Update module github.com/urfave/cli/v3 to v3.12.0 by renovate[bot] · Pull Request #68 · bluet/syspkg

What's Changed

feat: add Command.ArgValidator for tree-wide argument validation by @dearchap in #2377
Single-value arguments can be marked as required by @idelchi in #2393
docs: clarify that named Arguments are excluded from cmd.Args() by @dearchap in #2411
fix: never run command action on shell completion past a double dash by @dearchap in #2412
chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @app/dependabot in #2413
Support custom FlagStringer for MutuallyExclusiveFlags by @SHIVANSHGARG07 in #2414
Add TextFlag for encoding.TextMarshaler/TextUnmarshaler values by @ChrisJr404 in #2415
chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @app/dependabot in #2416
chore(deps): bump the python-packages group with 2 updates by @app/dependabot in #2417
Show inherited persistent flags in child help by @justadityaraj in #2421
fix: preserve whitespace in positional arguments by @lenamonj in #2423
fix: preserve whitespace in equals-form flag values by @BenYang12 in #2425
fix: complete subcommand flags after positional arguments by @fzlzjerry in #2426
Fix a year-less timestamp layout losing January 1 by @youdie006 in #2427
docs: add go-size-analyzer, module version, and reflection by @imsumedhaa in #2428

New Contributors

@idelchi made their first contribution in #2393
@SHIVANSHGARG07 made their first contribution in #2414
@ChrisJr404 made their first contribution in #2415
@justadityaraj made their first contribution in #2421
@lenamonj made their first contribution in #2423
@BenYang12 made their first contribution in #2425
@youdie006 made their first contribution in #2427
@imsumedhaa made their first contribution in #2428

Full Changelog: urfave/cli@v3.11.0...v3.12.0

`v3.11.0`

What's Changed

fix: correct a typo in the help message for the powershell autocompletion by @suzuki-shunsuke in #2383
Escape backslashes in fish completion descriptions by @mahirhir in #2378
chore(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in #2389
chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in the python-packages group by @dependabot[bot] in #2391
chore(deps): bump actions/setup-python from 6 to 7 by @dependabot[bot] in #2390
fix: skip all hidden flags in shell completion, not just bool flags by @vidigoat in #2388
Fix nil pointer dereference for interface-typed flag values by @mrueg in #2400
Fix index out of range panic when Run is given no arguments by @mrueg in #2401
fix: honor BoolWithInverseFlag DefaultText by @fzlzjerry in #2403
Fix Issue #2385 by @BrandonIrizarry in #2386
fix: inherit HideHelpCommand in subcommands by @utkarshalpha in #2395
test: cover Run-with-no-arguments paths (#2406) by @dearchap in #2407
test: add shell-completion case for hidden BoolWithInverseFlag by @dearchap in #2408
test: fix ineffective mutex error-string assertion and add mirror cases by @dearchap in #2410

New Contributors

@mahirhir made their first contribution in #2378
@vidigoat made their first contribution in #2388
@fzlzjerry made their first contribution in #2403
@BrandonIrizarry made their first contribution in #2386
@utkarshalpha made their first contribution in #2395

Full Changelog: urfave/cli@v3.10.1...v3.11.0

`v3.10.1`

What's Changed

chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #2371
fix: align gfmrun example counter with actual runnable count by @dearchap in #2369
v3: yield the version flag's -v alias to a user-defined flag by @c-tonneslan in #2330
fix: keep completion subcommand order deterministic in help output by @suzuki-shunsuke in #2374
fix: allow DefaultCommand to handle its own flags by @lihan3238 in #2322

New Contributors

@lihan3238 made their first contribution in #2322

Full Changelog: urfave/cli@v3.10.0...v3.10.1

`v3.10.0`

What's Changed

feat: add Flag.SchemaType() and Flag.SchemaItemsType() for JSON Schema introspection by @dearchap in #2368
feat: add Command.Walk() and Command.Path() convenience methods by @dearchap in #2353
fix: let --help flag take precedence over parse errors by @dearchap in #2360
fix: resolve remaining help invocation inconsistencies by @dearchap in #2361
fix: skip After hook when help is displayed on subcommand by @dearchap in #2363
fix: show GLOBAL OPTIONS in SubcommandHelpTemplate by @dearchap in #2359
fix: resolve broken links in CHANGELOG.md by @dearchap in #2357
docs: document what happened to build tags in v3 migration guide by @dearchap in #2358
Various docs updates and dependency bumps

