build(deps): bump mvdan.cc/sh/v3 from 3.13.1 to 3.14.1

[dependabot]

Bumps mvdan.cc/sh/v3 from 3.13.1 to 3.14.1.

Release notes

Sourced from mvdan.cc/sh/v3's releases.

v3.14.1

• syntax
  • Fix the indentation of heredocs nested inside command substitutions - #1403
  • Keep literal tabs in <<- heredoc bodies rather than replacing them with spaces
  • Don't indent heredocs without dashes nested in <<- ones, whose output no longer parsed
  • Zsh: don't drop the prefix in short forms like $#"$foo" and $+"$foo" - #1405
• interp
  • Fix the build on 32-bit FreeBSD and NetBSD
• expand
  • Don't let escaped characters such as \* act as glob metacharacters
• pattern
  • Treat unclosed extended operator groups like @(a as literals, avoiding a panic

Consider becoming a sponsor if you benefit from the work that went into this release!

Binaries built on go version go1.27.1 linux/amd64 with:

CGO_ENABLED=0 go build -trimpath -ldflags="-w -s"

v3.14.0

This release drops support for Go 1.25 and includes many enhancements, particularly in the interpreter, which implements more shell features and fixes many divergences from Bash.

• cmd/shfmt
  • Add --detect to find shell files by executable bit or shebang - #944
• syntax
  • Add Preorder, an iterator over all nodes, complementing Walk
  • Add encoding.TextUnmarshaler implementations for each operator type
  • Support ${ foo;} and ${|foo;} inside double quotes - #1368
  • Support array elements in {varname} redirects, like exec {fds[3]}>&- - #719
  • Backslashes inside backquotes within double quotes escape double quotes - #1083
  • Allow pound signs in associative array keys like ${args[cmd,#]} - #1285
  • Don't treat # as the start of a comment inside [[ ]] tests - #1326
  • Don't join then or do with a semicolon when heredocs are pending - #1047
  • Print a space after ! in arithmetic expressions, avoiding history expansion - #987
  • Space nested closing parentheses like the opening ones - #876
  • Make SplitBraces reject malformed sequences and skip backslash escapes - #1330
  • Zsh: support the ${=name}, ${~name}, and ${^name} prefixes - #1238
  • Zsh: support the ;| case terminator and leading parentheses for globs - #1293, #1279
  • Zsh: parse subscript flag arguments as patterns, and allow [ globs in arrays - #1278, #1322
• syntax/typedjson
  • Encode operators as their syntax form, such as ">>", rather than integers - #1321
  • Return errors rather than panicking on malformed input
• interp
  • Add BashOpts to set Bash options like shopt - #962
  • Add AccessHandler to control file access checks, used by -r and cd - #1318
  • Add HandlerContext.LastExitStatus, and provide a HandlerContext to stat handlers
  • Implement the help and times builtins, as well as $- - #1398
  • Implement the ;& and ;;& case terminators - #1391
  • Implement the -N test operator, and make -nt and -ot follow POSIX - #1340
  • Support sparse indexed arrays such as a=([5]=x) - #1373

... (truncated)

Changelog

Sourced from mvdan.cc/sh/v3's changelog.

[3.14.1] - 2026-09-06

• syntax
  • Fix the indentation of heredocs nested inside command substitutions - #1403
  • Keep literal tabs in <<- heredoc bodies rather than replacing them with spaces
  • Don't indent heredocs without dashes nested in <<- ones, whose output no longer parsed
  • Zsh: don't drop the prefix in short forms like $#"$foo" and $+"$foo" - #1405
• interp
  • Fix the build on 32-bit FreeBSD and NetBSD
• expand
  • Don't let escaped characters such as \* act as glob metacharacters
• pattern
  • Treat unclosed extended operator groups like @(a as literals, avoiding a panic

[3.14.0] - 2026-08-28

This release drops support for Go 1.25 and includes many enhancements, particularly in the interpreter, which implements more shell features and fixes many divergences from Bash.

• cmd/shfmt
  • Add --detect to find shell files by executable bit or shebang - #944
• syntax
  • Add Preorder, an iterator over all nodes, complementing Walk
  • Add encoding.TextUnmarshaler implementations for each operator type
  • Support ${ foo;} and ${|foo;} inside double quotes - #1368
  • Support array elements in {varname} redirects, like exec {fds[3]}>&- - #719
  • Backslashes inside backquotes within double quotes escape double quotes - #1083
  • Allow pound signs in associative array keys like ${args[cmd,#]} - #1285
  • Don't treat # as the start of a comment inside [[ ]] tests - #1326
  • Don't join then or do with a semicolon when heredocs are pending - #1047
  • Print a space after ! in arithmetic expressions, avoiding history expansion - #987
  • Space nested closing parentheses like the opening ones - #876
  • Make SplitBraces reject malformed sequences and skip backslash escapes - #1330
  • Zsh: support the ${=name}, ${~name}, and ${^name} prefixes - #1238
  • Zsh: support the ;| case terminator and leading parentheses for globs - #1293, #1279
  • Zsh: parse subscript flag arguments as patterns, and allow [ globs in arrays - #1278, #1322
• syntax/typedjson
  • Encode operators as their syntax form, such as ">>", rather than integers - #1321
  • Return errors rather than panicking on malformed input
• interp
  • Add BashOpts to set Bash options like shopt - #962
  • Add AccessHandler to control file access checks, used by -r and cd - #1318
  • Add HandlerContext.LastExitStatus, and provide a HandlerContext to stat handlers
  • Implement the help and times builtins, as well as $- - #1398
  • Implement the ;& and ;;& case terminators - #1391
  • Implement the -N test operator, and make -nt and -ot follow POSIX - #1340
  • Support sparse indexed arrays such as a=([5]=x) - #1373
  • Run files as shell scripts when exec fails with ENOEXEC - #1065
  • Support empty here-documents, and don't expand quoted ones - #1390

... (truncated)

Commits

• a3f0c75 CHANGELOG: add entry for v3.14.1
• 29855f3 interp: stop confirming a huge brace sequence against bash
• 39a9394 expand: keep escaped characters from acting as glob metacharacters
• a89e798 expand: add test cases for globbing with escaped metacharacters
• 755b3e5 pattern: treat unclosed extended operator groups as literals
• 63af908 fix: gitAtime build fail on 32-bit FreeBSD and NetBSD
• 671a5e2 syntax: count columns for bytes written via colCounter.Write
• 7c82969 syntax: don't indent heredocs without dashes nested in <<- ones
• 075feed syntax: keep literal tabs in <<- heredoc bodies intact
• 466c5e8 syntax: add test cases for literal tabs in <<- heredoc bodies
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)