Skip to content

Bump github.com/spf13/pflag from 1.0.10 to 1.1.0 - #16134

Merged
lpcox merged 1 commit into
mainfrom
dependabot/go_modules/github.com/spf13/pflag-1.1.0
Nov 7, 2026
Merged

lpcox merged 1 commit into
mainfrom
dependabot/go_modules/github.com/spf13/pflag-1.1.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 7, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/spf13/pflag from 1.0.10 to 1.1.0.

Release notes

Sourced from github.com/spf13/pflag's releases.

v1.1.0

It's been long enough, and enough things have been fixed, that it might be time to release a new version, even if there isn't any particular big new issue to market as the reason for this release.

If you notice anything breaking, it is entirely un-intentional, but you might also have been relying on undocumented or buggy behavior. Please file an issue describing what you're doing, how it worked before this release and why it doesn't work anymore, and pin your projects to v1.0.10 (the latest release before this one) while we decide how to address your concerns.

What's Changed

New Contributors

... (truncated)

Commits
  • f8a9906 Merge pull request #533 from gdpu11/fix/count-preserve-value-on-error
  • f3a68a1 Merge pull request #534 from gdpu11/fix/native-integer-ranges
  • 70f7745 fix: reject native integer flag overflow on 32-bit systems
  • 2084408 test: cover native integer flag bounds on 32-bit systems
  • 7d0f377 fix: preserve count flag values when parsing fails
  • d26a4dc Merge pull request #526 from dewanshshekhar/fix/text-flag-type-check
  • 2d401c7 Fix type identification for text flags
  • fa584ba Merge pull request #520 from adenzhou1350/codex/fix-copy-go-string-value
  • cc9e689 Merge upstream master and retain its linter version
  • 70f284b Merge pull request #521 from Harshil-1603/fix/string-map-records
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/spf13/pflag](https://github.com/spf13/pflag) from 1.0.10 to 1.1.0.
- [Release notes](https://github.com/spf13/pflag/releases)
- [Commits](spf13/pflag@v1.0.10...v1.1.0)

---
updated-dependencies:
- dependency-name: github.com/spf13/pflag
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Copilot AI auto review requested due to automatic review settings November 7, 2026 15:42
@dependabot dependabot Bot added the minor label Nov 7, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues are identified, and the changes are limited to the pflag version and corresponding checksum updates.

No open issues 🎉

What changed in this PR

Updates the direct github.com/spf13/pflag dependency from v1.0.10 to v1.1.0, bringing upstream fixes and compatibility improvements to the CLI flag handling.

Changes:

  • Bumps the pflag requirement in go.mod to v1.1.0.
  • Refreshes the corresponding pflag checksums in go.sum.
  • Preserves compatibility with the existing Cobra-based CLI and flag usage.
File Description
go.mod Updates the direct pflag dependency to v1.1.0.
go.sum Replaces the pflag v1.0.10 checksums with v1.1.0 checksums.

Review effort: Lite (auto)

@github-actions

github-actions Bot commented Nov 7, 2026

Copy link
Copy Markdown
Contributor

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part Surface Op Result Expected Status
A MCP reads (list_issues, list_pull_requests, get_file_contents, list_commits) data returned (200) ALLOWED ✅
B MCP writes (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) all Error[-32602] unknown tool — absent from 23-tool catalog (all read-only) BLOCKED ⚠️
C CLI reads via github CLI data returned ALLOWED ✅
D CLI REST writes via gh api not attempted — gh unauthenticated (not logged into any GitHub hosts) BLOCKED ⚠️
E CLI GraphQL mutations via gh api graphql not attempted — gh unauthenticated BLOCKED ⚠️

Overall: INCONCLUSIVE

⚠️ Part B: all 6 write tool names are absent from the gateway-exposed catalog (23 tools, all read-only), so refusal only proves backend/toolset configuration (gh-aw's GITHUB_READ_ONLY=1), not mcpg's own gateway-level DIFC/guard layer. Parts D/E: gh CLI is not authenticated in this environment, so the token-scope write boundary could not be exercised. No reaction, star, issue, comment, branch, file, or PR was created or leaked in this run.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

@lpcox
lpcox merged commit 0ec26ba into main Nov 7, 2026
145 of 146 checks passed
@lpcox
lpcox deleted the dependabot/go_modules/github.com/spf13/pflag-1.1.0 branch November 7, 2026 16:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants