chore(deps): Update dependency mvdan/sh to v3.13.1

[renovate]

This PR contains the following updates:

Package	Update	Change
mvdan/sh	minor	3.11.0 → 3.13.1

---

Release Notes

mvdan/sh (mvdan/sh)

v3.13.1

Compare Source

Initial release.

v3.13.0

Compare Source

This release introduces support for Zsh in the parser and formatter, which was tracked in issue #​120 alongside the label https://github.com/mvdan/sh/labels/zsh. While support is not complete, it should be far enough for many use cases.

This release also drops support for Go 1.24 and includes many other enhancements:

• cmd/shfmt
  • Exit with a non-zero status when -l prints any filenames
  • shfmt -version is now derived from the git current tag, dropping the -ldflags workaround
• syntax
  • New nodes types and node fields are introduced alongside LangZsh
  • LangVariant is now a bitset, allowing the use of sets like "Bash-like"
  • Add InteractiveSeq and StmtsSeq iterator methods for Parser
  • Stop exposing the internal buffer in Printer via struct embedding
  • Support the use of brace expansions like declare {a,b}_c=value
  • Fix a bug where POSIX and Bash incorrectly allowed empty command lists
• interp
  • Add support for shopt -s dotglob and shopt -s extglob
  • Add support for simple uses of !(expr) extended glob patterns
  • Support more builtin flags for declare, type, read
  • Fix various bugs relating to nulls, errors, and arrays
• expand
  • Add Config.DotGlob and Config.ExtGlob for the interpreter
  • Add Variable.Flags to get the one-character declare flags
  • Do not force env vars on Windows to be uppercase
  • Fix various bugs relating to glob pattern matching
• pattern
  • Add GlobLeadingDot and ExtendedOperators for the interpreter
  • Add NegExtGlobError to mark the use of !(expr) negation patterns

Consider becoming a sponsor if you benefit from the work that went into this release!

Binaries built on go version go1.26.1 linux/amd64 with:

CGO_ENABLED=0 go build -trimpath -ldflags="-w -s"

Note that this release no longer includes a sha256sums.txt asset; GitHub now provide digests natively.

v3.12.0

Compare Source

• The mvdan-sh JS package is discontinued in favor of sh-syntax - #​1145
• cmd/shfmt
  • Support the "simplify" and "minify" flags via EditorConfig - #​819
  • --simplify and --minify are now formatting options, disabling the use of EditorConfig
  • Do not allow --write to replace non-regular files - #​843
• interp
  • Add IsBuiltin to check if a command name is a shell built-in - #​1164
  • Add HandlerContext.Builtin to allow ExecHandlerFunc to call built-ins
  • Initial support for $! and wait PID - #​221
  • Return non-fatal ExecHandlerFunc errors via the Runner.Run API
  • Add HandlerContext.Pos to provide handlers with source positions
  • Deprecate NewExitStatus and IsExitStatus in favor of ExitStatus
  • Fix wait to always return the status of the last given job
  • Copy all env vars for background subshells to avoid data races
  • Support reading random numbers via $RANDOM and $SRANDOM
  • Set $BASH_REMATCH when matching regular expressions via =~
  • Support modifying local vars from the parent calling function
• expand
  • Adjust which backslash sequences are expanded in here-docs - #​1138
  • Tweak tilde expansions to match Bash semantics
• pattern
  • Remove the flawed and broken Braces mode; use syntax.SplitBraces instead
  • Tweak ** to only act as "globstar" when alone as a path element - #​1149
  • Tweak * and ** to not match leading dots in basenames
  • Add a NoGlobStar mode to match the POSIX semantics
• fileutil
  • Treat all non-regular files as definitely not shell scripts - #​1089

Consider becoming a sponsor if you benefit from the work that went into this release!

Binaries built on go version go1.24.4 linux/amd64 with:

CGO_ENABLED=0 go build -trimpath -ldflags="-w -s -X=main.version=v3.12.0"

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.