chore(deps): update module github.com/yuin/goldmark to v2

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/yuin/goldmark	v1.8.6 → v2.0.2

---

Release Notes

yuin/goldmark (github.com/yuin/goldmark)

v2.0.2

Compare Source

• fix(parser): fix indented code block parsing to handle tabs correctly
• refactor: make parser.Nil primitive type
• fix: implement FirstRune and LastRune to support CJK-friendly line break strategies correctly
• fix(extension): strip trailing punctuation exposed by an unmatched ')' in linkify
• refactor(ast): make Link and Image properties exported

v2.0.1

Compare Source

• perf: improve performance
• fix(extension): fix #​571

v2.0.0

Compare Source

• initial official release of v2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[platex-rehor-bot]

⚠️ This PR should not be merged — it would re-introduce CVE-2026-5160 (XSS in goldmark < 1.7.17).

Why this PR is invalid:

The repo currently has a replace directive in go.mod that pins github.com/yuin/goldmark (v1) to v1.8.2 to mitigate CVE-2026-5160. The only transitive dependency requiring goldmark is golang.org/x/tools → github.com/yuin/goldmark@v1.4.13 (vulnerable).

This PR changes the replace directive from:

replace github.com/yuin/goldmark => github.com/yuin/goldmark v1.8.2

to:

replace github.com/yuin/goldmark/v2 => github.com/yuin/goldmark/v2 v2.0.0

In Go modules, github.com/yuin/goldmark (v1) and github.com/yuin/goldmark/v2 are different module paths. Applying this change would:

1. Remove the v1 replace that mitigates CVE-2026-5160
2. Add a v2 replace that has no effect (nothing in the dependency tree requires goldmark/v2)
3. Leave goldmark v1 resolving to v1.4.13, which is vulnerable

The bot likely generated this PR mechanically based on the goldmark v2.0.0 release without checking that the transitive dep chain still uses v1.