chore(deps): bump the engine group across 2 directories with 13 updates

[dependabot]

Bumps the engine group with 9 updates in the / directory:

Package	From	To
github.com/1password/onepassword-sdk-go	0.1.7	0.2.0
github.com/opencontainers/image-spec	1.1.0	1.1.1
golang.org/x/crypto	0.35.0	0.36.0
golang.org/x/mod	0.23.0	0.24.0
golang.org/x/net	0.35.0	0.37.0
golang.org/x/oauth2	0.27.0	0.28.0
golang.org/x/tools	0.30.0	0.31.0
google.golang.org/grpc	1.70.0	1.71.0
mvdan.cc/sh/v3	3.10.1-0.20250103084315-5e4be7920b8b	3.11.0

Bumps the engine group with 2 updates in the /sdk/go directory: golang.org/x/net and google.golang.org/grpc.

Updates github.com/1password/onepassword-sdk-go from 0.1.7 to 0.2.0

Release notes

Sourced from github.com/1password/onepassword-sdk-go's releases.

Release 0.2.0

1Password Go SDK v0.2.0

NEW

• File Support: You can now create Document items, attach files to items, delete files from items, and read file contents using the SDK.

IMPROVED

• Read files using secret references: You can now resolve secret references that point to files attached to 1Password items.
• Read SSH keys in Open SSH format: You can now use a secret reference to fetch a private key in OpenSSH format. For example: op://vault/<SSH item>/private key?ssh-format=openssh
• Support for more item field types: You can now create, retrieve, and edit items containing SSH keys, Month-Year and Menu-type fields using the SDK.
• Read more field types using secret references: You can now resolve secret references that point to information stored in Date, Month/Year, Address, and Reference field types.
• Improved error messages: The error messages returned by the SDK were improved to be more clear and actionable.

⚠️ BREAKING CHANGE ⚠️

This release contains a breaking change for the Go SDK, where the attributes of client (Vaults, Items, Secrets), as well as the Shares attribute of client.Items should now be accessed through getter methods instead of directly.

This does not affect any code already deployed, and will not take effect in your code-base before explicitly updating to the latest version of the 1Password Go SDK (0.2.0).

To migrate your code which uses prior versions of the 1Password Go SDK to the latest, replace in your application code all occurrences of:

• client.Items.Shares. with client.Items().Shares().
• client.Items. with client.Items().
• client.Vaults. with client.Vaults().
• client.Secrets. with client.Secrets().

in the SDK function calls.

Commits

• 28e9f2b update build number
• eb28aef fix import example
• 7f3febd update invocation size error message and clean up examples
• 0b62911 fix comments and remove unnecessary err check
• 1dd5a8b update comments
• 278ba33 message limit is now private
• 79537e3 clean up example file
• 9525b50 Remove redundant functions from SSH key example
• 3b4b112 add size check for invocations
• 55505b9 update readme
• Additional commits viewable in compare view

Updates github.com/opencontainers/image-spec from 1.1.0 to 1.1.1

Release notes

Sourced from github.com/opencontainers/image-spec's releases.

v1.1.1

Vote Passed [+5 -0 nv1] - https://groups.google.com/a/opencontainers.org/g/dev/c/T-olx0jdT18 Release PR : opencontainers/image-spec#1247 Full Changelog: opencontainers/image-spec@v1.1.0...v1.1.1

Commits

• 147f9c1 Release v1.1.1
• fbb4662 Merge pull request #1238 from mkenigs/wording-nit
• 81e457e Fix grammar nit
• 92353b0 Merge pull request #1225 from sudo-bmitch/pr-doc-go-version
• 1a0b9f9 Merge pull request #1230 from sudo-bmitch/pr-layout-extensibility
• f272635 Merge pull request #1228 from sudo-bmitch/pr-mixed-digest-algo
• e0462ab Merge pull request #1229 from tianon/setup-go
• cf536e3 Merge pull request #1227 from sudo-bmitch/pr-rm-project-doc
• 60acaac Document extensibility of the image layout
• 4dcf962 Document Go version policy
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.35.0 to 0.36.0

