gomod(deps): Bump the go-deps group across 1 directory with 9 updates

[dependabot]

Bumps the go-deps group with 8 updates in the / directory:

Package	From	To
charm.land/bubbles/v2	2.1.0	2.1.1
github.com/alecthomas/kong	1.15.0	1.16.0
github.com/containerd/containerd/v2	2.3.0	2.3.3
github.com/docker/cli	29.4.2+incompatible	29.6.2+incompatible
github.com/moby/buildkit	0.29.0	0.31.2
github.com/moby/moby/client	0.4.1	0.5.0
github.com/posthog/posthog-go	1.12.4	1.22.0
github.com/tidwall/gjson	1.18.0	1.19.0

Updates charm.land/bubbles/v2 from 2.1.0 to 2.1.1

Release notes

Sourced from charm.land/bubbles/v2's releases.

v2.1.1

Lil’ Textarea Fix

This is a tiny patch to fix a bug in textarea where the prompt character could be missing styling on empty lines. That’s all for now!

Thanks for using Bubbles, Charm 🌞

Changelog

Fixed

• d2b2217d6352ce04183623d66d4266115419733c: fix(textarea): apply prompt style on all lines, including fillers (@​meowgorithm)

Docs

• a13f110fba4f13ce5fe9bc7fd51619f5782077b9: docs: fix typo in README (#921) (@​Rohan5commit)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

• d2b2217 fix(textarea): apply prompt style on all lines, including fillers
• 0dafc72 chore(deps): bump actions/checkout from 6 to 7 in the all group (#1006)
• 492ed7d chore(deps): bump the all group with 2 updates (#1004)
• 40d145e chore(deps): bump the all group with 2 updates (#996)
• 8585ef8 chore(deps): bump github.com/sahilm/fuzzy in the all group (#969)
• ef0090e chore: remove CODEOWNERS
• 6feda24 chore(deps): bump the all group with 3 updates (#958)
• 42130e8 chore(deps): bump github.com/mattn/go-runewidth in the all group (#952)
• 0d62ce2 chore(deps): bump dependabot/fetch-metadata from 2 to 3 in the all group (#953)
• 204774b chore(deps): bump github.com/mattn/go-runewidth in the all group (#945)
• Additional commits viewable in compare view

Updates charm.land/bubbletea/v2 from 2.0.6 to 2.0.7

Release notes

Sourced from charm.land/bubbletea/v2's releases.

v2.0.7

A few lil’ stability patches

Hi! This is a patch release with a few solid improvements around stability and correctness.

• @​lrstanley, one of our faves, fixed a race condition around mice in the Cursed Renderer
• @​lawrence3699 fixed a panic that could happen when input's not available
• We fixed a correctness issue with regard to mouse releases when Kitty Keyboard was active (thanks, @​mitchellh)

Thanks for using Bubble Tea, and if you see anything awry please do let us know!

—Charm 👋

Changelog

Fixed

• c60f0c53042238305ec13b486326588f12aea0ec: fix: prevent data race with cursedRenderer.onMouse (#1691) (@​lrstanley)
• 074596e14e2f5ca5e3986ee72e7c08f1569c4178: fix: skip input reader restore when input is disabled (#1680) (@​lawrence3699)
• 878d7df2f2b02f3ca8db177fa8553834bc35ea7c: fix(deps): bump ultraviolet for kitty keyboard fix (@​meowgorithm)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

• a23da80 v2.0.7
• 670963e chore(task): add release and fetch-tags tasks
• 29c4c32 fix(examples/deps): go mod tidy
• 878d7df chore(deps): bump ultraviolet for kitty keyboard fix
• c60f0c5 fix: prevent data race with cursedRenderer.onMouse (#1691)
• 640d879 docs(readme): update footer image
• 0fbefd2 chore: remove CODEOWNERS
• 074596e fix: skip input reader restore when input is disabled (#1680)
• See full diff in compare view

Updates github.com/alecthomas/kong from 1.15.0 to 1.16.0

Commits

• 8cbde34 Fix panic when a float flag is resolved from an integer value (#621)
• 649eaf2 chore(deps): update all non-major dependencies (#622)
• ae4bfdd fix: correct typos in resolver.go and README.md (#617)
• c2c0229 Fix env var validation conflicts (#619)
• f95198e chore(deps): update all non-major dependencies (#608)
• b03afc3 treat single-character aliases as short flags (#605)
• 66d2f03 chore(deps): update actions/checkout action to v7 (#609)
• 3c99622 Fix formatting and clarify passthrough mode in README (#610)
• 9d8d9f7 Allow a node with a Run() method to run without a subcommand (#614)
• ff16446 Fix duplicate embedded callback hooks (#616)
• Additional commits viewable in compare view

Updates github.com/containerd/containerd/v2 from 2.3.0 to 2.3.3

Release notes

Sourced from github.com/containerd/containerd/v2's releases.

containerd 2.3.3

Welcome to the v2.3.3 release of containerd!

The third patch release for containerd 2.3 contains various fixes and updates.

Highlights

• Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services (#13694)

Container Runtime Interface (CRI)

• Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit (#13697)
• Reject CreateContainer calls when the target sandbox is not running (#13668)
• Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks (#13645)

Image Distribution

• Surface OCI error bodies in registry 403 responses by falling back to GET requests (#13738)

Snapshotters

• Align default 4K mkfs block size for EROFS across all platforms (#13632)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Maksym Pavlenko
• Samuel Karp
• Chris Henzie
• Phil Estes
• Sebastiaan van Stijn
• Akihiro Suda
• Austin Vazquez
• Chris Crone
• Derek McGowan
• Maksim An
• crawfordxx
• cshung
• lauralorenz

Changes

• Prepare release notes for v2.3.3 (#13750)
  • 7f6cee02a Prepare release notes for v2.3.3
• CI: migrate Vagrant to Lima (#13744)
  • 7316210ce CI: migrate Vagrant to Lima

... (truncated)

Commits

• aad1100 Merge pull request #13750 from chrishenzie/prepare-v2.3.3
• 7f6cee0 Prepare release notes for v2.3.3
• bc63467 Merge pull request #13744 from AkihiroSuda/cherrypick-13728-2.3
• 7316210 CI: migrate Vagrant to Lima
• dc84019 Merge pull request #13738 from k8s-infra-cherrypick-robot/cherry-pick-13547-t...
• 457fba3 remotes: surface OCI error body on HEAD 403 via GET fallback
• 5e5581f Merge pull request #13732 from k8s-infra-cherrypick-robot/cherry-pick-13725-t...
• dc2df93 Update go to 1.26.5
• e2240ef Merge pull request #13711 from k8s-infra-cherrypick-robot/cherry-pick-13707-t...
• 5be0495 ci: pin fog-json to resolve gem conflict
• Additional commits viewable in compare view

Updates github.com/docker/cli from 29.4.2+incompatible to 29.6.2+incompatible

Commits

• dfc4efb Merge pull request #7109 from vvoland/update-docker
• dba8675 Bump to 29.6.2
• d9aefe5 Merge tag 'v29.6.1' into 29.x
• 9182b35 Merge tag 'v29.6.0' into 29.x
• 0ae55a3 Merge tag 'v29.5.3' into 29.x
• 029a4b2 Merge tag 'v29.5.2' into 29.x
• e596fea Merge tag 'v29.5.1' into 29.x
• 0c72f45 Merge tag 'v29.5.0' into 29.x
• 26f2736 Merge tag 'v29.4.1' into 29.x
• ac4c4df Merge tag 'v29.4.0' into 29.x
• Additional commits viewable in compare view

Updates github.com/moby/buildkit from 0.29.0 to 0.31.2

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.31.2

Welcome to the v0.31.2 release of buildkit!

This is a security patch release with four moderate and one low severity security fixes.

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Dawei Wei

Notable Changes

• Git source checkout from a bundle file could lead to command injection. GHSA-hw3h-2gp9-cxpv
• Possible panic when incorrect parameters sent from frontend. GHSA-qx3x-mv6r-52p6
• LLB file operation can be tricked to remove /tmp directory contents. GHSA-32pv-7hq5-qhwq
• Malicious client can bypass destination directory validation on local sources upload. GHSA-g2h8-426c-7976
• WCOW cache mount source selector resolves NTFS junctions outside of cache root. GHSA-388v-wmr2-g2v2
• Fix possible buildctl failures after successful builds over slow connhelper transports. #6940
• Fix possible daemon crash during concurrent builds. #6916

Dependency Changes

• github.com/tonistiigi/fsutil 0257b3308df4 -> 30cd4fc5d911

Previous release can be found at v0.31.1

v0.31.1

buildkit 0.31.1

Welcome to the v0.31.1 release of buildkit!

This is a security patch release with two low severity security fixes.

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi

Notable Changes

• Custom frontend could bypass Seccomp/AppArmor restrictions GHSA-7236-3392-c5c6
• Possible runtime DoS via unbounded group parsing GHSA-72x6-4j93-7w86

... (truncated)

Commits

• e42e1bf Merge pull request #6960 from tonistiigi/v0.31.2-picks
• 1a32681 vendor: update github.com/tonistiigi/fsutil to 30cd4fc5d911
• 0669f4b executor/oci: avoid delete access for WCOW pin
• 44c0ed6 executor/oci: pin resolved WCOW cache source
• 473663b executor/oci: pin WCOW cache mount source across mount realization
• a9155a4 executor/oci: confine WCOW cache mount source within cache root
• 3916124 fileop: contain rm parent traversal
• 5aefc4a solver: reject negative LLB input indexes
• 1659c30 solver: add tests for op input index validation
• ed77788 solver: validate op input indices to avoid panics
• Additional commits viewable in compare view

Updates github.com/moby/moby/client from 0.4.1 to 0.5.0

Release notes

Sourced from github.com/moby/moby/client's releases.

client/0.5.0

0.5.0

Changelog

• The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

client/v0.5.0-rc.1

0.5.0-rc.1

Changelog

• The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

Changelog

Sourced from github.com/moby/moby/client's changelog.

0.5.0 (2013-07-17)

• Runtime: List all processes running inside a container with 'docker top'
• Runtime: Host directories can be mounted as volumes with 'docker run -v'
• Runtime: Containers can expose public UDP ports (eg, '-p 123/udp')
• Runtime: Optionally specify an exact public port (eg. '-p 80:4500')
• Registry: New image naming scheme inspired by Go packaging convention allows arbitrary combinations of registries
• Builder: ENTRYPOINT instruction sets a default binary entry point to a container
• Builder: VOLUME instruction marks a part of the container as persistent data

• Builder: 'docker build' displays the full output of a build by default
• Runtime: 'docker login' supports additional options

• Runtime: Dont save a container's hostname when committing an image.
• Registry: Fix issues when uploading images to a private registry

0.4.8 (2013-07-01)

• Builder: New build operation ENTRYPOINT adds an executable entry point to the container.

• Runtime: Fix a bug which caused 'docker run -d' to no longer print the container ID.
• Tests: Fix issues in the test suite

0.4.7 (2013-06-28)

• Registry: easier push/pull to a custom registry
• Remote API: the progress bar updates faster when downloading and uploading large files

• Remote API: fix a bug in the optional unix socket transport

• Runtime: improve detection of kernel version

• Runtime: host directories can be mounted as volumes with 'docker run -b'

• Runtime: fix an issue when only attaching to stdin

• Runtime: use 'tar --numeric-owner' to avoid uid mismatch across multiple hosts
• Hack: improve test suite and dev environment
• Hack: remove dependency on unit tests on 'os/user'

• Documentation: add terminology section

0.4.6 (2013-06-22)

• Runtime: fix a bug which caused creation of empty images (and volumes) to crash.

0.4.5 (2013-06-21)

• Builder: 'docker build git://URL' fetches and builds a remote git repository

• Runtime: 'docker ps -s' optionally prints container size
• Tests: Improved and simplified

• Runtime: fix a regression introduced in 0.4.3 which caused the logs command to fail.
• Builder: fix a regression when using ADD with single regular file.

0.4.4 (2013-06-19)

• Builder: fix a regression introduced in 0.4.3 which caused builds to fail on new clients.

0.4.3 (2013-06-19)

• Builder: ADD of a local file will detect tar archives and unpack them

• Runtime: Remove bsdtar dependency
• Runtime: Add unix socket and multiple -H support
• Runtime: Prevent rm of running containers
• Runtime: Use go1.1 cookiejar
• Builder: ADD improvements: use tar for copy + automatically unpack local archives

... (truncated)

Commits

• 51f6c4a Merge pull request #1227 from dotcloud/bump_0.5.0
• f4eaec3 Merge pull request #1226 from metalivedev/easydockerfile
• b083418 change -b -> -v and add udp example
• 5794857 Merge pull request #1169 from crosbymichael/buildfile-tests
• e7f3f6f Add unit tests for buildfile config instructions
• aa56714 Make dockerfile docs easier to find. Clean up formatting.
• f8dfd0a Merge pull request #1225 from dotcloud/hotfix_docker_rmi
• 3dbf9c6 Merge pull request #1219 from metalivedev/docs-repoupdate
• de563a3 Merge pull request #1194 from crosbymichael/build-verbose
• 9cf2b41 change rm usage in docs
• Additional commits viewable in compare view

Updates github.com/posthog/posthog-go from 1.12.4 to 1.22.0

Release notes

Sourced from github.com/posthog/posthog-go's releases.

1.22.0

Unreleased

1.21.0

Unreleased

1.20.0

Unreleased

1.19.0

Unreleased

1.18.0

Unreleased

1.17.5

Unreleased

1.17.4

Unreleased

1.17.3

Unreleased

1.17.2

Unreleased

1.17.1

Unreleased

1.17.0

Unreleased

1.16.2

Unreleased

1.16.1

Unreleased

1.16.0

Unreleased

1.15.1

Unreleased

1.15.0

Unreleased

1.14.0

Unreleased

... (truncated)

Changelog

Sourced from github.com/posthog/posthog-go's changelog.

1.22.0

Minor Changes

• f102f70: Error tracking stack traces now support server-side symbolication. When the running executable's identity can be determined (GNU build id on Linux, LC_UUID on macOS), the default extractor emits frames with raw instruction addresses and client-expanded inline groups, and exceptions carry a $debug_images property, so PostHog can re-symbolicate against debug symbols uploaded with posthog-cli symbol-sets upload — including exact inline expansion and source context. Without uploaded symbols the runtime-resolved frames are kept as-is, and when the executable can't be identified the frames keep their previous plain shape.

  Requires a PostHog backend with grouped inline frame support (PostHog Cloud, or self-hosted ≥ July 2026). Older backends resolve each group member independently, which duplicates inline expansions when debug symbols are uploaded. To keep the previous plain frames, use a custom StackTraceExtractor.

1.21.0

Minor Changes

• 9e9ad63: Send minimal $feature_flag_called events when the server enables it. When the /flags?v=2 response carries minimalFlagCalledEvents: true (remote evaluation) or the local-evaluation definitions payload carries minimal_flag_called_events: true, and the evaluated flag has has_experiment: false, the event keeps only a strict allowlist of evaluation properties ($feature_flag, $feature_flag_response, $feature_flag_has_experiment, $feature_flag_id, $feature_flag_version, $feature_flag_reason, $feature_flag_request_id, $feature_flag_evaluated_at, $feature_flag_error, locally_evaluated, $groups, $process_person_profile, $geoip_disable, $is_server, $session_id, $window_id, $device_id, $lib, $lib_version) plus static system context ($os, $os_version, $os_distro, $go_version); everything else — including Config.DefaultEventProperties and the snapshot path's $feature/<key> and $feature_flag_payload — is stripped. Any missing signal (gate absent, has_experiment unknown, experiment-linked flag, legacy response shapes) keeps today's full event shape. The gate is server-controlled per project; no SDK configuration is added.

1.20.0

Minor Changes

• 3ea8ce6: Error tracking stack frames are now sent in the canonical cross-SDK wire order: the entry point is first and the crash/capture site is last. Previously frames were sent innermost-first. Coordinated rollout: the ingestion pipeline gates on $lib_version, so this ships as a minor release.

1.19.0

Minor Changes

• 154fd08: Add a $feature_flag_has_experiment boolean property to $feature_flag_called events. The value comes from the has_experiment field the server reports on flag metadata (/flags?v=2) and on local-evaluation flag definitions. The property is only sent when the server explicitly reported has_experiment (true or false); it is omitted when unknown (older deployments, v3 responses, or flags missing from the response).

1.18.0

Minor Changes

• 39c72dc: Drop the newest event instead of blocking when the in-memory queue is full, and make the queue size configurable.

  • Enqueue now returns ErrQueueFull when the queue is full, dropping the newest message rather than blocking the caller until space frees up. This matches posthog-python and posthog-rs. The drop is reported only through the returned error, not through Callback.Failure, so it stays cheap and off the callback goroutines under sustained overload. Backfill/bulk callers: check the error returned by Enqueue for ErrQueueFull and throttle or retry (or raise MaxQueueSize); otherwise events that overflow the queue are dropped, not delayed.
  • Add Config.MaxQueueSize (default DefaultMaxQueueSize = 10000) to control the in-memory message queue capacity independently of BatchSize. It is clamped up to BatchSize so the queue always holds at least one full batch. This replaces the previous hardcoded BatchSize * 10 sizing.
  • Change the default BatchSize (DefaultBatchSize) from 250 to 100, aligning with posthog-python, posthog-node, and posthog-rs. Callers that set BatchSize explicitly are unaffected.

1.17.5

Patch Changes

• fe66557: Change the default capture delivery budget from 10 attempts to 4 (DefaultMaxAttempts) when Config.MaxRetries is unset, aligning with the cross-SDK Capture V1 parity standard (posthog-rs uses the same envelope). This affects both the v0 (/batch/) and v1 send paths, since they share the attempt budget. Callers that set MaxRetries explicitly are unaffected.
• 3d8404a: Unify the capture retry backoff ceiling at 30s. DefaultBackoff's cap changes from 10s to 30s (default only — override via Config.RetryAfter), and the Capture V1 send now clamps a server Retry-After to the same 30s so a hostile or buggy header cannot park a batch goroutine. Retry-After still acts as a minimum; the configured backoff is never truncated. This aligns the default retry behavior with posthog-rs and posthog-python.

1.17.4

Patch Changes

• 25e43f8: Stop duplicating distinct_id inside /flags person properties.

1.17.3

... (truncated)

Commits

• 6b63077 chore: release v1.22.0 [version bump] [skip ci]
• f102f70 feat(error-tracking): grouped inline frames + debug images for server-side sy...
• 73399d9 chore: release v1.21.0 [version bump] [skip ci]
• 9e9ad63 feat(flags): minimize $feature_flag_called events for non-experiment flags (#...
• 10bec86 chore: release v1.20.0 [version bump] [skip ci]
• 3ea8ce6 feat: send error tracking stack frames in canonical bottom-up order (#254)
• 901880f chore: release v1.19.0 [version bump] [skip ci]
• 154fd08 feat(flags): add $feature_flag_has_experiment to $feature_flag_called events ...
• 9e7c67e chore: release v1.18.0 [version bump] [skip ci]
• 39c72dc feat: drop newest on full queue, add configurable MaxQueueSize (#258)
• Additional commits viewable in compare view

Updates github.com/tidwall/gjson from 1.18.0 to 1.19.0

Commits

• 0fac2c9 Add iterator functions All, Keys, and Values
• 4d23028 Add repo url
• 10d2662 Add copyright comment
• 4a91ee1 Update README.md
• See full diff in compare view