gomod(deps): Bump the go-deps group across 1 directory with 11 updates

[dependabot]

Bumps the go-deps group with 10 updates in the / directory:

Package	From	To
charm.land/bubbles/v2	2.1.0	2.1.1
github.com/alecthomas/kong	1.15.0	1.16.1
github.com/charmbracelet/x/ansi	0.11.7	0.11.8
github.com/containerd/containerd/v2	2.3.0	2.3.3
github.com/docker/cli	29.4.2+incompatible	29.7.2+incompatible
github.com/moby/buildkit	0.29.0	0.32.2
github.com/moby/moby/client	0.4.1	0.5.1
github.com/posthog/posthog-go	1.12.4	1.23.0
github.com/tidwall/gjson	1.18.0	1.19.0
golang.org/x/mod	0.38.0	0.39.0

Updates charm.land/bubbles/v2 from 2.1.0 to 2.1.1

Release notes

Sourced from charm.land/bubbles/v2's releases.

v2.1.1

Lil’ Textarea Fix

This is a tiny patch to fix a bug in textarea where the prompt character could be missing styling on empty lines. That’s all for now!

Thanks for using Bubbles, Charm 🌞

Changelog

Fixed

• d2b2217d6352ce04183623d66d4266115419733c: fix(textarea): apply prompt style on all lines, including fillers (@​meowgorithm)

Docs

• a13f110fba4f13ce5fe9bc7fd51619f5782077b9: docs: fix typo in README (#921) (@​Rohan5commit)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

• d2b2217 fix(textarea): apply prompt style on all lines, including fillers
• 0dafc72 chore(deps): bump actions/checkout from 6 to 7 in the all group (#1006)
• 492ed7d chore(deps): bump the all group with 2 updates (#1004)
• 40d145e chore(deps): bump the all group with 2 updates (#996)
• 8585ef8 chore(deps): bump github.com/sahilm/fuzzy in the all group (#969)
• ef0090e chore: remove CODEOWNERS
• 6feda24 chore(deps): bump the all group with 3 updates (#958)
• 42130e8 chore(deps): bump github.com/mattn/go-runewidth in the all group (#952)
• 0d62ce2 chore(deps): bump dependabot/fetch-metadata from 2 to 3 in the all group (#953)
• 204774b chore(deps): bump github.com/mattn/go-runewidth in the all group (#945)
• Additional commits viewable in compare view

Updates charm.land/bubbletea/v2 from 2.0.6 to 2.0.7

Release notes

Sourced from charm.land/bubbletea/v2's releases.

v2.0.7

A few lil’ stability patches

Hi! This is a patch release with a few solid improvements around stability and correctness.

• @​lrstanley, one of our faves, fixed a race condition around mice in the Cursed Renderer
• @​lawrence3699 fixed a panic that could happen when input's not available
• We fixed a correctness issue with regard to mouse releases when Kitty Keyboard was active (thanks, @​mitchellh)

Thanks for using Bubble Tea, and if you see anything awry please do let us know!

—Charm 👋

Changelog

Fixed

• c60f0c53042238305ec13b486326588f12aea0ec: fix: prevent data race with cursedRenderer.onMouse (#1691) (@​lrstanley)
• 074596e14e2f5ca5e3986ee72e7c08f1569c4178: fix: skip input reader restore when input is disabled (#1680) (@​lawrence3699)
• 878d7df2f2b02f3ca8db177fa8553834bc35ea7c: fix(deps): bump ultraviolet for kitty keyboard fix (@​meowgorithm)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

• a23da80 v2.0.7
• 670963e chore(task): add release and fetch-tags tasks
• 29c4c32 fix(examples/deps): go mod tidy
• 878d7df chore(deps): bump ultraviolet for kitty keyboard fix
• c60f0c5 fix: prevent data race with cursedRenderer.onMouse (#1691)
• 640d879 docs(readme): update footer image
• 0fbefd2 chore: remove CODEOWNERS
• 074596e fix: skip input reader restore when input is disabled (#1680)
• See full diff in compare view

Updates github.com/alecthomas/kong from 1.15.0 to 1.16.1

Commits

• 0678fd3 Fix disabled DefaultEnvars help suffix (#638)
• 33d3305 Fix single-character alias leaking between sibling commands (#637)
• a5c9626 Fix counter panic on a uint or float field with an explicit --flag=N (#626)
• b401ebf Fix filecontent mapper panicking on a non-[]byte target (#625)
• 8cbde34 Fix panic when a float flag is resolved from an integer value (#621)
• 649eaf2 chore(deps): update all non-major dependencies (#622)
• ae4bfdd fix: correct typos in resolver.go and README.md (#617)
• c2c0229 Fix env var validation conflicts (#619)
• f95198e chore(deps): update all non-major dependencies (#608)
• b03afc3 treat single-character aliases as short flags (#605)
• Additional commits viewable in compare view

Updates github.com/charmbracelet/x/ansi from 0.11.7 to 0.11.8

Commits

• 00c6608 fix(wcwidth): measure wcwidth per codepoint (#933)
• 240ce7b chore: lint cellbuf (#944)
• c2cf573 chore(ansi): lint (#943)
• 3755eba chore(deps): bump github.com/charmbracelet/x/xpty (#932)
• 75eb341 chore(deps): bump github.com/mattn/go-runewidth (#925)
• 7e2d3e6 fix(xpty): report context cancellation in WaitProcess
• 41c9e6b chore(deps): bump github.com/mattn/go-runewidth (#924)
• 482a565 chore(powernap): update lsp configs from nvim-lspconfig
• 3eef36e chore(deps): bump github.com/bits-and-blooms/bitset (#914)
• 872754a chore(deps): bump golang.org/x/sys (#909)
• Additional commits viewable in compare view

Updates github.com/containerd/containerd/v2 from 2.3.0 to 2.3.3

Release notes

Sourced from github.com/containerd/containerd/v2's releases.

containerd 2.3.3

Welcome to the v2.3.3 release of containerd!

The third patch release for containerd 2.3 contains various fixes and updates.

Highlights

• Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services (#13694)

Container Runtime Interface (CRI)

• Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit (#13697)
• Reject CreateContainer calls when the target sandbox is not running (#13668)
• Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks (#13645)

Image Distribution

• Surface OCI error bodies in registry 403 responses by falling back to GET requests (#13738)

Snapshotters

• Align default 4K mkfs block size for EROFS across all platforms (#13632)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Maksym Pavlenko
• Samuel Karp
• Chris Henzie
• Phil Estes
• Sebastiaan van Stijn
• Akihiro Suda
• Austin Vazquez
• Chris Crone
• Derek McGowan
• Maksim An
• crawfordxx
• cshung
• lauralorenz

Changes

• Prepare release notes for v2.3.3 (#13750)
  • 7f6cee02a Prepare release notes for v2.3.3
• CI: migrate Vagrant to Lima (#13744)
  • 7316210ce CI: migrate Vagrant to Lima

... (truncated)

Commits

• aad1100 Merge pull request #13750 from chrishenzie/prepare-v2.3.3
• 7f6cee0 Prepare release notes for v2.3.3
• bc63467 Merge pull request #13744 from AkihiroSuda/cherrypick-13728-2.3
• 7316210 CI: migrate Vagrant to Lima
• dc84019 Merge pull request #13738 from k8s-infra-cherrypick-robot/cherry-pick-13547-t...
• 457fba3 remotes: surface OCI error body on HEAD 403 via GET fallback
• 5e5581f Merge pull request #13732 from k8s-infra-cherrypick-robot/cherry-pick-13725-t...
• dc2df93 Update go to 1.26.5
• e2240ef Merge pull request #13711 from k8s-infra-cherrypick-robot/cherry-pick-13707-t...
• 5be0495 ci: pin fog-json to resolve gem conflict
• Additional commits viewable in compare view

Updates github.com/docker/cli from 29.4.2+incompatible to 29.7.2+incompatible

Commits

• a7dcaa6 Merge pull request #7151 from vvoland/update-archive
• 400b45f vendor: github.com/moby/go-archive v0.3.3
• 38887ec Merge pull request #7145 from winklemad/fix-service-duplicate-removal-panic
• 904aef7 Merge pull request #7147 from docker/dependabot/github_actions/docker-actions...
• f08e60e build(deps): bump docker/docker-agent-action/.github/workflows/review-pr.yml
• abfd891 Merge pull request #7149 from vvoland/update-docker
• 519eb45 VERSION: 29.7.2
• 8717af7 cli/command/service: fix panic when removing duplicate values
• e9452d6 Merge pull request #7142 from thaJeztah/bump_go_archive_0.3.2
• a6014a7 vendor: github.com/moby/go-archive v0.3.2
• Additional commits viewable in compare view

Updates github.com/moby/buildkit from 0.29.0 to 0.32.2

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.32.2

Welcome to the v0.32.2 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

• CrazyMax

Notable Changes

• Revert the v0.32.1 OCI artifact attestation push-order workaround, restoring BuildKit's spec-aligned behavior of allowing referrers to be pushed before their subject manifests. #7016

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.32.1

v0.32.1

Welcome to the v0.32.1 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

• CrazyMax

Notable Changes

• Fix archive extraction through implied parent directories and absolute symlinks. #7005
• Fix OCI artifact attestation pushes to registries that strictly validate subject references. #7012

Dependency Changes

• github.com/moby/go-archive v0.2.1 -> v0.2.0

Previous release can be found at v0.32.0

v0.32.0

Welcome to the v0.32.0 release of buildkit!

... (truncated)

Commits

• 991535e Merge pull request #7016 from crazy-max/v0.32_backport_7015
• b4e609f exporter: revert attestation manifest push order
• f1697c4 Merge pull request #7013 from crazy-max/v0.32-backport-7012
• c300afc exporter: fix attestation manifest push order
• 68bcd7d Merge pull request #7006 from crazy-max/v0.32-pick-0.32.1
• 640eb23 dockerfile: test ADD hardlinks through absolute symlinks
• c7dc8c8 dockerfile: regression test for ADD archives through absolute symlinks
• f3b57e4 dockerfile: regression test for ADD archives with implied parents
• 5f3d92c Revert "vendor: github.com/moby/go-archive v0.2.1"
• f5d08d5 Merge pull request #6992 from crazy-max/fix-export-finalize-test
• Additional commits viewable in compare view

Updates github.com/moby/moby/client from 0.4.1 to 0.5.1

Release notes

Sourced from github.com/moby/moby/client's releases.

client/v0.5.1

0.5.1

Changelog

• client/pkg/jsonmessage: Display: fix godoc link. moby/moby#53070
• client: ServiceCreate, ServiceUpdate: fix duplicate and 'unkown' platforms. moby/moby#53012
• client: ServiceInspect, ContainerCommit: omit optional query args if not set. moby/moby#53010
• golangci-lint: enable perfsprint linter. moby/moby#53016

client/0.5.0

0.5.0

Changelog

• The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

client/v0.5.0-rc.1

0.5.0-rc.1

Changelog

• The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

Changelog

Sourced from github.com/moby/moby/client's changelog.

0.5.1 (2013-07-30)

• API: Docker client now sets useragent (RFC 2616)
• Runtime: Add ps args to docker top
• Runtime: Add support for container ID files (pidfile like)
• Runtime: Add container=lxc in default env
• Runtime: Support networkless containers with docker run -n and docker -d -b=none
• API: Add /events endpoint
• Builder: ADD command now understands URLs
• Builder: CmdAdd and CmdEnv now respect Dockerfile-set ENV variables

• Hack: Simplify unit tests with helpers
• Hack: Improve docker.upstart event
• Hack: Add coverage testing into docker-ci
• Runtime: Stdout/stderr logs are now stored in the same file as JSON
• Runtime: Allocate a /16 IP range by default, with fallback to /24. Try 12 ranges instead of 3.
• Runtime: Change .dockercfg format to json and support multiple auth remote

• Runtime: Do not override volumes from config
• Runtime: Fix issue with EXPOSE override
• Builder: Create directories with 755 instead of 700 within ADD instruction

0.5.0 (2013-07-17)

• Runtime: List all processes running inside a container with 'docker top'
• Runtime: Host directories can be mounted as volumes with 'docker run -v'
• Runtime: Containers can expose public UDP ports (eg, '-p 123/udp')
• Runtime: Optionally specify an exact public port (eg. '-p 80:4500')
• Registry: New image naming scheme inspired by Go packaging convention allows arbitrary combinations of registries
• Builder: ENTRYPOINT instruction sets a default binary entry point to a container
• Builder: VOLUME instruction marks a part of the container as persistent data

• Builder: 'docker build' displays the full output of a build by default
• Runtime: 'docker login' supports additional options

• Runtime: Dont save a container's hostname when committing an image.
• Registry: Fix issues when uploading images to a private registry

0.4.8 (2013-07-01)

• Builder: New build operation ENTRYPOINT adds an executable entry point to the container.

• Runtime: Fix a bug which caused 'docker run -d' to no longer print the container ID.
• Tests: Fix issues in the test suite

0.4.7 (2013-06-28)

• Registry: easier push/pull to a custom registry
• Remote API: the progress bar updates faster when downloading and uploading large files

• Remote API: fix a bug in the optional unix socket transport

• Runtime: improve detection of kernel version

• Runtime: host directories can be mounted as volumes with 'docker run -b'

• Runtime: fix an issue when only attaching to stdin

• Runtime: use 'tar --numeric-owner' to avoid uid mismatch across multiple hosts
• Hack: improve test suite and dev environment
• Hack: remove dependency on unit tests on 'os/user'

• Documentation: add terminology section

0.4.6 (2013-06-22)

... (truncated)

Commits

• 3b89d13 Bump to v0.5.1
• 16225c4 Merge pull request #1291 from dotcloud/ensure_mount_commit
• dd2f0d8 Merge pull request #1238 from dotcloud/1237-improve_docker_top-feature
• 0b57e44 Merge branch 'master' into 1237-improve_docker_top-feature
• f2dc492 Merge pull request #1342 from dsissitka/patch-4
• a7ace53 Merge pull request #1339 from dhrp/docker-run-d-description
• c99e8de Merge branch 'cleanup_signal_handling' of https://github.com/calavera/docker ...
• c06aa62 Merge pull request #1306 from dotcloud/1294_fix_wrong_untag_using_id_rmi
• 9ba9983 Fixed a couple of minor syntax errors.
• 7d68afb Merge pull request #1209 from zimbatm/upstart-improvements
• Additional commits viewable in compare view

Updates github.com/posthog/posthog-go from 1.12.4 to 1.23.0

Release notes

Sourced from github.com/posthog/posthog-go's releases.

1.23.0

Unreleased

1.22.0

Unreleased

1.21.0

Unreleased

1.20.0

Unreleased

1.19.0

Unreleased

1.18.0

Unreleased

1.17.5

Unreleased

1.17.4

Unreleased

1.17.3

Unreleased

1.17.2

Unreleased

1.17.1

Unreleased

1.17.0

Unreleased

1.16.2

Unreleased

1.16.1

Unreleased

1.16.0

Unreleased

1.15.1

Unreleased

1.15.0

Unreleased

... (truncated)

Changelog

Sourced from github.com/posthog/posthog-go's changelog.

1.23.0

Minor Changes

• 941d9ca: Support the starts_with, not_starts_with, ends_with, and not_ends_with property filter operators in feature flag local evaluation. Matching is case-insensitive and mirrors icontains, so flags using these operators no longer fall back to remote evaluation.

1.22.0

Minor Changes

• f102f70: Error tracking stack traces now support server-side symbolication. When the running executable's identity can be determined (GNU build id on Linux, LC_UUID on macOS), the default extractor emits frames with raw instruction addresses and client-expanded inline groups, and exceptions carry a $debug_images property, so PostHog can re-symbolicate against debug symbols uploaded with posthog-cli symbol-sets upload — including exact inline expansion and source context. Without uploaded symbols the runtime-resolved frames are kept as-is, and when the executable can't be identified the frames keep their previous plain shape.

  Requires a PostHog backend with grouped inline frame support (PostHog Cloud, or self-hosted ≥ July 2026). Older backends resolve each group member independently, which duplicates inline expansions when debug symbols are uploaded. To keep the previous plain frames, use a custom StackTraceExtractor.

1.21.0

Minor Changes

• 9e9ad63: Send minimal $feature_flag_called events when the server enables it. When the /flags?v=2 response carries minimalFlagCalledEvents: true (remote evaluation) or the local-evaluation definitions payload carries minimal_flag_called_events: true, and the evaluated flag has has_experiment: false, the event keeps only a strict allowlist of evaluation properties ($feature_flag, $feature_flag_response, $feature_flag_has_experiment, $feature_flag_id, $feature_flag_version, $feature_flag_reason, $feature_flag_request_id, $feature_flag_evaluated_at, $feature_flag_error, locally_evaluated, $groups, $process_person_profile, $geoip_disable, $is_server, $session_id, $window_id, $device_id, $lib, $lib_version) plus static system context ($os, $os_version, $os_distro, $go_version); everything else — including Config.DefaultEventProperties and the snapshot path's $feature/<key> and $feature_flag_payload — is stripped. Any missing signal (gate absent, has_experiment unknown, experiment-linked flag, legacy response shapes) keeps today's full event shape. The gate is server-controlled per project; no SDK configuration is added.

1.20.0

Minor Changes

• 3ea8ce6: Error tracking stack frames are now sent in the canonical cross-SDK wire order: the entry point is first and the crash/capture site is last. Previously frames were sent innermost-first. Coordinated rollout: the ingestion pipeline gates on $lib_version, so this ships as a minor release.

1.19.0

Minor Changes

• 154fd08: Add a $feature_flag_has_experiment boolean property to $feature_flag_called events. The value comes from the has_experiment field the server reports on flag metadata (/flags?v=2) and on local-evaluation flag definitions. The property is only sent when the server explicitly reported has_experiment (true or false); it is omitted when unknown (older deployments, v3 responses, or flags missing from the response).

1.18.0

Minor Changes

• 39c72dc: Drop the newest event instead of blocking when the in-memory queue is full, and make the queue size configurable.

  • Enqueue now returns ErrQueueFull when the queue is full, dropping the newest message rather than blocking the caller until space frees up. This matches posthog-python and posthog-rs. The drop is reported only through the returned error, not through Callback.Failure, so it stays cheap and off the callback goroutines under sustained overload. Backfill/bulk callers: check the error returned by Enqueue for ErrQueueFull and throttle or retry (or raise MaxQueueSize); otherwise events that overflow the queue are dropped, not delayed.
  • Add Config.MaxQueueSize (default DefaultMaxQueueSize = 10000) to control the in-memory message queue capacity independently of BatchSize. It is clamped up to BatchSize so the queue always holds at least one full batch. This replaces the previous hardcoded BatchSize * 10 sizing.
  • Change the default BatchSize (DefaultBatchSize) from 250 to 100, aligning with posthog-python, posthog-node, and posthog-rs. Callers that set BatchSize explicitly are unaffected.

1.17.5

Patch Changes

• fe66557: Change the default capture delivery budget from 10 attempts to 4 (DefaultMaxAttempts) when Config.MaxRetries is unset, aligning with the cross-SDK Capture V1 parity standard (posthog-rs uses the same envelope). This affects both the v0 (/batch/) and v1 send paths, since they share the attempt budget. Callers that set MaxRetries explicitly are unaffected.
• 3d8404a: Unify the capture retry backoff ceiling at 30s. DefaultBackoff's cap changes from 10s to 30s (default only — override via Config.RetryAfter), and the Capture V1 send now clamps a server Retry-After to the same 30s so a hostile or buggy header cannot park a batch goroutine. Retry-After still acts as a minimum; the configured backoff is never truncated. This aligns the default retry behavior with posthog-rs and posthog-python.

1.17.4

... (truncated)

Commits

• 019af19 chore: release v1.23.0 [version bump] [skip ci]
• 941d9ca feat: support starts_with and ends_with operators in local evaluation (#264)
• 049b682 ci: clean up workflow warnings (#263)
• 6b63077 chore: release v1.22.0 [version bump] [skip ci]
• f102f70 feat(error-tracking): grouped inline frames + debug images for server-side sy...
• 73399d9 chore: release v1.21.0 [version bump] [skip ci]
• 9e9ad63 feat(flags): minimize $feature_flag_called events for non-experiment flags (#...
• 10bec86 chore: release v1.20.0 [version bump] [skip ci]
• 3ea8ce6 feat: send error tracking stack frames in canonical bottom-up order (#254)
• 901880f chore: release v1.19.0 [version bump] [skip ci]
• Additional commits viewable in compare view

Updates github.com/tidwall/gjson from 1.18.0 to 1.19.0

Commits

• 0fac2c9 Add iterator functions All, Keys, and Values
• 4d23028 Add repo url
• 10d2662 Add copyright comment
• 4a91ee1 Update README.md
• See full diff in compare view

Updates golang.org/x/mod from 0.38.0 to 0.39.0

Commits

• 13be902 go.mod: update golang.org/x dependencies
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.