Commits

• 49bf5b8 go.mod: update golang.org/x dependencies
• 24852b6 ssh: add decode support for banners
• bbc689c ssh: use a more straightforward return value
• See full diff in compare view

Updates golang.org/x/mod from 0.23.0 to 0.24.0

Commits

• dc121ce all: upgrade go directive to at least 1.23.0 [generated]
• See full diff in compare view

Updates golang.org/x/net from 0.35.0 to 0.37.0

Commits

• 99b3ae0 go.mod: update golang.org/x dependencies
• 85d1d54 go.mod: update golang.org/x dependencies
• cde1dda proxy, http/httpproxy: do not mismatch IPv6 zone ids against hosts
• fe7f039 publicsuffix: spruce up code gen and speed up PublicSuffix
• 459513d internal/http3: move more common stream processing to genericConn
• aad0180 http2: fix flakiness from t.Log when GOOS=js
• b73e574 http2: don't log expected errors from writing invalid trailers
• 5f45c77 internal/http3: make read-data tests usable for server handlers
• 43c2540 http2, internal/httpcommon: reject userinfo in :authority
• 1d78a08 http2, internal/httpcommon: factor out server header logic for h2/h3
• Additional commits viewable in compare view

Updates golang.org/x/oauth2 from 0.27.0 to 0.28.0

Commits

• 0042180 oauth2: Deep copy context client in NewClient
• ce350bf oauth2: remove unneeded TokenSource implementation in transport test
• 44967ab google: fix typos
• 9c82a8c oauth2.go: use a more straightforward return value
• See full diff in compare view

Updates golang.org/x/sync from 0.11.0 to 0.12.0

Commits

• b637f27 errgroup: drop support for Go versions before 1.20
• 960bf1f all: upgrade go directive to at least 1.23.0 [generated]
• See full diff in compare view

Updates golang.org/x/sys from 0.30.0 to 0.31.0

Commits

• 74cfc93 all: upgrade go directive to at least 1.23.0 [generated]
• See full diff in compare view

Updates golang.org/x/term from 0.29.0 to 0.30.0

Commits

• 04218fd go.mod: update golang.org/x dependencies
• 208db03 all: upgrade go directive to at least 1.23.0 [generated]
• See full diff in compare view

Updates golang.org/x/text from 0.22.0 to 0.23.0

Commits

• 566b44f go.mod: update golang.org/x dependencies
• d5156da collate/build: do not use println in tests
• 221d88c x/text: fix scientific notation by removing extraneous spaces
• b18c107 internal/export/unicode: change C comment to mention unassigned code points
• 835f8ac language: use a more straightforward return value
• ae68efb internal/export/unicode: add CategoryAliases, Cn, and LC
• 518d9c0 all: upgrade go directive to at least 1.23.0 [generated]
• See full diff in compare view

Updates golang.org/x/tools from 0.30.0 to 0.31.0

Commits

• 6a5b66b go.mod: update golang.org/x dependencies
• 25a90be gopls/internal/golang: Implementations for func types
• db6008c go/types/internal/play: show Cursor.Stack of selected node
• ece9e9b gopls/doc/generate: add status in codelenses and inlayhints
• 340f21a gopls: move gopls/doc/generate package
• 0721940 gopls/internal/analysis/modernize: strings.Fields -> FieldsSeq
• 8d38122 gopls/internal/cache: reproduce and fix crash on if cond overflow
• d81d6fc gopls/internal/util/asm: better assembly parsing
• 455db21 gopls/internal/cache/parsego: fix OOB crash in fixInitStmt
• 2b1f550 gopls/internal/analysis/gofix: allow literal array lengths
• Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.70.0 to 1.71.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.71.0

API Changes

• balancer: Custom LB policies that record metrics must use the new MetricsRecorder method on Balancer.ClientConn instead of the removed Balancer.BuildOptions.MetricsRecorder field to obtain a metrics recorder. (#8027)
• balancer: balancer.ClientConn implementations must now embed a delegate implementation. This allows grpc-go to add new methods to the interface and remain backward compatible. (#8026)
• balancer/endpointsharding: The constructor accepts the child balancer's builder and a struct with optional configuration. (#8052)

New Features

• xds: Add support for dualstack via the additional_addresses field in the Endpoint resource. To disable this feature, set the environment variable GRPC_EXPERIMENTAL_XDS_DUALSTACK_ENDPOINTS=false. (#8134)
• stats/opentelemetry: Add experimental support for OpenTelemetry tracing. (#7852)
• xds/internal/xdsclient: Add counter metrics for valid and invalid resource updates. (#8038)
• balancer/leastrequest, roundrobin: Add dualstack support. (#7969, #7966)
• balancer/endpointsharding: Balancers created with the new DisableAutoReconnect option will not attempt to call ExitIdle automatically on their children when the children report idle. (#8052)

Bug Fixes

• client: Fix support for proxies when using grpc.NewClient so the target is resolved by the proxy as expected. (#7881)
  • Added WithLocalDNSResolution() dial option to explicitly force target resolution on the client instead. (#7881)
• weightedtarget: Return erroring picker when no targets are configured. (#8070)
• xds: Fail RPCs with UNAVAILABLE when the EDS resource is missing or contains no endpoints (#8070)
• xdsclient: Fix a bug where connectivity failures were reported to resource watchers before trying all listed servers. (#8075)
• grpc: Fix the number of bytes reported in the error message when encoded messages are larger than 4GB. (#8033)
• xds: Fixed a bug preventing tests from creating multiple servers or channels with different bootstrap configs. (#8050)
• grpc: Fix message length checks when compression is enabled and maxReceiveMessageSize is MaxInt (#7918)
  • Special Thanks: @​vinothkumarr227

Documentation

• client: Improve documentation of grpc.NewClient and ClientConn.CanonicalTarget by providing examples. (#8078)
• examples/features/dualstack: New example demonstrating usage of endpoints and dualstack functionality. (#8098)

Commits

• d01db5c Change version to 1.71.0 (#8105)
• 012f8bf xds: Enable dualstack flag (#8134)
• bf0c885 examples/features/dualstack: Demonstrate Dual Stack functionality (#8098) (#8...
• 05bdd66 ringhash: Remove TODO comment (#8096)
• ddb2484 xds: remove obsolete xDS transport custom dialer option (#8079)
• 8528f43 cleanup: replace Dial with NewClient (#7975)
• ae2a04f ringhash: Replace DNS resolver before sending xDS Update in test (#8091)
• e55819e lazy: Use channel to wait for resolver error being received in test (#8088)
• b524c08 xdsclient: include xds node ID in errors from the WatchResource API (#8093)
• 91eb6aa client: improve documentation of target strings (#8078)
• Additional commits viewable in compare view

Updates mvdan.cc/sh/v3 from 3.10.1-0.20250103084315-5e4be7920b8b to 3.11.0

Release notes

Sourced from mvdan.cc/sh/v3's releases.

v3.11.0

This release drops support for Go 1.22 and includes many enhancements.

• cmd/shfmt
  • Support -l=0 and -f=0 to split filenames with null bytes - #1096
• syntax
  • New iterator API: Parser.WordsSeq
  • Fix Parser.Incomplete and IsIncomplete to work well with Parser.Words - #937
  • Initial support for parsing incomplete shell via RecoverErrors
  • Expand LangError to include which language was used when parsing
• interp
  • Refactor setting variables to fix array declaration edge cases - #1108
  • Fix test read/write/exec operators to work correctly on directories - #1116
  • Replace the cancelreader dependency with os.File.SetReadDeadline
  • Avoid waiting for process substitutions, matching Bash
  • Skip OpenHandler when opening named pipes for process substitutions - #1120
  • Use TMPDIR if set via Env to create temporary files such as named pipes
• expand
  • New iterator API: FieldsSeq
  • Correctly handle repeated backslashes in double quotes - #1106
  • Don't expand backslashes inside here-documents - #1070

Consider becoming a sponsor if you benefit from the work that went into this release!

Binaries built on go version go1.24.0 linux/amd64 with:

CGO_ENABLED=0 go build -trimpath -ldflags="-w -s -X=main.version=v3.11.0"

Changelog

Sourced from mvdan.cc/sh/v3's changelog.

[3.11.0] - 2025-03-05

This release drops support for Go 1.22 and includes many enhancements.

• cmd/shfmt
  • Support -l=0 and -f=0 to split filenames with null bytes - #1096
• syntax
  • New iterator API: Parser.WordsSeq
  • Fix Parser.Incomplete and IsIncomplete to work well with Parser.Words - #937
  • Initial support for parsing incomplete shell via RecoverErrors
  • Expand LangError to include which language was used when parsing
• interp
  • Refactor setting variables to fix array declaration edge cases - #1108
  • Fix test read/write/exec operators to work correctly on directories - #1116
  • Replace the cancelreader dependency with os.File.SetReadDeadline
  • Avoid waiting for process substitutions, matching Bash
  • Skip OpenHandler when opening named pipes for process substitutions - #1120
  • Use TMPDIR if set via Env to create temporary files such as named pipes
• expand
  • New iterator API: FieldsSeq
  • Correctly handle repeated backslashes in double quotes - #1106
  • Don't expand backslashes inside here-documents - #1070

Consider becoming a sponsor if you benefit from the work that went into this release!

[3.10.0] - 2024-10-20

• cmd/shfmt
  • Report the correct language variant in parser error messages - #1102
  • Move --filename out of the parser options category - #1079
• syntax
  • Parse all CRLF line endings as LF, including inside heredocs - #1088
  • Count skipped backslashes inside backticks in position column numbers - #1098
  • Count skipped null bytes in position column numbers for consistency
• interp
  • Fix a regression in v3.9.0 which broke redirecting files to stdin - #1099
  • Fix a regression in v3.9.0 where HandlerContext.Stdin was never nil
  • Add an Interactive option to be used by interactive shells - #1100
  • Support closing stdin, stdout, and stderr via redirections like <&-

Consider becoming a sponsor if you benefit from the work that went into this release!

[3.9.0] - 2024-08-16

This release drops support for Go 1.21 and includes many fixes.

• cmd/shfmt
  • Switch the diff implementation to remove one dependency
• syntax
  • Protect against overflows in position offset integers

... (truncated)

Commits

• See full diff in compare view

Updates golang.org/x/net from 0.35.0 to 0.37.0

Commits

• 99b3ae0 go.mod: update golang.org/x dependencies
• 85d1d54 go.mod: update golang.org/x dependencies
• cde1dda proxy, http/httpproxy: do not mismatch IPv6 zone ids against hosts
• fe7f039 publicsuffix: spruce up code gen and speed up PublicSuffix
• 459513d internal/http3: move more common stream processing to genericConn
• aad0180 http2: fix flakiness from t.Log when GOOS=js
• b73e574 http2: don't log expected errors from writing invalid trailers
• 5f45c77 internal/http3: make read-data tests usable for server handlers
• 43c2540 http2, internal/httpcommon: reject userinfo in :authority
• 1d78a08 http2, internal/httpcommon: factor out server header logic for h2/h3
• Additional commits viewable in compare view

Updates golang.org/x/sync from 0.11.0 to 0.12.0

Commits

• b637f27 errgroup: drop support for Go versions before 1.20
• 960bf1f all: upgrade go directive to at least 1.23.0 [generated]
• See full diff in compare view

Updates golang.org/x/sys from 0.30.0 to 0.31.0

Commits

• 74cfc93 all: upgrade go directive to at least 1.23.0 [generated]
• See full diff in compare view

Updates golang.org/x/text from 0.22.0 to 0.23.0

Commits

• 566b44f go.mod: update golang.org/x dependencies
• d5156da collate/build: do not use println in tests
• 221d88c x/text: fix scientific notation by removing extraneous spaces
• b18c107 internal/export/unicode: change C comment to mention unassigned code points
• 835f8ac language: use a more straightforward return value
• ae68efb internal/export/unicode: add CategoryAliases, Cn, and LC
• 518d9c0 all: upgrade go directive to at least 1.23.0 [generated]
• See full diff in compare view

Updates google.golang.org/grpc from 1.70.0 to 1.71.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.71.0

API Changes

• balancer: Custom LB policies that record metrics must use the new MetricsRecorder method on Balancer.ClientConn instead of the removed Balancer.BuildOptions.MetricsRecorder field to obtain a metrics recorder. (#8027)
• balancer: balancer.ClientConn implementations must now embed a delegate implementation. This allows grpc-go to add new methods to the interface and remain backward compatible. (#8026)
• balancer/endpointsharding: The constructor accepts the child balancer's builder and a struct with optional configuration. (#8052)

New Features

• xds: Add support for dualstack via the additional_addresses field in the Endpoint resource. To disable this feature, set the environment variable GRPC_EXPERIMENTAL_XDS_DUALSTACK_ENDPOINTS=false. (#8134)
• stats/opentelemetry: Add experimental support for OpenTelemetry tracing. (#7852)
• xds/internal/xdsclient: Add counter metrics for valid and invalid resource updates. (#8038)
• balancer/leastrequest, roundrobin: Add dualstack support. (#7969, #7966)
• balancer/endpointsharding: Balancers created with the new DisableAutoReconnect option will not attempt to call ExitIdle automatically on their children when the children report idle. (#8052)

Bug Fixes

• client: Fix support for proxies when using grpc.NewClient so the target is resolved by the proxy as expected. (#7881)
  • Added WithLocalDNSResolution() dial option to explicitly force target resolution on the client instead. (#7881)
• weightedtarget: Return erroring picker when no targets are configured. (#8070)
• xds: Fail RPCs with UNAVAILABLE when the EDS resource is missing or contains no endpoints (#8070)
• xdsclient: Fix a bug where connectivity failures were reported to resource watchers before trying all listed servers. (#8075)
• grpc: Fix the number of bytes reported in the error message when encoded messages are larger than 4GB. (#8033)
• xds: Fixed a bug preventing tests from creating multiple servers or channels with different bootstrap configs. (#8050)
• grpc: Fix message length checks when compression is enabled and maxReceiveMessageSize is MaxInt (#7918)
  • Special Thanks: @​vinothkumarr227

Documentation

• client: Improve documentation of grpc.NewClient and ClientConn.CanonicalTarget by providing examples. (#8078)
• examples/features/dualstack: New example demonstrating usage of endpoints and dualstack functionality. (#8098)

Commits

• d01db5c Change version to 1.71.0 (#8105)
• 012f8bf xds: Enable dualstack flag (#8134)
• bf0c885 examples/features/dualstack: Demonstrate Dual Stack functionality (#8098) (#8...
• 05bdd66 ringhash: Remove TODO comment (#8096)
• ddb2484 xds: remove obsolete xDS transport custom dialer option (#8079)
• 8528f43 cleanup: replace Dial with NewClient (#7975)
• ae2a04f ringhash: Replace DNS resolver before sending xDS Update in test (#8091)
• e55819e lazy: Use channel to wait for resolver error being received in test (#8088)
• b524c08 xdsclient: include xds node ID in errors from the WatchResource API (#8093)
• 91eb6aa client: improve documentation of target strings (#8078)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions