build: explicitly fetch katana sub-packages at v1.6.1 to resolve transitive dependencies

Author: h0tak88r

Dockerfile

@@ -33,10 +33,14 @@ RUN go mod download
 COPY cmd/ ./cmd/
 COPY internal/ ./internal/
 
-# Fetch katana (new direct dependency) and add its go.sum entries.
-# Avoid `go mod tidy` here — it would upgrade unrelated indirect deps
-# (e.g. gitlab SDK) and break nuclei v3.7.1 compilation.
-RUN go get github.com/projectdiscovery/katana@latest
+# Fetch katana and all its sub-packages into go.sum.
+# go get on the top-level module alone doesn't resolve transitive deps
+# of sub-packages — we must fetch each used sub-package explicitly.
+RUN go get github.com/projectdiscovery/katana@v1.6.1 && \
+    go get github.com/projectdiscovery/katana/pkg/utils@v1.6.1 && \
+    go get github.com/projectdiscovery/katana/pkg/output@v1.6.1 && \
+    go get github.com/projectdiscovery/katana/pkg/types@v1.6.1 && \
+    go get github.com/projectdiscovery/katana/pkg/engine/standard@v1.6.1
 
 # Build main autoar binary from cmd/autoar (CGO enabled for naabu/libpcap)
 RUN CGO_ENABLED=1 GOOS=linux go build -ldflags="-s -w" -o /app/autoar ./cmd/autoar