chore(deps): bump govaluate to fix slice-bounds panic on invalid UTF-8 input

[XananasX7]

Summary

Bump github.com/projectdiscovery/govaluate to v0.0.0-20260615100919-5ee2581bbf7e to pull in the fix for the slice-bounds panic on invalid UTF-8 input.

Related Issue

Fixes #7462

Root Cause

The govaluate lexer advanced strPosition by utf8.RuneLen(utf8.RuneError) == 3 when it encountered an invalid UTF-8 byte, even though only 1 byte was consumed. This caused the offset to drift past the actual string length, triggering a slice bounds out of range panic in readUntilFalse.

Since expressions.Evaluate only caught govaluate errors (not panics), a target returning invalid UTF-8 bytes in response data could crash the entire nuclei process.

Fix

The upstream fix was merged in projectdiscovery/govaluate#4 (today, 2026-06-15). This PR updates nuclei's dependency to consume it.

Changes:

• go.mod: bump govaluate v0.0.0-20260504230327-80320480bb6e → v0.0.0-20260615100919-5ee2581bbf7e
• go.sum: updated checksums

Testing

• go build ./... passes cleanly
• Existing unit tests pass
• The crash path (invalid UTF-8 in evaluated expressions) is now handled gracefully at the govaluate lexer level

Summary by CodeRabbit

• Chores
  • Updated govaluate dependency to the latest version.

[coderabbitai]

Walkthrough

Updates the github.com/projectdiscovery/govaluate dependency in go.mod from pseudo-version v0.0.0-20260504230327-80320480bb6e to v0.0.0-20260615100919-5ee2581bbf7e. No other files are modified.

Changes

govaluate Dependency Bump

Layer / File(s)	Summary
govaluate version bump go.mod	Updates github.com/projectdiscovery/govaluate to a newer pseudo-version dated 2026-06-15.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related issues

• [BUG] govaluate: slice bounds out of range panic in readUntilFalse on invalid UTF-8 input #7462: The bumped govaluate version (v0.0.0-20260615100919-5ee2581bbf7e) replaces the exact problematic version (v0.0.0-20260504230327-80320480bb6e) cited in the slice bounds out of range panic bug in readUntilFalse.

Poem

A module line, just one small edit,
The govaluate hop was worth it!
From May to June the hash has changed,
And panics past are rearranged.
🐇 hops away satisfied ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and specifically describes the main change: bumping the govaluate dependency to fix a critical slice-bounds panic issue caused by invalid UTF-8 input.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}