;290](https://github.com/mmcdole/gofeed/issues/290)) - Resolve every URI-bearing HTML attribute, including elements with multiple URI attributes. ([#&#8203;323](https://github.com/mmcdole/gofeed/issues/323)) - Preserve ordinary Atom content that merely looks like base64 and trim whitespace-prefixed Atom links. ([#&#8203;238](https://github.com/mmcdole/gofeed/issues/238), [#&#8203;283](https://github.com/mmcdole/gofeed/issues/283)) - Promote embedded Atom author, date, content, summary, and category elements from RSS into universal fields. ([#&#8203;292](https://github.com/mmcdole/gofeed/issues/292)) - Correct RSS `guid` `isPermaLink` handling and replace the invalid `itunes:subtitle` feed-link fallback with `atom:link`. ([#&#8203;283](https://github.com/mmcdole/gofeed/issues/283), [#&#8203;322](https://github.com/mmcdole/gofeed/issues/322)) - Handle illegal C0 XML controls, mixed CDATA content, namespace whitespace, `<cloud>` children, and non-content `<encoded>` elements without losing the feed. ([#&#8203;284](https://github.com/mmcdole/gofeed/issues/284), [#&#8203;295](https://github.com/mmcdole/gofeed/issues/295), [#&#8203;317](https://github.com/mmcdole/gofeed/issues/317), [#&#8203;318](https://github.com/mmcdole/gofeed/issues/318), [#&#8203;325](https://github.com/mmcdole/gofeed/issues/325)) - Continue entity decoding after bare ampersands without corrupting query parameters that resemble legacy HTML entities. ([#&#8203;319](https://github.com/mmcdole/gofeed/issues/319), [#&#8203;321](https://github.com/mmcdole/gofeed/issues/321)) - Correct named timezone offsets and additional date layouts. ([#&#8203;234](https://github.com/mmcdole/gofeed/issues/234), [#&#8203;282](https://github.com/mmcdole/gofeed/issues/282), [#&#8203;324](https://github.com/mmcdole/gofeed/issues/324)) - Tolerate off-spec JSON Feed IDs, booleans, attachment sizes, and durations; use attachment byte size for `Enclosure.Length`; and reject out-of-range numeric sizes safely. ([#&#8203;279](https://github.com/mmcdole/gofeed/issues/279), [#&#8203;326](https://github.com/mmcdole/gofeed/issues/326)) - Prevent sorting panics when items have nil parsed publication dates. #### Dependencies and maintenance - Replace `jsoniter` with `encoding/json`. ([#&#8203;280](https://github.com/mmcdole/gofeed/issues/280)) - Migrate to `github.com/mmcdole/goxpp/v2` v2.0.0. ([#&#8203;329](https://github.com/mmcdole/gofeed/issues/329)) - Replace `goquery` and `cascadia` with direct `x/net/html` traversal. ([#&#8203;330](https://github.com/mmcdole/gofeed/issues/330)) - Upgrade `golang.org/x/net` and `golang.org/x/text` for security, and upgrade `testify` and `urfave/cli`. - Expand regression fixtures and consolidate parser and translator control flow. ([#&#8203;332](https://github.com/mmcdole/gofeed/issues/332), [#&#8203;333](https://github.com/mmcdole/gofeed/issues/333)) - Add contributor guidance and test-fixture conventions. ([#&#8203;331](https://github.com/mmcdole/gofeed/issues/331)) - Modernize GitHub Actions with stable/oldstable builds, race-enabled shuffled tests, Staticcheck, govulncheck, Codecov, and Dependabot; remove the defunct Travis configuration. ([#&#8203;297](https://github.com/mmcdole/gofeed/issues/297), [#&#8203;335](https://github.com/mmcdole/gofeed/issues/335)) #### Contributors Contributions in this release came from [@&#8203;mmcdole](https://github.com/mmcdole), [@&#8203;TypicalAM](https://github.com/TypicalAM), [@&#8203;oprudkyi](https://github.com/oprudkyi), and [@&#8203;akfaew](https://github.com/akfaew). **Full changelog:** <https://github.com/mmcdole/gofeed/compare/v1.3.0...v1.4.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTYuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI1Ni4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
fix(deps): update module github.com/mmcdole/gofeed to v1.4.0
Some checks failed
CI/CD Workflow / Detect changed paths (pull_request) Successful in 13s
Details
CI/CD Workflow / Security (Secrets: gitleaks) (pull_request) Successful in 15s
Details
CI/CD Workflow / Test Frontend (Node.js) (pull_request) Has been skipped
Details
CI/CD Workflow / Test Postgres Store (pull_request) Failing after 1m48s
Details
CI/CD Workflow / Test Backend (Go) (pull_request) Successful in 4m10s
Details
CI/CD Workflow / Security (Go: govulncheck + gosec) (pull_request) Failing after 3m2s
Details
CI/CD Workflow / E2E (Playwright + Go) (pull_request) Successful in 8m53s
Details
CI/CD Workflow / Build and Publish Docker Image (pull_request) Has been skipped
Details
CI/CD Workflow / Trigger Dockhand Deployment (pull_request) Has been skipped
Details
e4e6948b46
Renovate commented 2026-07-11 06:02:42 +02:00
Author
Collaborator
Copy link

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 4 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.55.0 -> v0.56.0
golang.org/x/sync v0.20.0 -> v0.21.0
golang.org/x/sys v0.45.0 -> v0.46.0
golang.org/x/text v0.37.0 -> v0.38.0
### ℹ️ Artifact update notice ##### File name: go.mod In order to perform the update(s) described in the table above, Renovate ran the `go get` command, which resulted in the following additional change(s): - 4 additional dependencies were updated Details: | **Package** | **Change** | | :------------------ | :--------------------- | | `golang.org/x/net` | `v0.55.0` -> `v0.56.0` | | `golang.org/x/sync` | `v0.20.0` -> `v0.21.0` | | `golang.org/x/sys` | `v0.45.0` -> `v0.46.0` | | `golang.org/x/text` | `v0.37.0` -> `v0.38.0` |
Some checks failed
CI/CD Workflow / Detect changed paths (pull_request) Successful in 13s
Details
CI/CD Workflow / Security (Secrets: gitleaks) (pull_request) Successful in 15s
Details
CI/CD Workflow / Test Frontend (Node.js) (pull_request) Has been skipped
Details
CI/CD Workflow / Test Postgres Store (pull_request) Failing after 1m48s
Details
CI/CD Workflow / Test Backend (Go) (pull_request) Successful in 4m10s
Details
CI/CD Workflow / Security (Go: govulncheck + gosec) (pull_request) Failing after 3m2s
Details
CI/CD Workflow / E2E (Playwright + Go) (pull_request) Successful in 8m53s
Details
CI/CD Workflow / Build and Publish Docker Image (pull_request) Has been skipped
Details
CI/CD Workflow / Trigger Dockhand Deployment (pull_request) Has been skipped
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/github.com-mmcdole-gofeed-1.x:renovate/github.com-mmcdole-gofeed-1.x
git switch renovate/github.com-mmcdole-gofeed-1.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff renovate/github.com-mmcdole-gofeed-1.x
git switch renovate/github.com-mmcdole-gofeed-1.x
git rebase main
git switch main
git merge --ff-only renovate/github.com-mmcdole-gofeed-1.x
git switch renovate/github.com-mmcdole-gofeed-1.x
git rebase main
git switch main
git merge --no-ff renovate/github.com-mmcdole-gofeed-1.x
git switch main
git merge --squash renovate/github.com-mmcdole-gofeed-1.x
git switch main
git merge --ff-only renovate/github.com-mmcdole-gofeed-1.x
git switch main
git merge renovate/github.com-mmcdole-gofeed-1.x
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
kreativmonkey/goloom!126
No description provided.