build(deps): Bump github.com/spf13/cobra from 0.0.7 to 1.3.0

[dependabot]

Bumps github.com/spf13/cobra from 0.0.7 to 1.3.0.

Release notes

Sourced from github.com/spf13/cobra's releases.

v1.3.0 - The Fall 2021 release 🍁

Completion fixes & enhancements 💇🏼

In v1.2.0, we introduced a new model for completions. Thanks to everyone for trying it, giving feedback, and providing numerous fixes! Continue to work with the new model as the old one (as noted in code comments) will be deprecated in a coming release.

• DisableFlagParsing now triggers custom completions for flag names #1161
• Fixed unbound variables in bash completions causing edge case errors #1321
• help completion formatting improvements & fixes #1444
• All completions now follow the help example: short desc are now capitalized and removes extra spacing from long description #1455
• Typo fixes in bash & zsh completions #1459
• Fixed mixed tab/spaces indentation in completion scripts. Now just 4 spaces #1473
• Support for different bash completion options. Bash completions v2 supports descriptions and requires descriptions to be removed for menu-complete, menu-complete-backward and insert-completions. These descriptions are now purposefully removed in support of this model. #1509
• Fix for invalid shell completions when using ~/.cobra.yaml. Log message Using config file: ~/.cobra.yaml now printed to stderr #1510
• Removes unnecessary trailing spaces from completion command descriptions #1520
• Option to hid default completion command #1541
• Remove __complete command for programs without subcommands #1563

Generator changes ⚙️

Thanks to @​spf13 for providing a number of changes to the Cobra generator tool, streamlining it for new users!

• The Cobra generator now won't automatically include Viper and cleans up a number of unused imports when not using Viper.
• The Cobra generator's default license is now none
• The Cobra generator now works with Go modules
• Documentation to reflect these changes

New Features ⭐

• License can be specified by their SPDX identifiers #1159
• MatchAll allows combining several PositionalArgs to work in concert. This now allows for enabling composing PositionalArgs #896

Bug Fixes 🐛

• Fixed multiple error message from cobra init boilerplates #1463 #1552 #1557

Testing 👀

• Now testing golang 1.16.x and 1.17.x in CI #1425
• Fix for running diff test to ignore CR for windows #949
• Added helper functions and reduced code reproduction in args_test #1426
• Now using official golangci-lint github action #1477

Security 🔏

• Added GitHub dependabot #1427
• Now using Viper v1.10.0
  • There is a known CVE in an indirect dependency from viper: spf13/cobra#1538. This will be patched in a future release

Documentation 📝

• Multiple projects added to the projects_using_cobra.md file: #1377 #1501 #1454
• Removed ToC from main readme file as it is now automagically displayed by GitHub #1429
• Documentation correct for when the --author flag is specified #1009
• shell_completions.md has an easier to use snippet for copying and pasting shell completions #1372

... (truncated)

Changelog

Sourced from github.com/spf13/cobra's changelog.

Cobra Changelog

v1.1.3

• Fix: release-branch.cobra1.1 only: Revert "Deprecate Go < 1.14" to maintain backward compatibility

v1.1.2

Notable Changes

• Bump license year to 2021 in golden files (#1309) @​Bowbaq
• Enhance PowerShell completion with custom comp (#1208) @​Luap99
• Update gopkg.in/yaml.v2 to v2.4.0: The previous breaking change in yaml.v2 v2.3.0 has been reverted, see go-yaml/yaml#670
• Documentation readability improvements (#1228 etc.) @​zaataylor etc.
• Use golangci-lint: Repair warnings and errors resulting from linting (#1044) @​umarcor

v1.1.1

• Fix: yaml.v2 2.3.0 contained a unintended breaking change. This release reverts to yaml.v2 v2.2.8 which has recent critical CVE fixes, but does not have the breaking changes. See spf13/cobra#1259 for context.
• Fix: correct internal formatting for go-md2man v2 (which caused man page generation to be broken). See spf13/cobra#1049 for context.

v1.1.0

Notable Changes

• Extend Go completions and revamp zsh comp (#1070)
• Fix man page doc generation - no auto generated tag when cmd.DisableAutoGenTag = true (#1104) @​jpmcb
• Add completion for help command (#1136)
• Complete subcommands when TraverseChildren is set (#1171)
• Fix stderr printing functions (#894)
• fix: fish output redirection (#1247)

v1.0.0

Announcing v1.0.0 of Cobra. 🎉

Notable Changes

• Fish completion (including support for Go custom completion) @​marckhouzam
• API (urgent): Rename BashCompDirectives to ShellCompDirectives @​marckhouzam
• Remove/replace SetOutput on Command - deprecated @​jpmcb
• add support for autolabel stale PR @​xchapter7x
• Add Labeler Actions @​xchapter7x
• Custom completions coded in Go (instead of Bash) @​marckhouzam
• Partial Revert of #922 @​jharshman
• Add Makefile to project @​jharshman
• Correct documentation for InOrStdin @​desponda
• Apply formatting to templates @​jharshman
• Revert change so help is printed on stdout again @​marckhouzam
• Update md2man to v2.0.0 @​pdf
• update viper to v1.4.0 @​umarcor

... (truncated)

Commits

• 178edbb Bump github.com/spf13/viper from 1.9.0 to 1.10.0 (#1561)
• 9054739 Remove __complete cmd for program without subcmds (#1563)
• 19c9c74 Always include the os package import when generating the root command (#1557)
• 01e05b8 Bump github.com/spf13/viper from 1.8.1 to 1.9.0 (#1554)
• 36bff0a fix root.go.golden (#1552)
• 1854bb5 Fix some typos (mostly found by codespell) (#1514)
• ff2c55e chore(ci): use golangci-lint-action (#1477)
• 1beb476 fix: Duplicate error message from cobra init boilerplates (#1463)
• 6f84ef4 Provide option to hide default 'completion' cmd (#1541)
• ee75a2b Remove trailing spaces from bash completion command description (#1520)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[JamesKButcher]

@siggiskulason to investigate please. Quite a significant version jump. Also consider dependencies and footprint

[lenny-goodell]

Note that if this new minor version jump was bringing in new dependencies we would see them as new indirect entries in the go.mod and the attribution script would flag them.

[siggiskulason]

I suggest we go ahead with this upgrade:

1. There are no new dependencies. Some of the indirect dependencies have been updated as per these changes in go.mod:

new	old
github.com/spf13/cobra v1.3.0	github.com/spf13/cobra v0.0.7
github.com/spf13/pflag v1.0.5 // indirect	github.com/spf13/pflag v1.0.3 // indirect
golang.org/x/crypto v0.0.0-20210817164053-32db794688a5 //	golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 // indirect
golang.org/x/sys v0.0.0-20211205182925-97ca703d548d // indirect	golang.org/x/sys v0.0.0-20190412213103-97732733099d // indirect
golang.org/x/text v0.3.7 // indirect	golang.org/x/text v0.3.2 // indirect

2. As well as a number of bugfixes, this update contains support for command completion, which was one of the features we wanted to add (as per the ADR). It will therefore enable us to add that feature.

3. Looking at their version history, they jumped straight from 0.0.7 to 1.0.0 in 2020, so we are replacing an early-2020 version with a late-2021 version.

4 The client is only slighly larger: 10.671.330 vs 10.518.691

Any objections to going ahead, @JamesKButcher / @lenny-intel ?

[JamesKButcher]

Good analysis, thanks @siggiskulason. Looks good to me

[lenny-goodell]

Any objections to going ahead, @JamesKButcher / @lenny-intel ?

Sounds good!

[lenny-goodell]

@dependabot recreate

[JamesKButcher]

LGTM