build(deps): bump mvdan.cc/sh/v3 from 3.8.0 to 3.12.0 in /hack/tools

[dependabot]

Bumps mvdan.cc/sh/v3 from 3.8.0 to 3.12.0.

Release notes

Sourced from mvdan.cc/sh/v3's releases.

v3.12.0

• The mvdan-sh JS package is discontinued in favor of sh-syntax - #1145
• cmd/shfmt
  • Support the "simplify" and "minify" flags via EditorConfig - #819
  • --simplify and --minify are now formatting options, disabling the use of EditorConfig
  • Do not allow --write to replace non-regular files - #843
• interp
  • Add IsBuiltin to check if a command name is a shell built-in - #1164
  • Add HandlerContext.Builtin to allow ExecHandlerFunc to call built-ins
  • Initial support for $! and wait PID - #221
  • Return non-fatal ExecHandlerFunc errors via the Runner.Run API
  • Add HandlerContext.Pos to provide handlers with source positions
  • Deprecate NewExitStatus and IsExitStatus in favor of ExitStatus
  • Fix wait to always return the status of the last given job
  • Copy all env vars for background subshells to avoid data races
  • Support reading random numbers via $RANDOM and $SRANDOM
  • Set $BASH_REMATCH when matching regular expressions via =~
  • Support modifying local vars from the parent calling function
• expand
  • Adjust which backslash sequences are expanded in here-docs - #1138
  • Tweak tilde expansions to match Bash semantics
• pattern
  • Remove the flawed and broken Braces mode; use syntax.SplitBraces instead
  • Tweak ** to only act as "globstar" when alone as a path element - #1149
  • Tweak * and ** to not match leading dots in basenames
  • Add a NoGlobStar mode to match the POSIX semantics
• fileutil
  • Treat all non-regular files as definitely not shell scripts - #1089

Consider becoming a sponsor if you benefit from the work that went into this release!

Binaries built on go version go1.24.4 linux/amd64 with:

CGO_ENABLED=0 go build -trimpath -ldflags="-w -s -X=main.version=v3.12.0"

v3.11.0

This release drops support for Go 1.22 and includes many enhancements.

• cmd/shfmt
  • Support -l=0 and -f=0 to split filenames with null bytes - #1096
• syntax
  • New iterator API: Parser.WordsSeq
  • Fix Parser.Incomplete and IsIncomplete to work well with Parser.Words - #937
  • Initial support for parsing incomplete shell via RecoverErrors
  • Expand LangError to include which language was used when parsing
• interp
  • Refactor setting variables to fix array declaration edge cases - #1108
  • Fix test read/write/exec operators to work correctly on directories - #1116
  • Replace the cancelreader dependency with os.File.SetReadDeadline
  • Avoid waiting for process substitutions, matching Bash

... (truncated)

Changelog

Sourced from mvdan.cc/sh/v3's changelog.

[3.12.0] - 2025-07-06

• The mvdan-sh JS package is discontinued in favor of sh-syntax - #1145
• cmd/shfmt
  • Support the "simplify" and "minify" flags via EditorConfig - #819
  • Do not allow --write to replace non-regular files - #843
• interp
  • Add IsBuiltin to check if a command name is a shell built-in - #1164
  • Add HandlerContext.Builtin to allow ExecHandlerFunc to call built-ins
  • Initial support for $! and wait PID - #221
  • Return non-fatal ExecHandlerFunc errors via the Runner.Run API
  • Add HandlerContext.Pos to provide handlers with source positions
  • Deprecate NewExitStatus and IsExitStatus in favor of ExitStatus
  • Fix wait to always return the status of the last given job
  • Copy all env vars for background subshells to avoid data races
  • Support reading random numbers via $RANDOM and $SRANDOM
  • Set $BASH_REMATCH when matching regular expressions via =~
  • Support modifying local vars from the parent calling function
• expand
  • Adjust which backslash sequences are expanded in here-docs - #1138
  • Tweak tilde expansions to match Bash semantics
• pattern
  • Remove the flawed and broken Braces mode; use syntax.SplitBraces instead
  • Tweak ** to only act as "globstar" when alone as a path element - #1149
  • Tweak * and ** to not match leading dots in basenames
  • Add a NoGlobStar mode to match the POSIX semantics
• fileutil
  • Treat all non-regular files as definitely not shell scripts - #1089

[3.11.0] - 2025-03-05

This release drops support for Go 1.22 and includes many enhancements.

• cmd/shfmt
  • Support -l=0 and -f=0 to split filenames with null bytes - #1096
• syntax
  • New iterator API: Parser.WordsSeq
  • Fix Parser.Incomplete and IsIncomplete to work well with Parser.Words - #937
  • Initial support for parsing incomplete shell via RecoverErrors
  • Expand LangError to include which language was used when parsing
• interp
  • Refactor setting variables to fix array declaration edge cases - #1108
  • Fix test read/write/exec operators to work correctly on directories - #1116
  • Replace the cancelreader dependency with os.File.SetReadDeadline
  • Avoid waiting for process substitutions, matching Bash
  • Skip OpenHandler when opening named pipes for process substitutions - #1120
  • Use TMPDIR if set via Env to create temporary files such as named pipes
• expand
  • New iterator API: FieldsSeq
  • Correctly handle repeated backslashes in double quotes - #1106

... (truncated)

Commits

• 8202166 CHANGELOG: add entry for v3.12.0
• 27a4af8 README.md: add another example to caveats
• 4e01dd2 interp: add HandlerContext.Builtin
• 0797923 interp: add test cases with exit inside a process substitution
• dbf7b7c interp: add HandlerContext.Pos
• 0dc0b96 interp: swap math/rand for math/rand/v2
• 3beaa0f interp: add exitStatus.ok for code == 0 comparisons
• b6baa19 interp: move oneIf under exitStatus
• 46bb4f2 interp: export IsBuiltin
• 0bb228b interp: refactor builtins to return an exitStatus
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)