Skip to content

Repository navigation

chore(deps): bump the all group across 1 directory with 34 updates - #75

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/all-38d721dc68
Open

chore(deps): bump the all group across 1 directory with 34 updates#75
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/all-38d721dc68

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the all group with 34 updates in the / directory:

Package From To
charm.land/bubbletea/v2 2.0.9 2.1.1
charm.land/catwalk 0.52.49 0.52.86
charm.land/fantasy 0.45.2 0.46.0
github.com/Arize-ai/openinference/go/openinference-semantic-conventions 0.1.8 0.1.12
github.com/Microsoft/go-winio 0.6.2 0.6.4
github.com/NimbleMarkets/ntcharts 0.5.1 0.5.2
github.com/bmatcuk/doublestar/v4 4.10.2 4.10.4
github.com/charmbracelet/ultraviolet 0.0.0-20260910203606-6c9e17dc7a16 0.0.0-20261008173134-6b8d4baf91b4
github.com/charmbracelet/x/ansi 0.11.8 0.11.9
github.com/charmbracelet/x/exp/charmtone 0.0.0-20260920004010-53e2afe73ae5 0.1.1
github.com/charmbracelet/x/exp/golden 0.0.0-20250806222409-83e3a29d542f 0.1.0
github.com/charmbracelet/x/exp/slice 0.0.0-20260920004010-53e2afe73ae5 0.1.0
github.com/coregx/gxpdf 0.9.4 0.9.10
github.com/gen2brain/beeep 0.11.2 0.11.3
github.com/go-git/go-git/v5 5.19.2 5.19.3
github.com/itchyny/gojq 0.12.19 0.12.20
github.com/labstack/echo/v5 5.4.2 5.4.4
github.com/landlock-lsm/go-landlock 0.10.1 0.11.0
github.com/ncruces/go-sqlite3 0.35.5 0.36.0
github.com/pdfcpu/pdfcpu 0.15.0 0.16.4
github.com/pressly/goose/v3 3.28.0 3.29.0
github.com/tidwall/gjson 1.19.0 1.20.0
github.com/tidwall/sjson 1.2.5 1.2.6
github.com/xuri/excelize/v2 2.11.1-0.20261008044812-1cf5392f4fb7 2.11.1
go.opentelemetry.io/otel 1.46.0 1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace 1.46.0 1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc 1.46.0 1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp 1.46.0 1.47.0
go.opentelemetry.io/otel/metric 1.46.0 1.47.0
go.opentelemetry.io/otel/sdk 1.46.0 1.47.0
go.opentelemetry.io/otel/trace 1.46.0 1.47.0
golang.design/x/clipboard 0.9.0 0.11.0
golang.org/x/exp 0.0.0-20260908205506-85c1c2202aba 0.0.0-20261014143641-f0251eb4aa3e
modernc.org/sqlite 1.59.0 1.60.1

Updates charm.land/bubbletea/v2 from 2.0.9 to 2.1.1
Updates charm.land/catwalk from 0.52.49 to 0.52.86
Updates charm.land/fantasy from 0.45.2 to 0.46.0
Updates github.com/Arize-ai/openinference/go/openinference-semantic-conventions from 0.1.8 to 0.1.12

Commits
  • 1ddfa3b chore(main): release python-openinference-instrumentation 0.1.12 (#696)
  • 861ea4b fix: Rename base tracer and masked span (#693)
  • f166bb3 chore: fix typo for haystack-ai (#695)
  • d349872 chore(main): release python-openinference-instrumentation-langchain 0.1.25 (#...
  • 06975ed fix: add token counts for langchain streaming (#669)
  • fe6255b chore(main): release python-openinference-instrumentation-langchain 0.1.24 (#...
  • a6feda3 feat(langchain): Enable configuration using common instrumentation pkg (#685)
  • 65e4967 chore(main): release python-openinference-instrumentation-vertexai 0.1.1 (#687)
  • fb3278c feat(vertexai): Enable configuration using common instrumentation pkg (#686)
  • 14a6343 chore(main): release python-openinference-instrumentation-llama-index 2.2.0 (...
  • Additional commits viewable in compare view

Updates github.com/Microsoft/go-winio from 0.6.2 to 0.6.4

Release notes

Sourced from github.com/Microsoft/go-winio's releases.

v0.6.4

What's Changed

Full Changelog: microsoft/go-winio@v0.6.3...v0.6.4

v0.6.3

What's Changed

New Contributors

Full Changelog: microsoft/go-winio@v0.6.2...v0.6.3

Commits
  • b900fd8 Fix regression in mkwinsyscall for non SystemDLLs (#394)
  • 48c993a Bump golang.org/x/sys from 0.48.0 to 0.49.0 (#393)
  • 2430248 improve interoperability with stdlib sentinel errors and deprecate aliases (#...
  • f19d971 linting: enable dupword, intrange, mirror, gocritic (#387)
  • 0b70f54 tools/mkwinsyscall: remove errnoERROR_IO_PENDING const (#260)
  • 7e8af9b Resolves race in makeConnectedServerPipe / Close (#388)
  • 70234f2 Bump golang.org/x/tools to v0.50.0 (#385)
  • 1de8712 fix linting issues (#325)
  • 3093527 ci: update actions and golangci-lint, and fix linting (#349)
  • c7e589d Merge pull request #383 from thaJeztah/use_tool_generate
  • Additional commits viewable in compare view

Updates github.com/NimbleMarkets/ntcharts from 0.5.1 to 0.5.2

Changelog

Sourced from github.com/NimbleMarkets/ntcharts's changelog.

v0.5.2 (2026-10-06)

Fixes backported from the v2 branch:

  • Fix Y scaling in wavelinechart and timeserieslinechart so values line up with the Y-axis ticks when the X axis is hidden, as streamlinechart was fixed in v0.5.0 (#7)
  • Never label an axis value as -0 with DefaultLabelFormatter (#7)
  • Fix missing or misplaced final axis labels when the label step doesn't divide the axis evenly (#16)
  • Label the final X-axis tick with the true axis maximum
  • Float64PointScaleBuffer.Offset now returns the offset instead of the scale
Commits
  • 43ba1c9 chore(license): update copyright years to 2024-2026
  • a1c9bd3 Release v0.5.2
  • d605ec0 docs(changelog): add v0.5.2 (unreleased) backported fixes
  • abddec4 fix(linechart): never label an axis value as "-0" (#7)
  • 0fa5c00 fix(buffer): return the point buffer offset
  • a1ba717 fix(linechart): correct final X-axis labels
  • 4637d88 fix: linechart label glitch (#16)
  • e3868df fix: propagate streamlinechart height fix to wave/timeserieslinechart (#7)
  • See full diff in compare view

Updates github.com/bmatcuk/doublestar/v4 from 4.10.2 to 4.10.4

Release notes

Sourced from github.com/bmatcuk/doublestar/v4's releases.

Preserves segment position across alternatives

Fixes patterns like x{**/a,b} which should be treated like x*/a and xb because the doublestar appears mid-pattern.

What's Changed

New Contributors

Full Changelog: bmatcuk/doublestar@v4.10.3...v4.10.4

Handles character ranges when using WithCaseInsensitive

Character ranges, such as [a-z] would not match things like A when using WithCaseInsensitive. This release fixes that.

Thanks to @​bensynapse for bringing this to my attention.

Full Changelog: bmatcuk/doublestar@v4.10.2...v4.10.3

Commits
  • 063daf7 update tests
  • 29d56e4 Merge branch 'yuefdev-fix/brace-segment-start-sol'
  • f8573f2 fix: preserve segment position across brace alternatives
  • 03688d3 fix tests
  • 7ac7790 case-insensitive character ranges
  • a922627 run symlink tests on windows
  • See full diff in compare view

Updates github.com/charmbracelet/ultraviolet from 0.0.0-20260910203606-6c9e17dc7a16 to 0.0.0-20261008173134-6b8d4baf91b4

Commits

Updates github.com/charmbracelet/x/ansi from 0.11.8 to 0.11.9

Commits
  • faa4adf ansi/v0.11.9
  • 09f7503 feat(ansi): OSC 7501 (#1004)
  • ad85c59 chore(powernap): update lsp configs from nvim-lspconfig
  • 953920d nerdfont/v0.1.0
  • 4edfc00 feat(nerdfont): overrides (#1000)
  • 7be62f4 chore(deps): bump golang.org/x/sys in /term in the all group (#996)
  • 29bfdbd feat: nerdfont
  • 9c77d67 chore(powernap): update lsp configs from nvim-lspconfig
  • d676b01 v0.1.0 for charmtone and slices
  • 53e2afe chore(powernap): update lsp configs from nvim-lspconfig
  • Additional commits viewable in compare view

Updates github.com/charmbracelet/x/exp/charmtone from 0.0.0-20260920004010-53e2afe73ae5 to 0.1.1

Commits

Updates github.com/charmbracelet/x/exp/golden from 0.0.0-20250806222409-83e3a29d542f to 0.1.0

Commits

Updates github.com/charmbracelet/x/exp/slice from 0.0.0-20260920004010-53e2afe73ae5 to 0.1.0

Commits

Updates github.com/coregx/gxpdf from 0.9.4 to 0.9.10

Release notes

Sourced from github.com/coregx/gxpdf's releases.

v0.9.10

GxPDF v0.9.10

A patch release with one hardening fix.

Fixed

  • An XRef stream could declare an unbounded number of entries (#120). With /W [0 0 0] no entry data is consumed, so the data-length check never fired and the count from /Index or /Size alone decided the work: a 241-byte file could ask for 2^31 entries - about 174 MB per million, roughly 370 GB at the limit. The entry count is now capped at 1,000,000; anything above it is an error before a single entry is allocated.

Zero-width streams within the limit still parse, and an open-only differential over 934 files (the reference corpora, testdata, examples) shows no change for any of them.

Install

go get github.com/coregx/gxpdf@v0.9.10

Full changelog: coregx/gxpdf@v0.9.9...v0.9.10

v0.9.9

GxPDF v0.9.9

A patch release that fixes a crash when opening a malformed PDF.

Fixed

  • Opening a PDF whose cross-reference stream had a non-integer /W or /Index entry, an /Index with an odd number of values, or a negative /W width crashed the process - a type assertion panic or an out-of-range slice. These are parse errors now, as are a /W field wider than 8 bytes, a negative /Index start or count, and an /Index that is not an array (#116, by @​kari-pikkarainen).
  • The same input that made an older build panic came from a 363-byte file in a public corpus, not only from a fuzzer.

Files that parsed before parse exactly as before: open results and Stream, Lattice and Auto table output are unchanged across a 934-file corpus.

Security

GHSA-8g65-h4j3-62jf (High, CVSS 7.5) covers this fix; a CVE id follows.

Known limitation

An XRef stream with /W [0 0 0] and a large /Index count still allocates without bound - a file of about 240 bytes can exhaust memory. This predates the release and is tracked in #120; until it is fixed, do not open untrusted files without a size and time budget.

Install

go get github.com/coregx/gxpdf@v0.9.9

Full changelog: coregx/gxpdf@v0.9.8...v0.9.9

v0.9.8

GxPDF v0.9.8

... (truncated)

Changelog

Sourced from github.com/coregx/gxpdf's changelog.

[0.9.10] - 2026-10-22

Fixed

  • An XRef stream could declare an unbounded number of entries (#120). With /W [0 0 0] no entry data is consumed, so the data-length check never fired and the count from /Index or /Size alone decided the work: a 241-byte file could ask for 2^31 entries, about 370 GB of allocation. The entry count is now capped at 1,000,000 (the limit folio's reader uses); anything above it is an error, and zero-width streams within the limit still parse.

[0.9.9] - 2026-10-22

Fixed

  • Malformed XRef stream /W or /Index panicked (#116, by @​kari-pikkarainen): a /W or /Index entry that was not an integer (a name, string or real), an /Index with an odd number of values, or a negative /W width panicked while the document was opened. These are now reported as errors, as are a /W field wider than 8 bytes, a negative /Index start or count, and an /Index that is not an array (previously ignored). Files that used to open parse exactly as before.

Security

  • GHSA-8g65-h4j3-62jf (High, CVSS 7.5, affected < 0.9.9): the panic above is reachable from any PDF opened with Open or OpenFromBytes, and a caller that does not wrap the call in recover() loses the process.

[0.9.8] - 2026-10-22

Fixed

  • Text inside Form XObjects ignored nested transformation matrices (#89). Text that Quartz and similar generators draw in a Form, one glyph at a time with a unit-sized font and a cm that sets its size and position, now combines the page cm, the Form /Matrix and nested glyph transforms, so extracted positions and sizes match what viewers draw. Form graphics state no longer leaks into the page, embedded font widths are used when character codes map directly to CIDs, and composite-font /W ranges are stored as ranges, so a PDF declaring a huge range no longer allocates a width per CID.
  • TJ adjustments ignored horizontal scaling (#89). Numeric TJ adjustments now scale with the active Tz value, in page and Form text alike.
  • Stream tables dropped a closely spaced rightmost column (#94). When the last column sat closer to its neighbour than the minimum column spacing, Stream extraction merged it away, so 2024, 1450 and (570) were missing from the fixture table in #94. A right edge that repeats in the same position on at least two of the table's rows is now kept as a column; a single, unaligned or distant edge is still ignored.
  • Pages whose streams used more than one filter, or a filter other than Flate, could not be read (#95). Text, fonts and object streams applied only the first filter of a stream, and most places supported only /FlateDecode, so content stored as [/ASCII85Decode /FlateDecode], /LZWDecode or /RunLengthDecode failed or came out empty. All streams now go through one decoder that applies the whole filter chain (Flate, LZW, ASCII85, ASCIIHex and RunLength, with PNG and TIFF predictors), also when the filters or their parameters are indirect objects. Each decoding step is limited to 64 MiB of output, so a small stream cannot expand into gigabytes. A filter that cannot be decoded (JBIG2, CCITT fax, JPEG 2000, a crypt filter other than Identity, or an unknown name) is now an error instead of passing compressed bytes on as page content.
  • GetImages returned no PNG or JPEG images, including those written by creator: since v0.1.0 the image filter name was compared with and without its leading slash, so no Flate or JPEG image was ever returned. Images are now decoded through the stream filter decoder, and a PNG or JPEG drawn with creator comes back from GetImagesWithError with its size, color space and data. An image may decode to the size its dictionary declares, up to 256 MiB; an image over that limit makes GetImagesWithError return an error instead of being left out.

Changed

  • Text coordinates now include the page and Form transforms at every font size (#96). Only Form text drawn with a font size of 2 or less was transformed; direct page text and larger Form text kept text-space coordinates, so the same text came out at different positions depending on how the PDF drew it. TextElement now reports the box the text covers on the page and its rendered height, for all text. This changes the reported coordinates of direct page text and of Form text larger than 2 units. /Rotate is still display metadata and is not applied.

[0.9.7] - 2026-10-17

Fixed

  • Non-ASCII text in Standard 14 fonts came out garbled: text was written to the content stream as UTF-8 bytes, so "06:00 – 18:00" showed as "06:00 – 18:00" in viewers and in extracted text. Text is now written in WinAnsiEncoding, which the font dictionaries already declare: Latin-1 letters (é ü ß Ø), € – — „ “ ” … • ™ Š Ž Œ and the rest of the encoding. Characters outside it (Cyrillic, Greek, CJK, Ł) are drawn and measured as ?; they need an embedded TrueType font.
  • Watermark text had no font: the font resource of a TextWatermark pointed to object 0, so viewers drew it in a substitute font, without the font's encoding.
  • Builder images were never embedded (#101). Container.Image drew a grey rectangle in place of the image, sized it with a guessed 2:1 aspect ratio, and Build() returned no error. The image is now embedded (JPEG as it is, PNG with its transparency mask) in headers, footers, rows, columns and table cells. FitWidth and FitHeight keep the image's aspect ratio; with both, the image fits inside that box. Without options an image takes its pixel size (1 pixel = 1 point), never wider than the available width; an image taller than a page is scaled down to the page. Bytes that are not a JPEG or PNG make Build() return an error.
  • An image drawn several times was stored several times: every placement wrote its own copy of the image data, so a logo in the header of a 50-page document was embedded 50 times. Each distinct image is now written once and shared by all placements (creator Page.DrawImage and builder).
  • Grayscale and CMYK JPEGs were declared RGB, and some PNGs lost their transparency (creator and builder). A JPEG's color space now follows its component count: grayscale JPEGs are DeviceGray (viewers showed garbage or an error for the one-component stream), CMYK JPEGs are DeviceCMYK, with the inverted samples of Adobe/Photoshop CMYK files mapped back by a /Decode array. Paletted PNGs with a transparent color (typical logos) and 16-bit PNGs with alpha now keep their transparency, and semi-transparent pixels keep their color — it was premultiplied by alpha and came out darker. 16-bit grayscale PNGs are written as DeviceGray. A JPEG with an unsupported number of components, or whose header declares a zero width or height, is an error.
  • CJK line breaking in builder text: a word containing CJK characters always started a new line, even when it fit on the current one. CJK text now continues the line and wraps between characters, without starting a line with closing punctuation (、。」）！？) or ending one with opening punctuation (「（). Rich text wraps CJK text too (it used to run past the line), CJK cells no longer make Auto table columns as wide as their whole text, and text continued on the next page no longer gains a space at each CJK line break.

Security

  • Out-of-memory crash on a PDF with a huge /Length (#92, by @​chiliec). A stream's /Length sized the read buffer directly, so a few-hundred-byte PDF declaring /Length 9000000000 made opening it or reading a page try to allocate ~9 GB and crash the process. Content streams and both XRef stream paths now read only the bytes actually present and report the length mismatch as an error.

[0.9.6] - 2026-10-16

Fixed

  • Row-spanning table cells (#100). A RowSpan cell was laid out in its first row only: border and background stopped there, text was clipped, vertical alignment centered in the first row, and the rows did not grow to fit it. It now covers all spanned rows; rows that must grow do so in proportion to their height.
  • Row spans across page breaks (#100). Cells after a break inside a span shifted left into the spanned column, and the spanning cell was lost. The cell now continues in its columns on the next page with its remaining content.
  • Table columns changed between pages: a table continued on the next page re-resolved Auto column widths and, without Columns, the column count from the remaining rows (an Auto column went from 114pt to 6pt). The column grid is now kept for the whole table.
  • Content running off the page: a table whose first row did not fit at the top of a page was drawn whole on one page below its bottom edge; a box whose first line did not fit near the bottom of a page was drawn below the page instead of moving to the next one.
  • Pagination never ended for a table whose header was taller than the page.
  • Fonts that failed to load were ignored (#102). builder.WithFont and WithFontFile dropped every error, so Build() succeeded and the text came out in Helvetica. Build() now returns an error per font, naming the family and the cause (font "Missing": load TTF: open …). Empty font data is an error too. WithFont loads from memory instead of a temporary file.
  • Text was measured and drawn with different fonts for some family names: layout matched "times…"/"courier…" by prefix and ignoring case, the renderer matched exact names, so e.g. "courier" was measured as Courier and drawn in Helvetica. Both now resolve families through one resolver. Underline and strikethrough also used Standard 14 widths for registered fonts.
  • PageNumber in a page header or footer showed 1 on every page ("Page 1 of 6" on all six pages). Header and footer blocks are shared by all pages, and the first page resolved them for every page.
  • An image in a row-spanning cell could be dropped by rounding: grown rows can sum to a few ulps less than the image needs. Text allowed 0.01pt; images, spacers, EnsureSpace and table row fitting compared exactly. All fit decisions now use one tolerance.

... (truncated)

Commits
  • 5494e76 chore: prepare release v0.9.10
  • 519e345 fix(parser): bound the entry count of an XRef stream
  • 09c50cc chore: prepare release v0.9.9
  • 291b90a test(parser): cover a /W that is not a three-integer array
  • c186d46 fix(parser): reject malformed /W and /Index in XRef streams
  • bfb1ead chore: ignore .gode and .mcp.json
  • 84ad7db docs: correct the dependency and CI statements
  • 98bad9d docs: rewrite the security policy
  • b51e86c chore: prepare release v0.9.8
  • 52377f7 feat: decode PDF stream filter chains
  • Additional commits viewable in compare view

Updates github.com/gen2brain/beeep from 0.11.2 to 0.11.3

Commits

Updates github.com/go-git/go-git/v5 from 5.19.2 to 5.19.3

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.19.3

What's Changed

New Contributors

Full Changelog: go-git/go-git@v5.19.2...v5.19.3

Commits
  • bdae57c Merge pull request #2468 from go-git/bump-pjbgf
  • 372805d build: Bump pjbgf/sha1cd to v0.7.0
  • e28bfff Merge pull request #2467 from go-git/renovate/releases/v5.x-go-git
  • dbfe60f build: Update module github.com/go-git/go-billy/v5 to v5.9.2
  • a3fa9b3 Merge pull request #2451 from go-git/drop-go-1.25
  • 1fc0e47 build: Drop Go 1.25
  • 4f28503 Merge pull request #2340 from jgoosens/releases/v5.x
  • 5a01a03 Merge pull request #2357 from go-git/renovate/releases/v5.x-go-golang.org-x-c...
  • 5372bc7 Merge pull request #2421 from akashchamp/fix/packfile-parallel-test-race
  • 3d20ded plumbing: format/packfile, Stop running TestChecksumMismatch and TestMalforme...
  • Additional commits viewable in compare view

Updates github.com/itchyny/gojq from 0.12.19 to 0.12.20

Release notes

Sourced from github.com/itchyny/gojq's releases.

Release v0.12.20

  • implement gojq.ToInt and gojq.ToFloat64 for converting number values
  • fix destructuring alternative operator (?//) to reset variables of later alternatives, and to propagate break and halt errors
  • fix update-assignment operator against object with overlapping paths
  • fix delpaths function to delete ancestor paths before descendant paths
  • fix getpath function against string input
  • fix indexing and slicing a number literal written after a unary operator
  • fix slice indices of floating point numbers for jq compatibility
  • fix date and time functions against fractional, non-finite, and out of range numbers
  • fix strptime function to accept the zero time instant
  • fix match, test, and capture functions to support array arguments
  • fix match function to report an empty match after a non-empty one
  • fix split/1 function against empty input string
  • fix math functions against large number literals like 1e1000
  • fix jn/2 and yn/2 functions to avoid long recurrence on large orders
  • fix abs function against non-numbers for jq compatibility
  • fix isnan function to return false for non-numbers for jq compatibility
  • fix halt_error function not to print a newline after non-string values
  • fix --argjson and --jsonargs options to reject empty and multiple JSON values
  • fix --stream option error message against unterminated input
  • fix JSON parse error message after a large value in non-seekable input like stdin
  • fix offset of YAML parse error on multi-byte characters
  • fix panic on continuing iteration after an invalid path error
  • fix data race on input iterator when running code concurrently
  • fix add function to handle a nil map and slice as the first value
  • support destructuring alternative operator (?//) in reduce and foreach syntax
  • allow optional operator followed by alternative operator without spaces (.a?//1)
  • improve performance of function calls by avoiding copies of scope values, and path tracking in path, paths, |=, and del by reducing allocations
Changelog

Sourced from github.com/itchyny/gojq's changelog.

v0.12.20 (2026-11-01)

  • implement gojq.ToInt and gojq.ToFloat64 for converting number values
  • fix destructuring alternative operator (?//) to reset variables of later alternatives, and to propagate break and halt errors
  • fix update-assignment operator against object with overlapping paths
  • fix delpaths function to delete ancestor paths before descendant paths
  • fix getpath function against string input
  • fix indexing and slicing a number literal written after a unary operator
  • fix slice indices of floating point numbers for jq compatibility
  • fix date and time functions against fractional, non-finite, and out of range numbers
  • fix strptime function to accept the zero time instant
  • fix match, test, and capture functions to support array arguments
  • fix match function to report an empty match after a non-empty one
  • fix split/1 function against empty input string
  • fix math functions against large number literals like 1e1000
  • fix jn/2 and yn/2 functions to avoid long recurrence on large orders
  • fix abs function against non-numbers for jq compatibility
  • fix isnan function to return false for non-numbers for jq compatibility
  • fix halt_error function not to print a newline after non-string values
  • fix --argjson and --jsonargs options to reject empty and multiple JSON values
  • fix --stream option error message against unterminated input
  • fix JSON parse error message after a large value in non-seekable input like stdin
  • fix offset of YAML parse error on multi-byte characters
  • fix panic on continuing iteration after an invalid path error
  • fix data race on input iterator when running code concurrently
  • fix add function to handle a nil map and slice as the first value
  • support destructuring alternative operator (?//) in reduce and foreach syntax
  • allow optional operator followed by alternative operator without spaces (.a?//1)
  • improve performance of function calls by avoiding copies of scope values, and path tracking in path, paths, |=, and del by reducing allocations
Commits
  • e7c14ec bump up version to 0.12.20
  • b326bdd update CHANGELOG.md for v0.12.20
  • e8319c4 use $(MAKE) instead of make in Makefile
  • e169ed9 fix strptime to accept the zero time instant (#333)
  • 806d7bd improve test coverage of query string conversion
  • 045a452 refactor format functions to avoid unnecessary interface conversion
  • b984f98 replace ncipollo/release-action with gh release create
  • 8b2f146 update dependencies
  • 7c7e71a fix JSON argument error to report the unexpected token after a value
  • e661b6a fix --argjson and --jsonargs to reject empty and multiple JSON values (#332)
  • Additional commits viewable in compare view

Updates github.com/labstack/echo/v5 from 5.4.2 to 5.4.4

Release notes

Sourced from github.com/labstack/echo/v5's releases.

v5.4.4

Proxy identity hardening

The proxy now retains its derived X-Real-IP header when an incoming request includes Connection: X-Real-IP, including mixed-case and duplicate Connection values. The value is restored after Go removes hop-by-hop headers, before the upstream transport runs.

The same captured identity is preserved across retries and balancer request replacement, and the protection applies to WebSocket upgrades. Default and custom transports and extractors remain supported.

Released v5.4.3 can omit the identity header for those requests. Identity spoofing additionally depends on an upstream that falls back to an untrusted source when the header is absent. This release does not change v5’s direct-peer default or the affected ranges of the earlier default-IP CVEs.

No new client-IP migration is required for v5. Applications behind proxies should continue using an extractor that trusts their own proxies. No public API, dependency, or minimum Go-version changes.

Validation

The implementation passed fresh independent Claude review, full race tests on Go 1.25 and 1.27, vet, staticcheck, golint, and govulncheck. Permanent tests cover HTTP/default/custom transports, raw WebSocket negotiation, duplicate/mixed-case header nominations, and a stateful extractor across request-swapping retries.

Implementation: #3200. This ports the additional proxy identity protection released in v4.16.3.

Full Changelog: labstack/echo@v5.4.3...v5.4.4

v5.4.3

Security

Upgrade to v5.4.3 to fix a static route-guard bypass involving encoded empty path segments in non-default path-matching or unescaping configurations. The confirmed impact is access to protected files inside a static root. The fix validates raw and decoded request paths and wildcard boundaries, including singly and doubly encoded leading slashes and guarded directory indexes.

Advisory: GHSA-v97q-3xf5-rj74

Fixes

  • Decode path parameters only once when UnescapePathParamValues is enabled, preserving literal percent-containing values.
  • Correct UseEscapedPathForMatching documentation without changing its behavior.
  • Preserve correctly escaped filenames and static prefixes such as /assets*.

Thanks to MyWorld319 for the static bypass report and alexreid for the parameter-decoding report.

Documentation

  • Publish v4 support dates and the Echo Support offer (#3193).
  • Mention Echo Pro in the Sponsors section (#3192).

Full Changelog: labstack/echo@v5.4.2...v5.4.3

Changelog

Sourced from github.com/labstack/echo/v5's changelog.

v5.4.4 - 2026-10-29

Proxy identity hardening

  • Preserve the derived upstream X-Real-IP after hop-by-hop header stripping. A client can no longer remove that header with Connection: X-Real-IP, including duplicate or mixed-case nominations and WebSocket upgrades.
  • Capture the client identity once and preserve it across retries and balancer request replacement. Default and custom transports and extractors remain supported.
  • Add permanent regressions for HTTP forwarding, raw WebSocket upgrades, header nominations, and stateful extraction during request-swapping retries. Implementation: #3200.

v5 already uses the connection peer by default. This release adds proxy header protection and does not change client-IP configuration or the affected ranges of the earlier default-IP CVEs. A missing identity header can affect an upstream that falls back to an untrusted source; no new client-IP migration, public API, dependency, or minimum Go-version change is introduced.

v5.4.0 - 2026-09-27

Security

This release fixes several security issues. Upgrading is recommended. Some fixes change behavior; read "Behavior changes to check before upgrading" below.

  • Request scheme: Context.Scheme() now uses the X-Forwarded-Proto, X-Forwarded-Protocol, X-Forwarded-Ssl and X-Url-Scheme headers only when the request comes directly from a loopback, link-local or private network address or a unix socket. Before this, any client could send X-Forwarded-Proto: https over plain HTTP and skip HTTPSRedirect. When X-Forwarded-Proto is present, only it is used (its last value), and the scheme is returned in lowercase. Echo#SchemeExtractor (and Config.SchemeExtractor) selects the strategy: ExtractSchemeFromHeaders(...TrustOption) (default), ExtractSchemeDirect() or LegacySchemeExtractor(). The Secure middleware now sets HSTS based on Context.Scheme(). The Proxy middleware always sets X-Forwarded-Proto from Context.Scheme() and removes X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme before forwarding. GHSA-2ffq-g2xg-c22p
  • Proxy middleware: always sets X-Real-IP from Context.RealIP(), so a client can no longer pass a spoofed X-Real-IP to the upstream. GHSA-99jh-6h7p-pp...

    Description has been truncated

@dependabot
chore(deps): bump the all group across 1 directory with 34 updates
109e2ee 
Bumps the all group with 34 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| charm.land/bubbletea/v2 | `2.0.9` | `2.1.1` |
| charm.land/catwalk | `0.52.49` | `0.52.86` |
| charm.land/fantasy | `0.45.2` | `0.46.0` |
| [github.com/Arize-ai/openinference/go/openinference-semantic-conventions](https://github.com/Arize-ai/openinference) | `0.1.8` | `0.1.12` |
| [github.com/Microsoft/go-winio](https://github.com/Microsoft/go-winio) | `0.6.2` | `0.6.4` |
| [github.com/NimbleMarkets/ntcharts](https://github.com/NimbleMarkets/ntcharts) | `0.5.1` | `0.5.2` |
| [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar) | `4.10.2` | `4.10.4` |
| [github.com/charmbracelet/ultraviolet](https://github.com/charmbracelet/ultraviolet) | `0.0.0-20260910203606-6c9e17dc7a16` | `0.0.0-20261008173134-6b8d4baf91b4` |
| [github.com/charmbracelet/x/ansi](https://github.com/charmbracelet/x) | `0.11.8` | `0.11.9` |
| [github.com/charmbracelet/x/exp/charmtone](https://github.com/charmbracelet/x) | `0.0.0-20260920004010-53e2afe73ae5` | `0.1.1` |
| [github.com/charmbracelet/x/exp/golden](https://github.com/charmbracelet/x) | `0.0.0-20250806222409-83e3a29d542f` | `0.1.0` |
| [github.com/charmbracelet/x/exp/slice](https://github.com/charmbracelet/x) | `0.0.0-20260920004010-53e2afe73ae5` | `0.1.0` |
| [github.com/coregx/gxpdf](https://github.com/coregx/gxpdf) | `0.9.4` | `0.9.10` |
| [github.com/gen2brain/beeep](https://github.com/gen2brain/beeep) | `0.11.2` | `0.11.3` |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.19.2` | `5.19.3` |
| [github.com/itchyny/gojq](https://github.com/itchyny/gojq) | `0.12.19` | `0.12.20` |
| [github.com/labstack/echo/v5](https://github.com/labstack/echo) | `5.4.2` | `5.4.4` |
| [github.com/landlock-lsm/go-landlock](https://github.com/landlock-lsm/go-landlock) | `0.10.1` | `0.11.0` |
| [github.com/ncruces/go-sqlite3](https://github.com/ncruces/go-sqlite3) | `0.35.5` | `0.36.0` |
| [github.com/pdfcpu/pdfcpu](https://github.com/pdfcpu/pdfcpu) | `0.15.0` | `0.16.4` |
| [github.com/pressly/goose/v3](https://github.com/pressly/goose) | `3.28.0` | `3.29.0` |
| [github.com/tidwall/gjson](https://github.com/tidwall/gjson) | `1.19.0` | `1.20.0` |
| [github.com/tidwall/sjson](https://github.com/tidwall/sjson) | `1.2.5` | `1.2.6` |
| [github.com/xuri/excelize/v2](https://github.com/xuri/excelize) | `2.11.1-0.20261008044812-1cf5392f4fb7` | `2.11.1` |
| [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/metric](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| golang.design/x/clipboard | `0.9.0` | `0.11.0` |
| [golang.org/x/exp](https://github.com/golang/exp) | `0.0.0-20260908205506-85c1c2202aba` | `0.0.0-20261014143641-f0251eb4aa3e` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.59.0` | `1.60.1` |



Updates `charm.land/bubbletea/v2` from 2.0.9 to 2.1.1

Updates `charm.land/catwalk` from 0.52.49 to 0.52.86

Updates `charm.land/fantasy` from 0.45.2 to 0.46.0

Updates `github.com/Arize-ai/openinference/go/openinference-semantic-conventions` from 0.1.8 to 0.1.12
- [Release notes](https://github.com/Arize-ai/openinference/releases)
- [Commits](Arize-ai/openinference@java-openinference-instrumentation-v0.1.8...python-openinference-instrumentation-v0.1.12)

Updates `github.com/Microsoft/go-winio` from 0.6.2 to 0.6.4
- [Release notes](https://github.com/Microsoft/go-winio/releases)
- [Commits](microsoft/go-winio@v0.6.2...v0.6.4)

Updates `github.com/NimbleMarkets/ntcharts` from 0.5.1 to 0.5.2
- [Changelog](https://github.com/NimbleMarkets/ntcharts/blob/v0.5.2/CHANGELOG.md)
- [Commits](NimbleMarkets/ntcharts@v0.5.1...v0.5.2)

Updates `github.com/bmatcuk/doublestar/v4` from 4.10.2 to 4.10.4
- [Release notes](https://github.com/bmatcuk/doublestar/releases)
- [Commits](bmatcuk/doublestar@v4.10.2...v4.10.4)

Updates `github.com/charmbracelet/ultraviolet` from 0.0.0-20260910203606-6c9e17dc7a16 to 0.0.0-20261008173134-6b8d4baf91b4
- [Commits](https://github.com/charmbracelet/ultraviolet/commits)

Updates `github.com/charmbracelet/x/ansi` from 0.11.8 to 0.11.9
- [Commits](charmbracelet/x@ansi/v0.11.8...ansi/v0.11.9)

Updates `github.com/charmbracelet/x/exp/charmtone` from 0.0.0-20260920004010-53e2afe73ae5 to 0.1.1
- [Commits](https://github.com/charmbracelet/x/commits/vcr/v0.1.1)

Updates `github.com/charmbracelet/x/exp/golden` from 0.0.0-20250806222409-83e3a29d542f to 0.1.0
- [Commits](https://github.com/charmbracelet/x/commits/v0.1.0)

Updates `github.com/charmbracelet/x/exp/slice` from 0.0.0-20260920004010-53e2afe73ae5 to 0.1.0
- [Commits](https://github.com/charmbracelet/x/commits/v0.1.0)

Updates `github.com/coregx/gxpdf` from 0.9.4 to 0.9.10
- [Release notes](https://github.com/coregx/gxpdf/releases)
- [Changelog](https://github.com/coregx/gxpdf/blob/main/CHANGELOG.md)
- [Commits](coregx/gxpdf@v0.9.4...v0.9.10)

Updates `github.com/gen2brain/beeep` from 0.11.2 to 0.11.3
- [Commits](gen2brain/beeep@v0.11.2...v0.11.3)

Updates `github.com/go-git/go-git/v5` from 5.19.2 to 5.19.3
- [Release notes](https://github.com/go-git/go-git/releases)
- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md)
- [Commits](go-git/go-git@v5.19.2...v5.19.3)

Updates `github.com/itchyny/gojq` from 0.12.19 to 0.12.20
- [Release notes](https://github.com/itchyny/gojq/releases)
- [Changelog](https://github.com/itchyny/gojq/blob/main/CHANGELOG.md)
- [Commits](itchyny/gojq@v0.12.19...v0.12.20)

Updates `github.com/labstack/echo/v5` from 5.4.2 to 5.4.4
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md)
- [Commits](labstack/echo@v5.4.2...v5.4.4)

Updates `github.com/landlock-lsm/go-landlock` from 0.10.1 to 0.11.0
- [Release notes](https://github.com/landlock-lsm/go-landlock/releases)
- [Commits](landlock-lsm/go-landlock@v0.10.1...v0.11.0)

Updates `github.com/ncruces/go-sqlite3` from 0.35.5 to 0.36.0
- [Release notes](https://github.com/ncruces/go-sqlite3/releases)
- [Commits](ncruces/go-sqlite3@v0.35.5...v0.36.0)

Updates `github.com/pdfcpu/pdfcpu` from 0.15.0 to 0.16.4
- [Release notes](https://github.com/pdfcpu/pdfcpu/releases)
- [Commits](pdfcpu/pdfcpu@v0.15.0...v0.16.4)

Updates `github.com/pressly/goose/v3` from 3.28.0 to 3.29.0
- [Release notes](https://github.com/pressly/goose/releases)
- [Changelog](https://github.com/pressly/goose/blob/main/CHANGELOG.md)
- [Commits](pressly/goose@v3.28.0...v3.29.0)

Updates `github.com/tidwall/gjson` from 1.19.0 to 1.20.0
- [Commits](tidwall/gjson@v1.19.0...v1.20.0)

Updates `github.com/tidwall/sjson` from 1.2.5 to 1.2.6
- [Commits](tidwall/sjson@v1.2.5...v1.2.6)

Updates `github.com/xuri/excelize/v2` from 2.11.1-0.20261008044812-1cf5392f4fb7 to 2.11.1
- [Release notes](https://github.com/xuri/excelize/releases)
- [Commits](https://github.com/xuri/excelize/commits/v2.11.1)

Updates `go.opentelemetry.io/otel` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/metric` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/trace` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `golang.design/x/clipboard` from 0.9.0 to 0.11.0

Updates `golang.org/x/exp` from 0.0.0-20260908205506-85c1c2202aba to 0.0.0-20261014143641-f0251eb4aa3e
- [Commits](https://github.com/golang/exp/commits)

Updates `modernc.org/sqlite` from 1.59.0 to 1.60.1
- [Release notes](https://gitlab.com/cznic/sqlite/tags)
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.59.0...v1.60.1)

---
updated-dependencies:
- dependency-name: charm.land/bubbletea/v2
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: charm.land/catwalk
  dependency-version: 0.52.86
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: charm.land/fantasy
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/Arize-ai/openinference/go/openinference-semantic-conventions
  dependency-version: 0.1.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/Microsoft/go-winio
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/NimbleMarkets/ntcharts
  dependency-version: 0.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/bmatcuk/doublestar/v4
  dependency-version: 4.10.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/charmbracelet/ultraviolet
  dependency-version: 0.0.0-20261008173134-6b8d4baf91b4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/charmbracelet/x/ansi
  dependency-version: 0.11.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/charmbracelet/x/exp/charmtone
  dependency-version: 0.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/charmbracelet/x/exp/golden
  dependency-version: 0.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/charmbracelet/x/exp/slice
  dependency-version: 0.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/coregx/gxpdf
  dependency-version: 0.9.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/gen2brain/beeep
  dependency-version: 0.11.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.19.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/itchyny/gojq
  dependency-version: 0.12.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/labstack/echo/v5
  dependency-version: 5.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/landlock-lsm/go-landlock
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/ncruces/go-sqlite3
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/pdfcpu/pdfcpu
  dependency-version: 0.16.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/pressly/goose/v3
  dependency-version: 3.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/tidwall/gjson
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/tidwall/sjson
  dependency-version: 1.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/xuri/excelize/v2
  dependency-version: 2.11.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: go.opentelemetry.io/otel/metric
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: go.opentelemetry.io/otel/trace
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: golang.design/x/clipboard
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: golang.org/x/exp
  dependency-version: 0.0.0-20261014143641-f0251eb4aa3e
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: modernc.org/sqlite
  dependency-version: 1.60.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: area: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants