chore(deps): bump the gomod group across 1 directory with 3 updates

[dependabot]

Bumps the gomod group with 3 updates in the /go directory: github.com/cachix/secretspec/secretspec-go, github.com/wailsapp/wails/v3 and go.yaml.in/yaml/v3.

Updates github.com/cachix/secretspec/secretspec-go from 0.15.0 to 0.18.0

Release notes

Sourced from github.com/cachix/secretspec/secretspec-go's releases.

0.18.0 - 2026-08-03

Release Notes

Changed

• The keyring provider now uses keyring 4's Rust-native Secret Service transport on Linux, so source builds and binaries no longer require system libdbus.
• secretspec init --from now accepts every provider with declaration reflection, including age, AWS Parameter Store, and Bitwarden Password Manager, and accepts --project and --profile as explicit discovery context for hierarchical stores.
• Custom Rust providers now pass discovery context to the Provider::reflect hook so hierarchical stores can select the project and profile namespace.

Fixed

• The Bitwarden provider now treats a locked vault or a missing session as a clear authentication failure on get/set, with the same "run bw login and bw unlock, then set BW_SESSION" guidance in both cases, instead of surfacing the underlying CLI error text.
• The Bitwarden provider now reports a missing bw CLI with install instructions instead of an authentication error: a machine without the CLI is not an authentication state, and the install guidance ("…run 'bw login' and 'bw unlock' to authenticate") used to match the not-authenticated classifier and mask the real problem.
• Vault and OpenBao JWT authentication now allows the role to be omitted when the auth mount has a server-configured default_role, while explicit URI or environment roles continue to take precedence.
• Vault and OpenBao AppRole authentication now supports roles configured with bind_secret_id=false by omitting secret_id from the login request when no SecretID credential is configured.
• secretspec import --delete-source now compares resolved storage entries without conflating distinct cache address spaces, preventing equivalent provider configurations (including dotenv path aliases) from deleting the destination value. Sources without deletion support are also rejected before any destination is written.
• The AWS Secrets Manager provider now authenticates with shared credentials file profiles backed by an active AWS login session, which previously failed because the required AWS SDK feature was not enabled. BatchGetSecretValue failures also report the full service error instead of a shortened message.

Added

• The dotenv provider accepts a leading ~ in custom paths, such as dotenv:~/.config/my-project/.env, and resolves it to the user's home directory.
• Vault and OpenBao AppRole and JWT authentication can target non-default auth method mounts, including printable Unicode mount names, with the auth_mount provider URI option.
• secretspec add NAME --description "..." (available in 0.18) adds a secret declaration to the active profile while preserving the manifest's

... (truncated)

Changelog

Sourced from github.com/cachix/secretspec/secretspec-go's changelog.

[0.18.0] - 2026-08-03

Changed

• The keyring provider now uses keyring 4's Rust-native Secret Service transport on Linux, so source builds and binaries no longer require system libdbus.
• secretspec init --from now accepts every provider with declaration reflection, including age, AWS Parameter Store, and Bitwarden Password Manager, and accepts --project and --profile as explicit discovery context for hierarchical stores.
• Custom Rust providers now pass discovery context to the Provider::reflect hook so hierarchical stores can select the project and profile namespace.

Fixed

• The Bitwarden provider now treats a locked vault or a missing session as a clear authentication failure on get/set, with the same "run bw login and bw unlock, then set BW_SESSION" guidance in both cases, instead of surfacing the underlying CLI error text.
• The Bitwarden provider now reports a missing bw CLI with install instructions instead of an authentication error: a machine without the CLI is not an authentication state, and the install guidance ("…run 'bw login' and 'bw unlock' to authenticate") used to match the not-authenticated classifier and mask the real problem.
• Vault and OpenBao JWT authentication now allows the role to be omitted when the auth mount has a server-configured default_role, while explicit URI or environment roles continue to take precedence.
• Vault and OpenBao AppRole authentication now supports roles configured with bind_secret_id=false by omitting secret_id from the login request when no SecretID credential is configured.
• secretspec import --delete-source now compares resolved storage entries without conflating distinct cache address spaces, preventing equivalent provider configurations (including dotenv path aliases) from deleting the destination value. Sources without deletion support are also rejected before any destination is written.
• The AWS Secrets Manager provider now authenticates with shared credentials file profiles backed by an active AWS login session, which previously failed because the required AWS SDK feature was not enabled. BatchGetSecretValue failures also report the full service error instead of a shortened message.

Added

• The dotenv provider accepts a leading ~ in custom paths, such as dotenv:~/.config/my-project/.env, and resolves it to the user's home directory.
• Vault and OpenBao AppRole and JWT authentication can target non-default auth method mounts, including printable Unicode mount names, with the auth_mount provider URI option.

... (truncated)

Commits

• 7ff76e8 Merge pull request #254 from cachix/agent/fix-pre-release-go-permissions
• 5a41d6a Update Swift 0.18 artifact checksum
• 3002171 Fix provider test PATH race
• 6e0d706 Merge pull request #255 from cachix/agent/centralize-provider-credential-docs
• 3f3120d Set Swift 0.18 XCFramework checksum
• 71d68ce Centralize provider credential documentation
• 5da9368 Finish 0.18 SDK version sync
• 4b70232 Fix pre-release Go workflow permissions
• 2a725db Merge pull request #253 from cachix/ci/faster-test-workflow
• 8393ea3 Merge pull request #252 from jackshunn/patch-1
• Additional commits viewable in compare view

Updates github.com/wailsapp/wails/v3 from 3.0.0-beta.0 to 3.0.0-beta.3

Release notes

Sourced from github.com/wailsapp/wails/v3's releases.

Wails v3.0.0-beta.3

Wails v3 Beta Release - v3.0.0-beta.3

Added

• Document Phase 10 beta verification completion in implementation details in PR by @​leaanthony

Fixed

• Pass window handle to Windows dark-mode API and validate arguments in PR by @​leaanthony
• Centralize macOS title-bar button state resolution for frameless windows in PR by @​taliesin-ai
• Prevent unreadable native menu text when a Windows application requests dark mode while the Windows app theme is light. The menu now uses the matching light native background until Windows can render dark menu text.
• Fix unreadable native menus on Windows 10 1809 / Windows Server 2019 (build 17763). The dark-mode uxtheme exports were gated on build 18334, so the app-level dark-mode opt-in never ran on those hosts: the menu background was painted dark but Windows kept drawing menu text in the light theme, leaving dark text on a dark background. The ordinals exist from 17763, so the gate now matches.

---

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.3

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

Wails v3.0.0-beta.2

Wails v3 Beta Release - v3.0.0-beta.2

Changed

• Promote v3 from alpha to beta
• Document system tray smart defaults and popup auto-hide behaviour, with regression coverage for click-handler selection (#5840).
• GitHub updater excludes Windows installer assets by default in PR by @​leaanthony
• Add support for rounded, square, and custom radius corners on macOS frameless windows in PR by @​leaanthony

Fixed

• Report live GTK4 window sizes and emit resize, maximise, minimise, and fullscreen state events from the configured surface (#5830).
• Fix Linux WebKit crash when sending Blob or FormData in fetch requests in PR by @​taliesin-ai
• Fetch shim passes undefined for missing Blob/FormData headers in PR by @​leaanthony

---

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.2

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

Wails v3.0.0-beta.1

Full Changelog: wailsapp/wails@v3.0.0-beta.0...v3.0.0-beta.1

Commits

• e5a901c chore(v3): bump to v3.0.0-beta.3 and update changelog [skip ci]
• 9b1e3ef ci(v3): skip nightly releases for bookkeeping-only changes (#5882)
• 56fe67e chore(changelog): auto-add entry for PR #5881 — docs(linux): record GTK beta ...
• 73ae9f6 docs(linux): record GTK beta verification evidence (#5881)
• f40df46 chore(changelog): auto-add entry for PR #5877 — fix(v3/windows): pass HWND to...
• c0dc59e fix(v3/windows): pass HWND to AllowDarkModeForWindow (#5877)
• 304dca0 chore(changelog): auto-add entry for PR #5870 — fix(v3): sync macOS frameless...
• 02ae0dc fix(v3): sync macOS frameless window controls (#5870)
• d95e60c ci(v3): attach artifacts to nightly releases (#5880)
• 538da54 fix(v3/windows): preserve native menu readability (#5879)
• Additional commits viewable in compare view

Updates go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5

Commits

• e16c7af Remove empty go.sum file
• 6abcd01 Fix unhandled nil-errors in tests
• 9481db7 Remove suite_test.go and gopkg.in/check.v1
• 485f5fc Use standard testing library for limit_test.go
• 3e00046 Use standard testing library for node_test.go
• f612058 Use standard testing library for decode_test.go
• 078f958 Use standard testing library encode_test.go
• 3847ac0 [v3] backport CodeQL workflow
• 1666663 Revert incorrect gofmt changes
• 73290cb Retract v3 tags that cannot be installed
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions