deps: bump the chainreactors group across 1 directory with 2 updates

[dependabot]

Bumps the chainreactors group with 2 updates in the / directory: github.com/chainreactors/spray and github.com/chainreactors/zombie.

Updates github.com/chainreactors/spray from 1.3.1-0.20260616101714-a52580bd9040 to 1.3.1

Release notes

Sourced from github.com/chainreactors/spray's releases.

v1.3.1

Changelog

Features

• [feat] 支持在所有请求字段中直接嵌入 mask 表达式（{?...} / {$...}），包括 -u URL、-H Header、--host、--cookie、--path，自动提取 mask 生成字典并在请求构建时替换 {{FUZZ}} 占位符；同时支持显式 -w 搭配 {{FUZZ}} 占位符在任意字段中引用同一字典
• [feat] 新增 --keys 插件，内嵌 156 条 proton found/keys 模板（覆盖 AWS/GCP/Azure/OpenAI/Slack/GitHub/Stripe 等），-a 自动启用
• [feat] 增强 extract 系统：新增 severity 分级、上下文捕获（--extract-context）、word matchers 预过滤，新增 9 条 HaE 规则（lfi-indicator/upload-form/url-as-value 等），模板总数 35→45
• [feat] 新增 ResourceLoader 机制，SDK 场景可控制资源加载行为，避免重复初始化

Bug Fixes

• [fix] 修复 Handler 处理中 wg 计数不完整导致 crawl-only 模式下提前 drain 的问题
• [fix] 修复 invalid baseline 跳过 extract 导致敏感数据（keys/recon）丢失的问题
• [fix] 修复 crawl source baseline 被 BaseCompare 误判为 invalid，导致递归爬虫中断
• [fix] 修复 --crawl 在带 base path 的 SPA URL 中二次拼接路径，导致 /base/base/... 和 recon 漏提取的问题
• [fix] 修复 RunWithCheck 中 OutputCh 在 pool goroutine 结束前被关闭导致 panic

Dependencies & CI

• [deps] 升级 proxyclient 至 v1.1.0，更新 chainreactors 全系依赖
• [ci] 新增 dependabot 自动依赖更新配置

使用示例

# URL 内嵌 mask（等价于 -u http://example.com -w '{$l#3}'）
spray -u 'http://example.com/{$l#3}'
Header 内嵌
spray -u http://example.com -H 'Token: {$d#6}'
Host 内嵌
spray -u http://example.com --host '{$l#3}.internal.com'
Cookie 内嵌
spray -u http://example.com --cookie 'sid={$hex#16}'
显式 -w + {{FUZZ}} 占位符（多字段同时替换）
spray -u 'http://example.com/{{FUZZ}}' -w '{$d#6}' -H 'Token: {{FUZZ}}'
敏感信息检测
spray -u http://example.com --keys
spray -u http://example.com -a  # advance 模式自动启用 keys

Full Changelog: chainreactors/spray@v1.3.0...v1.3.1

Commits

• See full diff in compare view

Updates github.com/chainreactors/zombie from 1.2.3-0.20260616102212-9bcfed7622ab to 1.3.0

Release notes

Sourced from github.com/chainreactors/zombie's releases.

v1.3.0 — SDK 编程接口 + 代理注入 + go:embed 模板 + 并发控制

v1 系列最终版本。全面重构为 SDK 友好架构；支持 per-instance 代理注入；模板从 base64 切换到 go:embed；新增 per-host 并发限速。后续新功能（service protocol / 模板化后渗透）将在 zombie2.0 分支开发。

New Features

SDK 编程接口

• NewRunner(opt) + RunnerOption 独立结构体，支持程序化调用
• RunWithArgs(ctx, args, options) 复用 CLI 解析 + 信号处理
• Help() 函数暴露帮助文本
• SetResourceProvider() / SetResourceLoader() 资源注入覆盖

opt := &core.RunnerOption{
    Threads:     50,
    Concurrency: 4,
    Timeout:     10,
    Mod:         "clusterbomb",
    FirstOnly:   true,
}
runner := core.NewRunner(opt)
runner.SetTargets(targets)
runner.SetUsers([]string{"root", "admin"})
runner.SetPasswords([]string{"123456", "admin"})
runner.RunWithContext(ctx)

代理注入

• ProxyDial 字段注入到 RunnerOption，per-execution 代理
• Socket 协议（SSH/Redis/MySQL/FTP/...）和 HTTP 协议统一走注入的 DialFunc
• 基于 utils/httpx 统一 HTTP transport 构建

opt.ProxyDial = proxyclient.NewDialFunc("socks5://127.0.0.1:1080")

go:embed 模板

• 模板从 base64 编码切换到 go:embed + deflate 压缩的 .bin 文件
• 源码体积减小，编译和启动速度提升
• templates_gen.go -embed 模式自动生成 embed 声明

per-host 并发限速

• --concurrency N（原 --host-threads）限制单 host 在飞连接数
• 基于 channel semaphore，避免触发 sshd MaxStartups 等服务端限速
• context 取消感知：目标命中后排队任务立即退出，不再建连

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.