build(deps): apply the four pending dependency updates - #13
Merged
Conversation
Dependabot opened these against the pre-rewrite history, so their branches
carry the old commits -- including the 13 MB binary the rewrite removed -- and
GitHub still reports them mergeable, which would put both straight back into
main. Neither `@dependabot rebase` nor `@dependabot recreate` moved them.
Same updates, applied on top of the rewritten main:
- github.com/spf13/cobra 1.9.1 -> 1.10.2
- github.com/spf13/viper 1.20.1 -> 1.21.0
- github.com/prometheus/client_golang 1.22.0 -> 1.24.1, client_model 0.6.1 -> 0.6.2
- actions/checkout v4 -> v7, actions/setup-go v5 -> v7,
softprops/action-gh-release v2 -> v3, golangci/golangci-lint-action v8 -> v9
SBOM regenerated: 33 dependencies now, down from 34.
This was referenced Aug 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #8, #9, #10 and #11.
Those were opened against the pre-rewrite history, so their branches still carry
the old commits — including the 13 MB binary the history rewrite removed.
GitHub reports them mergeable anyway, because their merge base still exists
server-side, so merging any of them would put the blob and the old SHAs straight
back into
main. Neither@dependabot rebasenor@dependabot recreatemovedthem within half an hour.
Same updates, applied on top of the rewritten
main:github.com/spf13/cobragithub.com/spf13/vipergithub.com/prometheus/client_golanggithub.com/prometheus/client_modelactions/checkoutactions/setup-gosoftprops/action-gh-releasegolangci/golangci-lint-actionSBOM regenerated — 33 dependencies, down from 34. Licence check, lint, race
tests and the vulnerability scan are all clean locally.
After this merges, #8–#11 should be closed and their branches deleted. They
are the last thing holding the old history alive on the remote: a fresh clone is
still 8.92 MiB because of them, against 269 KiB for
mainalone.