build(deps): bump mvdan.cc/sh/v3 from 3.13.1 to 3.14.0

[dependabot]

Bumps mvdan.cc/sh/v3 from 3.13.1 to 3.14.0.

Release notes

Sourced from mvdan.cc/sh/v3's releases.

v3.14.0

This release drops support for Go 1.25 and includes many enhancements, particularly in the interpreter, which implements more shell features and fixes many divergences from Bash.

• cmd/shfmt
  • Add --detect to find shell files by executable bit or shebang - #944
• syntax
  • Add Preorder, an iterator over all nodes, complementing Walk
  • Add encoding.TextUnmarshaler implementations for each operator type
  • Support ${ foo;} and ${|foo;} inside double quotes - #1368
  • Support array elements in {varname} redirects, like exec {fds[3]}>&- - #719
  • Backslashes inside backquotes within double quotes escape double quotes - #1083
  • Allow pound signs in associative array keys like ${args[cmd,#]} - #1285
  • Don't treat # as the start of a comment inside [[ ]] tests - #1326
  • Don't join then or do with a semicolon when heredocs are pending - #1047
  • Print a space after ! in arithmetic expressions, avoiding history expansion - #987
  • Space nested closing parentheses like the opening ones - #876
  • Make SplitBraces reject malformed sequences and skip backslash escapes - #1330
  • Zsh: support the ${=name}, ${~name}, and ${^name} prefixes - #1238
  • Zsh: support the ;| case terminator and leading parentheses for globs - #1293, #1279
  • Zsh: parse subscript flag arguments as patterns, and allow [ globs in arrays - #1278, #1322
• syntax/typedjson
  • Encode operators as their syntax form, such as ">>", rather than integers - #1321
  • Return errors rather than panicking on malformed input
• interp
  • Add BashOpts to set Bash options like shopt - #962
  • Add AccessHandler to control file access checks, used by -r and cd - #1318
  • Add HandlerContext.LastExitStatus, and provide a HandlerContext to stat handlers
  • Implement the help and times builtins, as well as $- - #1398
  • Implement the ;& and ;;& case terminators - #1391
  • Implement the -N test operator, and make -nt and -ot follow POSIX - #1340
  • Support sparse indexed arrays such as a=([5]=x) - #1373
  • Run files as shell scripts when exec fails with ENOEXEC - #1065
  • Support empty here-documents, and don't expand quoted ones - #1390
  • Support js/wasm, where subprocesses and pipes are unavailable
  • Keep the redirections applied by exec with no arguments
  • Only fire the exit trap when the shell exits, rather than after every Run
• expand
  • Add BracesSeq with a config and error reporting, deprecating Braces
  • Add Variable.Indexes to describe sparse indexed arrays
  • Support integer bases in arithmetic - #339
  • Short-circuit the arithmetic && and || operators - #1371
  • Apply per-element operators to quoted array expansions like "${a[@]%o}" - #1081
  • Make unquoted ${!arr[@]} consistent with the quoted form - #672
  • Fix many divergences from Bash in arithmetic, string, and brace expansions
  • Reject unsupported Zsh syntax rather than panicking - #1363
• pattern
  • Treat an unmatched [ as a literal character, like Bash - #1372
  • Fix panics and mismatches in bracket expressions, such as [![:space:]]
• fileutil
  • Recognize dash shebangs as POSIX shell for -ln=auto - #1307

... (truncated)

Changelog

Sourced from mvdan.cc/sh/v3's changelog.

[3.14.0] - 2026-08-28

This release drops support for Go 1.25 and includes many enhancements, particularly in the interpreter, which implements more shell features and fixes many divergences from Bash.

• cmd/shfmt
  • Add --detect to find shell files by executable bit or shebang - #944
• syntax
  • Add Preorder, an iterator over all nodes, complementing Walk
  • Add encoding.TextUnmarshaler implementations for each operator type
  • Support ${ foo;} and ${|foo;} inside double quotes - #1368
  • Support array elements in {varname} redirects, like exec {fds[3]}>&- - #719
  • Backslashes inside backquotes within double quotes escape double quotes - #1083
  • Allow pound signs in associative array keys like ${args[cmd,#]} - #1285
  • Don't treat # as the start of a comment inside [[ ]] tests - #1326
  • Don't join then or do with a semicolon when heredocs are pending - #1047
  • Print a space after ! in arithmetic expressions, avoiding history expansion - #987
  • Space nested closing parentheses like the opening ones - #876
  • Make SplitBraces reject malformed sequences and skip backslash escapes - #1330
  • Zsh: support the ${=name}, ${~name}, and ${^name} prefixes - #1238
  • Zsh: support the ;| case terminator and leading parentheses for globs - #1293, #1279
  • Zsh: parse subscript flag arguments as patterns, and allow [ globs in arrays - #1278, #1322
• syntax/typedjson
  • Encode operators as their syntax form, such as ">>", rather than integers - #1321
  • Return errors rather than panicking on malformed input
• interp
  • Add BashOpts to set Bash options like shopt - #962
  • Add AccessHandler to control file access checks, used by -r and cd - #1318
  • Add HandlerContext.LastExitStatus, and provide a HandlerContext to stat handlers
  • Implement the help and times builtins, as well as $- - #1398
  • Implement the ;& and ;;& case terminators - #1391
  • Implement the -N test operator, and make -nt and -ot follow POSIX - #1340
  • Support sparse indexed arrays such as a=([5]=x) - #1373
  • Run files as shell scripts when exec fails with ENOEXEC - #1065
  • Support empty here-documents, and don't expand quoted ones - #1390
  • Support js/wasm, where subprocesses and pipes are unavailable
  • Keep the redirections applied by exec with no arguments
  • Only fire the exit trap when the shell exits, rather than after every Run
• expand
  • Add BracesSeq with a config and error reporting, deprecating Braces
  • Add Variable.Indexes to describe sparse indexed arrays
  • Support integer bases in arithmetic - #339
  • Short-circuit the arithmetic && and || operators - #1371
  • Apply per-element operators to quoted array expansions like "${a[@]%o}" - #1081
  • Make unquoted ${!arr[@]} consistent with the quoted form - #672
  • Fix many divergences from Bash in arithmetic, string, and brace expansions
  • Reject unsupported Zsh syntax rather than panicking - #1363
• pattern
  • Treat an unmatched [ as a literal character, like Bash - #1372

... (truncated)

Commits

• 868c8e8 CHANGELOG: add entry for v3.14.0
• 0d67740 interp: define the shortPathName test stub just once
• 8976822 interp: fix getAtime on the BSDs, Solaris, and AIX
• 48af1f3 expand: detect reading a file as a directory via syscall.ENOTDIR
• cd3ef1f interp: retry executing a program on ETXTBSY
• 13c4e98 interp: add regression test for the exec ETXTBSY race
• a64648d README: replace gosh and fuzzing with a sponsorship summary
• 1599bef syntax: allow pound signs in associative array keys
• 971ffa8 syntax: add test cases for issue #1285
• 4da6033 interp: note that Params should be split in v4
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[atmos-pro]

Tip

Atmos Pro  

No affected stacks workflow was detected for this pull request.
If this is expected, no action is needed.
Learn More. Ask AI.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

• go.mod

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.29%. Comparing base (ccac49e) to head (3b704c9).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3147   +/-   ##
=======================================
  Coverage   84.29%   84.29%           
=======================================
  Files        2047     2047           
  Lines      202085   202085           
=======================================
  Hits       170357   170357           
- Misses      23522    23523    +1     
+ Partials     8206     8205    -1     

Flag	Coverage Δ
unittests	84.29% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 9 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

CI timing summary

Latest completed GitHub Actions runs for bc41377f4ce6.

• PR wall-clock time: 28m 41s
• Aggregate runner time: 8h 44m 26s
• Included: 14 workflows, 117 jobs (including matrix jobs)

Wall-clock time spans the earliest included workflow creation through the latest completion. Aggregate runner time adds each job's execution time, so concurrent jobs are counted separately.

Workflow	Elapsed	Runner time	Jobs
❌ Tests	28m 39s	8h 14m 44s	97
✅ CodeQL	7m 13s	16m 05s	6
✅ atmos.ci	3m 50s	3m 46s	1
✅ Dependency Review	3m 21s	3m 18s	1
✅ Pre-commit	2m 58s	2m 55s	1
✅ Release Documentation Check	1m 02s	56s	1
✅ TruffleHog secret scan	42s	38s	1
✅ vhs	28s	24s	3
✅ Verify Repository Symlinks	27s	23s	1
✅ Validate Codeowners	27s	23s	1
✅ Go Version Change Detection	25s	21s	1
✅ PR Size Labeler	24s	20s	1
✅ autofix.ci	16s	13s	1
⏭️ Feature release	9s	0s	1

Longest jobs (top 10)

Job	Workflow	Duration	Conclusion
[race] non-acceptance test suite (shard 4/4)	Tests	18m 51s	✅ success
Build (macos-intel)	Tests	14m 10s	✅ success
[floci] go e2e	Tests	14m 09s	✅ success
Acceptance Tests (macos, shard 3/10)	Tests	12m 58s	✅ success
Acceptance Tests (windows, shard 3/10)	Tests	12m 56s	✅ success
Acceptance Tests (macos, shard 1/10)	Tests	12m 24s	✅ success
Acceptance Tests (macos, shard 2/10)	Tests	12m 13s	✅ success
Acceptance Tests (windows, shard 1/10)	Tests	12m 04s	✅ success
Acceptance Tests (windows, shard 9/10)	Tests	11m 45s	✅ success
Acceptance Tests (windows, shard 2/10)	Tests	11m 44s	✅ success

Updated automatically when a PR workflow finishes.