go.mod: bump the most-deps group across 1 directory with 6 updates

[dependabot]

Bumps the most-deps group with 5 updates in the / directory:

Package	From	To
github.com/rogpeppe/go-internal	1.15.0	1.16.0
github.com/stretchr/testify	1.11.1	1.12.1
golang.org/x/crypto	0.54.0	0.55.0
google.golang.org/protobuf	1.36.11	1.36.12
mvdan.cc/sh/v3	3.13.1	3.14.0

Updates github.com/rogpeppe/go-internal from 1.15.0 to 1.16.0

Commits

• 49d4e9d testscript/plugin: new package (#307)
• b82995b testscript: add dynamic command capability (#306)
• 5cab5df goproxytest: make .mod and .info files optional (#305)
• See full diff in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

• assert: make *AssertionFunc types just aliases by @​dolmen in stretchr/testify#1563

Fixes

• mock: avoid panic when expected type is nil in Arguments.Diff by @​mutaiib in stretchr/testify#1775
• mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @​brackendawson in stretchr/testify#1786
• suite: validate method signatures and continue execution for valid tests by @​vyas-git in stretchr/testify#1665
• assert.PanicsWithError: report error message by @​olivergondza in stretchr/testify#1400
• assert: IsIncreasing et al can return false w/out failing by @​brackendawson in stretchr/testify#1787
• add type to error message of assert.Same by @​egawata in stretchr/testify#1792
• mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @​brackendawson in stretchr/testify#1795
• assert: truncate very long objects in test failure messages by @​brackendawson in stretchr/testify#1646
• assert: fix NotSubset error messages using %#v instead of %q (fixes #1800) by @​nghiack7 in stretchr/testify#1888
• suite: prevent panic when SetupTest skips with HandleStats by @​blackwell-systems in stretchr/testify#1877

Documentation, Build & CI

• CI: test also with Go 1.23 by @​dolmen in stretchr/testify#1783
• Vendor unmaintained github.com/pmezard/go-difflib by @​brackendawson in stretchr/testify#1708
• Promote ccoVeille to maintainer by @​brackendawson in stretchr/testify#1784
• build(deps): bump actions/setup-go from 5 to 6 by @​dependabot[bot] in stretchr/testify#1790
• assert.YAMLEq: Document mutlidoc behavior by @​brackendawson in stretchr/testify#1791
• _codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @​dolmen in stretchr/testify#1782
• doc: remove ineffective inline code blocks by @​brackendawson in stretchr/testify#1714
• Tag generated assertions as non-generated in new .gitattributes by @​ubunatic in stretchr/testify#1815

... (truncated)

Commits

• 959dbda Merge pull request #1935 from harryzcy/yaml-update
• 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
• 001eb79 Merge pull request #1905 from Kentzo/patch-1
• ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
• 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
• f8c01f3 mock: Mock.Return does not exist anymore
• 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
• a11649e assert: make *AssertionFunc type just aliases
• dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
• 098f8d7 _codegen: use strings.Builder
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.54.0 to 0.55.0

Commits

• f44d03d go.mod: update golang.org/x dependencies
• 5ed4944 crypto/internal/poly1305: provide optimised assembly for riscv64
• b07833c ssh: return window credit for discarded extended data
• d701c51 acme: fix nil pointer dereference in pebble test error reporting
• 999d053 ssh: fix parsing of GSSAPI payloads offering multiple mechanisms
• 90f76b8 ssh: reject certificate signature keys before recursing
• b53964a ssh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers, MACs
• 626e40f ssh: drain stderr on forwarded TCP and Unix channels
• 31914c6 x509roots/fallback: update bundle
• f2135b8 all: clean up minor issues found by staticcheck
• Additional commits viewable in compare view

Updates golang.org/x/text from 0.40.0 to 0.41.0

Commits

• acdba66 go.mod: update golang.org/x dependencies
• 02aa981 secure/precis: fix short destination buffer handling in Nickname profile
• See full diff in compare view

Updates google.golang.org/protobuf from 1.36.11 to 1.36.12

Updates mvdan.cc/sh/v3 from 3.13.1 to 3.14.0

Release notes

Sourced from mvdan.cc/sh/v3's releases.

v3.14.0

This release drops support for Go 1.25 and includes many enhancements, particularly in the interpreter, which implements more shell features and fixes many divergences from Bash.

• cmd/shfmt
  • Add --detect to find shell files by executable bit or shebang - #944
• syntax
  • Add Preorder, an iterator over all nodes, complementing Walk
  • Add encoding.TextUnmarshaler implementations for each operator type
  • Support ${ foo;} and ${|foo;} inside double quotes - #1368
  • Support array elements in {varname} redirects, like exec {fds[3]}>&- - #719
  • Backslashes inside backquotes within double quotes escape double quotes - #1083
  • Allow pound signs in associative array keys like ${args[cmd,#]} - #1285
  • Don't treat # as the start of a comment inside [[ ]] tests - #1326
  • Don't join then or do with a semicolon when heredocs are pending - #1047
  • Print a space after ! in arithmetic expressions, avoiding history expansion - #987
  • Space nested closing parentheses like the opening ones - #876
  • Make SplitBraces reject malformed sequences and skip backslash escapes - #1330
  • Zsh: support the ${=name}, ${~name}, and ${^name} prefixes - #1238
  • Zsh: support the ;| case terminator and leading parentheses for globs - #1293, #1279
  • Zsh: parse subscript flag arguments as patterns, and allow [ globs in arrays - #1278, #1322
• syntax/typedjson
  • Encode operators as their syntax form, such as ">>", rather than integers - #1321
  • Return errors rather than panicking on malformed input
• interp
  • Add BashOpts to set Bash options like shopt - #962
  • Add AccessHandler to control file access checks, used by -r and cd - #1318
  • Add HandlerContext.LastExitStatus, and provide a HandlerContext to stat handlers
  • Implement the help and times builtins, as well as $- - #1398
  • Implement the ;& and ;;& case terminators - #1391
  • Implement the -N test operator, and make -nt and -ot follow POSIX - #1340
  • Support sparse indexed arrays such as a=([5]=x) - #1373
  • Run files as shell scripts when exec fails with ENOEXEC - #1065
  • Support empty here-documents, and don't expand quoted ones - #1390
  • Support js/wasm, where subprocesses and pipes are unavailable
  • Keep the redirections applied by exec with no arguments
  • Only fire the exit trap when the shell exits, rather than after every Run
• expand
  • Add BracesSeq with a config and error reporting, deprecating Braces
  • Add Variable.Indexes to describe sparse indexed arrays
  • Support integer bases in arithmetic - #339
  • Short-circuit the arithmetic && and || operators - #1371
  • Apply per-element operators to quoted array expansions like "${a[@]%o}" - #1081
  • Make unquoted ${!arr[@]} consistent with the quoted form - #672
  • Fix many divergences from Bash in arithmetic, string, and brace expansions
  • Reject unsupported Zsh syntax rather than panicking - #1363
• pattern
  • Treat an unmatched [ as a literal character, like Bash - #1372
  • Fix panics and mismatches in bracket expressions, such as [![:space:]]
• fileutil
  • Recognize dash shebangs as POSIX shell for -ln=auto - #1307

... (truncated)

Changelog

Sourced from mvdan.cc/sh/v3's changelog.

[3.14.0] - 2026-08-28

This release drops support for Go 1.25 and includes many enhancements, particularly in the interpreter, which implements more shell features and fixes many divergences from Bash.

• cmd/shfmt
  • Add --detect to find shell files by executable bit or shebang - #944
• syntax
  • Add Preorder, an iterator over all nodes, complementing Walk
  • Add encoding.TextUnmarshaler implementations for each operator type
  • Support ${ foo;} and ${|foo;} inside double quotes - #1368
  • Support array elements in {varname} redirects, like exec {fds[3]}>&- - #719
  • Backslashes inside backquotes within double quotes escape double quotes - #1083
  • Allow pound signs in associative array keys like ${args[cmd,#]} - #1285
  • Don't treat # as the start of a comment inside [[ ]] tests - #1326
  • Don't join then or do with a semicolon when heredocs are pending - #1047
  • Print a space after ! in arithmetic expressions, avoiding history expansion - #987
  • Space nested closing parentheses like the opening ones - #876
  • Make SplitBraces reject malformed sequences and skip backslash escapes - #1330
  • Zsh: support the ${=name}, ${~name}, and ${^name} prefixes - #1238
  • Zsh: support the ;| case terminator and leading parentheses for globs - #1293, #1279
  • Zsh: parse subscript flag arguments as patterns, and allow [ globs in arrays - #1278, #1322
• syntax/typedjson
  • Encode operators as their syntax form, such as ">>", rather than integers - #1321
  • Return errors rather than panicking on malformed input
• interp
  • Add BashOpts to set Bash options like shopt - #962
  • Add AccessHandler to control file access checks, used by -r and cd - #1318
  • Add HandlerContext.LastExitStatus, and provide a HandlerContext to stat handlers
  • Implement the help and times builtins, as well as $- - #1398
  • Implement the ;& and ;;& case terminators - #1391
  • Implement the -N test operator, and make -nt and -ot follow POSIX - #1340
  • Support sparse indexed arrays such as a=([5]=x) - #1373
  • Run files as shell scripts when exec fails with ENOEXEC - #1065
  • Support empty here-documents, and don't expand quoted ones - #1390
  • Support js/wasm, where subprocesses and pipes are unavailable
  • Keep the redirections applied by exec with no arguments
  • Only fire the exit trap when the shell exits, rather than after every Run
• expand
  • Add BracesSeq with a config and error reporting, deprecating Braces
  • Add Variable.Indexes to describe sparse indexed arrays
  • Support integer bases in arithmetic - #339
  • Short-circuit the arithmetic && and || operators - #1371
  • Apply per-element operators to quoted array expansions like "${a[@]%o}" - #1081
  • Make unquoted ${!arr[@]} consistent with the quoted form - #672
  • Fix many divergences from Bash in arithmetic, string, and brace expansions
  • Reject unsupported Zsh syntax rather than panicking - #1363
• pattern
  • Treat an unmatched [ as a literal character, like Bash - #1372

... (truncated)

Commits

• 868c8e8 CHANGELOG: add entry for v3.14.0
• 0d67740 interp: define the shortPathName test stub just once
• 8976822 interp: fix getAtime on the BSDs, Solaris, and AIX
• 48af1f3 expand: detect reading a file as a directory via syscall.ENOTDIR
• cd3ef1f interp: retry executing a program on ETXTBSY
• 13c4e98 interp: add regression test for the exec ETXTBSY race
• a64648d README: replace gosh and fuzzing with a sponsorship summary
• 1599bef syntax: allow pound signs in associative array keys
• 971ffa8 syntax: add test cases for issue #1285
• 4da6033 interp: note that Params should be split in v4
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions