Skip to content

chore(deps): bump the all group across 1 directory with 3 updates#2

Closed
dependabot[bot] wants to merge 35 commits intomainfrom
dependabot/go_modules/all-5178c1f509
Closed

chore(deps): bump the all group across 1 directory with 3 updates#2
dependabot[bot] wants to merge 35 commits intomainfrom
dependabot/go_modules/all-5178c1f509

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 6, 2026

Bumps the all group with 3 updates in the / directory: charm.land/catwalk, github.com/go-git/go-git/v5 and modernc.org/sqlite.

Updates charm.land/catwalk from 0.33.2 to 0.34.3

Release notes

Sourced from charm.land/catwalk's releases.

v0.34.3

Changelog

Other stuff

  • a44074b5978338623b1d8e93bdd0ee14d4fe1967: chore: re-generate copilot (@​andreynering)
  • 561143829fefd3d55de6ed312fd478eeb6ae1d0d: ci(update): one generator per command, add continue-on-error: true (@​andreynering)

First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:

wget 'https://github.com/charmbracelet/catwalk/releases/download/v0.34.3/checksums.txt'
wget 'https://github.com/charmbracelet/catwalk/releases/download/v0.34.3/checksums.txt.sigstore.json'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

v0.34.2

Changelog

Other stuff

  • b735c901458a5bcdb6b70df1b988b0323aa2a246: chore: new provider: nebius token factory (#227) (@​harmw)

... (truncated)

Commits

Updates github.com/go-git/go-git/v5 from 5.17.1 to 5.17.2

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.17.2

What's Changed

⚠️ This release fixes a bug (go-git/go-git#1942) that blocked some users from upgrading to v5.17.1. Thanks @​pskrbasu for reporting it. 🙇

Full Changelog: go-git/go-git@v5.17.1...v5.17.2

Commits
  • 45ae193 Merge pull request #1944 from go-git/fix-perms
  • fda4f74 storage: filesystem/dotgit, Skip writing pack files that already exist on disk
  • 2212dc7 Merge pull request #1941 from go-git/renovate/releases/v5.x-go-github.com-go-...
  • ebb2d7d build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY]
  • See full diff in compare view

Updates modernc.org/sqlite from 1.48.0 to 1.48.1

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

  • 2026-04-04 v1.48.2:

    • Fix ABI mapping mismatch in the pre-update hook trampoline that caused silent truncation of large 64-bit RowIDs.
    • Ensure the Go trampoline signature correctly aligns with the public sqlite3_preupdate_hook C API, preventing data corruption for high-entropy keys (e.g., Snowflake IDs).
    • See [GitLab merge request #98](https://gitlab.com/cznic/sqlite/-/merge_requests/98), thanks Josh Bleecher Snyder!
    • Fix the memory allocator used in (*conn).Deserialize.
    • Replace tls.Alloc with sqlite3_malloc64 to prevent internal allocator corruption. This ensures the buffer is safely owned by SQLite, which may resize or free it due to the SQLITE_DESERIALIZE_RESIZEABLE and SQLITE_DESERIALIZE_FREEONCLOSE flags.
    • Prevent a memory leak by properly freeing the allocated buffer if fetching the main database name fails before handing ownership to SQLite.
    • See [GitLab merge request #100](https://gitlab.com/cznic/sqlite/-/merge_requests/100), thanks Josh Bleecher Snyder!
    • Fix (*conn).Deserialize to explicitly reject nil or empty byte slices.
    • Prevent silent database disconnection and connection pool corruption caused by SQLite's default behavior when sqlite3_deserialize receives a 0-length buffer.
    • See [GitLab merge request #101](https://gitlab.com/cznic/sqlite/-/merge_requests/101), thanks Josh Bleecher Snyder!
    • Fix commitHookTrampoline and rollbackHookTrampoline signatures by removing the unused pCsr parameter.
    • Aligns internal hook callbacks accurately with the underlying SQLite C API, cleaning up the code to prevent potential future confusion or bugs.
    • See [GitLab merge request #102](https://gitlab.com/cznic/sqlite/-/merge_requests/102), thanks Josh Bleecher Snyder!
  • 2026-04-03 v1.48.1:

    • Fix memory leaks and double-free vulnerabilities in the multi-statement query execution path.
    • Ensure bind-parameter allocations are reliably freed via strict ownership transfer if an error occurs mid-loop or if multiple statements bind parameters.
    • Fix a resource leak where a subsequent statement's error could orphan a previously generated rows object without closing it, leaking the prepared statement handle.
    • See [GitLab merge request #96](https://gitlab.com/cznic/sqlite/-/merge_requests/96), thanks Josh Bleecher Snyder!
  • 2026-03-27 v1.48.0:

    • Add _timezone DSN query parameter to apply IANA timezones (e.g., "America/New_York") to both reads and writes.
    • Writes will convert time.Time values to the target timezone before formatting as a string.
    • Reads will interpret timezone-less strings as being in the target timezone.
    • Does not impact _inttotime integer values, which will always safely evaluate as UTC.
    • Add support for _time_format=datetime URI parameter to format time.Time values identically to SQLite's native datetime() function and CURRENT_TIMESTAMP (YYYY-MM-DD HH:MM:SS).
    • See [GitLab merge request #94](https://gitlab.com/cznic/sqlite/-/merge_requests/94) and [GitLab merge request #95](https://gitlab.com/cznic/sqlite/-/merge_requests/95), thanks Josh Bleecher Snyder!
  • 2026-03-17 v1.47.0: Add CGO-free version of the vector extensions from https://github.com/asg017/sqlite-vec. See vec_test.go for example usage. From the GitHub project page:

    • Important: sqlite-vec is a pre-v1, so expect breaking changes!
    • Store and query float, int8, and binary vectors in vec0 virtual tables
    • Written in pure C, no dependencies, runs anywhere SQLite runs (Linux/MacOS/Windows, in the browser with WASM, Raspberry Pis, etc.)
    • Store non-vector data in metadata, auxiliary, or partition key columns
    • See [GitLab merge request #93](https://gitlab.com/cznic/sqlite/-/merge_requests/93), thanks Zhenghao Zhang!
  • 2026-03-16 v1.46.2: Upgrade to SQLite 3.51.3.

  • 2026-02-17 v1.46.1:

    • Ensure connection state is reset if Tx.Commit fails. Previously, errors like SQLITE_BUSY during COMMIT could leave the underlying connection inside a transaction, causing errors when the connection was reused by the database/sql pool. The driver now detects this state and forces a rollback internally.
    • Fixes [GitHub issue #2](modernc-org/sqlite#2), thanks Edoardo Spadolini!
  • 2026-02-17 v1.46.0:

    • Enable ColumnTypeScanType to report time.Time instead of string for TEXT columns declared as DATE, DATETIME, TIME, or TIMESTAMP via a new _texttotime URI parameter.
    • See [GitHub pull request #1](modernc-org/sqlite#1), thanks devhaozi!
  • 2026-02-09 v1.45.0:

    • Introduce vtab subpackage (modernc.org/sqlite/vtab) exposing Module, Table, Cursor, and IndexInfo API for Go virtual tables.

... (truncated)

Commits
  • 51d1f91 CHANGELOG.md: document v1.48.1...
  • 50a8b7f CHANGELOG.md: document v1.48.1
  • 6050024 Merge branch 'multi-stmt-double-free' into 'master'
  • ef93ba8 improve memory safety of allocs in stmt.query
  • 2a97c68 add conn.freeAllocs
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

roninjin10 and others added 30 commits April 2, 2026 14:39
Adds package.json, tsconfig, bunfig, gitignore, config,
preload, agents definition, and tickets directory.
Adds reusable React components: CommandProbe, FeatureEnum,
ForEachFeature, GrillMe, Review, ValidationLoop, WriteAPrd.
Adds MDX prompt templates for audit, coverage, feature-enum,
grill-me, implement, plan, research, review, ticket, validate,
and write-a-prd workflows.
Adds workflow TSX files: audit, debug, feature-enum, grill-me,
implement, improve-test-coverage, plan, ralph, research, review,
test-first, ticket-create, ticket-implement, and write-a-prd.
Adds PRD, design doc, engineering spec, and feature
definitions for the smithers TUI.
- Create internal/config/defaults.go with SmithersMCPName, DefaultSmithersMCPConfig(), DefaultDisabledTools(), and IsSmithersCLIAvailable() helpers
- Update Config.setDefaults() to inject Smithers MCP with stdio transport pointing to 'smithers --mcp'
- Apply default disabled tools list (sourcegraph) only when user hasn't configured any
- Add comprehensive unit tests for default injection, user override preservation, and disabled tool behavior
- Respects user config: custom command paths, disabled flag, and custom disabled tool lists

Integration flow:
- TUI startup calls Config.Load() which calls setDefaults()
- setDefaults() injects "smithers" MCP entry into config.MCP map
- app.New() calls mcp.Initialize() which discovers tools via stdio handshake
- SetupAgents() runs with Smithers agent allowed access to all Smithers MCP tools (AllowedMCP: {"smithers": nil})

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- TestSmithersMCPDiscoveryFlow: verifies config setup with mock server
- TestSmithersMCPDefaultInjectedIntoConfig: confirms agent MCP permissions
- TestSmithersMCPToolDiscoveryWithMockServer: end-to-end tool discovery via in-memory transport
- TestSmithersMCPStateTransitions: validates state machine constants and representations

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- New tape: tests/vhs/mcp-tool-discovery.tape
- Records startup with Smithers MCP discovery
- Verifies MCP status indicator (connected or error)
- Tests agent access to discovered MCP tools
- Demonstrates graceful degradation when Smithers CLI unavailable
- Updated README with instructions for running the tape

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…at startup

- Add PopToRoot() and Root() methods to router for stack management
- Enforce single-view minimum (prevents popping root)
- Default to uiChat instead of uiLanding in Smithers mode after init
- Allow session loading in both uiLanding and uiChat states
- Add Esc key handling in uiSmithersView to return to chat console
- Update router comments to reflect chat-root design

This establishes chat as the default console and base of navigation stack in Smithers mode.
- Add comprehensive router unit tests for Push, Pop, PopToRoot semantics
- Add chat-default-console E2E test placeholder (full integration via VHS)
- Verify router enforces single-view minimum (chat root protection)
Implement ListWorkflows, GetWorkflowDefinition, RunWorkflow, and
GetWorkflowDAG on the Smithers client with full three-tier transport
(daemon HTTP API → exec CLI fallback). No SQLite fallback since workflows
are filesystem artefacts, not DB rows.

Key design choices:
- WithWorkspaceID() option gates daemon API routes (/api/workspaces/{id}/...)
- ListWorkflows adapts DiscoveredWorkflow CLI output to the canonical Workflow type
- RunWorkflow posts to /api/workspaces/{id}/runs with {workflowId, input?}
- GetWorkflowDAG hits /launch-fields endpoint; falls back to a generic single-field stub
- New apiGetJSON/apiPostJSON/decodeDaemonResponse helpers for plain-JSON daemon responses (distinct from legacy envelope and v1 transports)
- 45 unit tests covering HTTP success, HTTP error codes, malformed JSON, exec fallback, bearer token propagation, empty-ID guards, and parse helpers

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…-client

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
roninjin10 and others added 5 commits April 5, 2026 23:46
Bumps the all group with 3 updates in the / directory: [charm.land/catwalk](https://github.com/charmbracelet/catwalk), [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) and [modernc.org/sqlite](https://gitlab.com/cznic/sqlite).


Updates `charm.land/catwalk` from 0.33.2 to 0.34.3
- [Release notes](https://github.com/charmbracelet/catwalk/releases)
- [Commits](charmbracelet/catwalk@v0.33.2...v0.34.3)

Updates `github.com/go-git/go-git/v5` from 5.17.1 to 5.17.2
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](go-git/go-git@v5.17.1...v5.17.2)

Updates `modernc.org/sqlite` from 1.48.0 to 1.48.1
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.48.0...v1.48.1)

---
updated-dependencies:
- dependency-name: charm.land/catwalk
  dependency-version: 0.34.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.17.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: modernc.org/sqlite
  dependency-version: 1.48.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Apr 6, 2026

Labels

The following labels could not be found: area: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Apr 6, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Apr 6, 2026
@dependabot dependabot bot deleted the dependabot/go_modules/all-5178c1f509 branch April 6, 2026 22:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant