chore(deps): bump the go-dependencies group with 2 updates

[dependabot]

Bumps the go-dependencies group with 2 updates: github.com/mattn/go-shellwords and google.golang.org/api.

Updates github.com/mattn/go-shellwords from 1.0.13 to 1.0.14

Commits

• 2b31b13 Merge pull request #72 from mattn/add-gitignore
• 925f016 Add .gitignore for .codex
• ad15017 Merge pull request #71 from mattn/refactor-buffers
• a3c716b Use byte buffers in Parse to reduce allocations
• a9af5c2 Merge pull request #70 from mattn/add-benchmarks
• 6eb4f8d Add benchmarks for Parse variants
• a51cda8 Merge pull request #69 from mattn/followups
• 2488652 Fix comment handling inside backticks and drop empty substitution words
• 5bec8b9 Merge pull request #55 from aTTiny73/feature/exclude-separator
• 4052da2 Merge remote-tracking branch 'origin/master' into pr55
• Additional commits viewable in compare view

Updates google.golang.org/api from 0.287.1 to 0.288.0

Release notes

Sourced from google.golang.org/api's releases.

v0.288.0

0.288.0 (2026-07-09)

Features

• all: Auto-regenerate discovery clients (#3647) (510a0c1)

Changelog

Sourced from google.golang.org/api's changelog.

0.288.0 (2026-07-09)

Features

• all: Auto-regenerate discovery clients (#3647) (510a0c1)

Commits

• 31d2afe chore(main): release 0.288.0 (#3648)
• 510a0c1 feat(all): auto-regenerate discovery clients (#3647)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

Claude finished @dependabot[bot]'s task in 49s —— View job

---

Dependency upgrade review

• Identify changed dependencies
• Assess go-shellwords 1.0.13 → 1.0.14
• Assess google.golang.org/api 0.287.1 → 0.288.0
• Check repo usage & flag risks

Verdict: ✅ Safe to merge. Both are non-breaking patch/minor bumps and the touched surface is tiny.

---

1. github.com/mattn/go-shellwords 1.0.13 → 1.0.14 (patch)

• Usage: single call site — shellwords.Parse(cmd) in cmd/kosli/testHelpers.go:58 (executeCommandC), test-only code. Not compiled into the shipped binary.
• Changes in v1.0.14: allocation refactor (byte buffers in Parse), comment-handling fix inside backticks, dropping empty substitution words, and an exclude-separator feature. No API signature changes (the /go.mod hash in go.sum is unchanged).
• Risk: negligible. The behavioral fixes affect backtick command-substitution and comment edge cases; test command strings here are plain CLI arg lists (kosli ... --flag value) with none of those constructs.

2. google.golang.org/api 0.287.1 → 0.288.0 (minor)

• Usage: only google.golang.org/api/iterator is imported, in internal/cloudrun/cloudrun.go:19 (used as iterator.Done at lines 354, 374). The Cloud Run clients themselves come from cloud.google.com/go/run/apiv2, a separate module that is unchanged here.
• Changes in v0.288.0: auto-regenerated discovery clients only. The stable iterator package is untouched; iterator.Done semantics are unchanged (module hash in go.sum is unchanged).
• Risk: negligible.

---

Suggested follow-up: none required. A green make build + the cloudrun and command test suites (which exercise executeCommandC) fully cover both change surfaces.