chore(deps): bump the all group across 1 directory with 5 updates

[dependabot]

Bumps the all group with 4 updates in the / directory: charm.land/bubbles/v2, charm.land/bubbletea/v2, charm.land/glamour/v2 and github.com/pelletier/go-toml/v2.

Updates charm.land/bubbles/v2 from 2.0.0 to 2.1.0

Release notes

Sourced from charm.land/bubbles/v2's releases.

v2.1.0

Shrink ’n’ grow your textareas

The update adds a new feature to automatically resize your textarea vertically as its content changes.

ta := textarea.New()
ta.DynamicHeight = true   // Enable dynamic resizing
ta.MinHeight = 3          // Minimum visible rows
ta.MaxHeight = 10         // Maximum visible rows
ta.MaxContentHeight = 20  // Maximum rows of content

Piece of cake, right?

Enjoy! 💘

Changelog

New!

• f1daacfa0cfee07e31a12498078426d275aa5286: feat(textarea): dynamic height (#910) (@​meowgorithm)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

• f1daacf feat(textarea): dynamic height (#910)
• d2b804e chore(deps): bump the all group with 2 updates (#908)
• c2c79e3 chore(deps): bump the all group with 2 updates (#902)
• See full diff in compare view

Updates charm.land/bubbletea/v2 from 2.0.2 to 2.0.7

Release notes

Sourced from charm.land/bubbletea/v2's releases.

v2.0.7

A few lil’ stability patches

Hi! This is a patch release with a few solid improvements around stability and correctness.

• @​lrstanley, one of our faves, fixed a race condition around mice in the Cursed Renderer
• @​lawrence3699 fixed a panic that could happen when input's not available
• We fixed a correctness issue with regard to mouse releases when Kitty Keyboard was active (thanks, @​mitchellh)

Thanks for using Bubble Tea, and if you see anything awry please do let us know!

—Charm 👋

Changelog

Fixed

• c60f0c53042238305ec13b486326588f12aea0ec: fix: prevent data race with cursedRenderer.onMouse (#1691) (@​lrstanley)
• 074596e14e2f5ca5e3986ee72e7c08f1569c4178: fix: skip input reader restore when input is disabled (#1680) (@​lawrence3699)
• 878d7df2f2b02f3ca8db177fa8553834bc35ea7c: fix(deps): bump ultraviolet for kitty keyboard fix (@​meowgorithm)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

v2.0.6

This release fixes an issue with how Bubble Tea handled wide characters. Before, a wide character might be skipped or cause an infinite loop causing the CPU to spike. See charmbracelet/bubbletea@fdcd0cf and charmbracelet/ultraviolet#109 for more details.

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

v2.0.5

A small release to remove accidental unwanted debug log file. See charmbracelet/bubbletea@1ed724a and charmbracelet/ultraviolet@b516641 for details.

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

v2.0.4

This release includes a small fix related to width calculation in x/ansi. See charmbracelet/bubbletea@c788fe9 and charmbracelet/x@6921c75 for more details.

---

... (truncated)

Commits

• a23da80 v2.0.7
• 670963e chore(task): add release and fetch-tags tasks
• 29c4c32 fix(examples/deps): go mod tidy
• 878d7df chore(deps): bump ultraviolet for kitty keyboard fix
• c60f0c5 fix: prevent data race with cursedRenderer.onMouse (#1691)
• 640d879 docs(readme): update footer image
• 0fbefd2 chore: remove CODEOWNERS
• 074596e fix: skip input reader restore when input is disabled (#1680)
• fdcd0cf chore: bump ultraviolet to 489999b90468 to fix a wide char issue
• 1ed724a chore: bump ultraviolet to v0.0.0-20260413211237-bd52878bcec2
• Additional commits viewable in compare view

Updates charm.land/glamour/v2 from 2.0.0 to 2.0.1

Release notes

Sourced from charm.land/glamour/v2's releases.

v2.0.1

Changelog

Bug fixes

• 975a0f30cc6519fde4481ab084987222c8f06c34: fix: close wrap writer before its downstream chain (#575) (@​taciturnaxolotl)

Other work

• c29364924407add0616fc067e4c70ddf9a5da0dd: chore: fix pre-existing lint failures (#575) (@​taciturnaxolotl)
• 95c93db04489cebf252ec856584445c7e85ee276: chore: bump lipgloss to v2.0.4 (@​taciturnaxolotl)
• 600b93a40bb9754522c7e3496b8b41989cf1dec7: chore: remove CODEOWNERS (@​aymanbagabas)
• 253da61fcb275fcd28296956ffae5f7d98ff618d: fix(ci): use local golangci config (@​aymanbagabas)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.

Commits

• 95c93db chore: bump lipgloss to v2.0.4
• c293649 chore: fix pre-existing lint failures
• 975a0f3 fix: close wrap writer before its downstream chain
• 600b93a chore: remove CODEOWNERS
• 253da61 fix(ci): use local golangci config
• See full diff in compare view

Updates charm.land/lipgloss/v2 from 2.0.2 to 2.0.4

Release notes

Sourced from charm.land/lipgloss/v2's releases.

v2.0.4

Mini Crash Patch

Hi! This is a small patch to fix a writer-related panic. Thanks for using Lip Gloss!

Changelog

Fixed

• fefa41d: fix: prevent crash when writing to a closed wrap writer (#699) (@​taciturnaxolotl)

Docs

• 40ec0e6: docs: fix typo in table comment (#641) (@​aymanbagabas)
• a4d0b40: docs: restore missing diaereses (#664) (@​meowgorithm)

Chore

• aa91b99: chore: remove CODEOWNERS (@​aymanbagabas)
• 9cbfe8b: chore(lint): exclude revive naming linter (@​aymanbagabas)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

v2.0.3

Changelog

Fixed

• 472d718e2314596549bee2c0c8ccf8beea5f25ae: fix: Avoid background color query hang (#636) (@​jedevc)

Docs

• 9e39a0ad4f4fc779d620f17783cee3494da6ae29: docs: fix README typo (#629) (@​Rohan5commit)
• cd93a9f5d2e3cb151da83150db29751d92585d23: docs: fix tree comment typo (#634) (@​Rohan5commit)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

• b00306c fix: prevent crash when writing to a closed wrap writer
• 40ec0e6 docs: fix typo in table comment (#641)
• e3b78a2 chore(deps): bump golang.org/x/sys in the all group (#691)
• 758dd87 chore(deps): bump golang.org/x/sys in the all group (#674)
• aa91b99 chore: remove CODEOWNERS
• 9cbfe8b chore(lint): exclude revive naming linter
• a4d0b40 docs: restore missing diaereses (#664)
• 472d718 fix: Avoid background color query hang (#636)
• 89fafba chore: bump x/ansi to v0.11.7 to fix width calculation bug
• d6d41e1 chore(deps): bump golang.org/x/sys in the all group (#663)
• Additional commits viewable in compare view

Updates github.com/pelletier/go-toml/v2 from 2.2.4 to 2.3.1

Release notes

Sourced from github.com/pelletier/go-toml/v2's releases.

v2.3.1

What's Changed

Fixed bugs

• Fix incorrect error positions in unstable parser Range() (#1047) by @​pelletier in pelletier/go-toml#1056
• fix: change DisallowUnknownFields error from "missing field" to "unknown field" by @​Yanhu007 in pelletier/go-toml#1054

Other changes

• README.md: remove reference to old go versions and modules by @​maruel in pelletier/go-toml#1048

New Contributors

• @​Yanhu007 made their first contribution in pelletier/go-toml#1054
• @​maruel made their first contribution in pelletier/go-toml#1048

Full Changelog: pelletier/go-toml@v2.3.0...v2.3.1

v2.3.0

This is the first release built largely with the help of AI coding agents. Highlights include the complete removal of the unsafe package. go-toml is now fully safe Go code, with a geomean overhead of only ~1.4% vs v2.2.4 and zero additional allocations on benchmarks. This release also adds omitzero struct tag support, improves UnmarshalText/Unmarshaler handling for tables and array tables, and fixes several bugs including nil pointer marshaling, leap second handling, and datetime unmarshaling panics.

What's Changed

What's new

• marshal: don't escape quotes unnecessarily by @​virtuald in pelletier/go-toml#991
• Add omitzero tag support by @​NathanBaulch in pelletier/go-toml#998
• Support custom IsZero() methods with omitzero tag by @​pelletier in pelletier/go-toml#1020
• UnmarshalText fallbacks to struct unmarshaling for tables and arrays by @​pelletier in pelletier/go-toml#1026
• [unstable] Support Unmarshaler interface for tables and array tables by @​pelletier in pelletier/go-toml#1027

Fixed bugs

• Add missing UnmarshalTOML call by @​pelletier in pelletier/go-toml#996
• Handle array table into an empty slice by @​pelletier in pelletier/go-toml#997
• Unwrap strict errors by @​bersace in pelletier/go-toml#1012
• Fix leap second handling found by fuzz by @​pelletier in pelletier/go-toml#1019
• Fix nil pointer map values not being marshaled by @​pelletier in pelletier/go-toml#1025
• Fix panic when unmarshaling datetime values to incompatible types (#1028) by @​pelletier in pelletier/go-toml#1029
• Fix parser error pointing to wrong line at EOF without trailing newline by @​pelletier in pelletier/go-toml#1041

Documentation

• Improve Unmarshaling README by @​heckelson in pelletier/go-toml#1016
• Create AGENTS.md guidelines file by @​pelletier in pelletier/go-toml#1017

Other changes

• Unsafe package removal by @​pelletier in pelletier/go-toml#1021
• Bump CI and test scripts to Go 1.26 by @​pelletier in pelletier/go-toml#1030

New Contributors

• @​virtuald made their first contribution in pelletier/go-toml#991
• @​NathanBaulch made their first contribution in pelletier/go-toml#999
• @​bersace made their first contribution in pelletier/go-toml#1012

... (truncated)

Commits

• f85c4e8 README.md: remove reference to old go versions and modules (#1048)
• 45d4fb4 fix: change DisallowUnknownFields error from "missing field" to "unknown fiel...
• c171216 Fix incorrect error positions in unstable parser Range() (#1047) (#1056)
• f36a3ec Reduce marshal and unmarshal overhead (#1044)
• 77f3862 Fix benchmark script replacing internal package imports (#1042)
• 16b1ef5 Fix parser error pointing to wrong line when last line has no trailing newlin...
• e14bde7 build(deps): bump docker/login-action from 3 to 4 (#1039)
• 4b1ff01 build(deps): bump docker/setup-buildx-action from 3 to 4 (#1040)
• 048a25f Go 1.26 (#1030)
• b357558 build(deps): bump goreleaser/goreleaser-action from 6 to 7 (#1035)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​pelletier/​go-toml/​v2@​v2.2.4 ⏵ v2.3.1	-10
	charm.land/​bubbletea/​v2@​v2.0.2 ⏵ v2.0.7	+1
	charm.land/​glamour/​v2@​v2.0.0 ⏵ v2.0.1	+1
	charm.land/​bubbles/​v2@​v2.0.0 ⏵ v2.1.0	+1
	charm.land/​lipgloss/​v2@​v2.0.2 ⏵ v2.0.4	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: golang github.com/pelletier/go-toml/v2 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → golang/github.com/pelletier/go-toml/v2@v2.3.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/pelletier/go-toml/v2@v2.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report