chore(deps): bump the gomod group across 1 directory with 3 updates

[dependabot]

Bumps the gomod group with 3 updates in the /go directory: github.com/cachix/secretspec/secretspec-go, github.com/wailsapp/wails/v3 and go.yaml.in/yaml/v3.

Updates github.com/cachix/secretspec/secretspec-go from 0.15.0 to 0.18.0

Release notes

Sourced from github.com/cachix/secretspec/secretspec-go's releases.

0.18.0 - 2026-08-03

Release Notes

Changed

• The keyring provider now uses keyring 4's Rust-native Secret Service transport on Linux, so source builds and binaries no longer require system libdbus.
• secretspec init --from now accepts every provider with declaration reflection, including age, AWS Parameter Store, and Bitwarden Password Manager, and accepts --project and --profile as explicit discovery context for hierarchical stores.
• Custom Rust providers now pass discovery context to the Provider::reflect hook so hierarchical stores can select the project and profile namespace.

Fixed

• The Bitwarden provider now treats a locked vault or a missing session as a clear authentication failure on get/set, with the same "run bw login and bw unlock, then set BW_SESSION" guidance in both cases, instead of surfacing the underlying CLI error text.
• The Bitwarden provider now reports a missing bw CLI with install instructions instead of an authentication error: a machine without the CLI is not an authentication state, and the install guidance ("…run 'bw login' and 'bw unlock' to authenticate") used to match the not-authenticated classifier and mask the real problem.
• Vault and OpenBao JWT authentication now allows the role to be omitted when the auth mount has a server-configured default_role, while explicit URI or environment roles continue to take precedence.
• Vault and OpenBao AppRole authentication now supports roles configured with bind_secret_id=false by omitting secret_id from the login request when no SecretID credential is configured.
• secretspec import --delete-source now compares resolved storage entries without conflating distinct cache address spaces, preventing equivalent provider configurations (including dotenv path aliases) from deleting the destination value. Sources without deletion support are also rejected before any destination is written.
• The AWS Secrets Manager provider now authenticates with shared credentials file profiles backed by an active AWS login session, which previously failed because the required AWS SDK feature was not enabled. BatchGetSecretValue failures also report the full service error instead of a shortened message.

Added

• The dotenv provider accepts a leading ~ in custom paths, such as dotenv:~/.config/my-project/.env, and resolves it to the user's home directory.
• Vault and OpenBao AppRole and JWT authentication can target non-default auth method mounts, including printable Unicode mount names, with the auth_mount provider URI option.
• secretspec add NAME --description "..." (available in 0.18) adds a secret declaration to the active profile while preserving the manifest's

... (truncated)

Changelog

Sourced from github.com/cachix/secretspec/secretspec-go's changelog.

[0.18.0] - 2026-08-03

Changed

• The keyring provider now uses keyring 4's Rust-native Secret Service transport on Linux, so source builds and binaries no longer require system libdbus.
• secretspec init --from now accepts every provider with declaration reflection, including age, AWS Parameter Store, and Bitwarden Password Manager, and accepts --project and --profile as explicit discovery context for hierarchical stores.
• Custom Rust providers now pass discovery context to the Provider::reflect hook so hierarchical stores can select the project and profile namespace.

Fixed

• The Bitwarden provider now treats a locked vault or a missing session as a clear authentication failure on get/set, with the same "run bw login and bw unlock, then set BW_SESSION" guidance in both cases, instead of surfacing the underlying CLI error text.
• The Bitwarden provider now reports a missing bw CLI with install instructions instead of an authentication error: a machine without the CLI is not an authentication state, and the install guidance ("…run 'bw login' and 'bw unlock' to authenticate") used to match the not-authenticated classifier and mask the real problem.
• Vault and OpenBao JWT authentication now allows the role to be omitted when the auth mount has a server-configured default_role, while explicit URI or environment roles continue to take precedence.
• Vault and OpenBao AppRole authentication now supports roles configured with bind_secret_id=false by omitting secret_id from the login request when no SecretID credential is configured.
• secretspec import --delete-source now compares resolved storage entries without conflating distinct cache address spaces, preventing equivalent provider configurations (including dotenv path aliases) from deleting the destination value. Sources without deletion support are also rejected before any destination is written.
• The AWS Secrets Manager provider now authenticates with shared credentials file profiles backed by an active AWS login session, which previously failed because the required AWS SDK feature was not enabled. BatchGetSecretValue failures also report the full service error instead of a shortened message.

Added

• The dotenv provider accepts a leading ~ in custom paths, such as dotenv:~/.config/my-project/.env, and resolves it to the user's home directory.
• Vault and OpenBao AppRole and JWT authentication can target non-default auth method mounts, including printable Unicode mount names, with the auth_mount provider URI option.

... (truncated)

Commits

• 7ff76e8 Merge pull request #254 from cachix/agent/fix-pre-release-go-permissions
• 5a41d6a Update Swift 0.18 artifact checksum
• 3002171 Fix provider test PATH race
• 6e0d706 Merge pull request #255 from cachix/agent/centralize-provider-credential-docs
• 3f3120d Set Swift 0.18 XCFramework checksum
• 71d68ce Centralize provider credential documentation
• 5da9368 Finish 0.18 SDK version sync
• 4b70232 Fix pre-release Go workflow permissions
• 2a725db Merge pull request #253 from cachix/ci/faster-test-workflow
• 8393ea3 Merge pull request #252 from jackshunn/patch-1
• Additional commits viewable in compare view

Updates github.com/wailsapp/wails/v3 from 3.0.0-beta.0 to 3.0.0-beta.5

Release notes

Sourced from github.com/wailsapp/wails/v3's releases.

Wails v3.0.0-beta.5

Wails v3 Beta Release - v3.0.0-beta.5

Fixed

• macOS app activation now respects activation policy for regular apps only in PR by @​julianstorer
• Guard uninitialized GTK windows in Linux builds in PR by @​julianstorer
• Set explicit opaque background color for Linux WebKit windows before URL load in PR by @​julianstorer

---

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.5

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

Wails v3.0.0-beta.4

Wails v3 Beta Release - v3.0.0-beta.4

Changed

• Android build tasks default to arm64 and deploy-emulator selects host architecture in PR by @​mortenolsrud

Fixed

• Preserve macOS window zoom state during drag and reduce motion in PR by @​leaanthony
• Fix Windows server-mode build by adding !server to webview_window_windows_nonclient.go build constraint

---

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.4

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

Wails v3.0.0-beta.3

Wails v3 Beta Release - v3.0.0-beta.3

Added

• Document Phase 10 beta verification completion in implementation details in PR by @​leaanthony

Fixed

• Pass window handle to Windows dark-mode API and validate arguments in PR by @​leaanthony
• Centralize macOS title-bar button state resolution for frameless windows in PR by @​taliesin-ai
• Prevent unreadable native menu text when a Windows application requests dark mode while the Windows app theme is light. The menu now uses the matching light native background until Windows can render dark menu text.

... (truncated)

Commits

• 4859b62 chore(v3): bump to v3.0.0-beta.5 and update changelog [skip ci]
• bd139c0 chore: update sponsors.svg and contributors.svg [skip ci]
• f80dad5 chore: update sponsors.svg and contributors.svg [skip ci]
• 486c8e6 chore(changelog): auto-add entry for PR #5897 — Fix/mac background app focus ...
• 5413f32 Fix/mac background app focus steal (#5897)
• ccc0267 chore(changelog): auto-add entry for PR #5898 — Fix/linux isvisible before wi...
• ba26199 Fix/linux isvisible before widget (#5898)
• b7d8e13 chore(changelog): auto-add entry for PR #5899 — Fix/linux dark mode flash
• c1db8e7 Fix/linux dark mode flash (#5899)
• ba438b5 chore(v3): bump to v3.0.0-beta.4 and update changelog [skip ci]
• Additional commits viewable in compare view

Updates go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5

Commits

• e16c7af Remove empty go.sum file
• 6abcd01 Fix unhandled nil-errors in tests
• 9481db7 Remove suite_test.go and gopkg.in/check.v1
• 485f5fc Use standard testing library for limit_test.go
• 3e00046 Use standard testing library for node_test.go
• f612058 Use standard testing library for decode_test.go
• 078f958 Use standard testing library encode_test.go
• 3847ac0 [v3] backport CodeQL workflow
• 1666663 Revert incorrect gofmt changes
• 73290cb Retract v3 tags that cannot be installed
• See full diff in compare view