Bump the go-deps group across 1 directory with 7 updates

[dependabot]

Bumps the go-deps group with 7 updates in the / directory:

Package	From	To
filippo.io/age	1.2.1	1.3.1
github.com/cyphar/filepath-securejoin	0.6.0	0.6.1
github.com/fluxcd/cli-utils	0.36.0-flux.15	0.37.0-flux.1
github.com/fluxcd/pkg/auth	0.33.0	0.34.0
github.com/onsi/gomega	1.38.2	1.38.3
golang.org/x/net	0.47.0	0.48.0
golang.org/x/oauth2	0.33.0	0.34.0

Updates filippo.io/age from 1.2.1 to 1.3.1

Release notes

Sourced from filippo.io/age's releases.

v1.3.1 is a minor release to restore version injection from downstream package build processes.

See the v1.3.0 release notes for an overview of recent additions.

age v1.3.0: post-quantum (and more)!

Exactly six years after the first age beta release, v1.3.0 brings post-quantum resistance to age, along with a couple long-requested features, built-in support for recipients compatible with hardware plugins, I/O API improvements, and many usability enhancements.

Post-quantum recipients

age now has native post-quantum recipients based on HPKE with a hybrid ML-KEM-768 KEM. The recipients start with age1pq1..., and the identities start with AGE-SECRET-KEY-PQ-1....

To generate a post-quantum keypair:

$ age-keygen -pq

If you have your own age implementation, C2SP has the specification, and CCTV has test vectors for the new hybrid recipient types.

(If you are using an older age client, an optional plugin is available that provides out-of-the-box support for encryption to hybrid recipients. Hybrid identities can be converted to work with the plugin with age-plugin-pq -identity.)

New I/O APIs

The new DecryptReaderAt API implements seeking decryption, which can be used with zip.NewReader.

The new EncryptReader API implements pull-based encryption by wrapping an io.Reader, as opposed to wrapping an io.Writer like Encrypt.

age-inspect

The new age-inspect(1) tool presents the metadata of an age file without decrypting it.

hello.age is an age file, version "age-encryption.org/v1".
This file is ASCII-armored.
This file is encrypted to the following recipient types:

"mlkem768x25519"

This file uses post-quantum encryption.
Size breakdown (assuming it decrypts successfully):
Header                      1627 bytes
Armor overhead              1350 bytes
Encryption overhead           32 bytes
Payload                     1959 bytes
                    -------------------

</tr></table>

... (truncated)

Commits

• b8564ad .github/workflows: inject version into source release artifact
• e4c611f cmd,extra: restore the Version link-time variable
• 6a8065f SIGSUM.md: update policy for v1.3.0
• 50a600e .github/workflows: improve release reproducibility
• 13aab81 .github/workflows: build and release source tarball
• 52338c2 .github/workflows: enable GitHub artifact attestation
• b70af41 cmd/age: don't output binary plaintext to terminal
• 4202739 internal/stream: fix DecryptReaderAt concurrency
• da21917 age: add ExampleDecryptReaderAt with zip.NewReader
• 2ff5d34 age: add DecryptReaderAt
• Additional commits viewable in compare view

Updates github.com/cyphar/filepath-securejoin from 0.6.0 to 0.6.1

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.6.1] - 2025-11-19

At last up jumped the cunning spider, and fiercely held her fast.

Fixed

• Our logic for deciding whether to use openat2(2) or fallback to an O_PATH resolver would cache the result to avoid doing needless test runs of openat2(2). However, this causes issues when pathrs-lite is being used by a program that applies new seccomp-bpf filters onto itself -- if the filter denies openat2(2) then we would return that error rather than falling back to the O_PATH resolver. To resolve this issue, we no longer cache the result if openat2(2) was successful, only if there was an error.
• A file descriptor leak in our openat2 wrapper (when doing the necessary dup for RESOLVE_IN_ROOT) has been removed.

[0.5.2] - 2025-11-19

"Will you walk into my parlour?" said a spider to a fly.

Fixed

• Our logic for deciding whether to use openat2(2) or fallback to an O_PATH resolver would cache the result to avoid doing needless test runs of openat2(2). However, this causes issues when pathrs-lite is being used by a program that applies new seccomp-bpf filters onto itself -- if the filter denies openat2(2) then we would return that error rather than falling back to the O_PATH resolver. To resolve this issue, we no longer cache the result if openat2(2) was successful, only if there was an error.
• A file descriptor leak in our openat2 wrapper (when doing the necessary dup for RESOLVE_IN_ROOT) has been removed.

Commits

• 9c4135b VERSION: release 0.6.1
• d952bef merge v0.5.x branch into main
• deb72a4 CHANGELOG: fix unreleased links
• 336bf8f merge #87 into cyphar/filepath-securejoin:v0.5.x
• 23c6e21 VERSION: back to development
• 6311ca8 VERSION: release v0.5.2
• 91da803 merge #86 into cyphar/filepath-securejoin:v0.5.x
• 4dbce7c gopathrs: close the fd after dup in openat2
• 1eaadd6 merge #85 into cyphar/filepath-securejoin:main
• c1c2a53 gopathrs: close the fd after dup in openat2
• Additional commits viewable in compare view

Updates github.com/fluxcd/cli-utils from 0.36.0-flux.15 to 0.37.0-flux.1

Commits

• aebccc7 Merge pull request #17 from mattfarina/1.35-support
• 5202163 Updating golangci-lint for Go 1.25
• 86f17bb Upgrade golangci-lint and fix warnings
• 244d65b Add k8s 1.35 support
• See full diff in compare view

Updates github.com/fluxcd/pkg/auth from 0.33.0 to 0.34.0

Commits

• c866cff Merge pull request #980 from fluxcd/fix-typo
• 72ea7ac github: Remove redundant options
• 66a0184 Merge pull request #979 from fluxcd/preview-release
• e9a43c6 Add Preview Release workflow
• 6d798f4 Merge pull request #960 from fluxcd/restconfig
• 8bef64b [RFC-0010] Introduce authentication for clusters
• 97cc6ae Merge pull request #978 from fluxcd/make-sops-secret
• e4649ae runtime/secrets: Add MakeSOPSSecret
• 5d6f266 Merge pull request #977 from fluxcd/set-secret-gvk
• 5aaefdf runtime/secrets: Set GVK on generated secrets
• Additional commits viewable in compare view

Updates github.com/onsi/gomega from 1.38.2 to 1.38.3

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.38.3

1.38.3

Fixes

make string formatitng more consistent for users who use format.Object directly

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.38.3

Fixes

make string formatitng more consistent for users who use format.Object directly

Commits

• a3ca2ca v1.38.3
• 4dada36 fix failing have http tests
• d40c691 make string formatitng more consistent for users who use format.Object directly
• 2a37b46 doc: fix typos
• ee26170 docs: fix HaveValue example
• cc85c05 Bump actions/setup-go from 5 to 6 (#866)
• 8905788 Bump github.com/onsi/ginkgo/v2 from 2.25.1 to 2.25.3 (#865)
• 67552c5 chore: apply fixes from Go modernize command
• See full diff in compare view

Updates golang.org/x/net from 0.47.0 to 0.48.0

Commits

• 35e1306 go.mod: update golang.org/x dependencies
• 7c36036 http2, webdav, websocket: fix %q verb uses with wrong type
• ec11ecc trace: fix data race in RenderEvents
• bff14c5 http2: don't PING a responsive server when resetting a stream
• 88a6421 dns/dnsmessage: avoid use of "strings" and "math" in dns/dnsmessage
• 123d099 http2: support net/http.Transport.NewClientConn
• 346cc61 webdav: relax test to check for any redirect status, not just 301
• See full diff in compare view

Updates golang.org/x/oauth2 from 0.33.0 to 0.34.0

Commits

• acc3815 endpoints: fix %q verb use with wrong type
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions