chore(deps): bump the dependencies group with 4 updates #573

dependabot · 2025-09-08T12:25:45Z

Bumps the dependencies group with 4 updates: github.com/spf13/cobra, github.com/spf13/pflag, github.com/stretchr/testify and golang.org/x/time.

Updates github.com/spf13/cobra from 1.9.1 to 1.10.1

Release notes

Sourced from github.com/spf13/cobra's releases.

v1.10.1

🐛 Fix

chore: upgrade pflags v1.0.9 by @jpmcb in spf13/cobra#2305

v1.0.9 of pflags brought back ParseErrorsWhitelist and marked it as deprecated

Full Changelog: spf13/cobra@v1.10.0...v1.10.1

v1.10.0

What's Changed

🚨 Attention!

Bump pflag to 1.0.8 by @tomasaschan in spf13/cobra#2303

This version of pflag carried a breaking change: it renamed ParseErrorsWhitelist to ParseErrorsAllowlist which can break builds if both pflag and cobra are dependencies in your project.

If you use both pflag and cobra, upgrade pflagto 1.0.8 andcobrato1.10.0`

or use the newer, fixed version of pflag v1.0.9 which keeps the deprecated ParseErrorsWhitelist

More details can be found here: spf13/cobra#2303

✨ Features

Flow context to command in SetHelpFunc by @Frassle in spf13/cobra#2241

The default ShellCompDirective can be customized for a command and its subcommands by @albers in spf13/cobra#2238

🐛 Fix

Upgrade golangci-lint to v2, address findings by @scop in spf13/cobra#2279

🪠 Testing

Test with Go 1.24 by @harryzcy in spf13/cobra#2236

chore: Rm GitHub Action PR size labeler by @jpmcb in spf13/cobra#2256

📝 Docs

Remove traling curlybrace by @yedayak in spf13/cobra#2237

Update command.go by @styee in spf13/cobra#2248

feat: Add security policy by @jpmcb in spf13/cobra#2253

Update Readme (Warp) by @ericdachen in spf13/cobra#2267

Add Periscope to the list of projects using Cobra by @anishathalye in spf13/cobra#2299

New Contributors

@harryzcy made their first contribution in spf13/cobra#2236

@yedayak made their first contribution in spf13/cobra#2237

@Frassle made their first contribution in spf13/cobra#2241

... (truncated)

Commits

7da941c chore: Bump pflag to v1.0.9 (#2305)
51d6751 Bump pflag to 1.0.8 (#2303)
3f3b818 Update README.md with new logo
dcaf42e Add Periscope to the list of projects using Cobra (#2299)
6dec1ae The default ShellCompDirective can be customized for a command and its subcom...
c8289c1 chore(golangci-lint): add some exclusion presets
4af7b64 refactor: apply golangci-lint autofixes, work around false positives
75790e4 chore(golangci-lint): upgrade to v2
db3ddb5 Adding sponsorship to README.md
67171d6 putting sponsorship below header
Additional commits viewable in compare view

Updates github.com/spf13/pflag from 1.0.7 to 1.0.9

Release notes

Sourced from github.com/spf13/pflag's releases.

v1.0.9

What's Changed

fix: Restore ParseErrorsWhitelist name for now by @tomasaschan in spf13/pflag#446

Full Changelog: spf13/pflag@v1.0.8...v1.0.9

v1.0.8

⚠️ Breaking Change

This version, while only a patch bump, includes a (very minor) breaking change: the flag.ParseErrorsWhitelist struct and corresponding FlagSet.parseErrorsWhitelist field have been renamed to ParseErrorsAllowlist.

This should result in compilation errors in any code that uses these fields, which can be fixed by adjusting the names at call sites. There is no change in semantics or behavior of the struct or field referred to by these names. If your code compiles without errors after bumping to/past v1.0.8, you are not affected by this change.

The breaking change was reverted in v1.0.9, by means of re-introducing the old names with deprecation warnings. The plan is still to remove them in a future release, so if your code does depend on the old names, please change them to use the new names at your earliest convenience.

What's Changed

Remove Redundant "Unknown-Flag" Error by @vaguecoder in spf13/pflag#364

Switching from whitelist to Allowlist terminology by @dubrie in spf13/pflag#261

Omit zero time.Time default from usage line by @mologie in spf13/pflag#438

implement CopyToGoFlagSet by @pohly in spf13/pflag#330

flag: Emulate stdlib behavior and do not print ErrHelp by @tmc in spf13/pflag#407

Print Default Values of String-to-String in Sorted Order by @vaguecoder in spf13/pflag#365

fix: Don't print ErrHelp in ParseAll by @tomasaschan in spf13/pflag#443

Reset args on re-parse even if empty by @tomasaschan in spf13/pflag#444

New Contributors

@vaguecoder made their first contribution in spf13/pflag#364

@dubrie made their first contribution in spf13/pflag#261

@mologie made their first contribution in spf13/pflag#438

@pohly made their first contribution in spf13/pflag#330

@tmc made their first contribution in spf13/pflag#407

@tomasaschan made their first contribution in spf13/pflag#443

Full Changelog: spf13/pflag@v1.0.7...v1.0.8

Commits

1043857 Merge pull request #446 from spf13/fix-backwards-compat
7412009 fix: Restore ParseErrorsWhitelist name for now
b9c16fa Merge pull request #444 from spf13/reset-args-even-if-empty
40abc49 Merge pull request #443 from spf13/silence-errhelp
1bf832c Use errors.Is instead of equality check
d25dd24 Reset args on re-parse even if empty
094909d Merge pull request #365 from vaguecoder/str2str-sorted
ccb49e5 Print Default Values of String-to-String in Sorted Order
b55ffb6 fix: Don't print ErrHelp in ParseAll
7c651d1 Merge pull request #407 from tmc/fix-errhelp
Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.0 to 1.11.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.11.1

This release fixes #1785 introduced in v1.11.0 where expected argument values implementing the stringer interface (String() string) with a method which mutates their value, when passed to mock.Mock.On (m.On("Method", <expected>).Return()) or actual argument values passed to mock.Mock.Called may no longer match one another where they previously did match. The behaviour prior to v1.11.0 where the stringer is always called is restored. Future testify releases may not call the stringer method at all in this case.

What's Changed

Backport #1786 to release/1.11: mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @brackendawson in stretchr/testify#1788

Full Changelog: stretchr/testify@v1.11.0...v1.11.1

Commits

2a57335 Merge pull request #1788 from brackendawson/1785-backport-1.11
af8c912 Backport #1786 to release/1.11
See full diff in compare view

Updates golang.org/x/time from 0.12.0 to 0.13.0

Commits

c0b0320 all: upgrade go directive to at least 1.24.0 [generated]
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the dependencies group with 4 updates: [github.com/spf13/cobra](https://github.com/spf13/cobra), [github.com/spf13/pflag](https://github.com/spf13/pflag), [github.com/stretchr/testify](https://github.com/stretchr/testify) and [golang.org/x/time](https://github.com/golang/time). Updates `github.com/spf13/cobra` from 1.9.1 to 1.10.1 - [Release notes](https://github.com/spf13/cobra/releases) - [Commits](spf13/cobra@v1.9.1...v1.10.1) Updates `github.com/spf13/pflag` from 1.0.7 to 1.0.9 - [Release notes](https://github.com/spf13/pflag/releases) - [Commits](spf13/pflag@v1.0.7...v1.0.9) Updates `github.com/stretchr/testify` from 1.11.0 to 1.11.1 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.11.0...v1.11.1) Updates `golang.org/x/time` from 0.12.0 to 0.13.0 - [Commits](golang/time@v0.12.0...v0.13.0) --- updated-dependencies: - dependency-name: github.com/spf13/cobra dependency-version: 1.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: github.com/spf13/pflag dependency-version: 1.0.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github.com/stretchr/testify dependency-version: 1.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: golang.org/x/time dependency-version: 0.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2025-09-08T12:25:56Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

socket-security · 2025-09-08T12:26:02Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/spf13/cobra@v1.9.1 ⏵ v1.10.1	⁺¹
	github.com/stretchr/testify@v1.11.0 ⏵ v1.11.1
	github.com/spf13/pflag@v1.0.7 ⏵ v1.0.9	⁺¹
	golang.org/x/time@v0.12.0 ⏵ v0.13.0

View full report

dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Sep 8, 2025

dependabot bot requested a review from a team as a code owner September 8, 2025 12:25

dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Sep 8, 2025

rhamzeh approved these changes Sep 9, 2025

View reviewed changes

rhamzeh added this pull request to the merge queue Sep 9, 2025

Merged via the queue into main with commit 04de3dc Sep 9, 2025
20 checks passed

rhamzeh deleted the dependabot/go_modules/dependencies-4b0d74a867 branch September 9, 2025 21:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the dependencies group with 4 updates #573

chore(deps): bump the dependencies group with 4 updates #573

Uh oh!

dependabot bot commented on behalf of github Sep 8, 2025

Uh oh!

coderabbitai bot commented Sep 8, 2025

Review skipped

Uh oh!

socket-security bot commented Sep 8, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chore(deps): bump the dependencies group with 4 updates #573

chore(deps): bump the dependencies group with 4 updates #573

Uh oh!

Conversation

dependabot bot commented on behalf of github Sep 8, 2025

v1.10.1

🐛 Fix

v1.10.0

What's Changed

🚨 Attention!

✨ Features

🐛 Fix

🪠 Testing

📝 Docs

New Contributors

v1.0.9

What's Changed

v1.0.8

⚠️ Breaking Change

What's Changed

New Contributors

v1.11.1

What's Changed

Uh oh!

coderabbitai bot commented Sep 8, 2025

Review skipped

Uh oh!

socket-security bot commented Sep 8, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants