deps: update dependencies to latest

.github/workflows/bench.yml

@@ -42,7 +42,7 @@ jobs:
         ./internal/panels/filetree/
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0   # needed for git push on main
 
@@ -173,7 +173,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 

.github/workflows/ci.yml

@@ -44,7 +44,7 @@ jobs:
 
     steps:
       # Pin actions to full SHA for supply-chain security.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
@@ -151,7 +151,7 @@ jobs:
       CGO_ENABLED: "0"
     steps:
       # Pin actions to full SHA for supply-chain security.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:

.github/workflows/deploy-web.yml

@@ -25,7 +25,7 @@ jobs:
       github.actor != 'github-actions[bot]'
     steps:
       # Pin actions to full SHA for supply-chain security.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:

.github/workflows/release.yml

@@ -29,7 +29,7 @@ jobs:
       id-token: write            # Required for cosign keyless (OIDC) signing
     steps:
       # Pin actions to full SHA for supply-chain security.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -220,7 +220,7 @@ jobs:
 
       - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
-          version: "v2.16.0"
+          version: "v2.17.0"
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

cmd/screenshots/package.json

@@ -5,6 +5,6 @@
   "dependencies": {
     "@xterm/addon-unicode11": "^0.9.0",
     "@xterm/xterm": "^6.0.0",
-    "playwright": "^1.61.1"
+    "playwright": "^1.62.0"
   }
 }

cmd/update_mcp_test.go

@@ -26,6 +26,15 @@ func TestUpdateCmd_HasLongDescription(t *testing.T) {
 }
 
 func TestUpdateCmd_ErrorWrapping(t *testing.T) {
+	// Point os.UserConfigDir at a temp directory. RunUpdate takes an
+	// exclusive lock under the user config dir, and go test runs package
+	// binaries concurrently, so without this the internal/update package's
+	// RunUpdate tests race with this one over the same lock file.
+	dir := t.TempDir()
+	t.Setenv("AppData", dir)         // Windows
+	t.Setenv("XDG_CONFIG_HOME", dir) // Unix
+	t.Setenv("HOME", dir)            // macOS, and Unix fallback
+
 	// Running "grut update" will call update.RunUpdate which fails for
 	// dev builds. This exercises the error wrapping path in RunE.
 	root, cleanup := buildRootCommand()

go.mod

@@ -36,7 +36,7 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect
 	github.com/charmbracelet/ultraviolet v0.0.0-20260720091822-7cc6674724ac // indirect
-	github.com/charmbracelet/x/exp/golden v0.0.0-20260705004817-2cc9a8fe1146 // indirect
+	github.com/charmbracelet/x/exp/golden v0.0.0-20260720091843-3eef36eaaa28 // indirect
 	github.com/charmbracelet/x/exp/slice v0.0.0-20260720091843-3eef36eaaa28 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
 	github.com/charmbracelet/x/termios v0.1.1 // indirect
@@ -80,7 +80,7 @@ require (
 	go.opentelemetry.io/otel/metric v1.44.0 // indirect
 	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.yaml.in/yaml/v4 v4.0.0-rc.6 // indirect
-	golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597 // indirect
+	golang.org/x/exp v0.0.0-20260718201538-764159d718ef // indirect
 	golang.org/x/net v0.57.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/text v0.40.0 // indirect

go.sum

@@ -36,8 +36,8 @@ github.com/charmbracelet/ultraviolet v0.0.0-20260720091822-7cc6674724ac h1:BP8qM
 github.com/charmbracelet/ultraviolet v0.0.0-20260720091822-7cc6674724ac/go.mod h1:psnCZIfwwxVs6v6DhUc6NJ8AQ3ejvs2ejKwoOMeVmUk=
 github.com/charmbracelet/x/ansi v0.11.7 h1:kzv1kJvjg2S3r9KHo8hDdHFQLEqn4RBCb39dAYC84jI=
 github.com/charmbracelet/x/ansi v0.11.7/go.mod h1:9qGpnAVYz+8ACONkZBUWPtL7lulP9No6p1epAihUZwQ=
-github.com/charmbracelet/x/exp/golden v0.0.0-20260705004817-2cc9a8fe1146 h1:+Gg3H2AVBIiYRUG/ctd7XjvUVbZ11odkbdkOrImmtbg=
-github.com/charmbracelet/x/exp/golden v0.0.0-20260705004817-2cc9a8fe1146/go.mod h1:6fMpcW6iwN/kX+xJ52eqVWsDiBTe0UJD24JLoHFe+P0=
+github.com/charmbracelet/x/exp/golden v0.0.0-20260720091843-3eef36eaaa28 h1:j4J91nSGIlhtPch2Rs0+SWTxZ7AJXBU721dgwlmm22U=
+github.com/charmbracelet/x/exp/golden v0.0.0-20260720091843-3eef36eaaa28/go.mod h1:6fMpcW6iwN/kX+xJ52eqVWsDiBTe0UJD24JLoHFe+P0=
 github.com/charmbracelet/x/exp/slice v0.0.0-20260720091843-3eef36eaaa28 h1:fGQpqto9ryOmNMRHacdlSLxKg+l2E+yX0PpIxoBZAi0=
 github.com/charmbracelet/x/exp/slice v0.0.0-20260720091843-3eef36eaaa28/go.mod h1:vqEfX6xzqW1pKKZUUiFOKg0OQ7bCh54Q2vR/tserrRA=
 github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
@@ -176,8 +176,8 @@ go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUS
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
 go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
-golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597 h1:qLvzZeaANDgyVOA8pyHCOStGlXn0rseXma+GQjeuv2g=
-golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q=
+golang.org/x/exp v0.0.0-20260718201538-764159d718ef h1:LkZ48HFgy/TvhTI0bcWkjgFkgLyKUwcTbDjS0DUjw+A=
+golang.org/x/exp v0.0.0-20260718201538-764159d718ef/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q=
 golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
 golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=

