Repository navigation
chore(deps): bump minor Go dependencies - #168
Merged
Merged
Conversation
Release binaries are built from the go.mod version (setup-go uses go-version-file), so they were compiled with go1.25.12. govulncheck reports five stdlib vulnerabilities reachable from our code on that toolchain (crypto/tls, net/http, net/url via the self-updater and httputil.Do; encoding/xml via snapshot dock plist parsing; encoding/asn1). Go 1.25 is also out of support since the 1.27 release. On go1.26.8 govulncheck reports 0 reachable vulnerabilities; vet, L1 (make test-unit) and golangci-lint v2.11.4 are clean.
bubbletea v1.3.0 -> v1.3.10 lipgloss v1.0.0 -> v1.1.0 cobra v1.8.1 -> v1.10.2 (pflag v1.0.5 -> v1.0.9) testify v1.11.1 -> v1.12.1 x/term v0.39.0 -> v0.46.0 x/sys v0.40.0 -> v0.48.0 (fixes GO-2026-5024, Windows-only) x/term and x/sys now require go >= 1.26.0, so this sits on top of the Go 1.26.8 toolchain bump. vet, L1 (make test-unit), golangci-lint v2.11.4 clean; govulncheck reports no vulnerabilities. Because lipgloss 1.1 changes color-profile detection and x/ansi jumps 0.8 -> 0.10, the TTY wizard was also driven through six screens in a fixed-size tmux pane with before/after binaries: captures including ANSI escapes are byte-identical.
5 of 8 tasks
4 of 6 tasks
4 of 7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Minor and patch bumps for the direct Go dependencies:
Prerequisite #166 is merged. Current x/term and x/sys require
go >= 1.26.0. This PR now targetsmainand includes the current Go toolchain and macOS 15 CI runner changes.Why?
Testing
Revalidated on October 8 against current
main: all six required checks pass, including the full macOS VM suite (5m15s). The Claude action failed before producing a review; the full dependency diff was reviewed locally with no blocking findings.go vet ./...passes (go1.26.8)make test-unit(L1): 24/24 packages okgolangci-lint v2.11.4: 0 issuesopenboot install -p minimal --dry-runin a 110×36 tmux pane (TERM=xterm-256color,COLORTERM=truecolor) with the same keystrokes. The six screens covered initial select, move+toggle, filter, catalog pane, review plan, and the dry-run apply. Captures including ANSI escape sequences are byte-identical between before and after.Cross-repo checklist
openboot.dev? NoNotes for reviewer
/gitdidn't visibly register, so that screen equals the previous one on both binaries. Filter-mode rendering wasn't separately exercised. Other terminals and color profiles (Apple Terminal 256-color,NO_COLOR) weren't compared.go.yaml.in/yaml/v3appears.