Update deps for existing vulnerabilities

[FrenchBen]

Details

Scanning for dependencies with known vulnerabilities...
Found 1 known vulnerability.

Vulnerability 1: GO-2022-0236

A malicious HTTP server or client can cause the net/http client
or server to panic. ReadRequest and ReadResponse can hit an
unrecoverable panic when reading a very large header (over 7MB
on 64-bit architectures, or over 4MB on 32-bit ones). Transport
and Client are vulnerable and the program can be made to crash
by a malicious server. Server is not vulnerable by default, but
can be if the default max header of 1MB is overridden by setting
Server.MaxHeaderBytes to a higher value, in which case the
program can be made to crash by a malicious client. This also
affects golang.org/x/net/http2/h2c and HeaderValuesContainsToken
in golang.org/x/net/http/httpguts.

Call stacks in your code:
requester/requester.go:185:19: github.com/rakyll/hey/requester.Work.makeRequest calls net/http.Client.Do, which eventually calls golang.org/x/net/http/httpguts.HeaderValuesContainsToken

Found in: golang.org/x/net/http/[email protected]
Fixed in: golang.org/x/net/http/[email protected]
More info: https://pkg.go.dev/vuln/GO-2022-0236

Informational

The vulnerabilities below are in packages that you import, but your code
doesn't appear to call any vulnerable functions. You may not need to take any
action. See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
for details.

Vulnerability 1: GO-2022-0288

An attacker can cause unbounded memory growth in servers accepting
HTTP/2 requests.

Found in: golang.org/x/net/[email protected]
Fixed in: golang.org/x/net/[email protected]
More info: https://pkg.go.dev/vuln/GO-2022-0288

Vulnerability 2: GO-2020-0015

An attacker could provide a single byte to a UTF16 decoder instantiated with
UseBOM or ExpectBOM to trigger an infinite loop if the String function on
the Decoder is called, or the Decoder is passed to transform.String.
If used to parse user supplied input, this may be used as a denial of service
vector.

Found in: golang.org/x/text/[email protected]
Fixed in: golang.org/x/text/[email protected]
More info: https://pkg.go.dev/vuln/GO-2020-0015

Test

$ go test ./...
ok  	github.com/rakyll/hey	0.114s
ok  	github.com/rakyll/hey/requester	1.203s

Build

$ go build && ./hey -n 1 -c 1 https://jsonplaceholder.typicode.com/todos/1

Summary:
  Total:	0.3961 secs
  Slowest:	0.3961 secs
  Fastest:	0.3961 secs
  Average:	0.3961 secs
  Requests/sec:	2.5247


Response time histogram:
  0.396 [1]	|■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■
  0.396 [0]	|
  0.396 [0]	|
  0.396 [0]	|
  0.396 [0]	|
  0.396 [0]	|
  0.396 [0]	|
  0.396 [0]	|
  0.396 [0]	|
  0.396 [0]	|
  0.396 [0]	|


Latency distribution:
  0% in 0.0000 secs
  0% in 0.0000 secs
  0% in 0.0000 secs
  0% in 0.0000 secs
  0% in 0.0000 secs
  0% in 0.0000 secs
  0% in 0.0000 secs

Details (average, fastest, slowest):
  DNS+dialup:	0.3557 secs, 0.3557 secs, 0.3557 secs
  DNS-lookup:	0.0087 secs, 0.0087 secs, 0.0087 secs
  req write:	0.0001 secs, 0.0001 secs, 0.0001 secs
  resp wait:	0.0400 secs, 0.0400 secs, 0.0400 secs
  resp read:	0.0003 secs, 0.0003 secs, 0.0003 secs

Status code distribution:
  [200]	1 responses