Fix CVE

[bboule]

Required links

Provide the links below. Our CI will automatically validate them.

• Forge link (github.com, gitlab.com, etc):
• pkg.go.dev:
• goreportcard.com:
• Coverage service link (codecov, coveralls, etc.):

Pre-submission checklist

• I have read the Contribution Guidelines
• I have read the Quality Standards

Repository requirements

These are validated automatically by CI:

• The repo has a go.mod file and at least one SemVer release (vX.Y.Z).
• The repo has an open source license.
• The repo documentation has a pkg.go.dev link.
• The repo documentation has a goreportcard link (grade A- or better).
• The repo documentation has a coverage service link.

These are recommended and reported as warnings:

• The repo has a continuous integration process (GitHub Actions, etc.).
• CI runs tests that must pass before merging.

Pull Request content

These are validated automatically by CI:

• This PR adds/removes/changes only one package.
• The package has been added in alphabetical order.
• The link text is the exact project name.
• The description is clear, concise, non-promotional, and ends with a period.
• The link in README.md matches the forge link above.

Category quality

Note: new categories require a minimum of 3 packages.

Packages added a long time ago might not meet the current guidelines anymore. It would be very helpful if you could check 3-5 packages above and below your submission to ensure they still meet the Quality Standards.

Please delete one of the following lines:

• The packages around my addition still meet the Quality Standards.
• I removed the following packages around my addition: (please give a short reason for each removal)

Thanks for your PR, you're awesome! 😎

[github-actions]

Automated Quality Checks

Skipped — this PR does not modify README.md, so package quality checks do not apply.

This is expected for maintenance, documentation, or workflow PRs.