chore(deps): bump the minor-patch group across 1 directory with 6 updates

[dependabot]

Bumps the minor-patch group with 5 updates in the / directory:

Package	From	To
golang.org/x/crypto	0.50.0	0.52.0
k8s.io/apimachinery	0.36.0	0.36.1
k8s.io/client-go	0.36.0	0.36.1
modernc.org/sqlite	1.50.0	1.50.1
tailscale.com	1.96.5	1.98.3

Updates golang.org/x/crypto from 0.50.0 to 0.52.0

Commits

• a1c0d99 go.mod: update golang.org/x dependencies
• 3c7c869 ssh: fix deadlock on unexpected channel responses
• 533fb3f ssh: fix source-address critical option bypass
• abbc44d ssh: fix incorrect operator order
• e052873 ssh: fix infinite loop on large channel writes due to integer overflow
• b61cf85 ssh: enforce user presence verification for security keys
• 9c2cd33 ssh: enforce strict limits on DSA key parameters
• 8907318 ssh: reject RSA keys with excessively large moduli
• ffd87b4 ssh: fix panic when authority callbacks are nil
• 4e7a738 ssh: fix deadlock on unexpected global responses
• Additional commits viewable in compare view

Updates golang.org/x/tools from 0.43.0 to 0.44.0

Commits

• 3dd188d go.mod: update golang.org/x dependencies
• aebd870 gopls: improve doc link matching to support links followed by a colon
• 5357b43 go/analysis/passes/modernize: rangeint: handle type parameter constraints
• bf04c61 go/types/internal/play: show normal terms of selected type
• 0ae2de0 gopls/internal/filecache: cache decoded objects in memCache
• 8e51a5f go/ssa: support direct references to embedded fields in struct lit
• 5005b9e internal/gcimporter: rename ureader_yes.go to ureader.go
• 5ca865b go/types/objectpath: add debugging command
• f6476fb internal/gcimporter: consume generic methods in gcimporter
• b36d1d1 internal/pkgbits: sync version.go with goroot
• Additional commits viewable in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates modernc.org/sqlite from 1.50.0 to 1.50.1

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

• 2026-05-21 v1.51.2:

  • Add FileControl.FileControlDataVersion, a wrapper around SQLITE_FCNTL_DATA_VERSION for observing pager-cache data-version changes, including those made on the same connection. Useful as a primitive for application-level cache invalidation.
  • Exposed via the idiomatic database/sql escape hatch (*sql.Conn).Raw(), consistent with the existing FileControlPersistWAL.
  • See [GitLab merge request #115](https://gitlab.com/cznic/sqlite/-/merge_requests/115), thanks Ian Chechin!

• 2026-05-10 v1.50.1:

  • Upgrade to SQLite 3.53.1.

• 2026-04-24 v1.50.0:

  • Upgrade to sqlite-vec v0.1.9.
  • Introduce ColumnInfo, enabling dynamic query builders and ORMs to retrieve underlying SQLite C-API metadata (OriginName, TableName, DatabaseName, and DeclType).
  • This feature is exposed via the idiomatic database/sql escape hatch (*sql.Conn).Raw(), avoiding custom statement handles and keeping the standard library workflow intact.
  • See [GitLab merge request #113](https://gitlab.com/cznic/sqlite/-/merge_requests/113), thanks Josh Bleecher Snyder!

• 2026-04-17 v1.49.0: Upgrade to SQLite 3.53.0.

  • Added -DSQLITE_ENABLE_DBPAGE_VTAB to the transpilation. See "The SQLITE_DBPAGE Virtual Table" for details.

• 2026-04-06 v1.48.2:

  • Fix ABI mapping mismatch in the pre-update hook trampoline that caused silent truncation of large 64-bit RowIDs.
  • Ensure the Go trampoline signature correctly aligns with the public sqlite3_preupdate_hook C API, preventing data corruption for high-entropy keys (e.g., Snowflake IDs).
  • See [GitLab merge request #98](https://gitlab.com/cznic/sqlite/-/merge_requests/98), thanks Josh Bleecher Snyder!
  • Fix the memory allocator used in (*conn).Deserialize.
  • Replace tls.Alloc with sqlite3_malloc64 to prevent internal allocator corruption. This ensures the buffer is safely owned by SQLite, which may resize or free it due to the SQLITE_DESERIALIZE_RESIZEABLE and SQLITE_DESERIALIZE_FREEONCLOSE flags.
  • Prevent a memory leak by properly freeing the allocated buffer if fetching the main database name fails before handing ownership to SQLite.
  • See [GitLab merge request #100](https://gitlab.com/cznic/sqlite/-/merge_requests/100), thanks Josh Bleecher Snyder!
  • Fix (*conn).Deserialize to explicitly reject nil or empty byte slices.
  • Prevent silent database disconnection and connection pool corruption caused by SQLite's default behavior when sqlite3_deserialize receives a 0-length buffer.
  • See [GitLab merge request #101](https://gitlab.com/cznic/sqlite/-/merge_requests/101), thanks Josh Bleecher Snyder!
  • Fix commitHookTrampoline and rollbackHookTrampoline signatures by removing the unused pCsr parameter.
  • Aligns internal hook callbacks accurately with the underlying SQLite C API, cleaning up the code to prevent potential future confusion or bugs.
  • See [GitLab merge request #102](https://gitlab.com/cznic/sqlite/-/merge_requests/102), thanks Josh Bleecher Snyder!
  • Fix checkptr instrumentation failures during go test -race when registering and using virtual tables (vtab).
  • Allocate sqlite3_module instances using the C allocator (libc.Xcalloc) instead of the Go heap. This ensures transpiled C code can safely perform pointer operations on the struct without tripping Go's pointer checks.
  • See [GitLab merge request #103](https://gitlab.com/cznic/sqlite/-/merge_requests/103), thanks Josh Bleecher Snyder!
  • Fix data race on mutex.id in the mutexTry non-recursive path.
  • Ensure consistent atomic writes (atomic.StoreInt32) to prevent data races with atomic loads in mutexHeld and mutexNotheld during concurrent execution.
  • See [GitLab merge request #104](https://gitlab.com/cznic/sqlite/-/merge_requests/104), thanks Josh Bleecher Snyder!
  • Fix resource leak in (*Backup).Commit where the destination connection was not closed on error.
  • Ensure dstConn is properly closed when sqlite3_backup_finish fails, preventing file descriptor, TLS, and memory leaks.
  • See [GitLab merge request #105](https://gitlab.com/cznic/sqlite/-/merge_requests/105), thanks Josh Bleecher Snyder!
  • Fix Exec to fully drain rows when encountering SQLITE_ROW, preventing silent data loss in DML statements.
  • Previously, Exec aborted after the first row, meaning INSERT, UPDATE, or DELETE statements with a RETURNING clause would fail to process subsequent rows. The execution path now correctly loops until SQLITE_DONE and properly respects context cancellations during the drain loop, fully aligning with native C sqlite3_exec semantics.
  • See [GitLab merge request #106](https://gitlab.com/cznic/sqlite/-/merge_requests/106), thanks Josh Bleecher Snyder!
  • Fix "Shadowed err value (stmt.go)".
  • See [GitLab issue #249](https://gitlab.com/cznic/sqlite/-/work_items/249), thanks Emrecan BATI!
  • Fix silent omission of virtual table savepoint callbacks by correctly setting the sqlite3_module version.
  • See [GitLab merge request #107](https://gitlab.com/cznic/sqlite/-/merge_requests/107), thanks Josh Bleecher Snyder!
  • Fix vfsRead to properly handle partial and fragmented reads from io.Reader.

... (truncated)

Commits

• b95ed45 upgrade to SQLite 3.53.1
• See full diff in compare view

Updates tailscale.com from 1.96.5 to 1.98.3

Release notes

Sourced from tailscale.com's releases.

v1.98.3

Please refer to the changelog available at https://tailscale.com/changelog

v1.98.2

Please refer to the changelog available at https://tailscale.com/changelog

Commits

• 8f2c8d6 VERSION.txt: this is 1.98.3
• 666f0d2 wgengine/router/osrouter: skip netfilter add-ons when chain setup fails (#19761)
• 34c5306 VERSION.txt: this is 1.98.2 (#19751)
• b192880 cmd/cloner: preserve nil-valued entries when cloning map (#19749)
• f13500e go.toolchain.rev: bump to Go 1.26.3
• 87ab419 VERSION.txt: this is v1.98.1
• bdcb71a tsnet: make workload identity federation opt-in
• 06a48f5 tsnet: ban awsstore and kubestore as deps in TestDeps
• f2d5ef7 VERSION.txt: this is v1.98.0
• aa21b0c client/systray: fix recommended exit node not showing as selected (#19627)
• Additional commits viewable in compare view