build(deps): bump github.com/go-sprout/sprout from 1.1.0 to 1.1.1 in the go-dependencies group

[dependabot]

Bumps the go-dependencies group with 1 update: github.com/go-sprout/sprout.

Updates github.com/go-sprout/sprout from 1.1.0 to 1.1.1

Release notes

Sourced from github.com/go-sprout/sprout's releases.

Release v1.1.1: Sprout Hardening 🔧

🌿 Sanding down the rough edges of v1.1.0!

A patch release fixing a broken derivePassword, a data race in shuffle, a division by zero in div, and a hermetic guarantee broken by the v1.1.0 additions.

🐛 Bug Fixes

• derivePassword Returned Empty: The counter was typed uint32, so text/template passed an int and the call panicked, silently swallowed by the SafeCall wrapper. The counter is now an int. This resolves #157. See [PR #197](go-sprout/sprout#197).
• Concurrency Safe shuffle: shuffle used a package-global math/rand.Source, racing when templates render in parallel. It now uses the concurrency safe math/rand.Shuffle. This resolves #195. See [PR #196](go-sprout/sprout#196).
• div Division by Zero: A zero divisor returned a bogus integer instead of failing, because the float division was cast after the fact. It now returns cannot divide by zero. See [PR #194](go-sprout/sprout#194).
• Hermetic Map Leaks: dateAgo, uuidv7, randInt and the expandEnv alias were missing from the non-hermetic exclusion list, so HermeticTxtFuncMap and HermeticHtmlFuncMap still exposed them. They are now excluded, and a test keeps the list exhaustive. See [PR #193](go-sprout/sprout#193).

🔒 Security & Dependencies

• Updated go.yaml.in/yaml/v3: Bumped from v3.0.4 to v3.0.5. See #188.
• CI Maintenance: Bumped actions/setup-go from 5 to 7 and arduino/setup-task from 2 to 3. See #189 and #190.

📚 Documentation

• Migration Guide Typos: Two typos corrected in the migration from Sprig guide. See [PR #192](go-sprout/sprout#192).

Full Changelog: go-sprout/sprout@v1.1.0...v1.1.1

Changelog

Sourced from github.com/go-sprout/sprout's changelog.

Release v1.1.1: Sprout Hardening 🔧 (2026-08-21)

🌿 Sanding down the rough edges of v1.1.0!

A patch release fixing a broken derivePassword, a data race in shuffle, a division by zero in div, and a hermetic guarantee broken by the v1.1.0 additions.

🐛 Bug Fixes

• derivePassword Returned Empty: The counter was typed uint32, so text/template passed an int and the call panicked, silently swallowed by the SafeCall wrapper. The counter is now an int. This resolves #157. See [PR #197](go-sprout/sprout#197).
• Concurrency Safe shuffle: shuffle used a package-global math/rand.Source, racing when templates render in parallel. It now uses the concurrency safe math/rand.Shuffle. This resolves #195. See [PR #196](go-sprout/sprout#196).
• div Division by Zero: A zero divisor returned a bogus integer instead of failing, because the float division was cast after the fact. It now returns cannot divide by zero. See [PR #194](go-sprout/sprout#194).
• Hermetic Map Leaks: dateAgo, uuidv7, randInt and the expandEnv alias were missing from the non-hermetic exclusion list, so HermeticTxtFuncMap and HermeticHtmlFuncMap still exposed them. They are now excluded, and a test keeps the list exhaustive. See [PR #193](go-sprout/sprout#193).

🔒 Security & Dependencies

• Updated go.yaml.in/yaml/v3: Bumped from v3.0.4 to v3.0.5. See #188.
• CI Maintenance: Bumped actions/setup-go from 5 to 7 and arduino/setup-task from 2 to 3. See #189 and #190.

📚 Documentation

• Migration Guide Typos: Two typos corrected in the migration from Sprig guide. See [PR #192](go-sprout/sprout#192).

---

📝 Notes

Templates are a drop-in replacement for v1.1.0, with one visible change: div now errors on a zero divisor instead of returning an arbitrary value. Go callers of CryptoRegistry.DerivePassword must note its counter parameter changed from uint32 to int.

Full Changelog: go-sprout/sprout@v1.1.0...v1.1.1

Commits

• 6b871dc chore: prepare v1.1.1
• 65f7905 fix(sprigin): empty derivePassword (#197)
• 22a2f29 fix(sprigin): respect the hermetic disclosure for aliasing and new sprout fun...
• ebd86db fix(strings): make shuffle safe for concurrent use (#196)
• 80bccca fix: divint by zero are possible due to casting (#194)
• 7d5028d docs: typo corrections on migration guide (#192)
• b7c1968 chore(deps): bump actions/setup-go from 5 to 7 (#189)
• 0d6e1b6 chore(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 (#188)
• 0180663 chore(deps): bump arduino/setup-task from 2 to 3 (#190)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.