internal/layout/registry_test.go

@@ -64,7 +64,7 @@ func TestRegistryOverwrite(t *testing.T) {
 
 func TestRegisterDefaults(t *testing.T) {
 	r := NewRegistry()
-	cfg, err := config.Load()
+	cfg, err := config.LoadDefaults()
 	require.NoError(t, err)
 	RegisterDefaults(context.Background(), r, cfg, nil, nil)
 

internal/panels/shared_utils_test.go

@@ -361,9 +361,13 @@ func TestStartDetachedFn_ReaperTimeout(t *testing.T) {
 	elapsed := time.Since(start)
 
 	assert.NoError(t, err)
-	// StartDetachedFn should return almost immediately (well under 1s),
-	// NOT block for the full duration of the command.
-	assert.Less(t, elapsed, 2*time.Second, "StartDetachedFn should not block on long-running commands")
+	// StartDetachedFn hands the child to a background reaper, so elapsed time
+	// tracks process-spawn cost, not the child's ~10s lifetime. The bound is
+	// deliberately loose: spawning a process on a loaded machine can take a
+	// couple of seconds, while a regression that reintroduced a blocking Wait
+	// would push elapsed past 9s. 5s separates the two cases cleanly.
+	const maxSpawnTime = 5 * time.Second
+	assert.Less(t, elapsed, maxSpawnTime, "StartDetachedFn should not block on long-running commands")
 }
 
 func TestStartDetachedFn_NilCmd(t *testing.T) {

internal/update/coverage_extra_test.go

@@ -324,7 +324,22 @@ func TestWriteCache_ParentIsFile(t *testing.T) {
 
 // --- RunUpdate coverage ---
 
+// isolateUserConfigDir points os.UserConfigDir at a temp directory so tests
+// that call RunUpdate don't contend for the real user-level update lock.
+// go test runs package binaries concurrently, so without this the cmd
+// package's update tests race with these over the same lock file and one
+// side fails with "another update is already in progress".
+func isolateUserConfigDir(t *testing.T) {
+	t.Helper()
+	dir := t.TempDir()
+	t.Setenv("AppData", dir)         // Windows
+	t.Setenv("XDG_CONFIG_HOME", dir) // Unix
+	t.Setenv("HOME", dir)            // macOS, and Unix fallback
+}
+
 func TestRunUpdate_AlreadyUpToDate(t *testing.T) {
+	isolateUserConfigDir(t)
+
 	// Mock API returns the same version as current.
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusOK)
@@ -341,6 +356,8 @@ func TestRunUpdate_AlreadyUpToDate(t *testing.T) {
 }
 
 func TestRunUpdate_FetchFailure(t *testing.T) {
+	isolateUserConfigDir(t)
+
 	// Mock API returns an error.
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusServiceUnavailable)
@@ -357,6 +374,8 @@ func TestRunUpdate_FetchFailure(t *testing.T) {
 }
 
 func TestRunUpdate_InvalidVersionFromAPI(t *testing.T) {
+	isolateUserConfigDir(t)
+
 	// Mock API returns a non-semver version.
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusOK)
@@ -374,7 +393,9 @@ func TestRunUpdate_InvalidVersionFromAPI(t *testing.T) {
 }
 
 func TestRunUpdate_DownloadFailure(t *testing.T) {
-	// Mock API returns a newer version — RunUpdate will try to download
+	isolateUserConfigDir(t)
+
+	// Mock API returns a newer version. RunUpdate will try to download
 	// the release archive from downloadBaseURL which will fail since
 	// the version doesn't exist.
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {