chore(deps): bump the all group across 2 directories with 3 updates by dependabot[bot] · Pull Request #555 · charmbracelet/wish

dependabot · 2026-06-02T03:23:42Z

Bumps the all group with 3 updates in the / directory: charm.land/bubbletea/v2, github.com/go-git/go-git/v5 and golang.org/x/crypto.
Bumps the all group with 2 updates in the /examples directory: charm.land/bubbletea/v2 and golang.org/x/crypto.

Updates charm.land/bubbletea/v2 from 2.0.6 to 2.0.7

Release notes

Sourced from charm.land/bubbletea/v2's releases.

v2.0.7

A few lil’ stability patches

Hi! This is a patch release with a few solid improvements around stability and correctness.

@lrstanley, one of our faves, fixed a race condition around mice in the Cursed Renderer

@lawrence3699 fixed a panic that could happen when input's not available

We fixed a correctness issue with regard to mouse releases when Kitty Keyboard was active (thanks, @mitchellh)

Thanks for using Bubble Tea, and if you see anything awry please do let us know!

—Charm 👋

Changelog

Fixed

c60f0c53042238305ec13b486326588f12aea0ec: fix: prevent data race with cursedRenderer.onMouse (#1691) (@lrstanley)

074596e14e2f5ca5e3986ee72e7c08f1569c4178: fix: skip input reader restore when input is disabled (#1680) (@lawrence3699)

878d7df2f2b02f3ca8db177fa8553834bc35ea7c: fix(deps): bump ultraviolet for kitty keyboard fix (@meowgorithm)

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

a23da80 v2.0.7
670963e chore(task): add release and fetch-tags tasks
29c4c32 fix(examples/deps): go mod tidy
878d7df chore(deps): bump ultraviolet for kitty keyboard fix
c60f0c5 fix: prevent data race with cursedRenderer.onMouse (#1691)
640d879 docs(readme): update footer image
0fbefd2 chore: remove CODEOWNERS
074596e fix: skip input reader restore when input is disabled (#1680)
See full diff in compare view

Updates github.com/go-git/go-git/v5 from 5.18.0 to 5.19.1

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.19.1

What's Changed

v5: plumbing: transport/ssh, Shell-quote path by @hiddeco in go-git/go-git#2068

v5: git: submodule, Fix relative URL resolution by @hiddeco in go-git/go-git#2070

v5: git: submodule, canonical remote for relative URLs by @hiddeco in go-git/go-git#2074

v5: git: submodule, error on remote without URLs by @hiddeco in go-git/go-git#2078

v5: plumbing: format/idxfile, Validate offset64 indices by @hiddeco in go-git/go-git#2084

v5: *: Reject malformed variable-length integers by @hiddeco in go-git/go-git#2092

v5: plumbing: format/packfile, Tighten delta validation by @hiddeco in go-git/go-git#2091

v5: Add worktreeFilesystem wrapper for worktree and hardening by @hiddeco in go-git/go-git#2100

v5: config: validate submodule names by @hiddeco in go-git/go-git#2082

build: Update module github.com/go-git/go-git/v5 to v5.19.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#2111

v5: git: Allow MkdirAll on worktree-root paths by @hiddeco in go-git/go-git#2117

v5: git: Stop validating symlink target paths by @pjbgf in go-git/go-git#2116

v5: plumbing: format decoder input bounds and contracts by @hiddeco in go-git/go-git#2125

plumbing: format/packfile, cap delta chain depth in parser by @pjbgf in go-git/go-git#2137

Full Changelog: go-git/go-git@v5.19.0...v5.19.1

v5.19.0

What's Changed

build: Update module github.com/go-git/go-git/v5 to v5.18.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#2010

v5: Bump sha1cd and go-billy by @pjbgf in go-git/go-git#2060

v5: Align object encoding with upstream by @pjbgf in go-git/go-git#2065

Full Changelog: go-git/go-git@v5.18.0...v5.19.0

Commits

3c3be60 Merge pull request #2137 from go-git/validate-v5
3fba897 plumbing: format/packfile, cap delta chain depth in parser
a97d660 Merge pull request #2125 from hiddeco/v5/format-input-bounds
aeaa125 plumbing: format/objfile, require Header before Read
1f38e17 plumbing: format/packfile, bound inflate size
f7545a0 plumbing: format/idxfile, bound nr by file size
170b881 Merge pull request #2116 from pjbgf/symlink-v5
7b6d994 Merge pull request #2117 from hiddeco/v5/worktree-fs-mkdirall-root-noop
f0709b3 git: Stop validating symlink target paths
776d00f git: Allow MkdirAll on worktree-root paths
Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.50.0 to 0.52.0

Commits

a1c0d99 go.mod: update golang.org/x dependencies
3c7c869 ssh: fix deadlock on unexpected channel responses
533fb3f ssh: fix source-address critical option bypass
abbc44d ssh: fix incorrect operator order
e052873 ssh: fix infinite loop on large channel writes due to integer overflow
b61cf85 ssh: enforce user presence verification for security keys
9c2cd33 ssh: enforce strict limits on DSA key parameters
8907318 ssh: reject RSA keys with excessively large moduli
ffd87b4 ssh: fix panic when authority callbacks are nil
4e7a738 ssh: fix deadlock on unexpected global responses
Additional commits viewable in compare view

Updates charm.land/bubbletea/v2 from 2.0.6 to 2.0.7

Release notes

Sourced from charm.land/bubbletea/v2's releases.

v2.0.7

A few lil’ stability patches

Hi! This is a patch release with a few solid improvements around stability and correctness.

@lrstanley, one of our faves, fixed a race condition around mice in the Cursed Renderer

@lawrence3699 fixed a panic that could happen when input's not available

We fixed a correctness issue with regard to mouse releases when Kitty Keyboard was active (thanks, @mitchellh)

Thanks for using Bubble Tea, and if you see anything awry please do let us know!

—Charm 👋

Changelog

Fixed

c60f0c53042238305ec13b486326588f12aea0ec: fix: prevent data race with cursedRenderer.onMouse (#1691) (@lrstanley)

074596e14e2f5ca5e3986ee72e7c08f1569c4178: fix: skip input reader restore when input is disabled (#1680) (@lawrence3699)

878d7df2f2b02f3ca8db177fa8553834bc35ea7c: fix(deps): bump ultraviolet for kitty keyboard fix (@meowgorithm)

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

a23da80 v2.0.7
670963e chore(task): add release and fetch-tags tasks
29c4c32 fix(examples/deps): go mod tidy
878d7df chore(deps): bump ultraviolet for kitty keyboard fix
c60f0c5 fix: prevent data race with cursedRenderer.onMouse (#1691)
640d879 docs(readme): update footer image
0fbefd2 chore: remove CODEOWNERS
074596e fix: skip input reader restore when input is disabled (#1680)
See full diff in compare view

Updates golang.org/x/crypto from 0.50.0 to 0.52.0

Commits

a1c0d99 go.mod: update golang.org/x dependencies
3c7c869 ssh: fix deadlock on unexpected channel responses
533fb3f ssh: fix source-address critical option bypass
abbc44d ssh: fix incorrect operator order
e052873 ssh: fix infinite loop on large channel writes due to integer overflow
b61cf85 ssh: enforce user presence verification for security keys
9c2cd33 ssh: enforce strict limits on DSA key parameters
8907318 ssh: reject RSA keys with excessively large moduli
ffd87b4 ssh: fix panic when authority callbacks are nil
4e7a738 ssh: fix deadlock on unexpected global responses
Additional commits viewable in compare view

Updates charm.land/bubbletea/v2 from 2.0.6 to 2.0.7

Release notes

Sourced from charm.land/bubbletea/v2's releases.

v2.0.7

A few lil’ stability patches

Hi! This is a patch release with a few solid improvements around stability and correctness.

@lrstanley, one of our faves, fixed a race condition around mice in the Cursed Renderer

@lawrence3699 fixed a panic that could happen when input's not available

We fixed a correctness issue with regard to mouse releases when Kitty Keyboard was active (thanks, @mitchellh)

Thanks for using Bubble Tea, and if you see anything awry please do let us know!

—Charm 👋

Changelog

Fixed

c60f0c53042238305ec13b486326588f12aea0ec: fix: prevent data race with cursedRenderer.onMouse (#1691) (@lrstanley)

074596e14e2f5ca5e3986ee72e7c08f1569c4178: fix: skip input reader restore when input is disabled (#1680) (@lawrence3699)

878d7df2f2b02f3ca8db177fa8553834bc35ea7c: fix(deps): bump ultraviolet for kitty keyboard fix (@meowgorithm)

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

a23da80 v2.0.7
670963e chore(task): add release and fetch-tags tasks
29c4c32 fix(examples/deps): go mod tidy
878d7df chore(deps): bump ultraviolet for kitty keyboard fix
c60f0c5 fix: prevent data race with cursedRenderer.onMouse (#1691)
640d879 docs(readme): update footer image
0fbefd2 chore: remove CODEOWNERS
074596e fix: skip input reader restore when input is disabled (#1680)
See full diff in compare view

Updates golang.org/x/crypto from 0.50.0 to 0.52.0

Commits

a1c0d99 go.mod: update golang.org/x dependencies
3c7c869 ssh: fix deadlock on unexpected channel responses
533fb3f ssh: fix source-address critical option bypass
abbc44d ssh: fix incorrect operator order
e052873 ssh: fix infinite loop on large channel writes due to integer overflow
b61cf85 ssh: enforce user presence verification for security keys
9c2cd33 ssh: enforce strict limits on DSA key parameters
8907318 ssh: reject RSA keys with excessively large moduli
ffd87b4 ssh: fix panic when authority callbacks are nil
4e7a738 ssh: fix deadlock on unexpected global responses
Additional commits viewable in compare view

Updates charm.land/bubbletea/v2 from 2.0.6 to 2.0.7

Release notes

Sourced from charm.land/bubbletea/v2's releases.

v2.0.7

A few lil’ stability patches

Hi! This is a patch release with a few solid improvements around stability and correctness.

@lrstanley, one of our faves, fixed a race condition around mice in the Cursed Renderer

@lawrence3699 fixed a panic that could happen when input's not available

We fixed a correctness issue with regard to mouse releases when Kitty Keyboard was active (thanks, @mitchellh)

Thanks for using Bubble Tea, and if you see anything awry please do let us know!

—Charm 👋

Changelog

Fixed

c60f0c53042238305ec13b486326588f12aea0ec: fix: prevent data race with cursedRenderer.onMouse (#1691) (@lrstanley)

074596e14e2f5ca5e3986ee72e7c08f1569c4178: fix: skip input reader restore when input is disabled (#1680) (@lawrence3699)

878d7df2f2b02f3ca8db177fa8553834bc35ea7c: fix(deps): bump ultraviolet for kitty keyboard fix (@meowgorithm)

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

a23da80 v2.0.7
670963e chore(task): add release and fetch-tags tasks
29c4c32 fix(examples/deps): go mod tidy
878d7df chore(deps): bump ultraviolet for kitty keyboard fix
c60f0c5 fix: prevent data race with cursedRenderer.onMouse (#1691)
640d879 docs(readme): update footer image
0fbefd2 chore: remove CODEOWNERS
074596e fix: skip input reader restore when input is disabled (#1680)
See full diff in compare view

Updates golang.org/x/crypto from 0.50.0 to 0.52.0

Commits

a1c0d99 go.mod: update golang.org/x dependencies
3c7c869 ssh: fix deadlock on unexpected channel responses
533fb3f ssh: fix source-address critical option bypass
abbc44d ssh: fix incorrect operator order
e052873 ssh: fix infinite loop on large channel writes due to integer overflow
b61cf85 ssh: enforce user presence verification for security keys
9c2cd33 ssh: enforce strict limits on DSA key parameters
8907318 ssh: reject RSA keys with excessively large moduli
ffd87b4 ssh: fix panic when authority callbacks are nil
4e7a738 ssh: fix deadlock on unexpected global responses
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the all group with 3 updates in the / directory: [charm.land/bubbletea/v2](https://github.com/charmbracelet/bubbletea), [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) and [golang.org/x/crypto](https://github.com/golang/crypto). Bumps the all group with 2 updates in the /examples directory: [charm.land/bubbletea/v2](https://github.com/charmbracelet/bubbletea) and [golang.org/x/crypto](https://github.com/golang/crypto). Updates `charm.land/bubbletea/v2` from 2.0.6 to 2.0.7 - [Release notes](https://github.com/charmbracelet/bubbletea/releases) - [Commits](charmbracelet/bubbletea@v2.0.6...v2.0.7) Updates `github.com/go-git/go-git/v5` from 5.18.0 to 5.19.1 - [Release notes](https://github.com/go-git/go-git/releases) - [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md) - [Commits](go-git/go-git@v5.18.0...v5.19.1) Updates `golang.org/x/crypto` from 0.50.0 to 0.52.0 - [Commits](golang/crypto@v0.50.0...v0.52.0) Updates `charm.land/bubbletea/v2` from 2.0.6 to 2.0.7 - [Release notes](https://github.com/charmbracelet/bubbletea/releases) - [Commits](charmbracelet/bubbletea@v2.0.6...v2.0.7) Updates `golang.org/x/crypto` from 0.50.0 to 0.52.0 - [Commits](golang/crypto@v0.50.0...v0.52.0) Updates `charm.land/bubbletea/v2` from 2.0.6 to 2.0.7 - [Release notes](https://github.com/charmbracelet/bubbletea/releases) - [Commits](charmbracelet/bubbletea@v2.0.6...v2.0.7) Updates `golang.org/x/crypto` from 0.50.0 to 0.52.0 - [Commits](golang/crypto@v0.50.0...v0.52.0) Updates `charm.land/bubbletea/v2` from 2.0.6 to 2.0.7 - [Release notes](https://github.com/charmbracelet/bubbletea/releases) - [Commits](charmbracelet/bubbletea@v2.0.6...v2.0.7) Updates `golang.org/x/crypto` from 0.50.0 to 0.52.0 - [Commits](golang/crypto@v0.50.0...v0.52.0) --- updated-dependencies: - dependency-name: charm.land/bubbletea/v2 dependency-version: 2.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.19.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: charm.land/bubbletea/v2 dependency-version: 2.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: charm.land/bubbletea/v2 dependency-version: 2.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: charm.land/bubbletea/v2 dependency-version: 2.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies label Jun 2, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the all group across 2 directories with 3 updates#555

chore(deps): bump the all group across 2 directories with 3 updates#555
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/all-959fe6fc14

dependabot Bot commented on behalf of github Jun 2, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.0.7

A few lil’ stability patches

Changelog

Fixed

v5.19.1

What's Changed

v5.19.0

What's Changed

v2.0.7

A few lil’ stability patches

Changelog

Fixed

v2.0.7

A few lil’ stability patches

Changelog

Fixed

v2.0.7

A few lil’ stability patches

Changelog

Fixed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jun 2, 2026 •

edited

Loading