chore(deps): bump the go-dependencies group with 2 updates

[dependabot]

Bumps the go-dependencies group with 2 updates: github.com/creasty/defaults and golang.org/x/mod.

Updates github.com/creasty/defaults from 1.9.0 to 1.10.0

Release notes

Sourced from github.com/creasty/defaults's releases.

v1.10.0

v1.9.0 ended with a list of four known issues. This release fixes three of them — #67, #71 and #79 — and two more bugs, #69 and #89, and exports the error Set returns for an argument it cannot fill (#70).

Behavior changes come first again. Two of them can change what a working program does. One is loud: a tag that was never applied is now an error. The other is quiet — a SetDefaults that ran only through method promotion no longer runs — so it comes first.

[BREAKING] SetDefaults runs once per value, and not through promotion (#85, #86)

In v1.9.0 a SetDefaults could run two or three times on the same value. A struct behind a pointer got one call as its fields were filled and another from the pointer (#67). A method promoted from an embedded field ran once for the field and again through the struct embedding it, and once more for each further level of embedding.

A value reached by one path now gets one call, and an embedded field gets exactly the calls a named field of its type would get. For a setter that is idempotent — the usual if c.Port == 0 { c.Port = 8080 } — this first table changes nothing:

SetDefaults calls	v1.9.0	v1.10.0
*T field, tagged default:"{}" or allocated by the caller	2	1
element of a []*T	2	1
**T field	2	1
embedded T	2	1
embedded T, two levels deep	3	1
embedded *T	3	1

That count is per path. A value reached by more than one path — two pointers to one struct, two slices over one array, one map held in two fields — still gets one call from each: two pointers to one struct went from 4 calls to 2, not to 1. See Known issues.

The second table is the one to read twice. These calls happened only through promotion, or after an unmarshaler had already taken the tag, and nothing reports that they are gone:

SetDefaults calls	v1.9.0	v1.10.0
embedded unexported struct	1	0
embedded T tagged default:"-"	1	0
embedded interface holding a Setter	1	0
embedded T whose UnmarshalText took the tag	1	0
*T field, T a struct, whose UnmarshalText took the tag	1	0
embedded *T left nil	called with a nil receiver	no call
embedded interface left nil	panic	no call

The *T field row is not an embedding. A *T field ran SetDefaults after UnmarshalText where a T field does not; it now agrees with the T field and with the README, which says the tag is handed to UnmarshalText and SetDefaults is not called. That holds only when T is a struct: a pointer to a non-struct type with both methods, such as *Level for type Level int, still gets SetDefaults after UnmarshalText took the tag, as in v1.9.0.

How to tell whether you are affected: look for a type whose SetDefaults you rely on, embedded where it gets no call of its own. A value it used to fill now stays zero:

type base struct{ Timeout time.Duration }
func (b *base) SetDefaults() {
if b.Timeout == 0 {
b.Timeout = 30 * time.Second
}
}
type Client struct {
base // v1.9.0: Timeout is 30s. v1.10.0: Timeout is 0.
}
</tr></table>

... (truncated)

Commits

• 2ffdddf Document why time.Duration and int64 share one parser (#94)
• 5ac1fda feat: export ErrInvalidType for a non-struct-pointer argument (#93)
• e2a8a35 fix: return an error when an array type's unmarshaler rejects its tag (#92)
• ff1c1df Report a failing unmarshaler's error instead of the fall-back's (#90)
• 3c42271 docs: replace example/ with a composite example that go test verifies (#91)
• d470c6f ci: aggregate the test matrix into one check a branch rule can require (#88)
• da0df18 fix: return an error for a default that recurses without end (#87)
• 0e063c1 fix: call an embedded type's SetDefaults once (#86)
• 2476b45 fix: call SetDefaults once for a struct behind a pointer (#85)
• 7887a6f Merge pull request #84 from creasty/claude/github-issue-69-ae1f01
• Additional commits viewable in compare view

Updates golang.org/x/mod from 0.38.0 to 0.41.0

Commits

• d0a27b2 modfile: fix Cleanup and DropTool documentation
• d12008c all: upgrade go directive to at least 1.26.0 [generated]
• d3398d0 go.mod: update golang.org/x dependencies
• 57549bf sumdb: ignore unrelated hashes in Lookup
• 96f62ae sumdb/tlog: fix TileHashReader authentication bypass
• 13be902 go.mod: update golang.org/x dependencies
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions