[dependabot]

Bumps the dependencies group with 9 updates:

Package	From	To
github.com/olekukonko/tablewriter	1.0.9	1.1.0
golang.org/x/crypto	0.41.0	0.42.0
golang.org/x/term	0.34.0	0.35.0
github.com/cyphar/filepath-securejoin	0.4.1	0.5.0
github.com/mattn/go-runewidth	0.0.16	0.0.19
github.com/olekukonko/ll	0.1.0	0.1.1
github.com/pjbgf/sha1cd	0.4.0	0.5.0
golang.org/x/net	0.43.0	0.44.0
golang.org/x/sys	0.35.0	0.36.0

Updates github.com/olekukonko/tablewriter from 1.0.9 to 1.1.0

Commits

• afe12b2 Merge pull request #295 from olekukonko/counter
• fe53e02 v1.1.0 in readme
• aa751db make count variadic update #294
• be92b88 initial lien count support #294
• e520aed Merge pull request #292 from EppO/fix-colorized-hmerge-footer
• f541e24 Fix AlignRight override for footer HMerge/TOTAL pattern
• 842268a Merge pull request #291 from Saurabh2402/improvement/setup-linter
• 8d10b0e lint code after sync
• 3fd0b25 Merge branch 'master' of https://github.com/Saurabh2402/tablewriter into impr...
• c0bceba add support for TrimLine update #290
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.41.0 to 0.42.0

Commits

• 5307a0c go.mod: update golang.org/x dependencies
• 9d77937 acme: include order problem in OrderError
• 8f580de ssh: remove Go 1.24 build tag for ML-KEM kex
• a4d1237 ssh/knownhosts: improve IPv6 support in Normalize
• b8d8dae curve25519: include potential fips140=only error in panic message
• f5a2eab ssh: use curve25519.X25519 instead of curve25519.ScalarMult
• 44ecf3a all: upgrade go directive to at least 1.24.0 [generated]
• See full diff in compare view

Updates golang.org/x/term from 0.34.0 to 0.35.0

Commits

• 1a11b45 go.mod: update golang.org/x dependencies
• d862cd5 all: upgrade go directive to at least 1.24.0 [generated]
• See full diff in compare view

Updates github.com/cyphar/filepath-securejoin from 0.4.1 to 0.5.0

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.5.0] - 2025-09-26

Let the past die. Kill it if you have to.

NOTE: With this release, some parts of github.com/cyphar/filepath-securejoin are now licensed under the Mozilla Public License (version 2). Please see COPYING.md as well as the the license header in each file for more details.

Breaking

• The new API introduced in the [0.3.0][] release has been moved to a new subpackage called pathrs-lite. This was primarily done to better indicate the split between the new and old APIs, as well as indicate to users the purpose of this subpackage (it is a less complete version of [libpathrs][]).

  We have added some wrappers to the top-level package to ease the transition, but those are deprecated and will be removed in the next minor release of filepath-securejoin. Users should update their import paths.

  This new subpackage has also been relicensed under the Mozilla Public License (version 2), please see COPYING.md for more details.

Added

• Most of the key bits the safe procfs API have now been exported and are available in github.com/cyphar/filepath-securejoin/pathrs-lite/procfs. At the moment this primarily consists of a new procfs.Handle API:

  • OpenProcRoot returns a new handle to /proc, endeavouring to make it safe if possible (subset=pid to protect against mistaken write attacks and leaks, as well as using fsopen(2) to avoid racing mount attacks).

    OpenUnsafeProcRoot returns a handle without attempting to create one with subset=pid, which makes it more dangerous to leak. Most users should use OpenProcRoot (even if you need to use ProcRoot as the base of an operation, as filepath-securejoin will internally open a handle when necessary).

  • The (*procfs.Handle).Open* family of methods lets you get a safe O_PATH handle to subpaths within /proc for certain subpaths.

    For OpenThreadSelf, the returned ProcThreadSelfCloser needs to be called after you completely finish using the handle (this is necessary because Go is multi-threaded and ProcThreadSelf references /proc/thread-self which may disappear if we do not runtime.LockOSThread -- ProcThreadSelfCloser is currently equivalent to runtime.UnlockOSThread).

    Note that you cannot open any procfs symlinks (most notably magic-links)

... (truncated)

Commits

• bb9e81f VERSION: release 0.5.0
• 17e58e1 CHANGELOG: minor updates
• cc071b2 hack: properly test ./...
• a1c1895 CHANGELOG: fix kernel version for open_tree(2)
• 432c95e doc: minor godoc improvements
• 90002f2 CHANGELOG: mention MPLv2 in pathrs-lite entry
• 59fcb8b COPYING: fix reference to pathrs-lite internal pkgs
• 43797e7 pathrs-lite: add Close to procfs wrapper
• 2a0e2b6 pathrs-lite: move Reopen impl to internal/procfs
• 3c5e239 *: update and improve godocs
• Additional commits viewable in compare view

Updates github.com/mattn/go-runewidth from 0.0.16 to 0.0.19

Commits

• 7770d04 Merge pull request #78 from josharian/josh/optimize-intable
• f53b71c Merge pull request #86 from mattn/fix-github-actions
• a09d510 Merge branch 'master' into fix-github-actions
• 778f900 Merge pull request #83 from clipperhouse/benchmark-allocs
• bfbd30c fix test.yaml
• 61f04f3 Merge pull request #82 from clipperhouse/graphemes-string-width
• db39519 Rename
• b3b19f2 Rename
• 94c0db1 Merge pull request #85 from mattn/fix-windows-terminal
• 76bca58 fix comment
• Additional commits viewable in compare view

Updates github.com/olekukonko/ll from 0.1.0 to 0.1.1

Commits

• 75100ce add to readme
• 13f98f3 add inspector support for Output
• See full diff in compare view

Updates github.com/pjbgf/sha1cd from 0.4.0 to 0.5.0

Release notes

Sourced from github.com/pjbgf/sha1cd's releases.

v0.5.0

What's Changed

• Refactor arm64 implementation and drop use of AVO by @​pjbgf in pjbgf/sha1cd#192
• build: Decrease dependabot interval by @​pjbgf in pjbgf/sha1cd#193
• build(deps): Bump golang from 20a022e to 14fd8a5 by @​dependabot[bot] in pjbgf/sha1cd#194
• Reduce allocations per operation to zero by @​pjbgf in pjbgf/sha1cd#195
• build: Add bench execution by @​pjbgf in pjbgf/sha1cd#197
• Introduce SIMD for arm64 by @​pjbgf in pjbgf/sha1cd#198
• amd64: Add SHANI implementation by @​pjbgf in pjbgf/sha1cd#199

Full Changelog: pjbgf/sha1cd@v0.4.0...v0.5.0

Commits

• 85c7a3d Merge pull request #199 from pjbgf/amd64-simd
• 75a4461 ubc: Remove native implementations
• e239975 amd64: Introduce SHANI implementation
• f052d33 Merge pull request #198 from pjbgf/arm
• 8792028 arm64: Introduce SIMD implementation
• 1d04cf2 Remove redundant go:generate instances
• 6fb6277 Run golden tests on generic and native implementations
• 88099dc ubc: Add noescape and nosplit directives
• 2692cee cgo: Align digest creation with purego implementation
• d390839 Merge pull request #197 from pjbgf/bench
• Additional commits viewable in compare view

Updates golang.org/x/net from 0.43.0 to 0.44.0

Commits

• 3b23d57 http2: fix race condition when disabling goroutine debugging for one test
• 8741050 http2: simplify TestServer_Push_RejectAfterGoAway
• 96e405c http2: modernize TestTransportRoundtripCloseOnWriteError
• 6dc6880 http2: simplify ClientConn Close and Shutdown tests
• 4e2915b http2: modernize TestTransportAllocationsAfterResponseBodyClose
• 30b0e78 http2: modernize TestRoundTripDoesntConsumeRequestBodyEarly
• b9acd77 http2: speed up TestTransportFlowControl
• 5153f4d go.mod: update golang.org/x dependencies
• 9338bdd http2: speed up TestTransportHandlerBodyClose
• 6b20036 http2: add synchronous handler support to serverTester
• Additional commits viewable in compare view

Updates golang.org/x/sys from 0.35.0 to 0.36.0

Commits

• b06ce05 windows: add FILE_ZERO_DATA_INFORMATION
• 689cc11 unix: fix Listen on solaris
• a4712b9 plan9: drop go version tags for unsupported versions
• 0293703 unix: add IFAL_* consts and ifaddrlblmsg on linux
• ab85cbb unix/linux: extend rtnetlink constants
• 9bd3753 unix: switch (*CPUSet).Zero to clear builtin
• 899c232 windows/mkwinsyscall: use syscall.SyscallN instead of syscall.Syscall{6,9,12,15}
• 543f21a all: upgrade go directive to at least 1.24.0 [generated]
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[semgrep-code-scalingo]

Legal Risk

github.com/cyphar/filepath-securejoin 0.5.0 was released under the MPL-2.0 license, a license that
has been flagged by your organization for consideration.

Recommendation

While merging is not directly blocked, it's best to pause and consider what it means to use this license before continuing. If you are unsure, reach out to your security team or Semgrep admin to address this issue.