[dependabot]

Bumps the go-dependencies group with 2 updates: github.com/itchyny/gojq and github.com/spf13/pflag.

Updates github.com/itchyny/gojq from 0.12.19 to 0.12.20

Release notes

Sourced from github.com/itchyny/gojq's releases.

Release v0.12.20

• implement gojq.ToInt and gojq.ToFloat64 for converting number values
• fix destructuring alternative operator (?//) to reset variables of later alternatives, and to propagate break and halt errors
• fix update-assignment operator against object with overlapping paths
• fix delpaths function to delete ancestor paths before descendant paths
• fix getpath function against string input
• fix indexing and slicing a number literal written after a unary operator
• fix slice indices of floating point numbers for jq compatibility
• fix date and time functions against fractional, non-finite, and out of range numbers
• fix strptime function to accept the zero time instant
• fix match, test, and capture functions to support array arguments
• fix match function to report an empty match after a non-empty one
• fix split/1 function against empty input string
• fix math functions against large number literals like 1e1000
• fix jn/2 and yn/2 functions to avoid long recurrence on large orders
• fix abs function against non-numbers for jq compatibility
• fix isnan function to return false for non-numbers for jq compatibility
• fix halt_error function not to print a newline after non-string values
• fix --argjson and --jsonargs options to reject empty and multiple JSON values
• fix --stream option error message against unterminated input
• fix JSON parse error message after a large value in non-seekable input like stdin
• fix offset of YAML parse error on multi-byte characters
• fix panic on continuing iteration after an invalid path error
• fix data race on input iterator when running code concurrently
• fix add function to handle a nil map and slice as the first value
• support destructuring alternative operator (?//) in reduce and foreach syntax
• allow optional operator followed by alternative operator without spaces (.a?//1)
• improve performance of function calls by avoiding copies of scope values, and path tracking in path, paths, |=, and del by reducing allocations

Changelog

Sourced from github.com/itchyny/gojq's changelog.

v0.12.20 (2026-11-01)

• implement gojq.ToInt and gojq.ToFloat64 for converting number values
• fix destructuring alternative operator (?//) to reset variables of later alternatives, and to propagate break and halt errors
• fix update-assignment operator against object with overlapping paths
• fix delpaths function to delete ancestor paths before descendant paths
• fix getpath function against string input
• fix indexing and slicing a number literal written after a unary operator
• fix slice indices of floating point numbers for jq compatibility
• fix date and time functions against fractional, non-finite, and out of range numbers
• fix strptime function to accept the zero time instant
• fix match, test, and capture functions to support array arguments
• fix match function to report an empty match after a non-empty one
• fix split/1 function against empty input string
• fix math functions against large number literals like 1e1000
• fix jn/2 and yn/2 functions to avoid long recurrence on large orders
• fix abs function against non-numbers for jq compatibility
• fix isnan function to return false for non-numbers for jq compatibility
• fix halt_error function not to print a newline after non-string values
• fix --argjson and --jsonargs options to reject empty and multiple JSON values
• fix --stream option error message against unterminated input
• fix JSON parse error message after a large value in non-seekable input like stdin
• fix offset of YAML parse error on multi-byte characters
• fix panic on continuing iteration after an invalid path error
• fix data race on input iterator when running code concurrently
• fix add function to handle a nil map and slice as the first value
• support destructuring alternative operator (?//) in reduce and foreach syntax
• allow optional operator followed by alternative operator without spaces (.a?//1)
• improve performance of function calls by avoiding copies of scope values, and path tracking in path, paths, |=, and del by reducing allocations

Commits

• e7c14ec bump up version to 0.12.20
• b326bdd update CHANGELOG.md for v0.12.20
• e8319c4 use $(MAKE) instead of make in Makefile
• e169ed9 fix strptime to accept the zero time instant (#333)
• 806d7bd improve test coverage of query string conversion
• 045a452 refactor format functions to avoid unnecessary interface conversion
• b984f98 replace ncipollo/release-action with gh release create
• 8b2f146 update dependencies
• 7c7e71a fix JSON argument error to report the unexpected token after a value
• e661b6a fix --argjson and --jsonargs to reject empty and multiple JSON values (#332)
• Additional commits viewable in compare view

Updates github.com/spf13/pflag from 1.0.10 to 1.1.0

Release notes

Sourced from github.com/spf13/pflag's releases.

v1.1.0

It's been long enough, and enough things have been fixed, that it might be time to release a new version, even if there isn't any particular big new issue to market as the reason for this release.

If you notice anything breaking, it is entirely un-intentional, but you might also have been relying on undocumented or buggy behavior. Please file an issue describing what you're doing, how it worked before this release and why it doesn't work anymore, and pin your projects to v1.0.10 (the latest release before this one) while we decide how to address your concerns.

What's Changed

• README: update badges and minor linting fixes by @​thaJeztah in spf13/pflag#452
• Show 'correct' explicit bool value syntax in help by @​alimpfard in spf13/pflag#453
• Fix for Go 1.24 by @​pterjan in spf13/pflag#460
• fix(map): ensure string-to-string flags maintain stable pointers by @​brandon1024 in spf13/pflag#457
• Fix getFlagType error message by @​wellitonscheer in spf13/pflag#462
• update actions, and fix linting issues by @​thaJeztah in spf13/pflag#450
• fix: README.md indicating the use of godoc(deprecated) by @​malklera in spf13/pflag#467
• Fix broken link to POSIX argument conventions by @​tomasaschan in spf13/pflag#464
• Replace raw stdlib parse errors in typed flag Set methods (#269) by @​reuvenharrison in spf13/pflag#469
• Extend UnknownFlags to UnknownFlagsHandling and introduce PassUnknownFlagToArgs (#337) by @​ikedam in spf13/pflag#440
• fix: allow nil default IP flags in GetIP by @​happysnaker in spf13/pflag#483
• fix: allow hex input in UintSlice by @​happysnaker in spf13/pflag#484
• fix: honor custom IsBoolFlag compatibility by @​happysnaker in spf13/pflag#487
• docs: clarify SortFlags example with complete runnable program by @​happysnaker in spf13/pflag#488
• docs: add release process documentation by @​happysnaker in spf13/pflag#490
• fix: print to set destination, not hardcoded os.Stderr by @​quite in spf13/pflag#502
• ci: bump golangci-lint to v2.13 for Go 1.27 by @​hdimer in spf13/pflag#508
• Initialize the target map when a StringToString flag has a nil default by @​nikolauspschuetz in spf13/pflag#506
• fix: honour deprecated ParseErrorsWhitelist.UnknownFlagsHandling by @​lenamonj in spf13/pflag#507
• test: add StringSlice Append coverage by @​LY-19418 in spf13/pflag#504
• Keep wrapping after an unbreakable usage word by @​AzazelSensei in spf13/pflag#503
• Validate IP slice values before appending or replacing by @​agammann in spf13/pflag#513
• fix(ci): Use the latest golangci-lint release by @​tomasaschan in spf13/pflag#525
• Reject IPv6 addresses as IPv4 masks by @​yuefdev in spf13/pflag#524
• Report the flag name as typed in deprecation warnings by @​hdimer in spf13/pflag#500
• Document non-interspersed argument parsing by @​yuefdev in spf13/pflag#523
• Preserve trailing whitespace in StringToString formatting by @​r4venrudy in spf13/pflag#522
• Reject extra CSV records in StringToString arguments by @​Harshil-1603 in spf13/pflag#521
• Preserve current string values in CopyToGoFlagSet by @​adenzhou1350 in spf13/pflag#520
• Fix type identification and mismatch checks for text flags by @​dewanshshekhar in spf13/pflag#526
• fix: enforce native integer flag bounds on 32-bit platforms by @​gdpu11 in spf13/pflag#534
• fix: preserve count flag values when parsing fails by @​gdpu11 in spf13/pflag#533

New Contributors

• @​alimpfard made their first contribution in spf13/pflag#453
• @​pterjan made their first contribution in spf13/pflag#460
• @​brandon1024 made their first contribution in spf13/pflag#457
• @​wellitonscheer made their first contribution in spf13/pflag#462
• @​malklera made their first contribution in spf13/pflag#467
• @​reuvenharrison made their first contribution in spf13/pflag#469
• @​ikedam made their first contribution in spf13/pflag#440
• @​happysnaker made their first contribution in spf13/pflag#483
• @​quite made their first contribution in spf13/pflag#502
• @​hdimer made their first contribution in spf13/pflag#508

... (truncated)

Commits

• f8a9906 Merge pull request #533 from gdpu11/fix/count-preserve-value-on-error
• f3a68a1 Merge pull request #534 from gdpu11/fix/native-integer-ranges
• 70f7745 fix: reject native integer flag overflow on 32-bit systems
• 2084408 test: cover native integer flag bounds on 32-bit systems
• 7d0f377 fix: preserve count flag values when parsing fails
• d26a4dc Merge pull request #526 from dewanshshekhar/fix/text-flag-type-check
• 2d401c7 Fix type identification for text flags
• fa584ba Merge pull request #520 from adenzhou1350/codex/fix-copy-go-string-value
• cc9e689 Merge upstream master and retain its linter version
• 70f284b Merge pull request #521 from Harshil-1603/fix/string-map-records
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Summary by cubic

Bumps the Go dependencies group: github.com/itchyny/gojq to v0.12.20 and github.com/spf13/pflag to v1.1.0, along with several indirect dependency updates.

Dependencies

• gojq v0.12.20 is a patch release with many bug fixes and performance improvements.
• pflag v1.1.0 is the first release since v1.0.10 and adds PassUnknownFlagToArgs; the maintainers note that undocumented or buggy flag-parsing behavior may have changed, so verify flag handling still behaves as expected.

^{Written for commit 5a971ea. Summary will update on new commits.}

[Copilot]

🟢 Approved

No active review issues are reported for the Go dependency updates.

No open issues 🎉

What changed in this PR

Updates Fizzy CLI’s Go dependencies for JSON query processing and command-line flag parsing, along with related indirect dependencies.

Changes:

• Bumps gojq from v0.12.19 to v0.12.20 and pflag from v1.0.10 to v1.1.0.
• Updates three indirect dependencies, removes stringish, and refreshes module checksums.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
go.sum	Refreshes checksums for updated and removed dependencies.
go.mod	Updates direct and indirect dependency requirements.

_{Review effort: Balanced}