gomod(deps): Bump the go-deps group across 1 directory with 9 updates

[dependabot]

Bumps the go-deps group with 8 updates in the / directory:

Package	From	To
charm.land/bubbles/v2	2.1.0	2.1.1
github.com/alecthomas/kong	1.15.0	1.16.0
github.com/containerd/containerd/v2	2.3.0	2.3.3
github.com/docker/cli	29.4.2+incompatible	29.7.1+incompatible
github.com/moby/buildkit	0.29.0	0.32.0
github.com/moby/moby/client	0.4.1	0.5.1
github.com/posthog/posthog-go	1.12.4	1.22.0
github.com/tidwall/gjson	1.18.0	1.19.0

Updates charm.land/bubbles/v2 from 2.1.0 to 2.1.1

Release notes

Sourced from charm.land/bubbles/v2's releases.

v2.1.1

Lil’ Textarea Fix

This is a tiny patch to fix a bug in textarea where the prompt character could be missing styling on empty lines. That’s all for now!

Thanks for using Bubbles, Charm 🌞

Changelog

Fixed

• d2b2217d6352ce04183623d66d4266115419733c: fix(textarea): apply prompt style on all lines, including fillers (@​meowgorithm)

Docs

• a13f110fba4f13ce5fe9bc7fd51619f5782077b9: docs: fix typo in README (#921) (@​Rohan5commit)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

• d2b2217 fix(textarea): apply prompt style on all lines, including fillers
• 0dafc72 chore(deps): bump actions/checkout from 6 to 7 in the all group (#1006)
• 492ed7d chore(deps): bump the all group with 2 updates (#1004)
• 40d145e chore(deps): bump the all group with 2 updates (#996)
• 8585ef8 chore(deps): bump github.com/sahilm/fuzzy in the all group (#969)
• ef0090e chore: remove CODEOWNERS
• 6feda24 chore(deps): bump the all group with 3 updates (#958)
• 42130e8 chore(deps): bump github.com/mattn/go-runewidth in the all group (#952)
• 0d62ce2 chore(deps): bump dependabot/fetch-metadata from 2 to 3 in the all group (#953)
• 204774b chore(deps): bump github.com/mattn/go-runewidth in the all group (#945)
• Additional commits viewable in compare view

Updates charm.land/bubbletea/v2 from 2.0.6 to 2.0.7

Release notes

Sourced from charm.land/bubbletea/v2's releases.

v2.0.7

A few lil’ stability patches

Hi! This is a patch release with a few solid improvements around stability and correctness.

• @​lrstanley, one of our faves, fixed a race condition around mice in the Cursed Renderer
• @​lawrence3699 fixed a panic that could happen when input's not available
• We fixed a correctness issue with regard to mouse releases when Kitty Keyboard was active (thanks, @​mitchellh)

Thanks for using Bubble Tea, and if you see anything awry please do let us know!

—Charm 👋

Changelog

Fixed

• c60f0c53042238305ec13b486326588f12aea0ec: fix: prevent data race with cursedRenderer.onMouse (#1691) (@​lrstanley)
• 074596e14e2f5ca5e3986ee72e7c08f1569c4178: fix: skip input reader restore when input is disabled (#1680) (@​lawrence3699)
• 878d7df2f2b02f3ca8db177fa8553834bc35ea7c: fix(deps): bump ultraviolet for kitty keyboard fix (@​meowgorithm)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

• a23da80 v2.0.7
• 670963e chore(task): add release and fetch-tags tasks
• 29c4c32 fix(examples/deps): go mod tidy
• 878d7df chore(deps): bump ultraviolet for kitty keyboard fix
• c60f0c5 fix: prevent data race with cursedRenderer.onMouse (#1691)
• 640d879 docs(readme): update footer image
• 0fbefd2 chore: remove CODEOWNERS
• 074596e fix: skip input reader restore when input is disabled (#1680)
• See full diff in compare view

Updates github.com/alecthomas/kong from 1.15.0 to 1.16.0

Commits

• 8cbde34 Fix panic when a float flag is resolved from an integer value (#621)
• 649eaf2 chore(deps): update all non-major dependencies (#622)
• ae4bfdd fix: correct typos in resolver.go and README.md (#617)
• c2c0229 Fix env var validation conflicts (#619)
• f95198e chore(deps): update all non-major dependencies (#608)
• b03afc3 treat single-character aliases as short flags (#605)
• 66d2f03 chore(deps): update actions/checkout action to v7 (#609)
• 3c99622 Fix formatting and clarify passthrough mode in README (#610)
• 9d8d9f7 Allow a node with a Run() method to run without a subcommand (#614)
• ff16446 Fix duplicate embedded callback hooks (#616)
• Additional commits viewable in compare view

Updates github.com/containerd/containerd/v2 from 2.3.0 to 2.3.3

Release notes

Sourced from github.com/containerd/containerd/v2's releases.

containerd 2.3.3

Welcome to the v2.3.3 release of containerd!

The third patch release for containerd 2.3 contains various fixes and updates.

Highlights

• Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services (#13694)

Container Runtime Interface (CRI)

• Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit (#13697)
• Reject CreateContainer calls when the target sandbox is not running (#13668)
• Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks (#13645)

Image Distribution

• Surface OCI error bodies in registry 403 responses by falling back to GET requests (#13738)

Snapshotters

• Align default 4K mkfs block size for EROFS across all platforms (#13632)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Maksym Pavlenko
• Samuel Karp
• Chris Henzie
• Phil Estes
• Sebastiaan van Stijn
• Akihiro Suda
• Austin Vazquez
• Chris Crone
• Derek McGowan
• Maksim An
• crawfordxx
• cshung
• lauralorenz

Changes

• Prepare release notes for v2.3.3 (#13750)
  • 7f6cee02a Prepare release notes for v2.3.3
• CI: migrate Vagrant to Lima (#13744)
  • 7316210ce CI: migrate Vagrant to Lima

... (truncated)

Commits

• aad1100 Merge pull request #13750 from chrishenzie/prepare-v2.3.3
• 7f6cee0 Prepare release notes for v2.3.3
• bc63467 Merge pull request #13744 from AkihiroSuda/cherrypick-13728-2.3
• 7316210 CI: migrate Vagrant to Lima
• dc84019 Merge pull request #13738 from k8s-infra-cherrypick-robot/cherry-pick-13547-t...
• 457fba3 remotes: surface OCI error body on HEAD 403 via GET fallback
• 5e5581f Merge pull request #13732 from k8s-infra-cherrypick-robot/cherry-pick-13725-t...
• dc2df93 Update go to 1.26.5
• e2240ef Merge pull request #13711 from k8s-infra-cherrypick-robot/cherry-pick-13707-t...
• 5be0495 ci: pin fog-json to resolve gem conflict
• Additional commits viewable in compare view

Updates github.com/docker/cli from 29.4.2+incompatible to 29.7.1+incompatible

Commits

• e9452d6 Merge pull request #7142 from thaJeztah/bump_go_archive_0.3.2
• a6014a7 vendor: github.com/moby/go-archive v0.3.2
• 2465fca Merge pull request #7140 from thaJeztah/bump_go_archive_0.3.1
• 52b15cc Merge pull request #7141 from thaJeztah/bump_version2
• 1359092 update version to 29.7.1
• 0b50545 vendor: github.com/moby/go-archive v0.3.1
• c1eba93 Merge pull request #7086 from mickael-docker/docs-authz-decoding
• 1a305be Merge pull request #7084 from thaJeztah/prompt_cleans
• 4c1c648 Merge pull request #7129 from docker/dependabot/github_actions/codeql-actions...
• ee046d3 Merge pull request #7134 from hirehamir/fix/flaky-client-hangs
• Additional commits viewable in compare view

Updates github.com/moby/buildkit from 0.29.0 to 0.32.0

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.32.0

Welcome to the v0.32.0 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Sebastiaan van Stijn
• Akihiro Suda
• Dawei Wei
• Felix de Souza
• Alberto Garcia Hierro
• Devendra Kushwah
• Giles Cope
• Kunalbehbud
• MohammadHasan Akbari
• Natnael Gebremariam
• Pierre Fenoll
• Simon Aguilera
• s3onghyun

Notable Changes

• Built-in Dockerfile frontend has been updated to v1.26.0. changelog
• Attestations now default to OCI artifact descriptors, use oci-artifacts=false if your registry does not support OCI artifacts. #6914
• Build steps can now opt out of default OpenTelemetry tracing or define custom tracing configuration. #6958
• Bolt database performance has been improved. #6943
• Included Runc container runtime has been updated to v1.4.3. #6853
• All remote cache backends now use OCI mediatypes for record descriptors. #6913
• Source policy identifiers are now normalized before sending them to policy evaluation. #6909
• SBOM scanner support for Windows has been added. #6941
• Session exporters now support an optional finalization callback after exports complete, allowing providers to run completion logic while gateway references are still available. #6978
• Lock contention in the LLB solver has been reduced. #6917
• Improve SSH support when using non-standard ports. #6895
• Improve validation of reading contents of invalid files via API. #6903
• Deprecated OTEL fallback variables OTEL_TRACE_PARENT, OTEL_TRACE_STATE are no longer supported. Use TRACEPARENT and TRACESTATE instead. #6874
• Fix possible cache miss issue on parallel builds with shared parts. #6955
• Fix chunked encoding support for S3-compatible remote cache backends. #6970
• Fix regression on handling OTEL_IGNORE_ERROR environment variable. #6966

Dependency Changes

• github.com/Microsoft/go-winio v0.6.2 -> ad3df93bed29
• github.com/Microsoft/hcsshim v0.14.1 -> v0.15.0-rc.1
• github.com/ProtonMail/go-crypto v1.3.0 -> v1.4.1

... (truncated)

Commits

• f5d08d5 Merge pull request #6992 from crazy-max/fix-export-finalize-test
• b1eea81 test: require image exporter for session finalize
• a498582 Merge pull request #6990 from crazy-max/fix-windows-local-export-invalid-test
• cc977b3 test: avoid local exporter invalid mode integration hang
• 7a9ce8f Merge pull request #6983 from moby/dependabot/github_actions/github/codeql-ac...
• 2b8e155 Merge pull request #6988 from moby/dependabot/github_actions/docker/login-act...
• dc7e2b1 build(deps): bump docker/login-action from 4.4.0 to 4.5.1
• 7281141 Merge pull request #6982 from thaJeztah/bump_go_archive_0.2.1
• f1ee611 build(deps): bump github/codeql-action/upload-sarif
• 53b2d03 vendor: github.com/moby/go-archive v0.2.1
• Additional commits viewable in compare view

Updates github.com/moby/moby/client from 0.4.1 to 0.5.1

Release notes

Sourced from github.com/moby/moby/client's releases.

client/v0.5.1

0.5.1

Changelog

• client/pkg/jsonmessage: Display: fix godoc link. moby/moby#53070
• client: ServiceCreate, ServiceUpdate: fix duplicate and 'unkown' platforms. moby/moby#53012
• client: ServiceInspect, ContainerCommit: omit optional query args if not set. moby/moby#53010
• golangci-lint: enable perfsprint linter. moby/moby#53016

client/0.5.0

0.5.0

Changelog

• The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

client/v0.5.0-rc.1

0.5.0-rc.1

Changelog

• The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636

Changelog

Sourced from github.com/moby/moby/client's changelog.

0.5.1 (2013-07-30)

• API: Docker client now sets useragent (RFC 2616)
• Runtime: Add ps args to docker top
• Runtime: Add support for container ID files (pidfile like)
• Runtime: Add container=lxc in default env
• Runtime: Support networkless containers with docker run -n and docker -d -b=none
• API: Add /events endpoint
• Builder: ADD command now understands URLs
• Builder: CmdAdd and CmdEnv now respect Dockerfile-set ENV variables

• Hack: Simplify unit tests with helpers
• Hack: Improve docker.upstart event
• Hack: Add coverage testing into docker-ci
• Runtime: Stdout/stderr logs are now stored in the same file as JSON
• Runtime: Allocate a /16 IP range by default, with fallback to /24. Try 12 ranges instead of 3.
• Runtime: Change .dockercfg format to json and support multiple auth remote

• Runtime: Do not override volumes from config
• Runtime: Fix issue with EXPOSE override
• Builder: Create directories with 755 instead of 700 within ADD instruction

0.5.0 (2013-07-17)

• Runtime: List all processes running inside a container with 'docker top'
• Runtime: Host directories can be mounted as volumes with 'docker run -v'
• Runtime: Containers can expose public UDP ports (eg, '-p 123/udp')
• Runtime: Optionally specify an exact public port (eg. '-p 80:4500')
• Registry: New image naming scheme inspired by Go packaging convention allows arbitrary combinations of registries
• Builder: ENTRYPOINT instruction sets a default binary entry point to a container
• Builder: VOLUME instruction marks a part of the container as persistent data

• Builder: 'docker build' displays the full output of a build by default
• Runtime: 'docker login' supports additional options

• Runtime: Dont save a container's hostname when committing an image.
• Registry: Fix issues when uploading images to a private registry

0.4.8 (2013-07-01)

• Builder: New build operation ENTRYPOINT adds an executable entry point to the container.

• Runtime: Fix a bug which caused 'docker run -d' to no longer print the container ID.
• Tests: Fix issues in the test suite

0.4.7 (2013-06-28)

• Registry: easier push/pull to a custom registry
• Remote API: the progress bar updates faster when downloading and uploading large files

• Remote API: fix a bug in the optional unix socket transport

• Runtime: improve detection of kernel version

• Runtime: host directories can be mounted as volumes with 'docker run -b'

• Runtime: fix an issue when only attaching to stdin

• Runtime: use 'tar --numeric-owner' to avoid uid mismatch across multiple hosts
• Hack: improve test suite and dev environment
• Hack: remove dependency on unit tests on 'os/user'

• Documentation: add terminology section

0.4.6 (2013-06-22)

... (truncated)

Commits

• 3b89d13 Bump to v0.5.1
• 16225c4 Merge pull request #1291 from dotcloud/ensure_mount_commit
• dd2f0d8 Merge pull request #1238 from dotcloud/1237-improve_docker_top-feature
• 0b57e44 Merge branch 'master' into 1237-improve_docker_top-feature
• f2dc492 Merge pull request #1342 from dsissitka/patch-4
• a7ace53 Merge pull request #1339 from dhrp/docker-run-d-description
• c99e8de Merge branch 'cleanup_signal_handling' of https://github.com/calavera/docker ...
• c06aa62 Merge pull request #1306 from dotcloud/1294_fix_wrong_untag_using_id_rmi
• 9ba9983 Fixed a couple of minor syntax errors.
• 7d68afb Merge pull request #1209 from zimbatm/upstart-improvements
• Additional commits viewable in compare view

Updates github.com/posthog/posthog-go from 1.12.4 to 1.22.0

Release notes

Sourced from github.com/posthog/posthog-go's releases.

1.22.0

Unreleased

1.21.0

Unreleased

1.20.0

Unreleased

1.19.0

Unreleased

1.18.0

Unreleased

1.17.5

Unreleased

1.17.4

Unreleased

1.17.3

Unreleased

1.17.2

Unreleased

1.17.1

Unreleased

1.17.0

Unreleased

1.16.2

Unreleased

1.16.1

Unreleased

1.16.0

Unreleased

1.15.1

Unreleased

1.15.0

Unreleased

1.14.0

Unreleased

... (truncated)

Changelog

Sourced from github.com/posthog/posthog-go's changelog.

1.22.0

Minor Changes

• f102f70: Error tracking stack traces now support server-side symbolication. When the running executable's identity can be determined (GNU build id on Linux, LC_UUID on macOS), the default extractor emits frames with raw instruction addresses and client-expanded inline groups, and exceptions carry a $debug_images property, so PostHog can re-symbolicate against debug symbols uploaded with posthog-cli symbol-sets upload — including exact inline expansion and source context. Without uploaded symbols the runtime-resolved frames are kept as-is, and when the executable can't be identified the frames keep their previous plain shape.

  Requires a PostHog backend with grouped inline frame support (PostHog Cloud, or self-hosted ≥ July 2026). Older backends resolve each group member independently, which duplicates inline expansions when debug symbols are uploaded. To keep the previous plain frames, use a custom StackTraceExtractor.

1.21.0

Minor Changes

• 9e9ad63: Send minimal $feature_flag_called events when the server enables it. When the /flags?v=2 response carries minimalFlagCalledEvents: true (remote evaluation) or the local-evaluation definitions payload carries minimal_flag_called_events: true, and the evaluated flag has has_experiment: false, the event keeps only a strict allowlist of evaluation properties ($feature_flag, $feature_flag_response, $feature_flag_has_experiment, $feature_flag_id, $feature_flag_version, $feature_flag_reason, $feature_flag_request_id, $feature_flag_evaluated_at, $feature_flag_error, locally_evaluated, $groups, $process_person_profile, $geoip_disable, $is_server, $session_id, $window_id, $device_id, $lib, $lib_version) plus static system context ($os, $os_version, $os_distro, $go_version); everything else — including Config.DefaultEventProperties and the snapshot path's $feature/<key> and $feature_flag_payload — is stripped. Any missing signal (gate absent, has_experiment unknown, experiment-linked flag, legacy response shapes) keeps today's full event shape. The gate is server-controlled per project; no SDK configuration is added.

1.20.0

Minor Changes

• 3ea8ce6: Error tracking stack frames are now sent in the canonical cross-SDK wire order: the entry point is first and the crash/capture site is last. Previously frames were sent innermost-first. Coordinated rollout: the ingestion pipeline gates on $lib_version, so this ships as a minor release.

1.19.0

Minor Changes

• 154fd08: Add a $feature_flag_has_experiment boolean property to $feature_flag_called events. The value comes from the has_experiment field the server reports on flag metadata (/flags?v=2) and on local-evaluation flag definitions. The property is only sent when the server explicitly reported has_experiment (true or false); it is omitted when unknown (older deployments, v3 responses, or flags missing from the response).

1.18.0

Minor Changes

• 39c72dc: Drop the newest event instead of blocking when the in-memory queue is full, and make the queue size configurable.

  • Enqueue now returns ErrQueueFull when the queue is full, dropping the newest message rather than blocking the caller until space frees up. This matches posthog-python and posthog-rs. The drop is reported only through the returned error, not through Callback.Failure, so it stays cheap and off the callback goroutines under sustained overload. Backfill/bulk callers: check the error returned by Enqueue for ErrQueueFull and throttle or retry (or raise MaxQueueSize); otherwise events that overflow the queue are dropped, not delayed.
  • Add Config.MaxQueueSize (default DefaultMaxQueueSize = 10000) to control the in-memory message queue capacity independently of BatchSize. It is clamped up to BatchSize so the queue always holds at least one full batch. This replaces the previous hardcoded BatchSize * 10 sizing.
  • Change the default BatchSize (DefaultBatchSize) from 250 to 100, aligning with posthog-python, posthog-node, and posthog-rs. Callers that set BatchSize explicitly are unaffected.

1.17.5

Patch Changes

• fe66557: Change the default capture delivery budget from 10 attempts to 4 (DefaultMaxAttempts) when Config.MaxRetries is unset, aligning with the cross-SDK Capture V1 parity standard (posthog-rs uses the same envelope). This affects both the v0 (/batch/) and v1 send paths, since they share the attempt budget. Callers that set MaxRetries explicitly are unaffected.
• 3d8404a: Unify the capture retry backoff ceiling at 30s. DefaultBackoff's cap changes from 10s to 30s (default only — override via Config.RetryAfter), and the Capture V1 send now clamps a server Retry-After to the same 30s so a hostile or buggy header cannot park a batch goroutine. Retry-After still acts as a minimum; the configured backoff is never truncated. This aligns the default retry behavior with posthog-rs and posthog-python.

1.17.4

Patch Changes

• 25e43f8: Stop duplicating distinct_id inside /flags person properties.

1.17.3

... (truncated)

Commits

• 6b63077 chore: release v1.22.0 [version bump] [skip ci]
• f102f70 feat(error-tracking): grouped inline frames + debug images for server-side sy...
• 73399d9 chore: release v1.21.0 [version bump] [skip ci]
• 9e9ad63 feat(flags): minimize $feature_flag_called events for non-experiment flags (#...
• 10bec86 chore: release v1.20.0 [version bump] [skip ci]
• 3ea8ce6 feat: send error tracking stack frames in canonical bottom-up order (#254)
• 901880f chore: release v1.19.0 [version bump] [skip ci]
• 154fd08 feat(flags): add $feature_flag_has_experiment to $feature_flag_called events ...
• 9e7c67e chore: release v1.18.0 [version bump] [skip ci]
• 39c72dc feat: drop newest on full queue, add configurable MaxQueueSize (#258)
• Additional commits viewable in compare view

Updates github.com/tidwall/gjson from 1.18.0 to 1.19.0

Commits

• 0fac2c9 Add iterator functions All, Keys, and Values
• 4d23028 Add repo url
• 10d2662 Add copyright comment
• 4a91ee1 Update README.md
• See full diff in compare view