build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.0 to 2.4.2

[dependabot]

Bumps github.com/pelletier/go-toml/v2 from 2.4.0 to 2.4.2.

Release notes

Sourced from github.com/pelletier/go-toml/v2's releases.

v2.4.2

What's Changed

Fixed bugs

• Fix decode of embedded structs tagged with options only (e.g. ,inline) by @​pelletier in pelletier/go-toml#1079

Full Changelog: pelletier/go-toml@v2.4.1...v2.4.2

v2.4.1

What's Changed

Fixed bugs

• Fix multiline string, array indentation, and omitempty behavior by @​pelletier in pelletier/go-toml#1076

Full Changelog: pelletier/go-toml@v2.4.0...v2.4.1

Commits

• 25fc130 Flatten embedded structs whose toml tag only sets options (#1079)
• 2586526 build(deps): bump actions/checkout from 6 to 7 (#1074)
• 4ef6436 Fix multiline string, array indentation, and omitempty behavior
• e3b2270 build(deps): bump docker/setup-buildx-action from 3 to 4 (#1073)
• abaa568 ci: fix release Docker attestations + enable manual tag re-release (#1071)
• See full diff in compare view

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 30, 2026, 7:44 PM ET / 23:44 UTC.

Summary
This PR bumps the direct production Go module github.com/pelletier/go-toml/v2 from v2.4.0 to v2.4.2 and updates the matching go.sum checksums.

Reproducibility: not applicable. this is a dependency maintenance PR rather than a reported runtime bug. The useful verification path is current-head CI plus config load/save coverage that exercises the TOML dependency.

Review metrics: 2 noteworthy metrics.

• Dependency diff size: 2 files changed, 3 additions, 3 deletions. The patch is limited to Go module metadata, so review can focus on dependency validation rather than application-code behavior.
• Current validation state: 10 successful checks, 2 skipped. The rebased head is mergeable and current CI/security validation is green in the latest status rollup.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Next step before merge

• No automated repair is needed; this is a clean maintainer-merge candidate after the successful rebase and checks.

Security
Cleared: The diff only updates an existing Go module version and checksums, with no new dependency source, workflow, script, credential, or permission changes.

Review details

Best possible solution:

Merge the narrow Dependabot bump now that the rebased head is clean and current-head validation is green.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a dependency maintenance PR rather than a reported runtime bug. The useful verification path is current-head CI plus config load/save coverage that exercises the TOML dependency.

Is this the best way to solve the issue?

Yes; updating go.mod and go.sum is the narrow maintainable way to take this semver-patch dependency bump. Current-head validation is green, so no alternate implementation path is needed.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 9343c18d6bb1.

Label changes

Label justifications:

• P3: This is a routine semver-patch dependency maintenance PR with no application-code diff and limited user-facing urgency.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot bot PRs are not subject to the external-contributor real behavior proof gate; status checks are the relevant proof surface here.

Evidence reviewed

What I checked:

• Current main still needs the bump: Current main at 9343c18 still requires github.com/pelletier/go-toml/v2 v2.4.0, so this PR is not already implemented. (go.mod:7, 9343c18d6bb1)
• PR diff is narrow module metadata: The PR patch changes only go.mod and go.sum, with 3 additions and 3 deletions, updating the module version and checksums to v2.4.2. (go.mod:7, 12b741e45ff4)
• Latest release has not shipped it: The latest release tag v0.3.1 still pins github.com/pelletier/go-toml/v2 v2.4.0, so the v2.4.2 bump remains unmerged/unreleased. (go.mod:7, 2cc577b8ebf4)
• TOML validation surface: The direct dependency is used by internal/config for toml.Unmarshal and toml.Marshal, so config load/save and CLI smoke coverage are the relevant behavior checks. (internal/config/config.go:126, 9343c18d6bb1)
• Current PR status is clean: The latest GitHub status poll reports head 12b741e as MERGEABLE/CLEAN with deps, lint, test, release-check, CodeQL, and secret-scan checks successful. (12b741e45ff4)
• Related same-repo search: Same-repository search found this open v2.4.2 bump plus older merged go-toml bumps, with no separate open canonical issue or replacement PR for the same remaining update.

Likely related people:

• vincentkoc: Merged the previous go-toml update in build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.0 #25 and authored/merged the recent CI smoke fix that affected earlier validation for this dependency PR. (role: merger and recent adjacent contributor; confidence: high; commits: 95d824c0282e, 9343c18d6bb1; files: go.mod, go.sum, .github/workflows/ci.yml)
• steipete: The checked-out blame attributes the current module baseline and TOML config load/save implementation to Peter Steinberger’s v0.3.1 release-prep commit, and steipete requested the Dependabot rebase on this PR. (role: release baseline contributor; confidence: medium; commits: 2cc577b8ebf4; files: go.mod, go.sum, internal/config/config.go)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

@dependabot rebase

[steipete]

@dependabot rebase