Update module github.com/antchfx/xpath to v1.3.6 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/antchfx/xpath	v1.2.0 → v1.3.6

GitHub Vulnerability Alerts

CVE-2026-32287

Boolean expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

---

Release Notes

antchfx/xpath (github.com/antchfx/xpath)

v1.3.6

Compare Source

Merged PR:

• #​120(@​mislav) - Fix last() predicate on grouped expr.

Fixed:

• #​121

v1.3.5

Compare Source

Merged PR:

• #​117(@​mislav）- fix ancestor:: axes with position predicate.

Fixed:

• #​113 - (fix string() function)

v1.3.4

Compare Source

Merged PR:

• #​107(@​Mrflatt) - supports Regexp feature in replace() function
• #​111(@​wjc4) - Improve getHashCode performance

Fixed:

• #​109

v1.3.3

Compare Source

fix non-English predicate query #​106

v1.3.2

Compare Source

New Features:

• Supports Unicode chars for Non-English (PR #​100)

Bug Fixed:

• #​101
• #​102
• #​104

v1.3.1

Compare Source

• Merged PR #​97.
• Allows node-set numeric operator +, -, mod().4b4638b
• #​98, Remove the duplicate element filter 5481aef

v1.3.0

Compare Source

• fixes #​93

New features:

• #​94，Remove the duplicate element on the query result
• new lower-case() function

v1.2.5

Compare Source

fix #​92 , add an regular expression checker for matches() before executing it

v1.2.4

Compare Source

PR #​82 - add CompileWithNS() supports custom prefix name for the specified namespaceURL.

v1.2.3

Compare Source

fixed:

fix concurrent goroutines deadlock, see antchfx/htmlquery#58

fix last() function, supports in the group query and the attribute filter query. see #​76,#​78

v1.2.2

Compare Source

**IMPORTANT: **

REMOVED Clone() method from query interface, replaced by the Reset(), this changed just for fix #​76,#​78

fix:

antchfx/htmlquery#52

v1.2.1

Compare Source

Bug fixed:

#​72
#​74
#​75

More

#​68 (Improve number handling by returning NaN for non-numbers )

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.