Full Changelog: urfave/cli@v3.9.1...v3.10.0

`v3.9.1`

syspkg/cmd/syspkg/main.go

What's Changed

fix: inherit Reader/Writer/ErrWriter from parent on subcommand setup by @c-tonneslan in #2329
fix: correct greedy colon parsing in bash completion script by @TimSoethout in #2336
fix: Honor env sources on duplicated flags by @ibobgunardi in #2355
fix: Remove incorrect flag check by @MohitPanchariya in #2280
fix: let completion command use normal flag parsing pipeline by @suzuki-shunsuke in #2279
fix: bash completion spacing by @cyphercodes in #2337
fix: fish custom completion arguments by @puneetdixit200 in #2338
fix: empty positional arg after a flag regression test by @c-tonneslan in #2328
docs: document build tags in v3 migration guide by @dearchap in #2358
chore(deps): bump mkdocs-git-revision-date-localized-plugin by @dependabot in #2347
Fix typos by @myfloss in #2339

Full Changelog: urfave/cli@v3.9.0...v3.9.1

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

fossabot · 2026-05-12T19:30:09Z

Needs Review

I recommend reviewing this upgrade before merging because a CI failure in GitHub Actions directly related to the upgrade is blocking the PR. The go.sum file is out of sync: it still contains stale checksum entries for the previous version (lines 7–8 of go.sum) alongside the correct entries for the new version, causing go mod tidy to exit with code 1. The fix is straightforward — running go mod tidy locally and committing the updated go.sum — but must be completed before merge. A secondary SonarQube CI failure exists due to a conflicting Automatic Analysis configuration, but this is unrelated to the dependency upgrade. The application's core CLI usage in cmd/syspkg/main.go uses only standard urfave/cli/v3 APIs (cli.Command, cli.BoolFlag, cmd.Bool(), cmd.Args().Slice(), app.Run()) and is not affected by any breaking API changes. A typosquat package (github.com/utfave/cli, note the transposed 'r' and 't') exists in the wild and should be treated as a reminder to double-check import paths, but the codebase correctly imports github.com/urfave/cli/v3 throughout.

Tip: Comment @fossabot fix to attempt automatic fixes.

Fix Suggestions

We identified 2 fixable issues in this upgrade.

Run 'go mod tidy' to remove stale github.com/urfave/cli/v3 v3.8.0 checksum entries from go.sum and ensure all dependencies are properly resolved. This will remove lines 7-8 in go.sum (the v3.8.0 h1: and v3.8.0/go.mod h1: entries) and may add/update other transitive dependency checksums. Commit the resulting go.sum (and go.mod if changed). Manual alternative: open go.sum and delete the two lines containing 'github.com/urfave/cli/v3 v3.8.0'.
Run: cd . && go mod tidy
Files: go.sum, go.mod
Disable Automatic Analysis in SonarQube Cloud for the 'bluet_syspkg' project. Go to SonarQube Cloud → Project 'bluet_syspkg' → Administration → Analysis Method, and disable 'Automatic Analysis' so that only the CI-based analysis (via SonarSource/sonarqube-scan-action in GitHub Actions) runs. Alternatively, remove the SonarSource/sonarqube-scan-action step from the GitHub Actions workflow if Automatic Analysis is preferred.
Files: .github/workflows/sonarqube.yml

AI Assistant Prompt

Copy prompt for AI assistant

# Fix CI Failures After `github.com/urfave/cli/v3` Upgrade (v3.8.0 → v3.9.0)

Repository: syspkg, PR #68

## Context

The `github.com/urfave/cli/v3` dependency was bumped from v3.8.0 to v3.9.0 in `go.mod`, but `go.sum` still contains stale checksum entries for v3.8.0, causing the CI lint/format check to fail (`go mod tidy` exits with code 1).

The application code in `cmd/syspkg/main.go` uses only standard APIs (`cli.Command`, `cli.BoolFlag`, `cmd.Bool()`, `cmd.Args().Slice()`, `app.Run()`) and is **not affected** by any breaking changes — no code changes are needed.

## Fix 1 (Primary): Clean up `go.sum`

Run `go mod tidy` to remove stale v3.8.0 checksum entries from `go.sum`.

**Files:** `go.sum`, `go.mod`

**What to do:**
1. Run `go mod tidy` in the repository root
2. Verify that `go.sum` no longer contains lines referencing `github.com/urfave/cli/v3 v3.8.0` (previously around lines 7-8)
3. Verify that `go.sum` contains entries for `github.com/urfave/cli/v3 v3.9.0`
4. Commit the updated `go.sum` (and `go.mod` if it changed)

**Manual alternative:** Open `go.sum` and delete the two lines containing `github.com/urfave/cli/v3 v3.8.0` (the `h1:` and `/go.mod h1:` entries).

## Fix 2 (Separate Issue — Manual Action Required): SonarQube CI Failure

A second CI failure (SonarQube scan, exit code 3) is **unrelated** to the dependency upgrade. It's caused by both Automatic Analysis and CI-triggered analysis being enabled simultaneously for the `bluet_syspkg` project.

**Resolution (requires human action in SonarQube Cloud UI):**
- Go to SonarQube Cloud → Project `bluet_syspkg` → Administration → Analysis Method
- Disable "Automatic Analysis" so only the CI-based scan (via `SonarSource/sonarqube-scan-action` in `.github/workflows/sonarqube.yml`) runs
- Alternatively, remove the `SonarSource/sonarqube-scan-action` step from the workflow if Automatic Analysis is preferred

## Verification

After applying Fix 1, run:
```bash
go mod tidy
go build ./...
go test ./...
```

All should pass without errors. The CI lint/format check should then succeed on the next push.

What we checked

go.mod correctly declares github.com/urfave/cli/v3 v3.9.0 as the required version, but go.sum still retains the old v3.8.0 checksum entries, causing a mismatch that go mod tidy detects and removes — triggering the CI failure. ^[1]
Stale github.com/urfave/cli/v3 v3.8.0 h1:... and v3.8.0/go.mod h1:... checksum entries (lines 7–8) are present alongside the correct v3.9.0 entries (lines 9–10). Running go mod tidy removes the stale entries; these changes must be committed to unblock CI. ^[2]
Correct github.com/urfave/cli/v3 v3.9.0 checksums are already present in go.sum, confirming the dependency was resolved properly. Only cleanup of stale v3.8.0 entries is needed. ^[3]
The sole import of github.com/urfave/cli/v3 is at line 12. All usages — cli.Command, cli.BoolFlag, cmd.Bool(), cmd.Args().Slice(), app.Run() — rely on stable, long-standing public APIs in urfave/cli/v3 that are unaffected by this minor version bump. ^[4]
app.Run(context.Background(), os.Args) at line 362 is the entry point for the CLI framework. This call signature is the standard urfave/cli/v3 pattern and is not impacted by this upgrade. ^[5]
getOptions() helper at line 370 uses cmd.Bool() for flag retrieval across all commands. This API is stable and unchanged between the two versions. ^[6]
A typosquat package github.com/utfave/cli (transposed 'r'/'t' in 'urfave') exists and exfiltrates system info via an init() function. The codebase correctly imports github.com/urfave/cli/v3, not the malicious variant — no direct risk, but worth confirming no dependency pulls in the typosquat transitively. ^[7]

Dependency Usage

github.com/urfave/cli/v3 is the foundational CLI framework for this project, powering the entire cmd/syspkg/main.go entry point — the user-facing syspkg command-line tool. It drives all user interactions including commands for package install, delete, refresh, upgrade, find, and nested show subcommands (upgradable, installed, package info), along with global flags for dry-run, verbose, interactive, and per-package-manager targeting (e.g., --apt, --snap, --flatpak). The dependency is architecturally critical: without it, the application has no CLI surface, as it is the sole mechanism translating user input into calls to the underlying syspkg package manager abstraction layer.

go.mod correctly declares github.com/urfave/cli/v3 v3.9.0 as the required version, but go.sum still retains the old v3.8.0 checksum entries, causing a mismatch that go mod tidy detects and removes — triggering the CI failure.

syspkg/go.mod

Line 5 in 456b204

require github.com/urfave/cli/v3 v3.9.0
Stale github.com/urfave/cli/v3 v3.8.0 h1:... and v3.8.0/go.mod h1:... checksum entries (lines 7–8) are present alongside the correct v3.9.0 entries (lines 9–10). Running go mod tidy removes the stale entries; these changes must be committed to unblock CI.

syspkg/go.sum

Line 7 in 456b204

github.com/urfave/cli/v3 v3.8.0 h1:XqKPrm0q4P0q5JpoclYoCAv0/MIvH/jZ2umzuf8pNTI=

View 4 more usages

Correct github.com/urfave/cli/v3 v3.9.0 checksums are already present in go.sum, confirming the dependency was resolved properly. Only cleanup of stale v3.8.0 entries is needed.

syspkg/go.sum

Line 9 in 456b204

github.com/urfave/cli/v3 v3.9.0 h1:AV9lIiPv3ukYnxunaCUsHnEozptYmDN2F0+yWqLMn/c=
The sole import of github.com/urfave/cli/v3 is at line 12. All usages — cli.Command, cli.BoolFlag, cmd.Bool(), cmd.Args().Slice(), app.Run() — rely on stable, long-standing public APIs in urfave/cli/v3 that are unaffected by this minor version bump.

syspkg/cmd/syspkg/main.go

Line 12 in 456b204

"github.com/urfave/cli/v3"
app.Run(context.Background(), os.Args) at line 362 is the entry point for the CLI framework. This call signature is the standard urfave/cli/v3 pattern and is not impacted by this upgrade.

syspkg/cmd/syspkg/main.go

Line 362 in 456b204

err = app.Run(context.Background(), os.Args)
getOptions() helper at line 370 uses cmd.Bool() for flag retrieval across all commands. This API is stable and unchanged between the two versions.

syspkg/cmd/syspkg/main.go

Line 370 in 456b204

func getOptions(cmd *cli.Command) *manager.Options {

Changes

github.com/urfave/cli/v3 was updated with several bug fixes including a panic prevention in BoolWithInverseFlag.String(), correct SliceFlagSeparator handling for environment variable sources, and suppression of empty stderr lines on exit. New features include flag completions for double-dash prefixes, descriptions in bash/PowerShell autocompletion, and BoolWithInverseFlag alias display in help text.

Made command help more consistent by @markshep-wbg in https://redirect.github.com/urfave/cli/pull/2287 (v3.9.0, release notes)
(issue_2285): correct function and variable naming in fish completion script by @TimSoethout in https://redirect.github.com/urfave/cli/pull/2286 (v3.9.0, release notes)
apply SliceFlagSeparator to env var sources by @lawrence3699 in https://redirect.github.com/urfave/cli/pull/2309 (v3.9.0, release notes)

View 13 more changes

don't print empty line to stderr when Exit message is empty by @Yanhu007 in https://redirect.github.com/urfave/cli/pull/2310 (v3.9.0, release notes)
flag: prevent BoolWithInverseFlag.String from panicking without a tab by @alliasgher in https://redirect.github.com/urfave/cli/pull/2311 (v3.9.0, release notes)
feat: add descriptions for bash and powershell autocompletion by @gabelluardo in https://redirect.github.com/urfave/cli/pull/2298 (v3.9.0, release notes)
show flag completions when completing a double-dash prefix by @morozov in https://redirect.github.com/urfave/cli/pull/2316 (v3.9.0, release notes)
parse flags for help subcommand (#2271) by @barry3406 in https://redirect.github.com/urfave/cli/pull/2319 (v3.9.0, release notes)
show BoolWithInverseFlag aliases in help text by @wucm667 in https://redirect.github.com/urfave/cli/pull/2321 (v3.9.0, release notes)
chore(deps): bump codecov/codecov-action from 5 to 6 by @dependabot[bot] in https://redirect.github.com/urfave/cli/pull/2300 (v3.9.0, release notes)
chore(deps): bump the python-packages group across 1 directory with 3 updates by @dependabot[bot] in https://redirect.github.com/urfave/cli/pull/2301 (v3.9.0, release notes)
docs: fix typo by @acrobatstick in https://redirect.github.com/urfave/cli/pull/2299 (v3.9.0, release notes)
fix(ci): update docs after bash completion update by @gabelluardo in https://redirect.github.com/urfave/cli/pull/2307 (v3.9.0, release notes)
refactor: bash completion script by @gabelluardo in https://redirect.github.com/urfave/cli/pull/2308 (v3.9.0, release notes)
drop shebang from bash completion template by @barry3406 in https://redirect.github.com/urfave/cli/pull/2317 (v3.9.0, release notes)
@gabelluardo made their first contribution in https://redirect.github.com/urfave/cli/pull/2298 (v3.9.0, release notes)

References (7)

[1]: go.mod correctly declares github.com/urfave/cli/v3 v3.9.0 as the required version, but go.sum still retains the old v3.8.0 checksum entries, causing a mismatch that go mod tidy detects and removes — triggering the CI failure.

syspkg/go.mod

Line 5 in 456b204

require github.com/urfave/cli/v3 v3.9.0

[2]: Stale github.com/urfave/cli/v3 v3.8.0 h1:... and v3.8.0/go.mod h1:... checksum entries (lines 7–8) are present alongside the correct v3.9.0 entries (lines 9–10). Running go mod tidy removes the stale entries; these changes must be committed to unblock CI.

syspkg/go.sum

Line 7 in 456b204

github.com/urfave/cli/v3 v3.8.0 h1:XqKPrm0q4P0q5JpoclYoCAv0/MIvH/jZ2umzuf8pNTI=

[3]: Correct github.com/urfave/cli/v3 v3.9.0 checksums are already present in go.sum, confirming the dependency was resolved properly. Only cleanup of stale v3.8.0 entries is needed.

syspkg/go.sum

Line 9 in 456b204

github.com/urfave/cli/v3 v3.9.0 h1:AV9lIiPv3ukYnxunaCUsHnEozptYmDN2F0+yWqLMn/c=

[4]: The sole import of github.com/urfave/cli/v3 is at line 12. All usages — cli.Command, cli.BoolFlag, cmd.Bool(), cmd.Args().Slice(), app.Run() — rely on stable, long-standing public APIs in urfave/cli/v3 that are unaffected by this minor version bump.

Line 12 in 456b204

"github.com/urfave/cli/v3"

[5]: app.Run(context.Background(), os.Args) at line 362 is the entry point for the CLI framework. This call signature is the standard urfave/cli/v3 pattern and is not impacted by this upgrade.

syspkg/cmd/syspkg/main.go

Line 362 in 456b204

err = app.Run(context.Background(), os.Args)

[6]: getOptions() helper at line 370 uses cmd.Bool() for flag retrieval across all commands. This API is stable and unchanged between the two versions.

syspkg/cmd/syspkg/main.go

Line 370 in 456b204

func getOptions(cmd *cli.Command) *manager.Options {

[7]: A typosquat package github.com/utfave/cli (transposed 'r'/'t' in 'urfave') exists and exfiltrates system info via an init() function. The codebase correctly imports github.com/urfave/cli/v3, not the malicious variant — no direct risk, but worth confirming no dependency pulls in the typosquat transitively. (source link)

fossabot analyzed this PR using dependency research. View this analysis on the web

fossabot · 2026-06-10T19:08:02Z

You have no credits left. Reach out to autoupdates@fossa.com and we'll top you up.

Credits are consumed when dependency updates are reviewed or proposed.

Re-run with @fossabot analyze.

Mute out-of-credit notifications until next month (expires 2026-07-01T00:00:00.000Z)

fossabot · 2026-06-10T19:08:03Z

You have no credits left. Reach out to autoupdates@fossa.com and we'll top you up.

Credits are consumed when dependency updates are reviewed or proposed.

Re-run with @fossabot analyze.

Mute out-of-credit notifications until next month (expires 2026-07-01T00:00:00.000Z)

sonarqubecloud · 2026-06-10T19:08:18Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-06-14T17:41:30Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-06-28T14:06:00Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

fossabot · 2026-08-16T17:12:35Z

You have no credits left. Reach out to autoupdates@fossa.com and we'll top you up.

Credits are consumed when dependency updates are reviewed or proposed.

Re-run with @fossabot analyze.

Mute out-of-credit notifications until next month (expires 2026-09-01T00:00:00.000Z)

depintel-bot · 2026-08-30T01:12:19Z

🟢 Ready to merge

Lapisa checked github.com/urfave/cli/v3 v3.9.0 → v3.12.0 against the interfaces this repository uses; no affected usage was found.

View evidence and analysis receipt

depintel verdict: `safe`

Package: github.com/urfave/cli/v3 v3.9.0 -> v3.12.0

_{review go-3b7c6194-github.com_urfave_cli_v3 · engine bfc18851}

Impact: NONE found — OK to merge on this evidence.

go static lane: exported contract surface intact (additions only or unchanged)

Basis: exported contract surface intact (additions only or unchanged)

Run: 20260914T194909Z-6f0ef941581b

Evidence is static analysis plus release evidence available to depintel at run time. This advisory verdict is not a substitute for maintainer review.

sonarqubecloud · 2026-08-30T20:51:30Z

❌ The last analysis has failed.

fossabot · 2026-09-02T09:10:08Z

You have no credits left. Reach out to autoupdates@fossa.com and we'll top you up.

Credits are consumed when dependency updates are reviewed or proposed.

Re-run with @fossabot analyze.

Mute out-of-credit notifications until next month (expires 2026-10-01T00:00:00.000Z)

fossabot · 2026-09-02T09:10:12Z

You have no credits left. Reach out to autoupdates@fossa.com and we'll top you up.

Credits are consumed when dependency updates are reviewed or proposed.

Re-run with @fossabot analyze.

Mute out-of-credit notifications until next month (expires 2026-10-01T00:00:00.000Z)

coderabbitai · 2026-09-14T19:33:31Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 9b904125-83e7-4a58-8636-0c6d1e224f04

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

sonarqubecloud · 2026-09-14T19:33:43Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code