GeezerVison

Bumps github.com/gomarkdown/markdown from v0.0.0-20260411013819-759bbc3e3207 to v0.0.0-20260724235538-61af6e1e6971, the first version with the fix for GHSA-cv23-7vc5-jfh7 / CVE-2026-102941. IsSafeURL sliced the URL before checking its length, so empty or 1 to 2 byte link destinations panic when Safelink is on.

The IronBank VAT scan of coder-service-2:2.38.3 flags this (High) in /opt/coder. It's justified as Mitigated today because the safeURL wrapper and panic recovery in coderd/render/markdown.go (#28340) keep it from crashing. The finding stays open until the library is bumped. The 2.38 backport is #31442.

This pins the first fixed version, not upstream HEAD, to keep the change small. Upstream has since added CommonMark parser changes and another fix (79e163b, GHSA-c9jw-c68c-f39j, quadratic parse time on unclosed HTML block tags) that isn't in a published advisory yet. That can be a follow-up bump. The safeURL workaround is left as is; it can be simplified separately.

Verified: go test ./coderd/render/... and go test ./coderd/notifications/ -run Golden pass. go mod tidy changed no other modules. Local git hooks were skipped; CI is the gate.

Part of ENT-229 (parent ENT-230). 2.38 backport: #31442.

Opened by Superblink on behalf of @droopy4096.