chore(deps): bump the go-dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the go-dependencies group with 5 updates in the / directory:

Package	From	To
charm.land/bubbles/v2	2.1.1	2.2.1
charm.land/bubbletea/v2	2.0.8	2.0.9
github.com/modelcontextprotocol/go-sdk	1.7.0	1.8.0
github.com/oapi-codegen/runtime	1.6.0	1.7.0
golang.org/x/term	0.45.0	0.46.0

Updates charm.land/bubbles/v2 from 2.1.1 to 2.2.1

Release notes

Sourced from charm.land/bubbles/v2's releases.

v2.2.1

Tiny Monday bugfix

Textarea element had a bug, where you used to be able to go 1 word backwards, even if there was nothing, which resulted in the whole TUI freezing. It was now fixed by @​OxQuasar!

Changelog

Fixed

• f6134114d735cf40e95c15ff62e7359e46d04fc9: fix(textarea): stop word-left at input boundary (#1036) (@​OxQuasar)

Docs

• 87d445838781700cb25e3fc3a6b26006eab97b41: docs: update godoc link in readme to new package (@​meowgorithm)

Other stuff

• 10489b5fafe92bfaea873297cab8ac8b5c5237f4: readme: drop tree section for now (@​meowgorithm)
• 490948109eb4731927ba2f4cd464d8175a9630d7: v2.2.1 (@​andrinoff)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

v2.2.0

A new Bubble and some new Textarea stuff

There are a couple nice features in today's release. Let's check em out!

If a tree falls in the forest…

At last, the tree Bubble from all star contributor @​dlvhdr’s is here! He built it for DiffNav and graciously contributed to Bubbles. We've been working with Dolev for a long time and were totally stoked when he offerd to contribute.

Select all, ctrl+c, ctrl+v…done!

Our own @​andrinoff added a bunch of awesome stuff to Textarea, including the long awaited text selection. Select, copy, and cut your way into mini text editing.

For more info see the docs.

And special thanks to @​zoriya for adding ctrl+left/right bindings.

xoxo, Charm! 💌

Changelog

New!

• 8cea431500a8837c241cbe8ad71601aa8f00a0d9: feat(textarea): support ctrl + left/right/backspace (#1020) (@​zoriya)
• 037ad37bb0aa6e8ec544df6d3af752755f0a72d9: feat: textarea selection (#1029) (@​andrinoff)
• e97af08ee293131e7b71f7e3006c06a81a2584b8: feat: tree bubble (#893) (@​dlvhdr)

... (truncated)

Commits

• 4909481 v2.2.1
• f613411 fix(textarea): stop word-left at input boundary (#1036)
• 903e1d5 chore(golint): bumop golangci (#1041)
• 10489b5 readme: drop tree section for now
• 87d4458 docs: update godoc link in readme to new package
• ef8af03 v2.2.0
• e97af08 feat: tree bubble (#893)
• a9d1dd2 chore: bump golangci (#1039)
• 037ad37 feat: textarea selection (#1029)
• 6484e49 fix(filepicker): don't blank the view when height is unset (#1026)
• Additional commits viewable in compare view

Updates charm.land/bubbletea/v2 from 2.0.8 to 2.0.9

Release notes

Sourced from charm.land/bubbletea/v2's releases.

v2.0.9

Small patches 🩹

Keybinds missing!

MouseButton11 and media record buttons were improperly handled, now fixed! (thanks to @​Ricardo-M-L and @​bunlongheng)

Weird UI artifacts with some terminals 👽

Sometimes, when switching between tabs in your terminal for example, the screen would not clear, now fixed!

... And some small corrections to docs!

Happy coding 🤖

Changelog

Fixed

• dc4b01750c5262f511164148e24de2cc7aabff47: fix(key): map media record to ultraviolet code (#1757) (@​Ricardo-M-L)
• 1862dfba1151de8f583b598d2ed1cfedf3f5b405: fix: assign MouseButton11 = uv.MouseButton11 (#1754) (@​bunlongheng)
• 930e18c9668417db1908c7a694ee49676116b46e: fix: don't panic in ProgressBarState.String() for out-of-range values (#1748) (@​ankit090701)
• faf4dcf54a92bab2fe3bf6f4715adf44f2fc245d: fix: pendingErase in cursedRenderer (#1755) (@​andrinoff)
• 0d3e281d1436499b40df085a352bb81b3c9de7d0: fix: restore kitty keyboard stack on exit (#1750) (@​deepakganesh78)
• 0ef9fc90dcb665e6ecfb160fa2b3fb4652b9b04c: fix: typo in doc (#1756) (@​andrinoff)

Docs

• d40db141fa4dc3644d116fcea819e1b94ea15b19: docs: fix background color detection example in doc comment (@​meowgorithm)
• 882727b7304802aebf4513bde83a2d7751c81687: docs: fix links to tutorials & examples (#1645) (@​mhdna)

Other stuff

• 708ee757a83cec3dcff684f7d9837479ec567ef1: ci: fix examples workflow (#1734) (@​kobihikri)
• 351d2159f8d8a85613aa2a6e98c8c63df3c98623: ci: sync dependabot config (#1763) (@​charmcli)
• 6fb1f47b6c7b598835f5d56597877f10cb980e9e: examples/sequence: fix milisecond typo in SleepPrintln (@​makoto-developer)
• 73b6d91ac1c3854dd4af046ab5f9e51d3b3b4290: v2.0.9 (@​andrinoff)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

• 73b6d91 v2.0.9
• 0d3e281 fix: restore kitty keyboard stack on exit (#1750)
• 930e18c fix: don't panic in ProgressBarState.String() for out-of-range values (#1748)
• faf4dcf fix: pendingErase in cursedRenderer (#1755)
• 351d215 ci: sync dependabot config (#1763)
• dc4b017 fix(key): map media record to ultraviolet code (#1757)
• 708ee75 ci: fix examples workflow (#1734)
• 1862dfb fix: assign MouseButton11 = uv.MouseButton11 (#1754)
• 0ef9fc9 fix: typo in doc (#1756)
• af9a33e chore: remove deprecated windows note (#1695)
• Additional commits viewable in compare view

Updates github.com/modelcontextprotocol/go-sdk from 1.7.0 to 1.8.0

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.8.0

This release is equivalent to v1.8.0-pre.2. Thank you to those who tested the pre-release.

In this release we introduce several fixes and improvements on top of v1.7.0. It adds no new protocol revision: the supported set is unchanged, and 2026-07-28 remains the newest version the SDK negotiates.

The bulk of the work is hardening the transports against resource exhaustion, closing session leaks, deadlocks and teardown hangs found by users running the new protocol at scale, and giving servers explicit control over which protocol versions they advertise.

Two behavior changes are guarded by new MCPGODEBUG flags; see the section below.

Hardening against resource exhaustion

Every decoding path that buffers incoming input is now bounded. JSON payloads are rejected past 1000 levels of nesting, before the parser recurses. Both SSE readers cap the bytes buffered for a single event via MaxEventSize on SSEClientTransport and StreamableClientTransport, and the stdio transport caps a single JSON-RPC frame via StdioTransport.MaxLineLength.

On the OAuth side, dynamic client registration responses are bounded to 1 MB, and the discovery code now validates metadata documents rather than trusting them.

• internal/json: json nesting depth check by @​yarolegovich (#1200)
• mcp: add an sse event size cap by @​yarolegovich (#1205)
• mcp: add a max request body size of the old transport by @​yarolegovich (#1224)
• oauthex: bound dcr read to 1mb by @​yarolegovich (#1206)
• oauthex: oauth discovery checks by @​yarolegovich (#1220)

Restricting the protocol versions a server supports

ServerOptions.SupportedProtocolVersions lets a server narrow the set of versions it advertises and negotiates. The list can only narrow, never widen; naming a version the SDK does not implement panics at construction. Relatedly, a stateful streamable handler receiving a 2026-07-28 request now returns that same JSON-RPC error instead of a plain-text 400, so the client can renegotiate down instead of losing the connection.

• mcp: allow restricting the protocol versions a server supports by @​guglielmo-san (#1199)
• mcp: return json-rpc error on stateful server serving protocolVersion20260728 requests by @​guglielmo-san (#1143)
• mcp: limit SSE discover supportedVersions to SSE-defined revisions by @​arimu1 (#1121)
• mcp: prefer the negotiated protocol version over the request context by @​gwyszynski-sa (#1163)
• mcp: export ClientSessionOptions.ProtocolVersion by @​arimu1 (#1127)

Per-request cache control

ServerOptions.SetCacheable is a new hook that decides the ttlMs and cacheScope fields of every result carrying them: server/discover, the four list methods, and resources/read. It runs once per result, after the handler returns, with the values that handler produced, so it can set a policy globally while still letting an individual handler override it. Anything left unset falls back to the protocol default of public.

• mcp: allow per request Cacheable customization by @​guglielmo-san (#1203)

Behavior changes guarded by MCPGODEBUG

Two new escape-hatch flags restore the previous behavior of the changes above. Both will be removed in v1.9.0.

• plaintextstatefulrejection=1 — restore the plain-text http.Error 400 body a stateful StreamableHTTPHandler previously returned for a request carrying per-request metadata. The default is now a JSON-RPC -32022 CodeUnsupportedProtocolVersion error with an UnsupportedProtocolVersionData payload advertising the legacy versions the server supports. Introduced by #1143.
• blockingcancelnotify=1 — restore the previous behavior where a cancelled call waits synchronously for notifications/cancelled to be delivered (up to 5s) before returning, joining any delivery error into the caller's error. The default now retires the call immediately and sends the notification asynchronously. Introduced by #1151.

Options below were removed, according to plan:

• seterroroverwrite
• enableoriginverification
• disablecontenttypecheck

... (truncated)

Commits

• 3f3b699 refactor: remove legacy MCPGODEBUG compatibility for new protocol release (#1...
• 830f0b7 mcp: update conformance tests (#1231)
• 12cbafe oauthex: oauth discovery checks (#1220)
• 3632967 mcp: add an sse event size cap (#1205)
• 0d3036f mcp: allow per request Cacheable customization (#1203)
• cb0de64 mcp: add a max request body size of the old transport (#1224)
• 2fdabde mcp: do not check metatada on notifications (#1215)
• 59185e6 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#1217)
• a6764cf build(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 (#1218)
• 8227246 fix: only subscribe when server advertises capability (#1221)
• Additional commits viewable in compare view

Updates github.com/oapi-codegen/runtime from 1.6.0 to 1.7.0

Release notes

Sourced from github.com/oapi-codegen/runtime's releases.

v1.7.0: Extensions for OpenAPI 3.1 parameter binding

This release teaches the parameter binders about OpenAPI 3.1 multi-type unions, and fixes a long-standing panic on the request binding path. As with v1.6.0, new behavior is controlled by explicit settings rather than assumptions: binding stays exactly as it was unless the new options are used.

Notable Changes

Binding OpenAPI 3.1 multi-type union parameters

OpenAPI 3.1 allows a parameter's type to be a list, such as type: [string, integer]. Go has no type meaning "one of these", so generated code maps such parameters to any — which the binders previously rejected outright with can not bind to destination of type: interface, making these parameters unusable.

The binder options structs (BindStyledParameterOptions, BindQueryParameterOptions, BindStringToObjectOptions) gain a Types []string field carrying the union's member list. It is only consulted when the destination is an any; binding into every concrete Go type is completely unchanged. The value binds to the first member that parses, trying boolean, integer, number, then string — most restrictive first, since a string always parses. Member detection follows the JSON number grammar (RFC 8259), so values like 007 or +1 bind as strings rather than being silently reinterpreted as numbers.

The bound value's dynamic type is always one of bool, int64, float64, string, or (with format: byte) []byte, so a handler's type switch is stable regardless of what the spec's format says. Applications that want format: int32 / format: float to narrow the produced types to int32 / float32 can opt in via a new package-level setting, following the same pattern as DefaultQueryEncoder from v1.6.0:

func init() {
    runtime.NarrowUnionNumericFormats = true
}

Generator support for emitting Types is landing in oapi-codegen separately; the runtime side ships first so generated code can rely on it. Arrays of unions and deepObject-style parameters are not covered yet — see the Types field documentation for the exact scope.

Fix for a panic when binding numeric values into slice destinations

Since v1.2.0, binding a string that happens to parse as an integer into a non-[]byte slice destination panicked with reflect: call of reflect.Value.OverflowInt on slice Value, instead of returning an error. This was reachable from generated code on the request path: a nullable.Nullable[[]string] query parameter using the default form/explode serialization would panic on ?p=123 while returning a normal binding error on ?p=abc. These cases now return a clean can not bind to destination of type: slice error.

🚀 New features and improvements

• Bind OpenAPI 3.1 multi-type union parameters into any destinations (#154) @​mromaszewicz, @​claude

🐛 Bug fixes

• Fix panic binding numeric values into non-byte slice destinations (#156) @​mromaszewicz, @​claude

✍ Other changes

• chore: use go mod tidy instead of tidied (#148) @​alexandear

📦 Dependency updates

• chore(deps): update github/codeql-action action to v4.37.7 (#152) @​renovate[bot]
• chore(deps): update release-drafter/release-drafter action to v7.7.0 - autoclosed (#151) @​renovate[bot]
• chore(deps): update github/codeql-action action to v4.37.5 (#150) @​renovate[bot]
• fix(deps): update module github.com/labstack/echo/v5 to v5.3.1 - autoclosed (#149) @​renovate[bot]
• chore(deps): update release-drafter/release-drafter action to v7.6.0 (#147) @​renovate[bot]
• chore(deps): update github/codeql-action action to v4.37.2 (#146) @​renovate[bot]

... (truncated)

Commits

• 25e2d35 Fix panic binding numeric values into non-byte slice destinations (#156)
• f2e468c Bind OpenAPI 3.1 multi-type union parameters into any destinations (#154)
• 611503e chore(deps): update github/codeql-action action to v4.37.7 (#152)
• d8c6443 chore(deps): update release-drafter/release-drafter action to v7.7.0 (#151)
• 0caa035 chore(deps): update github/codeql-action action to v4.37.5 (#150)
• 95ed734 fix(deps): update module github.com/labstack/echo/v5 to v5.3.1 (#149)
• 2f68f55 chore: use go mod tidy instead of tidied (#148)
• 03f0d06 chore(deps): update release-drafter/release-drafter action to v7.6.0 (#147)
• 99e61d7 chore(deps): update github/codeql-action action to v4.37.2 (#146)
• See full diff in compare view

Updates golang.org/x/term from 0.45.0 to 0.46.0

Commits

• 6226200 go.mod: update golang.org/x dependencies
• 7c2fb74 term: process bytes returned with a read error
• 3963fce all: upgrade go directive to at least 1.26.0 [generated]
• See full diff in compare view