Bump the minor-and-patch group with 4 updates

[dependabot]

Bumps the minor-and-patch group with 4 updates: github.com/mattn/go-sqlite3, golang.org/x/mod, golang.org/x/term and golang.org/x/text.

Updates github.com/mattn/go-sqlite3 from 1.14.34 to 1.14.37

Commits

• bb8d0b2 Bump Go test matrix versions from 1.23-1.25 to 1.24-1.26
• bc7436e Bump GitHub Actions versions to latest
• 0f12d4e Ensure Close always removes runtime finalizer to prevent memory leak
• d71eda8 Fix upgrade.sh: add already-up-to-date check and fix changelog URL format
• 4ea2a9f Upgrade SQLite to version 3051003
• 8c99a68 Call sqlite3_clear_bindings() in bind() to reset parameters
• 5a1f4d3 use unsafe.Slice
• 8366a00 create pull-request
• See full diff in compare view

Updates golang.org/x/mod from 0.33.0 to 0.34.0

Commits

• 1ac721d go.mod: update golang.org/x dependencies
• fb1fac8 all: upgrade go directive to at least 1.25.0 [generated]
• See full diff in compare view

Updates golang.org/x/term from 0.40.0 to 0.41.0

Commits

• 9d2dc07 go.mod: update golang.org/x dependencies
• d954e03 all: upgrade go directive to at least 1.25.0 [generated]
• See full diff in compare view

Updates golang.org/x/text from 0.34.0 to 0.35.0

Commits

• 7ca2c6d go.mod: update golang.org/x dependencies
• 73d1ba9 all: upgrade go directive to at least 1.25.0 [generated]
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[roborev-ci]

roborev: Combined Review (bc2fd3c)

The dependency updates introduce a medium-severity security vulnerability in a transitive dependency.

Medium

• go.mod#L71
  The
  change bumps the indirect dependency golang.org/x/net from v0.49.0 to v0.50.0. The Go vulnerability database marks golang.org/x/net/http2 as vulnerable in >= v0.50.0, < v0.51.0 under GO-2026-4559 / CVE-2026-27141. In this range, malformed HTTP/2 frames can panic an affected server, leading to a potential remote DoS.
  *
  Suggested remediation:* Pin golang.org/x/net to v0.51.0 or newer, or revert to v0.49.0 until transitive dependencies can be updated safely. (Source: [GO-2026-4559](https://pkg.go
  .dev/vuln/GO-2026-4559))

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (d3034fc)

Summary Verdict: The PR updates Go dependencies and the Nix vendorHash, but introduces a high-severity build issue due
to missing go.sum changes.

High

• Location: go.mod
• Problem: Dependencies were updated in go.mod, but the corresponding checksum updates in go.sum are missing from the diff. This will cause build failures during checksum verification.

---

Fix:** Run go mod tidy and include the go.sum changes in the commit.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[wesm]

false positive