deps: bump the go-dependencies group with 5 updates

[dependabot]

Bumps the go-dependencies group with 5 updates:

Package	From	To
charm.land/lipgloss/v2	2.0.5	2.0.6
github.com/charmbracelet/x/ansi	0.11.7	0.11.8
github.com/stretchr/testify	1.11.1	1.12.0
golang.org/x/mod	0.38.0	0.40.0
golang.org/x/text	0.40.0	0.41.0

Updates charm.land/lipgloss/v2 from 2.0.5 to 2.0.6

Release notes

Sourced from charm.land/lipgloss/v2's releases.

v2.0.6

Devanagari, auto-grapheme mode, and more

Hi! The big news in this release is that Lip Gloss now properly renders Devanagari (Hindi)! Beyond that—or perhaps as a result—Lip Gloss will now switch to mode 2027 for grapheme support when possible.

There's other good stuff too. Let's go!

क्या हाल है?

Hindi speakers, it's about time! Lip Gloss and Ultraviolet now properly renders Devanagari. That means Bubble Tea will as well.

This brings us to…

Cyberpunk 2027

Lip Gloss (and Ultraviolet) now asks the terminal at startup whether it supports Unicode core mode (DEC mode 2027), and when it does, measures widths the same way the terminal does. We did this for Devanagari but it also means Emojis and things render better now too. Let's go!

Shrinky tables: not anymore

Columns no longer shrink to zero width. Thanks, @​taciturnaxolotl!

---

Changelog

Fixed

• d231906a63681848939223b6e03d049b513697a0: fix(table): prevent columns from shrinking to zero width (#671) (@​taciturnaxolotl)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

• 733ce53 chore(deps): bump uv and ansi (#726)
• 3147668 chore(deps): bump github.com/lucasb-eyer/go-colorful in the all group (#725)
• 5696b28 chore(deps): bump actions/setup-go from 6 to 7 in the all group (#716)
• d231906 fix(table): prevent columns from shrinking to zero width (#671)
• d19c46c chore(deps): bump golang.org/x/sys in the all group (#714)
• 10f9584 chore(deps): bump ultraviolet for emoji-related fixes
• See full diff in compare view

Updates github.com/charmbracelet/x/ansi from 0.11.7 to 0.11.8

Commits

• 00c6608 fix(wcwidth): measure wcwidth per codepoint (#933)
• 240ce7b chore: lint cellbuf (#944)
• c2cf573 chore(ansi): lint (#943)
• 3755eba chore(deps): bump github.com/charmbracelet/x/xpty (#932)
• 75eb341 chore(deps): bump github.com/mattn/go-runewidth (#925)
• 7e2d3e6 fix(xpty): report context cancellation in WaitProcess
• 41c9e6b chore(deps): bump github.com/mattn/go-runewidth (#924)
• 482a565 chore(powernap): update lsp configs from nvim-lspconfig
• 3eef36e chore(deps): bump github.com/bits-and-blooms/bitset (#914)
• 872754a chore(deps): bump golang.org/x/sys (#909)
• Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.0

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.0

What's Changed

Functional Changes

• assert: make *AssertionFunc types just aliases by @​dolmen in stretchr/testify#1563

Fixes

• mock: avoid panic when expected type is nil in Arguments.Diff by @​mutaiib in stretchr/testify#1775
• mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @​brackendawson in stretchr/testify#1786
• suite: validate method signatures and continue execution for valid tests by @​vyas-git in stretchr/testify#1665
• assert.PanicsWithError: report error message by @​olivergondza in stretchr/testify#1400
• assert: IsIncreasing et al can return false w/out failing by @​brackendawson in stretchr/testify#1787
• add type to error message of assert.Same by @​egawata in stretchr/testify#1792
• mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @​brackendawson in stretchr/testify#1795
• assert: truncate very long objects in test failure messages by @​brackendawson in stretchr/testify#1646
• assert: fix NotSubset error messages using %#v instead of %q (fixes #1800) by @​nghiack7 in stretchr/testify#1888
• suite: prevent panic when SetupTest skips with HandleStats by @​blackwell-systems in stretchr/testify#1877

Documentation, Build & CI

• CI: test also with Go 1.23 by @​dolmen in stretchr/testify#1783
• Vendor unmaintained github.com/pmezard/go-difflib by @​brackendawson in stretchr/testify#1708
• Promote ccoVeille to maintainer by @​brackendawson in stretchr/testify#1784
• build(deps): bump actions/setup-go from 5 to 6 by @​dependabot[bot] in stretchr/testify#1790
• assert.YAMLEq: Document mutlidoc behavior by @​brackendawson in stretchr/testify#1791
• _codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @​dolmen in stretchr/testify#1782
• doc: remove ineffective inline code blocks by @​brackendawson in stretchr/testify#1714
• Tag generated assertions as non-generated in new .gitattributes by @​ubunatic in stretchr/testify#1815
• chore: vendor go-spew from https://github.com/davecgh/go-spew by @​ccoVeille in stretchr/testify#1827
• require: fix godoc generation for assertions returning a bool by @​Baxromumarov in stretchr/testify#1850
• docs(require): correct example usage to use assert.CollectT (require.CollectT does not exist) by @​a2not in stretchr/testify#1821
• docs: Fix EventuallyWithTf documentation with proper placement of formatting arguments by @​a2not in stretchr/testify#1842
• EMERITUS.md: add @​tylerb by @​dolmen in stretchr/testify#1812
• CI: test also with Go 1.24 by @​alexandear in stretchr/testify#1856
• deps: bump objx to v0.5.3 and remove dependency cycle issue by @​ccoVeille in stretchr/testify#1823
• CI: upgrade GitHub Actions and pin hashes by @​SuperQ in stretchr/testify#1883
• CI: add _readme-gofmt tool to reformat Go code in README by @​dolmen in stretchr/testify#1889
• CI: add check of GitHub Action pinned hashes against tag by @​dolmen in stretchr/testify#1885
• _codegen: modernize by @​dolmen in stretchr/testify#1890
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in stretchr/testify#1906
• mock: Mock.Return does not exist anymore by @​Kentzo in stretchr/testify#1905

New Contributors

• @​mutaiib made their first contribution in stretchr/testify#1775
• @​vyas-git made their first contribution in stretchr/testify#1665
• @​olivergondza made their first contribution in stretchr/testify#1400
• @​egawata made their first contribution in stretchr/testify#1792
• @​ubunatic made their first contribution in stretchr/testify#1815
• @​Baxromumarov made their first contribution in stretchr/testify#1850
• @​a2not made their first contribution in stretchr/testify#1821

... (truncated)

Commits

• 001eb79 Merge pull request #1905 from Kentzo/patch-1
• ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
• 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
• f8c01f3 mock: Mock.Return does not exist anymore
• 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
• a11649e assert: make *AssertionFunc type just aliases
• dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
• 098f8d7 _codegen: use strings.Builder
• d2699be _codegen: modernize
• a463c8c Merge pull request #1885 from stretchr/dolmen/ci-check-ghactions-hashes
• Additional commits viewable in compare view

Updates golang.org/x/mod from 0.38.0 to 0.40.0

Commits

• d3398d0 go.mod: update golang.org/x dependencies
• 57549bf sumdb: ignore unrelated hashes in Lookup
• 96f62ae sumdb/tlog: fix TileHashReader authentication bypass
• 13be902 go.mod: update golang.org/x dependencies
• See full diff in compare view

Updates golang.org/x/text from 0.40.0 to 0.41.0

Commits

• acdba66 go.mod: update golang.org/x dependencies
• 02aa981 secure/precis: fix short destination buffer handling in Nickname profile
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Summary by cubic

Bumps five Go dependencies and pins the toolchain to Go 1.26.7 to pick up the net/url fix (GO-2026-6218). Unicode rendering in the TUI is more accurate (grapheme-aware widths, per-codepoint wcwidth), and github.com/stretchr/testify 1.12.0 may change some failure messages and mock behavior. Also updates golang.org/x/mod and golang.org/x/text with upstream fixes, removes unused indirect deps, refreshes indirects, and updates the Nix vendorHash.

• Review and rollout
  • Run the full test suite; update mocks or expected messages affected by github.com/stretchr/testify 1.12.0.
  • Spot-check TUI layouts for table widths and emoji/Devanagari spacing.
  • CI and release builds pick up Go 1.26.7 via the toolchain directive; Nix builds remain on 1.26.5 and are covered by the new vendorHash.
  • No code migrations required.

^{Written for commit ed492b0. Summary will update on new commits.}

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates Go module dependencies to newer versions (primarily charmbracelet/charm.land ecosystem + golang.org/x + testify), with corresponding checksum refreshes.

Changes:

• Bumped multiple direct dependencies in go.mod (lipgloss/v2, x/ansi, testify, x/mod, x/text) and one indirect (ultraviolet, go-colorful).
• Updated go.sum to match new module versions and pruned some older sums.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
go.mod	Bumps several direct/indirect dependency versions.
go.sum	Updates checksums to reflect the dependency version changes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jeremy]

Pushed two commits to make this the PR that clears the board:

• Nix vendorHash regenerated for the bumped deps (dependabot can't update the fixed-output hash, so the flake job failed with a mismatch).
• toolchain go1.26.7 in go.mod — clears the ambient Security failure (govulncheck GO-2026-6218, net/url, fixed in go1.26.6) that's currently failing every PR. The go directive stays at 1.26.5 deliberately: nixpkgs still ships Go 1.26.5 and buildGoModule runs with GOTOOLCHAIN=local (which ignores the toolchain directive), so raising the directive itself would break the flake build the way v0.8.0 did. setup-go v7 resolves go-version-file to the toolchain directive, so CI and release builds get 1.26.7.

The x/mod bump already in this PR fixes the Trivy HIGHs (CVE-2026-56864/56865) failing on main. Once this merges, #639 and #641 just need re-runs — their failures are all ambient.

Note: don't @dependabot rebase — it would drop these commits.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.