build(deps): bump the gomod group across 1 directory with 4 updates

[dependabot]

Bumps the gomod group with 4 updates in the /go directory: github.com/cachix/secretspec/secretspec-go, github.com/wailsapp/wails/v3, go.yaml.in/yaml/v3 and google.golang.org/protobuf.

Updates github.com/cachix/secretspec/secretspec-go from 0.15.0 to 0.19.1

Release notes

Sourced from github.com/cachix/secretspec/secretspec-go's releases.

0.19.1 - 2026-08-11

Release Notes

Republishes 0.19.0's command-line artifacts. The library and CLI behave exactly as in 0.19.0.

Added

• Windows ARM64 CLI release artifacts (aarch64-pc-windows-msvc), attached to the GitHub Release as secretspec-aarch64-pc-windows-msvc.zip with a checksum. The static installer keeps selecting the x86_64 build on Windows ARM64, which runs under emulation, so download the archive directly for a native binary.

Fixed

• The 0.19.0 GitHub Release shipped without its CLI archives, its installer, and the Swift XCFramework, so curl https://install.secretspec.dev | sh and swift package resolution of 0.19.0 both failed. Every language registry (crates.io, PyPI, npm, RubyGems, Hackage, NuGet) published 0.19.0 normally and is unaffected. Install 0.19.1 instead; SwiftPM version ranges resolve to it automatically.

Install secretspec 0.19.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/cachix/secretspec/releases/download/v0.19.1/secretspec-installer.sh | sh

Download secretspec 0.19.1

File	Platform	Checksum
secretspec-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
secretspec-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
secretspec-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
secretspec-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
secretspec-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

0.19.0 - 2026-08-10

Release Notes

Changed

• A provider URI may no longer carry a credential. A URI with a password (scheme://user:secret@host) is rejected, and onepassword+token:// no longer accepts the service account token in its userinfo

... (truncated)

Changelog

Sourced from github.com/cachix/secretspec/secretspec-go's changelog.

[0.19.1] - 2026-08-11

Republishes 0.19.0's command-line artifacts. The library and CLI behave exactly as in 0.19.0.

Added

• The age provider supports deleting secrets: secretspec delete, secretspec import --delete-source, and cache invalidation now work with it, so an age-encrypted file can serve as the local store of a cached provider alias — an encrypted-at-rest cache with no keyring daemon or OS keychain involved.
• Windows ARM64 CLI release artifacts (aarch64-pc-windows-msvc), attached to the GitHub Release as secretspec-aarch64-pc-windows-msvc.zip with a checksum. The static installer keeps selecting the x86_64 build on Windows ARM64, which runs under emulation, so download the archive directly for a native binary.

Fixed

• The 0.19.0 GitHub Release shipped without its CLI archives, its installer, and the Swift XCFramework, so curl https://install.secretspec.dev | sh and swift package resolution of 0.19.0 both failed. Every language registry (crates.io, PyPI, npm, RubyGems, Hackage, NuGet) published 0.19.0 normally and is unaffected. Install 0.19.1 instead; SwiftPM version ranges resolve to it automatically.

[0.19.0] - 2026-08-10

Changed

• A provider URI may no longer carry a credential. A URI with a password (scheme://user:PASSWORD@host) is rejected, and onepassword+token:// no longer accepts the service account token in its userinfo (onepassword+token://token@vault). A URI is committed to secretspec.toml, echoed into shell history, and printed by CI, so a credential written there is already disclosed and redacting it at the terminal cannot retract it. Keep the scheme and supply the credential through a provider credential (secretspec config provider login <alias>, or credentials = { ... } on the alias) or the provider's environment variable; the errors name both. An unparseable provider specification is now also redacted before it is reported.
• secretspec get resolves through the same path as the SDK's resolve_named, so a single-secret read makes exactly the decisions batch resolution makes. It continues to read the whole profile regardless of an active scope, and audits the coordinates it actually reached.
• 1Password field references now resolve in one batched CLI call, reducing repeated unlocks and process startup when loading multiple secrets. If a missing reference requires individual reads, those reads remain bounded and concurrent.

... (truncated)

Commits

• b90afe3 Merge pull request #326 from cachix/release-0.19.1
• f0a1f99 Update the SwiftPM checksum for 0.19.1
• 8211d76 docs: clarify SecretSpec 0.19 post
• bbca318 docs: add SecretSpec 0.19 release post
• 5f5708c Release 0.19.1
• 29d3123 Fix the 0.19.0 release artifacts and Swift checksum
• a782a6d Ship Windows ARM64 CLI artifacts again
• f2610cd Merge pull request #314 from cachix/release-0.19.0
• 9d091ea Release 0.19.0
• 5eb3203 Merge pull request #325 from cachix/docs-standardize-provider-guides
• Additional commits viewable in compare view

Updates github.com/wailsapp/wails/v3 from 3.0.0-beta.0 to 3.0.0-beta.8

Release notes

Sourced from github.com/wailsapp/wails/v3's releases.

Wails v3.0.0-beta.8

Wails v3 Beta Release - v3.0.0-beta.8

Added

• Add documentation URL generation to automatic changelog entries in PR by @​taliesin-ai
• Add Streams: bidirectional byte streams between Go and JavaScript with the WebSocket programming model and no listening socket. Declare a stream in Go with app.HandleStream(name, handler) and connect from the frontend with Stream(name), which returns a WebSocket-shaped object. Go→JS is carried by one held poll per window over the asset server, JS→Go by a normal POST; nothing binds a TCP port and nothing goes through evaluateJavaScript. In server builds (-tags server) the same handler is served over a real WebSocket instead, so application code is identical across builds. by @​leaanthony
• Move mailbox changelog entry to Unreleased in PR by @​leaanthony

Changed

• Update docs sidebar autogeneration and blog author type derivation in PR by @​leaanthony

Fixed

• WebView2 initialization uses a deadline and message pump in PR by @​leaanthony
• WebView2 cookie test skips in CI unless opt-in and locks execution to current OS thread in PR by @​leaanthony
• Windows menu builders restore command IDs for submenu parent items in PR by @​gilad-ch
• Align the official cross-compilation image with the GTK 4.14+ Linux support baseline (#5928)
• Configure iOS Xcode project to retain inherited linker flags and add -ObjC in PR by @​mortenolsrud
• Fix excessive TCP connection churn in the wails3 dev asset proxy on large frontends, which could exhaust the host's ephemeral ports and make unrelated processes fail with EADDRNOTAVAIL
• Queue per-window event JavaScript for ordered dispatch and backpressure in PR by @​leaanthony

Removed

• Remove the desktop binary release pipeline: v3 releases are tag-only and the wails3 CLI is installed with go install. Deletes release-v3.yml and the nightly step that dispatched it in PR by @​leaanthony

---

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.8

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

Wails v3.0.0-beta.7

Wails v3 Beta Release - v3.0.0-beta.7

Added

• Add macOS autoplay preference to disable user action requirement for media playback in PR by @​Eyalm321
• Move mailbox changelog entry to Unreleased in PR by @​leaanthony

Changed

• macOS zoom animation uses CADisplayLink or NSTimer for smoother performance in PR by @​savely-krasovsky

... (truncated)

Commits

• 81a1499 chore(v3): bump to v3.0.0-beta.8 and update changelog [skip ci]
• 0bfdf79 chore(changelog): auto-add entry for PR #5957 — fix(release): harden nightly ...
• ffeb113 fix(release): harden nightly release automation (#5957)
• aa3e48f style: separate v2 release workflow steps
• b7a59d5 fix: filter v2 release notes from shared tag history
• 0fed6a2 [skip ci] Publish @​wailsio/runtime 3.0.0-beta.7
• 08274e0 feat(v3): streams — WebSocket semantics without a listening socket (#5942)
• 9636e37 chore(changelog): auto-add entry for PR #5952 — fix(v3/windows): bound the We...
• 8e08788 fix(v3/windows): bound the WebView2 embed wait and re-enable the cookie test ...
• 16bbdd5 chore(changelog): auto-add entry for PR #5951 — fix(v3/windows): skip the Web...
• Additional commits viewable in compare view

Updates go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5

Commits

• e16c7af Remove empty go.sum file
• 6abcd01 Fix unhandled nil-errors in tests
• 9481db7 Remove suite_test.go and gopkg.in/check.v1
• 485f5fc Use standard testing library for limit_test.go
• 3e00046 Use standard testing library for node_test.go
• f612058 Use standard testing library for decode_test.go
• 078f958 Use standard testing library encode_test.go
• 3847ac0 [v3] backport CodeQL workflow
• 1666663 Revert incorrect gofmt changes
• 73290cb Retract v3 tags that cannot be installed
• See full diff in compare view

Updates google.golang.org/protobuf from 1.36.11 to 1.36.12