[github-actions]

📦 Vulnerable Dependencies

Severity	ID	Contextual Analysis	Dependency Path
Unknown	CVE-2026-97045	Not Covered	1 Direct golang.org/x/net:0.58.0 1 Transitive golang.org/x/net:0.58.0

🔖 Details

Vulnerability Details

Contextual Analysis:	Not Covered
CVSS V3:	-
Dependency Path:	golang.org/x/net: 0.58.0 (Direct) Fix Version: 0.62.0

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or fostered under ), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.

Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.

---

🐸 JFrog Frogbot

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization, Workspace
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8ce59313-8b50-4dba-b806-1d6e732eb140

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}