deps: bump github.com/chainreactors/spray from 1.3.1-0.20260616101714-a52580bd9040 to 1.3.1 in the chainreactors group

[dependabot]

Bumps the chainreactors group with 1 update: github.com/chainreactors/spray.

Updates github.com/chainreactors/spray from 1.3.1-0.20260616101714-a52580bd9040 to 1.3.1

Release notes

Sourced from github.com/chainreactors/spray's releases.

v1.3.1

Changelog

Features

• [feat] 支持在所有请求字段中直接嵌入 mask 表达式（{?...} / {$...}），包括 -u URL、-H Header、--host、--cookie、--path，自动提取 mask 生成字典并在请求构建时替换 {{FUZZ}} 占位符；同时支持显式 -w 搭配 {{FUZZ}} 占位符在任意字段中引用同一字典
• [feat] 新增 --keys 插件，内嵌 156 条 proton found/keys 模板（覆盖 AWS/GCP/Azure/OpenAI/Slack/GitHub/Stripe 等），-a 自动启用
• [feat] 增强 extract 系统：新增 severity 分级、上下文捕获（--extract-context）、word matchers 预过滤，新增 9 条 HaE 规则（lfi-indicator/upload-form/url-as-value 等），模板总数 35→45
• [feat] 新增 ResourceLoader 机制，SDK 场景可控制资源加载行为，避免重复初始化

Bug Fixes

• [fix] 修复 Handler 处理中 wg 计数不完整导致 crawl-only 模式下提前 drain 的问题
• [fix] 修复 invalid baseline 跳过 extract 导致敏感数据（keys/recon）丢失的问题
• [fix] 修复 crawl source baseline 被 BaseCompare 误判为 invalid，导致递归爬虫中断
• [fix] 修复 RunWithCheck 中 OutputCh 在 pool goroutine 结束前被关闭导致 panic

Dependencies & CI

• [deps] 升级 proxyclient 至 v1.1.0，更新 chainreactors 全系依赖
• [ci] 新增 dependabot 自动依赖更新配置

使用示例

# URL 内嵌 mask（等价于 -u http://example.com -w '{$l#3}'）
spray -u 'http://example.com/{$l#3}'
Header 内嵌
spray -u http://example.com -H 'Token: {$d#6}'
Host 内嵌
spray -u http://example.com --host '{$l#3}.internal.com'
Cookie 内嵌
spray -u http://example.com --cookie 'sid={$hex#16}'
显式 -w + {{FUZZ}} 占位符（多字段同时替换）
spray -u 'http://example.com/{{FUZZ}}' -w '{$d#6}' -H 'Token: {{FUZZ}}'
敏感信息检测
spray -u http://example.com --keys
spray -u http://example.com -a  # advance 模式自动启用 keys

Full Changelog: chainreactors/spray@v1.3.0...v1.3.1

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.