build(deps): refresh Go modules and CI actions - #13
Merged
Conversation
Clears the seven Dependabot PRs open since 2026-07-07, verified together in one pass rather than merged one at a time. Modules: lipgloss v2.0.4 -> v2.0.5, bubbletea v2.0.7 -> v2.0.8 (samples), ultraviolet 20260525132238 -> 20260703014108, x/term v0.44.0 -> v0.45.0, x/sys v0.46.0 -> v0.47.0, x/sync v0.20.0 -> v0.21.0. ultraviolet is bumped in the root module as well, which the Dependabot PRs did not do. cmd replaces the library with `..`, so MVS was already resolving the samples' newer ultraviolet for library code while the library's own go.mod still declared the older one -- the library was tested against a version it did not declare, and a consumer importing flatte alone would have got the older substrate. Actions: checkout v4 -> v7, setup-go v5 -> v7, upload-pages-artifact v3 -> v5, deploy-pages v4 -> v5, release-please-action v4 -> v5. All are Node 24 runtime upgrades with no config-breaking changes for how this repo calls them, and together they clear the Node 20 deprecation warning on every run. One behavior change is worth knowing: setup-go v6+ prefers the toolchain directive over the go directive when installing, and sets GOTOOLCHAIN=local. That makes the toolchain go1.25.12 pin added for GO-2026-4602 the explicit CI toolchain instead of something Go's auto-switching arrived at. Full QA green on both modules: tests, -race, vet on darwin and GOOS=windows, gofmt, and byte-identical goldens -- the substrate bump moved no rendering.
This was referenced Aug 15, 2026
adrianlungu
added a commit
that referenced
this pull request
Aug 16, 2026
* chore(main): release 0.1.2 * docs: drop duplicated changelog entry for the dependency refresh PR #13 landed as a merge commit rather than a squash, so release-please recorded the same change twice: once for the branch commit 5362e69 and once for the merge commit 22582d2, which it attributed via the pull request title. Keep the entry pointing at the commit that carries the change. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Adrian Lungu <contact@adrianlungu.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the seven Dependabot PRs open since 2026-07-07 (#1, #2, #3, #4, #5, #9, #10), verified together in one pass rather than merged one at a time. Each of those PRs was branched from a
mainthat predates the Windows CI fix, so all seven needed rebasing regardless.Modules
charm.land/lipgloss/v2charm.land/bubbletea/v2(samples)github.com/charmbracelet/ultraviolet2026052513223820260703014108golang.org/x/termgolang.org/x/sysgolang.org/x/syncOne deliberate deviation from Dependabot:
ultravioletis bumped in the root module too, which PR #9 did not do.cmdcarriesreplace github.com/lunguini/flatte => .., so MVS was already resolving the samples' newerultravioletfor library code while the library's owngo.modstill declared the older one. The library was therefore tested against a version it did not declare, and a consumer importingflatteon its own would have resolved the older substrate. The two modules' substrate pins should stay aligned.Actions
checkoutv4→v7,setup-gov5→v7,upload-pages-artifactv3→v5,deploy-pagesv4→v5,release-please-actionv4→v5.All are Node 24 runtime upgrades with no config-breaking changes for how this repo calls them, and together they clear the Node 20 deprecation warning that currently appears on every run.
One behavior change worth knowing:
setup-gov6+ (PR #460) prefers thetoolchaindirective over thegodirective when installing, and setsGOTOOLCHAIN=localso the Go command will not silently download a different toolchain. That makes thetoolchain go1.25.12pin added for GO-2026-4602 the explicit CI toolchain rather than something Go's auto-switching arrived at — a good outcome, but it also means a module requiring a Go newer than the pin now fails hard instead of self-upgrading.Verification
Run locally on both modules with every bump applied together:
go test ./...— pass, goldens byte-identical (the substrate bump moved no rendering, which was the main risk)go test -race ./...— cleango vet ./...on darwin andGOOS=windows— cleangofmt— cleanThe action bumps can only be validated by CI, which this PR exercises.
🤖 Generated with Claude Code