gomod(deps): Bump the go-deps group across 1 directory with 12 updates

[dependabot]

Bumps the go-deps group with 9 updates in the / directory:

Package	From	To
charm.land/bubbles/v2	2.1.0	2.1.1
charm.land/lipgloss/v2	2.0.4	2.0.5
github.com/containerd/containerd/v2	2.3.0	2.3.2
github.com/docker/cli	29.4.2+incompatible	29.6.1+incompatible
github.com/moby/buildkit	0.29.0	0.31.1
github.com/moby/moby/client	0.4.1	0.5.0
github.com/posthog/posthog-go	1.12.4	1.17.5
github.com/tidwall/gjson	1.18.0	1.19.0
golang.org/x/mod	0.36.0	0.37.0

Updates charm.land/bubbles/v2 from 2.1.0 to 2.1.1

Release notes

Sourced from charm.land/bubbles/v2's releases.

v2.1.1

Lil’ Textarea Fix

This is a tiny patch to fix a bug in textarea where the prompt character could be missing styling on empty lines. That’s all for now!

Thanks for using Bubbles, Charm 🌞

Changelog

Fixed

• d2b2217d6352ce04183623d66d4266115419733c: fix(textarea): apply prompt style on all lines, including fillers (@​meowgorithm)

Docs

• a13f110fba4f13ce5fe9bc7fd51619f5782077b9: docs: fix typo in README (#921) (@​Rohan5commit)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

• d2b2217 fix(textarea): apply prompt style on all lines, including fillers
• 0dafc72 chore(deps): bump actions/checkout from 6 to 7 in the all group (#1006)
• 492ed7d chore(deps): bump the all group with 2 updates (#1004)
• 40d145e chore(deps): bump the all group with 2 updates (#996)
• 8585ef8 chore(deps): bump github.com/sahilm/fuzzy in the all group (#969)
• ef0090e chore: remove CODEOWNERS
• 6feda24 chore(deps): bump the all group with 3 updates (#958)
• 42130e8 chore(deps): bump github.com/mattn/go-runewidth in the all group (#952)
• 0d62ce2 chore(deps): bump dependabot/fetch-metadata from 2 to 3 in the all group (#953)
• 204774b chore(deps): bump github.com/mattn/go-runewidth in the all group (#945)
• Additional commits viewable in compare view

Updates charm.land/bubbletea/v2 from 2.0.6 to 2.0.7

Release notes

Sourced from charm.land/bubbletea/v2's releases.

v2.0.7

A few lil’ stability patches

Hi! This is a patch release with a few solid improvements around stability and correctness.

• @​lrstanley, one of our faves, fixed a race condition around mice in the Cursed Renderer
• @​lawrence3699 fixed a panic that could happen when input's not available
• We fixed a correctness issue with regard to mouse releases when Kitty Keyboard was active (thanks, @​mitchellh)

Thanks for using Bubble Tea, and if you see anything awry please do let us know!

—Charm 👋

Changelog

Fixed

• c60f0c53042238305ec13b486326588f12aea0ec: fix: prevent data race with cursedRenderer.onMouse (#1691) (@​lrstanley)
• 074596e14e2f5ca5e3986ee72e7c08f1569c4178: fix: skip input reader restore when input is disabled (#1680) (@​lawrence3699)
• 878d7df2f2b02f3ca8db177fa8553834bc35ea7c: fix(deps): bump ultraviolet for kitty keyboard fix (@​meowgorithm)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

• a23da80 v2.0.7
• 670963e chore(task): add release and fetch-tags tasks
• 29c4c32 fix(examples/deps): go mod tidy
• 878d7df chore(deps): bump ultraviolet for kitty keyboard fix
• c60f0c5 fix: prevent data race with cursedRenderer.onMouse (#1691)
• 640d879 docs(readme): update footer image
• 0fbefd2 chore: remove CODEOWNERS
• 074596e fix: skip input reader restore when input is disabled (#1680)
• See full diff in compare view

Updates charm.land/lipgloss/v2 from 2.0.4 to 2.0.5

Release notes

Sourced from charm.land/lipgloss/v2's releases.

v2.0.5

Graphemes, Schmraphemes

If you’re using emojis in the terminal you're in for a rough ride. That said, we do what we can. This release brings some in some very specific edge case rendering improvements. Enjoy.

Enjoy!

Changelog

• 10f9584edb197ddbbfc789081d33b6fadaea5742: chore(deps): bump ultraviolet for emoji-related improvements

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

• 5bd778d chore(deps): bump actions/checkout from 6 to 7 in the all group (#703)
• f2a46ba chore(deps): bump golang.org/x/sys in the all group (#701)
• See full diff in compare view

Updates github.com/containerd/containerd/v2 from 2.3.0 to 2.3.2

Release notes

Sourced from github.com/containerd/containerd/v2's releases.

containerd 2.3.2

Welcome to the v2.3.2 release of containerd!

The second patch release for containerd 2.3 contains various fixes and updates including security patches.

Security Updates

• containerd
  • CVE-2026-50195
  • CVE-2026-53488
  • CVE-2026-53492
  • CVE-2026-53489
  • CVE-2026-47262

Highlights

• Fix a data race when reading shim logs on Windows (#13522)

Image Distribution

• Allow the last host to retry on transient network errors (#13591)

Runtime

• Fix container startup failures caused by concurrent task RPC timeouts during slow container creation (#13512)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Chris Henzie
• Akihiro Suda
• Derek McGowan
• Akhil Mohan
• Austin Vazquez
• Ben Cressey
• Brian Goff
• Maksym Pavlenko
• Sebastiaan van Stijn
• Sergey Kanzhelev

Changes

• Prepare release notes for v2.3.2 (#13627)
  • fb8ca00b0 Prepare release notes for v2.3.2

... (truncated)

Commits

• fff62f1 Merge pull request #13627 from samuelkarp/prepare-v2.3.2
• fb8ca00 Prepare release notes for v2.3.2
• 9c69960 Merge commit from fork
• b54e3ec Merge pull request #13608 from thaJeztah/2.3_bump_crypto
• 0d1dbb8 Merge pull request #13591 from k8s-infra-cherrypick-robot/cherry-pick-13323-t...
• 0b94695 [release/2.3] vendor: golang.org/x/crypto v0.53.0
• b38dbd1 Merge pull request #13601 from k8s-infra-cherrypick-robot/cherry-pick-13590-t...
• 0f62515 Merge commit from fork
• 7c2e086 Merge commit from fork
• 94aa1e2 Merge commit from fork
• Additional commits viewable in compare view

Updates github.com/docker/cli from 29.4.2+incompatible to 29.6.1+incompatible

Commits

• 8900f1d Merge pull request #7074 from thaJeztah/version
• 22b8f13 Merge pull request #7069 from docker-agent/auto/migrate-to-docker-agent-action
• d9c59c9 version 29.6.1
• 6430751 Merge pull request #7073 from thaJeztah/bump_moby_user
• 8fda97b vendor: github.com/moby/sys/user v0.4.1
• f9dc4e4 chore: bump docker-agent-action to v2.0.1
• f8a2d2b Merge pull request #7070 from docker/dependabot/github_actions/actions/checko...
• 7eb15d3 build(deps): bump actions/checkout from 6.0.3 to 7.0.0
• 033b0ff Merge pull request #7063 from docker/dependabot/github_actions/crazy-max/dot-...
• 317bfd1 Merge pull request #7067 from docker/dependabot/github_actions/docker/cagent-...
• Additional commits viewable in compare view

Updates github.com/moby/buildkit from 0.29.0 to 0.31.1

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.31.1

buildkit 0.31.1

Welcome to the v0.31.1 release of buildkit!

This is a security patch release with two low severity security fixes.

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi

Notable Changes

• Custom frontend could bypass Seccomp/AppArmor restrictions GHSA-7236-3392-c5c6
• Possible runtime DoS via unbounded group parsing GHSA-72x6-4j93-7w86

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.31.0

v0.31.0

buildkit 0.31.0

Welcome to the v0.31.0 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Sebastiaan van Stijn
• Bjorn Neergaard
• Jonathan A. Sternberg
• Akihiro Suda
• Bryce Gibson
• Ava Barron
• Brian Goff
• Jiří Moravčík
• ZRHann
• Kevin NZUGUEM

... (truncated)

Commits

• 673b7e0 Merge pull request #6896 from tonistiigi/v0.31.1-picks
• 81ce1c6 ci: tolerate empty test matrix includes
• 69a3924 user: limit size of parsed passwd/group files
• 3ea6dd0 security: validate exec security modes
• c411f0a Merge pull request #6876 from thaJeztah/bump_runc
• f292e5c Dockerfile: update runc binary to v1.3.6
• d31ba4a Merge pull request #6867 from okhowang/fix/platforms-data-race
• e819928 Merge pull request #6869 from crazy-max/update-policy-helpers
• e4d0dba chore: update generated files
• c13539b vendor: update policy-helpers to d5411a945cfc
• Additional commits viewable in compare view

Updates github.com/moby/moby/client from 0.4.1 to 0.5.0

Release notes

Sourced from github.com/moby/moby/client's releases.

client/0.5.0

0.5.0

Changelog

• The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

client/v0.5.0-rc.1

0.5.0-rc.1

Changelog

• The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

Changelog

Sourced from github.com/moby/moby/client's changelog.

0.5.0 (2013-07-17)

• Runtime: List all processes running inside a container with 'docker top'
• Runtime: Host directories can be mounted as volumes with 'docker run -v'
• Runtime: Containers can expose public UDP ports (eg, '-p 123/udp')
• Runtime: Optionally specify an exact public port (eg. '-p 80:4500')
• Registry: New image naming scheme inspired by Go packaging convention allows arbitrary combinations of registries
• Builder: ENTRYPOINT instruction sets a default binary entry point to a container
• Builder: VOLUME instruction marks a part of the container as persistent data

• Builder: 'docker build' displays the full output of a build by default
• Runtime: 'docker login' supports additional options

• Runtime: Dont save a container's hostname when committing an image.
• Registry: Fix issues when uploading images to a private registry

0.4.8 (2013-07-01)

• Builder: New build operation ENTRYPOINT adds an executable entry point to the container.

• Runtime: Fix a bug which caused 'docker run -d' to no longer print the container ID.
• Tests: Fix issues in the test suite

0.4.7 (2013-06-28)

• Registry: easier push/pull to a custom registry
• Remote API: the progress bar updates faster when downloading and uploading large files

• Remote API: fix a bug in the optional unix socket transport

• Runtime: improve detection of kernel version

• Runtime: host directories can be mounted as volumes with 'docker run -b'

• Runtime: fix an issue when only attaching to stdin

• Runtime: use 'tar --numeric-owner' to avoid uid mismatch across multiple hosts
• Hack: improve test suite and dev environment
• Hack: remove dependency on unit tests on 'os/user'

• Documentation: add terminology section

0.4.6 (2013-06-22)

• Runtime: fix a bug which caused creation of empty images (and volumes) to crash.

0.4.5 (2013-06-21)

• Builder: 'docker build git://URL' fetches and builds a remote git repository

• Runtime: 'docker ps -s' optionally prints container size
• Tests: Improved and simplified

• Runtime: fix a regression introduced in 0.4.3 which caused the logs command to fail.
• Builder: fix a regression when using ADD with single regular file.

0.4.4 (2013-06-19)

• Builder: fix a regression introduced in 0.4.3 which caused builds to fail on new clients.

0.4.3 (2013-06-19)

• Builder: ADD of a local file will detect tar archives and unpack them

• Runtime: Remove bsdtar dependency
• Runtime: Add unix socket and multiple -H support
• Runtime: Prevent rm of running containers
• Runtime: Use go1.1 cookiejar
• Builder: ADD improvements: use tar for copy + automatically unpack local archives

... (truncated)

Commits

• 51f6c4a Merge pull request #1227 from dotcloud/bump_0.5.0
• f4eaec3 Merge pull request #1226 from metalivedev/easydockerfile
• b083418 change -b -> -v and add udp example
• 5794857 Merge pull request #1169 from crosbymichael/buildfile-tests
• e7f3f6f Add unit tests for buildfile config instructions
• aa56714 Make dockerfile docs easier to find. Clean up formatting.
• f8dfd0a Merge pull request #1225 from dotcloud/hotfix_docker_rmi
• 3dbf9c6 Merge pull request #1219 from metalivedev/docs-repoupdate
• de563a3 Merge pull request #1194 from crosbymichael/build-verbose
• 9cf2b41 change rm usage in docs
• Additional commits viewable in compare view

Updates github.com/posthog/posthog-go from 1.12.4 to 1.17.5

Release notes

Sourced from github.com/posthog/posthog-go's releases.

1.17.5

Unreleased

1.17.4

Unreleased

1.17.3

Unreleased

1.17.2

Unreleased

1.17.1

Unreleased

1.17.0

Unreleased

1.16.2

Unreleased

1.16.1

Unreleased

1.16.0

Unreleased

1.15.1

Unreleased

1.15.0

Unreleased

1.14.0

Unreleased

1.13.2

Unreleased

1.13.1

Unreleased

1.13.0

Unreleased

1.12.6

Unreleased

1.12.5

Unreleased

Changelog

Sourced from github.com/posthog/posthog-go's changelog.

1.17.5

Patch Changes

• fe66557: Change the default capture delivery budget from 10 attempts to 4 (DefaultMaxAttempts) when Config.MaxRetries is unset, aligning with the cross-SDK Capture V1 parity standard (posthog-rs uses the same envelope). This affects both the v0 (/batch/) and v1 send paths, since they share the attempt budget. Callers that set MaxRetries explicitly are unaffected.
• 3d8404a: Unify the capture retry backoff ceiling at 30s. DefaultBackoff's cap changes from 10s to 30s (default only — override via Config.RetryAfter), and the Capture V1 send now clamps a server Retry-After to the same 30s so a hostile or buggy header cannot park a batch goroutine. Retry-After still acts as a minimum; the configured backoff is never truncated. This aligns the default retry behavior with posthog-rs and posthog-python.

1.17.4

Patch Changes

• 25e43f8: Stop duplicating distinct_id inside /flags person properties.

1.17.3

Patch Changes

• dafed74: Retry remote feature flag requests after transient 502 and 504 responses.

1.17.2

Patch Changes

• d98ef79: Retry feature flag requests after transient network errors only. The feature flag request retry count defaults to 1 and can be set to 0 to disable retries.

1.17.1

Patch Changes

• 651b303: Preserve caller-provided system context values when building capture v1 event properties.
• e0eb8bd: Send capture batches uncompressed when request-body compression fails instead of failing the batch.
• 71f5c2e: Expose capture default properties to BeforeSend hooks before serialization.

1.17.0

Minor Changes

• ff0e74b: Enrich capture-v1 failure reporting with typed errors and verbose result logging. When CaptureMode is CaptureModeAnalyticsV1, Callback.Failure now receives either a *CaptureEventError (a single event the server dropped, or one still asking to retry once attempts are exhausted — exposing EventUUID, Result, Details, and Exhausted) or a *CaptureRequestError (a whole request that failed on a non-2xx status, transport error, or malformed body — exposing StatusCode, Code, Description, and unwrapping to the underlying error). Inspect them with errors.As. Additionally, with Verbose: true the SDK logs one debug line per 2xx response summarizing the per-event directive counts (ok/warning/drop/retry/other) so partial-submission outcomes are easy to debug. The legacy path and its callback errors are unchanged.
• ff0e74b: Add opt-in capture-v1 support via a new Config.CaptureMode option. It defaults to CaptureModeLegacy (the existing POST /batch/ endpoint), so upgrading is transparent and requires no code changes. Set CaptureMode: posthog.CaptureModeAnalyticsV1 to send events to POST /i/v1/analytics/events instead, which uses Bearer auth, per-event delivery results, and partial retry (only the events the server asks to retry are re-sent). For v1, the Callback interface is unchanged but outcomes become per-event: a drop result fails an individual event (and can fire Failure on an HTTP 200), warning counts as success, and a uuid missing from the results is silently dropped. All other configuration (host, API key, Callback, Logger, MaxRetries, Compression) is reused across both modes.
• ff0e74b: Add zstd, deflate, and brotli compression for the capture-v1 path, alongside the existing gzip. Select one via Config.Compression (CompressionZstd, CompressionDeflate, CompressionBrotli) and the SDK sets the matching Content-Encoding header (zstd, deflate, br). These three codecs require CaptureMode: posthog.CaptureModeAnalyticsV1 — the legacy POST /batch/ endpoint only understands gzip, so configuring them with CaptureModeLegacy returns a validation error. CompressionGzip and CompressionNone continue to work on both capture modes. All codecs use pure-Go libraries (stdlib compress/zlib, github.com/klauspost/compress/zstd, github.com/andybalholm/brotli), so CGO_ENABLED=0 builds are unaffected.

1.16.2

Patch Changes

• 76de226: Dedupe $feature_flag_called events by feature flag response value.

1.16.1

Patch Changes

... (truncated)

Commits

• d7f8a22 chore: release v1.17.5 [version bump] [skip ci]
• fe66557 feat(capture): default to 4 delivery attempts (down from 10) (#256)
• 3d8404a fix(capture): unify retry backoff ceiling at 30s (#255)
• 6affc15 ci: Standardize SDK release failure telemetry (#252)
• 93b9681 chore: release v1.17.4 [version bump] [skip ci]
• 25e43f8 fix: stop duplicating distinct_id in flags person properties (#250)
• 01e60bf chore: release v1.17.3 [version bump] [skip ci]
• dafed74 fix: Retry flags requests on 502 and 504 (#251)
• ed70fae fix: make TCP drop recovery test deterministic (#248)
• 2b6e187 ci: update SDK harness to 0.9.0 (#247)
• Additional commits viewable in compare view

Updates github.com/tidwall/gjson from 1.18.0 to 1.19.0

Commits

• 0fac2c9 Add iterator functions All, Keys, and Values
• 4d23028 Add repo url
• 10d2662 Add copyright comment
• 4a91ee1 Update README.md
• See full diff in compare view

Updates golang.org/x/mod from 0.36.0 to 0.37.0

Commits

• deb1dfc go.mod: update golang.org/x dependencies
• 087f651 modfile: use slices.Backward
• 343ee60 x/mod: allow for aggressively conslidating requires
• See full diff in compare view

Updates golang.org/x/net from 0.54.0 to 0.55.0

Commits

• 7770ec4 go.mod: update golang.org/x dependencies
• 4ece7b6 html: escape greater-than symbol in doctype identifiers
• 08be507 html: improve Noah's Ark clause performance
• a8fb2fe html: properly render fostered elements in foreign content
• 0dc5b7a html: properly check namespace in "in body" any other end tag
• a452f3c html: ignore duplicate attributes during tokenization
• f865199 quic: fix appendMaxDataFrame erroneously accumulating sentLimit
• 210ed3c quic: establish a "happened-before" relationship between stream write and read
• ad8140e quic: fix buffer slicing when handling overlapping stream data
• 23ee2ef http2: avoid API changes when built with go1.27
• See full diff in compare view

Updates golang.org/x/sync from 0.20.0 to 0.21.0

Commits

• 5071ed6 all: fix some comments to improve readability
• See full diff in compare view