GHSA-65gg-g7rw-6cpc Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

• Go github.com/tomwright/dasel/v3: >= 3.0.0, < 3.11.2 → fixed in 3.11.2

Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: `dasel query 'a '` panics at `selector/lexer/tokenize.go:60`. The whitespace-skip loop right above (lines 55-57) advances `p.i` to `p.srcLen` when the input is all-whitespace or whitespace-trailing. The very next line reads `p.src[p.i]` without a bounds check. Vulnerable code `selector/lexer/tokenize.go:53-74` (v3.11.0): ```go func (p *Tokenizer) parseCurRune() (Token, error) { // Skip over whitespace for p.i = p.srcLen { return NewToken(EOF, "", p.i, 0), nil } if p.src[p.i] == '/' && p.i+1 < p.srcLen && p.src[p.i+1] == '/' { ``` Prevalence The other two cases in this class shipped fixes two weeks ago; this one wasn't covered in those patches. I checked the rest of `parseCurRune` for other unguarded direct-access points after a `pos++` - nothing else stood out. A `testing.F` harness on `lexer.NewTokenizer(s).Tokenize()` catches all three with trivially short inputs and would close the class.