deps: bump the go-dependencies group across 1 directory with 12 updates

DE
2d ago
+272-293

Bumps the go-dependencies group with 12 updates in the / directory:

PackageFromTo
charm.land/bubbletea/v22.1.02.1.1
charm.land/lipgloss/v22.0.62.1.0
github.com/godbus/dbus/v55.2.25.2.4
github.com/gofrs/flock0.13.10.13.2
github.com/itchyny/gojq0.12.190.12.20
github.com/sigstore/sigstore-go1.3.01.4.0
github.com/spf13/pflag1.0.101.1.0
github.com/yuin/goldmark1.8.61.8.7
golang.org/x/mod0.42.00.43.0
golang.org/x/sys0.49.00.50.0
golang.org/x/text0.43.00.44.0
modernc.org/sqlite1.61.01.62.0

Updates charm.land/bubbletea/v2 from 2.1.0 to 2.1.1
Updates charm.land/lipgloss/v2 from 2.0.6 to 2.1.0
Updates github.com/godbus/dbus/v5 from 5.2.2 to 5.2.4

Release notes

Sourced from github.com/godbus/dbus/v5's releases.

v5.2.4

What's Changed

New Contributors

Full Changelog: https://github.com/godbus/dbus/compare/v5.2.3...v5.2.4

v5.2.3

What's Changed

New Contributors

Full Changelog: https://github.com/godbus/dbus/compare/v5.2.2...v5.2.3

Commits
  • 4e46d5e Merge pull request #448 from SashaMIT/fix/system-bus-error
  • 2d04606 conn: return the system bus error on every OS
  • 4ad7526 Merge pull request #424 from twilly/linux-system-bus-address
  • 9f81f26 conn: support /run and /var/run default addresses
  • b3c0de5 Merge pull request #442 from kolyshkin/fuzz-oom
  • c0b1b46 Do not trust lengths from the input when allocating
  • 51e6822 Merge pull request #447 from godbus/fix/ci_bump_lint
  • ec94797 CI: bump golangci-lint to 2.14
  • ad906d5 Merge pull request #444 from kolyshkin/no-tcp-tag
  • d7c5c0b Add godbus_no_tcp build tag to disable tcp transports
  • Additional commits viewable in compare view

Updates github.com/gofrs/flock from 0.13.1 to 0.13.2

Release notes

Sourced from github.com/gofrs/flock's releases.

v0.13.2

What's Changed

New Contributors

Full Changelog: https://github.com/gofrs/flock/compare/v0.13.0...v0.13.2

Commits
  • 9dd5c85 fix: tryCtx with context cancellation (#162)
  • 7dbcfa2 chore(deps): bump golang.org/x/sys from 0.48.0 to 0.49.0 in the gomod group (...
  • d06df4a chore(deps): bump the github-actions group with 4 updates (#160)
  • 844daec chore(deps): bump the github-actions group with 2 updates (#158)
  • c2b0425 chore(deps): bump golang.org/x/sys from 0.47.0 to 0.48.0 in the gomod group (...
  • 67dc0b1 chore(deps): bump the github-actions group with 2 updates (#156)
  • bcff6e2 chore: create the GH release based on tags (#155)
  • See full diff in compare view

Updates github.com/itchyny/gojq from 0.12.19 to 0.12.20

Release notes

Sourced from github.com/itchyny/gojq's releases.

Release v0.12.20

  • implement gojq.ToInt and gojq.ToFloat64 for converting number values
  • fix destructuring alternative operator (?//) to reset variables of later alternatives, and to propagate break and halt errors
  • fix update-assignment operator against object with overlapping paths
  • fix delpaths function to delete ancestor paths before descendant paths
  • fix getpath function against string input
  • fix indexing and slicing a number literal written after a unary operator
  • fix slice indices of floating point numbers for jq compatibility
  • fix date and time functions against fractional, non-finite, and out of range numbers
  • fix strptime function to accept the zero time instant
  • fix match, test, and capture functions to support array arguments
  • fix match function to report an empty match after a non-empty one
  • fix split/1 function against empty input string
  • fix math functions against large number literals like 1e1000
  • fix jn/2 and yn/2 functions to avoid long recurrence on large orders
  • fix abs function against non-numbers for jq compatibility
  • fix isnan function to return false for non-numbers for jq compatibility
  • fix halt_error function not to print a newline after non-string values
  • fix --argjson and --jsonargs options to reject empty and multiple JSON values
  • fix --stream option error message against unterminated input
  • fix JSON parse error message after a large value in non-seekable input like stdin
  • fix offset of YAML parse error on multi-byte characters
  • fix panic on continuing iteration after an invalid path error
  • fix data race on input iterator when running code concurrently
  • fix add function to handle a nil map and slice as the first value
  • support destructuring alternative operator (?//) in reduce and foreach syntax
  • allow optional operator followed by alternative operator without spaces (.a?//1)
  • improve performance of function calls by avoiding copies of scope values, and path tracking in path, paths, |=, and del by reducing allocations
Changelog

Sourced from github.com/itchyny/gojq's changelog.

v0.12.20 (2026-11-01)

  • implement gojq.ToInt and gojq.ToFloat64 for converting number values
  • fix destructuring alternative operator (?//) to reset variables of later alternatives, and to propagate break and halt errors
  • fix update-assignment operator against object with overlapping paths
  • fix delpaths function to delete ancestor paths before descendant paths
  • fix getpath function against string input
  • fix indexing and slicing a number literal written after a unary operator
  • fix slice indices of floating point numbers for jq compatibility
  • fix date and time functions against fractional, non-finite, and out of range numbers
  • fix strptime function to accept the zero time instant
  • fix match, test, and capture functions to support array arguments
  • fix match function to report an empty match after a non-empty one
  • fix split/1 function against empty input string
  • fix math functions against large number literals like 1e1000
  • fix jn/2 and yn/2 functions to avoid long recurrence on large orders
  • fix abs function against non-numbers for jq compatibility
  • fix isnan function to return false for non-numbers for jq compatibility
  • fix halt_error function not to print a newline after non-string values
  • fix --argjson and --jsonargs options to reject empty and multiple JSON values
  • fix --stream option error message against unterminated input
  • fix JSON parse error message after a large value in non-seekable input like stdin
  • fix offset of YAML parse error on multi-byte characters
  • fix panic on continuing iteration after an invalid path error
  • fix data race on input iterator when running code concurrently
  • fix add function to handle a nil map and slice as the first value
  • support destructuring alternative operator (?//) in reduce and foreach syntax
  • allow optional operator followed by alternative operator without spaces (.a?//1)
  • improve performance of function calls by avoiding copies of scope values, and path tracking in path, paths, |=, and del by reducing allocations
Commits
  • e7c14ec bump up version to 0.12.20
  • b326bdd update CHANGELOG.md for v0.12.20
  • e8319c4 use $(MAKE) instead of make in Makefile
  • e169ed9 fix strptime to accept the zero time instant (#333)
  • 806d7bd improve test coverage of query string conversion
  • 045a452 refactor format functions to avoid unnecessary interface conversion
  • b984f98 replace ncipollo/release-action with gh release create
  • 8b2f146 update dependencies
  • 7c7e71a fix JSON argument error to report the unexpected token after a value
  • e661b6a fix --argjson and --jsonargs to reject empty and multiple JSON values (#332)
  • Additional commits viewable in compare view

Updates github.com/sigstore/sigstore-go from 1.3.0 to 1.4.0

Release notes

Sourced from github.com/sigstore/sigstore-go's releases.

v1.4.0

What's Changed

New Contributors

Full Changelog: https://github.com/sigstore/sigstore-go/compare/v1.3.0...v1.4.0

Commits
  • be417d9 sign: accept custom transports for Rekor clients (#690)
  • 42c420a fix(verify): use pointer receiver for ErrVerification methods (#689)
  • 924d9a6 Bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 (#688)
  • f203a5a Bump the minor-patch group across 1 directory with 4 updates (#687)
  • 0161b20 sign: allow callers to set the User-Agent for Fulcio, TSA and Rekor (#686)
  • 35e12bb Drop patch version from go directive in go.mod (#685)
  • 29ea8ed Bump the minor-patch group across 1 directory with 5 updates (#683)
  • b9b4e28 Bump the minor-patch group across 2 directories with 9 updates (#681)
  • e55f0ed Bump google.golang.org/grpc from 1.82.1 to 1.83.2 (#674)
  • a061819 bound fuzz tests to 64kb inputs (#680)
  • Additional commits viewable in compare view

Updates github.com/spf13/pflag from 1.0.10 to 1.1.0

Release notes

Sourced from github.com/spf13/pflag's releases.

v1.1.0

It's been long enough, and enough things have been fixed, that it might be time to release a new version, even if there isn't any particular big new issue to market as the reason for this release.

If you notice anything breaking, it is entirely un-intentional, but you might also have been relying on undocumented or buggy behavior. Please file an issue describing what you're doing, how it worked before this release and why it doesn't work anymore, and pin your projects to v1.0.10 (the latest release before this one) while we decide how to address your concerns.

What's Changed

New Contributors

... (truncated)

Commits
  • f8a9906 Merge pull request #533 from gdpu11/fix/count-preserve-value-on-error
  • f3a68a1 Merge pull request #534 from gdpu11/fix/native-integer-ranges
  • 70f7745 fix: reject native integer flag overflow on 32-bit systems
  • 2084408 test: cover native integer flag bounds on 32-bit systems
  • 7d0f377 fix: preserve count flag values when parsing fails
  • d26a4dc Merge pull request #526 from dewanshshekhar/fix/text-flag-type-check
  • 2d401c7 Fix type identification for text flags
  • fa584ba Merge pull request #520 from adenzhou1350/codex/fix-copy-go-string-value
  • cc9e689 Merge upstream master and retain its linter version
  • 70f284b Merge pull request #521 from Harshil-1603/fix/string-map-records
  • Additional commits viewable in compare view

Updates github.com/yuin/goldmark from 1.8.6 to 1.8.7

Release notes

Sourced from github.com/yuin/goldmark's releases.

v1.8.7

  • chore: bump golangci-lint to v2
  • perf: cache search results, limit length
  • fix(parser): #585
Commits
  • 6dafb0c chore: bump golangci-lint to v2
  • ddec203 perf: cache search results, limit length
  • b4539c4 fix(parser): #585
  • aefb206 Merge pull request #581 from chiliec/fix-linkify-trailing-punct-paren
  • ad479cb fix(extension): strip trailing punctuation exposed by an unmatched ')' in lin...
  • See full diff in compare view

Updates golang.org/x/mod from 0.42.0 to 0.43.0

Commits

Updates golang.org/x/sys from 0.49.0 to 0.50.0

Commits
  • 00227f1 unix: avoid using stale written count from sendfile on freebsd/386 after EINVAL
  • aa1b965 unix: don't skip directory entries with zero inodes on Linux
  • 37845fb unix: reject a short SCM_CREDENTIALS payload in ParseUnixCredentials
  • 313c631 unix: add IoctlGetUint64
  • 4a36a34 cpu: add wasm32 "architecture"
  • 908ab59 windows: use SyscallN consistently for Windows system calls
  • f5cb030 unix: set R12 before the ppc64x syscall branch
  • 0e9e10f windows: remove MemoryBasicInformation.PartitionId field on windows/386
  • 9b24ac0 windows: fix PSAPI_WORKING_SET_EX_BLOCK bit accessors
  • 69a6691 windows/mkwinsyscall: read 32-bit results from the low half of the return reg...
  • See full diff in compare view

Updates golang.org/x/text from 0.43.0 to 0.44.0

Commits
  • 6070ac3 go.mod: update golang.org/x dependencies
  • 972f268 language: count '_' alongside '-' in ParseAcceptLanguage guard
  • 367ce9e internal/export/idna: avoid excessive work in Punycode encoding
  • See full diff in compare view

Updates modernc.org/sqlite from 1.61.0 to 1.62.0

Release notes

Sourced from modernc.org/sqlite's releases.

v1.62.0

Signed provenance for this release: the two files below. VERIFYING.md in the repository says how to check them.

v1.61.1

Signed provenance for this release: the two files below. VERIFYING.md in the repository says how to check them.

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

  • 2026-11-07 v1.62.0:

    • Add illumos/amd64, tested on an OmniOS builder. Resolves [GitLab issue #210](https://gitlab.com/cznic/sqlite/-/issues/210), thanks Jasper Siepkes (@​siepkes), who also started the modernc.org/libc port!
    • Re-vendor lib/ from modernc.org/libsqlite3 v1.16.0 and vec/ from modernc.org/libsqlite_vec v0.8.0; SQLite stays 3.54.1 and sqlite-vec v0.1.9. The pinned modernc.org/libc becomes v1.80.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
    • Add opt-in syncing with fdatasync(2), off by default: Fdatasync(true) makes commits sync with fdatasync instead of fsync, process-wide, which skips the timestamp update fsync forces and keeps a commit just as durable. FdatasyncEnabled reports the setting; on macOS and Windows Fdatasync returns ErrFdatasyncUnavailable. Resolves [GitHub issue #10](modernc-org/sqlite#10), thanks aibeshkov!
    • Limit now works on a connection handed out by a driver.Connector that wraps the ones NewConnector opens, provided the wrapper has an Unwrap() driver.Conn method; it used to fail with unexpected driverConn type. NewConnector now also says which optional interfaces such a wrapper must forward. Resolves [GitHub issue #11](modernc-org/sqlite#11), thanks Andres Morey (@​amorey)!

  • 2026-10-31 v1.61.1:

    • Prepared statements are no longer parsed and planned again on every execution. Since v1.61.0, SQLite 3.54 expired a cached statement that has a col = ? term in a join or an ORDER BY query whenever the driver cleared its bindings after a run, so a statement prepared with db.Prepare or tx.Prepare cost about twice what it did in v1.60.1. Integer bindings now stay in place between executions, so a parameter bound to 0 or 1 does not re-prepare it either. Resolves [GitLab issue #264](https://gitlab.com/cznic/sqlite/-/issues/264). See [GitLab merge request #147](https://gitlab.com/cznic/sqlite/-/merge_requests/147), thanks Roman Khafizianov (@​requilence)!
    • Fix a panic reachable from SQL through a VFS made by vfs.New. It reported its files as writable, so with PRAGMA journal_mode=OFF a write reached a write method the VFS does not have and the process panicked, as did closing a WAL database shipped with its -wal file; with the journal on, the write failed with a misleading SQLITE_NOMEM. Such files are now read-only to SQLite, and every write fails with SQLITE_READONLY. See [GitLab merge request #145](https://gitlab.com/cznic/sqlite/-/merge_requests/145), thanks Ian Chechin!
    • Fix a process abort reachable through a VFS made by vfs.New. SQLite's request to delete a journal, made when PRAGMA journal_mode leaves PERSIST or TRUNCATE and on the first read of a 0-byte database that has a -journal file next to it in the served file system, reached the transpiled xDelete, an unimplemented stub that aborted the process. It now fails with SQLITE_IOERR_DELETE, which SQLite tolerates, and nothing is deleted; the write methods the VFS lacked answer SQLITE_READONLY instead of being nil.
    • Tx.Commit now stops waiting for a lock once the context given to BeginTx is done, and Rows.Next and Rows.Close once the query's context is done, each returning the context's error; they used to wait the full busy_timeout when a reader's lock in rollback-journal mode blocked the COMMIT, or the commit of an autocommit INSERT ... RETURNING finished or closed after its first row. Only the wait watches the context; Rollback is unchanged. Resolves [GitLab issue #263](https://gitlab.com/cznic/sqlite/-/issues/263), thanks SirLouen!
    • The attest CI job now copies vendor.json into the provenance document from the tagged commit, not from the working tree make vendor-check has just stamped with its own Go release; the v1.61.0 job failed its own verification over that field, so v1.61.0 has no provenance document, see VERIFYING.md. Tooling only.
    • Add THREAT-MODEL.md, the threat model behind the scope in SECURITY.md: the connection string, the connection lifecycle, the page cache binding and the VFS bridge, one row per concern with its status and the commit that settled it. TestVFSReadEOF now also checks the short read on vfsRead itself. Documentation and tests only. See [GitLab merge request #146](https://gitlab.com/cznic/sqlite/-/merge_requests/146), thanks Ian Chechin!

  • 2026-10-21 v1.61.0:

  • 2026-09-29 v1.60.1:

    • Binding arguments to a statement is no longer quadratic in the number of its parameters, which made multi-row INSERTs with thousands of ? parameters slow. Resolves [GitHub issue #8](modernc-org/sqlite#8), thanks wencycool!

  • 2026-09-28 v1.60.0:

    • A fault while reading the memory-mapped -shm file of a WAL database no longer crashes the process. The statement fails with a disk I/O error, extended code SQLITE_IOERR_IN_PAGE (8714), and the connection stays usable, as in MSVC builds of SQLite. On by default on every platform and not switchable; lib.SehInject and lib.SehPending inject such a fault for tests. Resolves [GitLab issue #221](https://gitlab.com/cznic/sqlite/-/issues/221), thanks Roman (@​requilence) for the report, and supersedes libsqlite3!4 and [GitHub pull request #7](modernc-org/sqlite#7), thanks hazyhaar for the two rounds, the ccgo finding and the Windows Server runs!
    • Re-vendor lib/ from modernc.org/libsqlite3 v1.15.0 and vec/ from modernc.org/libsqlite_vec v0.6.0; SQLite stays 3.53.4 and sqlite-vec v0.1.9. Go 1.26 is now required, and the pinned modernc.org/libc becomes v1.77.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
    • Nine exported lib constants that never had a meaningful value are gone: INFINITY, MB_CUR_MAX, NAN, RESERVED_BYTE, SHARED_FIRST, SQLITE_CANTOPEN_BKPT, SQLITE_CORRUPT_BKPT

      Description has been truncated

      Summary by cubic

      Bumps 12 direct Go dependencies and updates the module from Go 1.26.7 to 1.27.0, pulling in matching indirect dependency updates.

      Migration

      • spf13/pflag 1.1.0 is the first release in years and may break undocumented or buggy behavior; pin to 1.0.10 if issues arise.
      • modernc.org/sqlite 1.62.0 requires downstream go.mod files to pin modernc.org/libc 1.80.1, which this PR does.