chore: bump Go version to 1.25.10 (and bump dependencies)

.github/workflows/checks.yml

@@ -1,13 +1,13 @@
 name: checks
 
 env:
-  HOMEBREW_NO_ANALYTICS: '1'
-  STAVEFILE_VERBOSE: '1'
-  STAVEFILE_DEBUG: '1'
+  HOMEBREW_NO_ANALYTICS: "1"
+  STAVEFILE_VERBOSE: "1"
+  STAVEFILE_DEBUG: "1"
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
   workflow_dispatch:
 
@@ -17,7 +17,7 @@ concurrency:
 
 jobs:
   checks:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/release.yml

@@ -1,9 +1,9 @@
 name: release
 
 env:
-  HOMEBREW_NO_ANALYTICS: '1'
-  STAVEFILE_VERBOSE: '1'
-  STAVEFILE_DEBUG: '1'
+  HOMEBREW_NO_ANALYTICS: "1"
+  STAVEFILE_VERBOSE: "1"
+  STAVEFILE_DEBUG: "1"
 
 defaults:
   run:
@@ -23,7 +23,7 @@ permissions:
 jobs:
   release:
     timeout-minutes: 30
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.golangci.yml

@@ -37,7 +37,7 @@ linters:
     - gocyclo
     - godot
     - goheader
-    - gomodguard
+    - gomodguard_v2
     - goprintffuncname
     - gosec
     - govet
@@ -46,7 +46,7 @@ linters:
     - ineffassign
     - interfacebloat
     - intrange
-#    - ireturn # Go internals for parsing Go code often return interfaces.
+    #    - ireturn # Go internals for parsing Go code often return interfaces.
     - lll
     - loggercheck
     - maintidx
@@ -86,7 +86,7 @@ linters:
     - varnamelen
     - wastedassign
     - whitespace
-#    - wrapcheck # Stave outputs error messages directly to the user, so wrapping is actually not what we want in this project.
+    #    - wrapcheck # Stave outputs error messages directly to the user, so wrapping is actually not what we want in this project.
     - zerologlint
   settings:
     cyclop:
@@ -105,6 +105,8 @@ linters:
       ignore-comments: true
     gocognit:
       min-complexity: 50
+    goconst:
+      ignore-tests: true
     gocritic:
       settings:
         captLocal:
@@ -113,21 +115,20 @@ linters:
           skipRecvDeref: false
     gocyclo:
       min-complexity: 50
-    gomodguard:
+    gomodguard_v2:
       blocked:
-        modules:
-          - github.com/golang/protobuf:
-              recommendations:
-                - google.golang.org/protobuf
-              reason: see https://developers.google.com/protocol-buffers/docs/reference/go/faq#modules
-          - github.com/satori/go.uuid:
-              recommendations:
-                - github.com/google/uuid
-              reason: satori's package is not maintained
-          - github.com/gofrs/uuid:
-              recommendations:
-                - github.com/google/uuid
-              reason: gofrs' package is not go module
+        - module: github.com/golang/protobuf
+          recommendations:
+            - google.golang.org/protobuf
+          reason: see https://developers.google.com/protocol-buffers/docs/reference/go/faq#modules
+        - module: github.com/satori/go.uuid
+          recommendations:
+            - github.com/google/uuid
+          reason: satori's package is not maintained
+        - module: github.com/gofrs/uuid
+          recommendations:
+            - github.com/google/uuid
+          reason: gofrs' package is not go module
     gosec:
       excludes:
         - G703 # This rule is about enabling arbitrary path traversal via injected user input; which, yeah, this is stave and it can do that.
@@ -207,7 +208,7 @@ linters:
           disabled: false
         - name: context-as-argument
           arguments:
-            - allowTypesBefore: '*testing.T,*github.com/user/repo/testing.Harness'
+            - allowTypesBefore: "*testing.T,*github.com/user/repo/testing.Harness"
           disabled: false
         - name: context-keys-type
           disabled: false
@@ -417,7 +418,7 @@ linters:
           - gocritic
         source: //noinspection
       - linters:
-        - revive
+          - revive
         text: "var-naming: avoid package names that conflict with Go standard library"
       - linters:
           - bodyclose

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.14.8] - 2026-05-19
+
+### Changed
+
+- Bump Go version to `1.25.10` (and update dependencies).
+
 ## [0.14.7] - 2026-04-23
 
 ### Changed
@@ -547,7 +553,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Added parallelism-by-default to use of Go tools from inside Stave.
 - Parallelized tests where possible, including locking mechanism to prevent parallel tests in same `testdata/(xyz/)` subdir.
 
-[unreleased]: https://github.com/yaklabco/stave/compare/v0.14.7...HEAD
+[unreleased]: https://github.com/yaklabco/stave/compare/v0.14.8...HEAD
+[0.14.8]: https://github.com/yaklabco/stave/compare/v0.14.7...v0.14.8
 [0.14.7]: https://github.com/yaklabco/stave/compare/v0.14.6...v0.14.7
 [0.14.6]: https://github.com/yaklabco/stave/compare/v0.14.5...v0.14.6
 [0.14.5]: https://github.com/yaklabco/stave/compare/v0.14.4...v0.14.5

config/hooks.go

@@ -23,36 +23,64 @@ type HookTarget struct {
 // HooksConfig maps Git hook names to their configured targets.
 type HooksConfig map[string][]HookTarget
 
+const (
+	HookNameApplypatchMsg       = "applypatch-msg"
+	HookNamePreApplypatch       = "pre-applypatch"
+	HookNamePostApplypatch      = "post-applypatch"
+	HookNamePreCommit           = "pre-commit"
+	HookNamePrepareCommitMsg    = "prepare-commit-msg"
+	HookNameCommitMsg           = "commit-msg"
+	HookNamePostCommit          = "post-commit"
+	HookNamePreRebase           = "pre-rebase"
+	HookNamePostCheckout        = "post-checkout"
+	HookNamePostMerge           = "post-merge"
+	HookNamePrePush             = "pre-push"
+	HookNamePreReceive          = "pre-receive"
+	HookNameUpdate              = "update"
+	HookNamePostReceive         = "post-receive"
+	HookNamePostUpdate          = "post-update"
+	HookNamePushToCheckout      = "push-to-checkout"
+	HookNamePreAutoGc           = "pre-auto-gc"
+	HookNamePostRewrite         = "post-rewrite"
+	HookNameSendemailValidate   = "sendemail-validate"
+	HookNameFsmonitorWatchman   = "fsmonitor-watchman"
+	HookNameP4PreSubmit         = "p4-pre-submit"
+	HookNameP4Changelist        = "p4-changelist"
+	HookNameP4PrepareChangelist = "p4-prepare-changelist"
+	HookNameP4PostChangelist    = "p4-post-changelist"
+	HookNamePostIndexChange     = "post-index-change"
+)
+
 // knownGitHooks is the set of standard Git hook names.
 // Used to warn on unrecognized hook names.
 //
 //nolint:gochecknoglobals // package-level lookup table for hook validation
 var knownGitHooks = lo.Keyify([]string{
-	"applypatch-msg",
-	"pre-applypatch",
-	"post-applypatch",
-	"pre-commit",
-	"prepare-commit-msg",
-	"commit-msg",
-	"post-commit",
-	"pre-rebase",
-	"post-checkout",
-	"post-merge",
-	"pre-push",
-	"pre-receive",
-	"update",
-	"post-receive",
-	"post-update",
-	"push-to-checkout",
-	"pre-auto-gc",
-	"post-rewrite",
-	"sendemail-validate",
-	"fsmonitor-watchman",
-	"p4-pre-submit",
-	"p4-changelist",
-	"p4-prepare-changelist",
-	"p4-post-changelist",
-	"post-index-change",
+	HookNameApplypatchMsg,
+	HookNamePreApplypatch,
+	HookNamePostApplypatch,
+	HookNamePreCommit,
+	HookNamePrepareCommitMsg,
+	HookNameCommitMsg,
+	HookNamePostCommit,
+	HookNamePreRebase,
+	HookNamePostCheckout,
+	HookNamePostMerge,
+	HookNamePrePush,
+	HookNamePreReceive,
+	HookNameUpdate,
+	HookNamePostReceive,
+	HookNamePostUpdate,
+	HookNamePushToCheckout,
+	HookNamePreAutoGc,
+	HookNamePostRewrite,
+	HookNameSendemailValidate,
+	HookNameFsmonitorWatchman,
+	HookNameP4PreSubmit,
+	HookNameP4Changelist,
+	HookNameP4PrepareChangelist,
+	HookNameP4PostChangelist,
+	HookNamePostIndexChange,
 })
 
 // IsKnownGitHook returns true if the hook name is a recognized Git hook.

go.mod

@@ -1,16 +1,16 @@
 module github.com/yaklabco/stave
 
-go 1.25.9
+go 1.25.10
 
 require (
-	charm.land/lipgloss/v2 v2.0.2
-	github.com/caarlos0/svu/v3 v3.4.0
+	charm.land/lipgloss/v2 v2.0.3
+	github.com/caarlos0/svu/v3 v3.4.1
 	github.com/charmbracelet/fang v1.0.0
 	github.com/charmbracelet/log v1.0.0
 	github.com/charmbracelet/x/term v0.2.2
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
-	github.com/fsnotify/fsnotify v1.9.0
-	github.com/go-git/go-git/v5 v5.17.2
+	github.com/fsnotify/fsnotify v1.10.1
+	github.com/go-git/go-git/v5 v5.19.1
 	github.com/gobwas/glob v0.2.3
 	github.com/google/uuid v1.6.0
 	github.com/muesli/reflow v0.3.0
@@ -19,44 +19,44 @@ require (
 	github.com/spf13/viper v1.21.0
 	github.com/stretchr/testify v1.11.1
 	github.com/yaklabco/direnv/v2 v2.37.2-0.20260408140756-a0bfab26dddf
-	golang.org/x/tools v0.43.0
+	golang.org/x/tools v0.45.0
 )
 
 require (
 	github.com/BurntSushi/toml v1.6.0 // indirect
-	github.com/Masterminds/semver/v3 v3.4.0 // indirect
+	github.com/Masterminds/semver/v3 v3.5.0 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/bitfield/gotestdox v0.2.2 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect
 	github.com/charmbracelet/lipgloss v1.1.0 // indirect
-	github.com/charmbracelet/ultraviolet v0.0.0-20260330092749-0f94982c930b // indirect
-	github.com/charmbracelet/x/ansi v0.11.6 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20260511121909-c840852527f3 // indirect
+	github.com/charmbracelet/x/ansi v0.11.7 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
-	github.com/charmbracelet/x/exp/charmtone v0.0.0-20260406091427-a791e22d5143 // indirect
+	github.com/charmbracelet/x/exp/charmtone v0.0.0-20260519012233-798e623c8447 // indirect
 	github.com/charmbracelet/x/termios v0.1.1 // indirect
 	github.com/charmbracelet/x/windows v0.2.2 // indirect
 	github.com/clipperhouse/displaywidth v0.11.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/dnephin/pflag v1.0.7 // indirect
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.8.0 // indirect
+	github.com/go-git/go-billy/v5 v5.9.0 // indirect
 	github.com/go-logfmt/logfmt v0.6.1 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.21 // indirect
+	github.com/mattn/go-isatty v0.0.22 // indirect
 	github.com/mattn/go-runewidth v0.0.23 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/mango v0.2.0 // indirect
 	github.com/muesli/mango-cobra v1.3.0 // indirect
 	github.com/muesli/mango-pflag v0.2.0 // indirect
 	github.com/muesli/roff v0.1.0 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
-	github.com/pelletier/go-toml/v2 v2.3.0 // indirect
+	github.com/pelletier/go-toml/v2 v2.3.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/sagikazarmark/locafero v0.12.0 // indirect
@@ -66,13 +66,13 @@ require (
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 // indirect
-	golang.org/x/mod v0.34.0 // indirect
-	golang.org/x/net v0.52.0 // indirect
+	golang.org/x/exp v0.0.0-20260508232706-74f9aab9d74a // indirect
+	golang.org/x/mod v0.36.0 // indirect
+	golang.org/x/net v0.54.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.43.0 // indirect
-	golang.org/x/term v0.41.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
+	golang.org/x/sys v0.44.0 // indirect
+	golang.org/x/term v0.43.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	gotest.tools/gotestsum v1.13.0 // indirect