build(deps): bump the gomod group with 3 updates

[dependabot]

Bumps the gomod group with 3 updates: github.com/creasty/defaults, github.com/go-playground/validator/v10 and github.com/montanaflynn/stats.

Updates github.com/creasty/defaults from 1.10.0 to 1.11.0

Release notes

Sourced from github.com/creasty/defaults's releases.

v1.11.0

v1.10.0 ended with six known issues. This release fixes three of them — data with a cycle crashed the process, a SetDefaults ran after an unmarshaler had taken the tag, and a failed default left part of itself behind — and half of a fourth: Set no longer writes to a map of slices or maps. The other two, and the rest of the fourth, stay as they are, now documented as intended. The API is unchanged, and so is go.mod.

Behavior changes come first, as before. Two of them can change what a working program does, and neither announces itself: one stops a SetDefaults call, and the other changes what Set leaves behind when it returns an error.

[BREAKING] SetDefaults is skipped behind a pointer once an unmarshaler took the tag (#97)

The README says that when a tag is handed to UnmarshalText, SetDefaults is not called. v1.10.0 made that hold for a struct, behind a pointer or not, and listed the rest as a known issue: a pointer to any other type still got SetDefaults after its unmarshaler took the tag. It no longer does:

type Level int
func (l *Level) UnmarshalText(b []byte) error {
n, err := strconv.Atoi(string(b))
if err != nil {
return err
}
*l = Level(n)
return nil
}
func (l *Level) SetDefaults() { *l += 100 }
type Config struct {
Level *Level default:"3" // v1.10.0: 103. v1.11.0: 3.
}

a field of that Level, left zero	v1.10.0	v1.11.0
*Level default:"3"	103	3
**Level default:"3"	103	3
embedded *Level default:"3"	103	3
*Level, with UnmarshalJSON in place of UnmarshalText	103	3
*Level default:"", which no unmarshaler is offered	100	100
*Level default:"0x10", which UnmarshalText rejects and parsing by kind takes	116	116
Level default:"3"	3	3

Nothing reports the missing call. How to tell whether you are affected: look for a type that is not a struct — a named int, string or slice — with both SetDefaults and UnmarshalText or UnmarshalJSON, behind a pointer a tag allocates. If its SetDefaults adjusted what the unmarshaler produced, that adjustment is gone; make it in the unmarshaler instead. A field of the type itself never got the call, and a pointer the caller allocated is still left alone.

[BREAKING] A failed default no longer leaves part of itself behind (#98)

When a default failed, Set returned the error but kept what it had filled on the way down. The value was then no longer zero, so a second Set could skip the tag and return nil, which v1.10.0 listed as a known issue for *scalar, *[]T and *map fields. Now each value Set found zero on the way to the failing default is put back to zero, whatever part of the default it had taken:

after Set returned the error	v1.10.0	v1.11.0
*int default:"eighty"	&0, and a second Set returns nil	nil, and a second Set returns the error again
*[]string default:"[1]"	&[], and a second Set returns nil	nil, and a second Set returns the error again
a struct field default:"{\"X\": 1, \"Y\": \"two\"}"	{X:1 Y:0}	{X:0 Y:0}
an untagged struct field whose A took 7 before B failed	{A:7 B:0}	{A:0 B:0}

... (truncated)

Commits

• 10a16ef refactor: read tag.value in fillField rather than aliasing it (#112)
• 08a42cd refactor: move the internal packages back into files (#111)
• 5012535 refactor: move the unmarshaler handoff to internal/unmarshal (#110)
• 120766a Move the promoted-method check to internal/method (#109)
• dc07feb perf: check a value deep in the path against an index, not a scan (#108)
• 702f9a4 perf: skip joining the int64 parsers' errors for an empty tag (#107)
• 31d8cbc test: pin a caller's pointer to a slice, map or pointer as a QUIRK (#106)
• 6852e14 fix: store only a struct copy back into the map holding it (#105)
• 6545f75 fix: end a cycle in the caller's data instead of overflowing the stack (#104)
• b9efcfb perf: skip walking a slice or map whose elements cannot hold defaults (#103)
• Additional commits viewable in compare view

Updates github.com/go-playground/validator/v10 from 10.30.4 to 10.30.5

Release notes

Sourced from github.com/go-playground/validator/v10's releases.

Release 10.30.5

What's Changed

• fix: allow signed integer fields in port validation by @​EJJI0113 in go-playground/validator#1633
• Go 1.27 support by @​nodivbyzero in go-playground/validator#1637
• docs: add AI agent attribution requirements to CONTRIBUTING.md by @​deankarn in go-playground/validator#1640

New Contributors

• @​EJJI0113 made their first contribution in go-playground/validator#1633

Full Changelog: go-playground/validator@v10.30.4...v10.30.5

Commits

• 6a9b666 docs: add AI agent attribution requirements to CONTRIBUTING.md (#1640)
• 830a0b2 Go 1.27 support (#1637)
• c7f3d2c fix: allow signed integer fields in port validation (#1633)
• See full diff in compare view

Updates github.com/montanaflynn/stats from 0.12.6 to 0.12.7

Release notes

Sourced from github.com/montanaflynn/stats's releases.

v0.12.7

Changelog

Fix

• 2ba60a707ddc68a8fada16438adecad9fb2981b1 fix: return ErrZero from PopulationSkewness for zero-variance input (#137)

Other

• c06ae5f864ab3128ee1124ea52b6d4da552d80e7 chore: update changelog for v0.12.7
• 2193b43bf0078fc9d24a55a739ef66fc7f11c32a test: use Error in TestExponentialRegressionYCoordErr (#136)

Changelog

Sourced from github.com/montanaflynn/stats's changelog.

[v0.12.7] - 2026-09-19

Fix

• Return ErrZero from PopulationSkewness for zero-variance input (#137)

Commits

• c06ae5f chore: update changelog for v0.12.7
• 2ba60a7 fix: return ErrZero from PopulationSkewness for zero-variance input (#137)
• 2193b43 test: use Error in TestExponentialRegressionYCoordErr (#136)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions