// characters inside string literals changed to \u003c, \u003e, \u0026, \u2028, \u2029
// so that the JSON will be safe to embed inside HTML <script> tags.
// For historical reasons, web browsers don't honor standard HTML
// escaping within <script> tags, so an alternative JSON encoding must be used.
func HTMLEscape(dst *bytes.Buffer, src []byte) {
	dst.Grow(len(src))

// htmlNospaceReplacementTable contains the runes that need to be escaped
// inside an unquoted attribute value.
// The set of runes escaped is the union of the HTML specials and
// those determined by running the JS below in browsers:
// <div id=d></div>
// <script>(function () {
// var a = [], d = document.getElementById("d"), i, c, s;
// for (i = 0; i < 0x10000; ++i) {
//
//	c = String.fromCharCode(i);

# the go.mod file, not (presumed-irrelevant) transitive dependencies.
#
# (If the go.mod file is inconsistent, the version downloaded should be the
# selected version from the broader graph, but the go.mod file will also be
# updated to list the correct versions. If at some point we change 'go mod
# download' to stop updating for consistency, then it should fail if the
# requirements are inconsistent.)