v1.33.1: Preserve remote key names on set

A small patch release centered on a fix to fnox set so updates no longer clobber a secret's custom remote key name. The rest is routine dependency and CI maintenance.

Fixed

• fnox set preserves an existing remote key name (#712) -- @jdx. When updating a remote-backed secret, fnox set previously resolved the remote key only from --key-name or the environment variable name, overwriting any custom value in your config and writing to the wrong backend object. Now it reuses the existing provider key when one is configured for the same provider, while --key-name still takes highest precedence and the environment key is used as a fallback when creating a secret or switching providers. Inherited parent-config secrets no longer steer a child override.

  As part of this fix, the HashiCorp Vault provider's put_secret was reworked to update individual fields via kv patch (preserving sibling fields), pass values through piped stdin so @ and - are treated literally, and correctly handle missing paths, concurrent writers, and soft-deleted KV v2 metadata.

Full Changelog: v1.33.0...v1.33.1

💚 Sponsor fnox

fnox is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.