the site generator hand-rolls a Markdown-subset renderer, a strict HTML tokenizer and a CSL formatter to stay dependency-free; adopting goldmark and x/net/html instead is a maintainer dependency decision

the site generator hand-rolls a Markdown-subset renderer, a strict HTML tokenizer and a CSL formatter to stay dependency-free; adopting goldmark and x/net/html instead is a maintainer dependency decision

Remedy grounds (2026-09-29)

• goldmark states CommonMark 0.31.2 compliance, depends only on the standard library and renders no raw HTML or dangerous links by default (https://github.com/yuin/goldmark, consulted 2026-09-29). The Go vulnerability database lists sixteen reports against golang.org/x/net/html, seven of them in 2026, chiefly parser denial of service and render-tree XSS (https://pkg.go.dev/search?q=golang.org%2Fx%2Fnet%2Fhtml&m=vuln, consulted 2026-09-29), while the generator only tokenises repository content strictly, so the full HTML5 parser buys little and adds that surface.
• Rejected: taking both dependencies as one decision; they carry different cost and different benefit.