[dependabot]

Bumps github.com/plexusone/omnivault from 0.5.0 to 0.6.0.

Release notes

Sourced from github.com/plexusone/omnivault's releases.

v0.6.0

Release Notes: v0.6.0`

Full Changelog: plexusone/omnivault@v0.5.0...v0.6.0

Changelog

Sourced from github.com/plexusone/omnivault's changelog.

[v0.6.0] - 2026-10-25

Highlights

• Security release: secrets are redacted when formatted or logged, and the file provider keeps secret paths inside its directory and refuses secret files other users can read. Adds a SQL table-backed provider (sql://). Secret.String is removed in favour of Secret.Reveal

Breaking

• vault.Secret.String is removed. Formatting a Secret or *Secret with fmt (any verb) or logging it with log/slog now prints [REDACTED]; read the value with Secret.Reveal (or Secret.Bytes) (45cd023)
• File provider: a secret path that is empty, absolute or leaves the directory with .. fails with vault.ErrInvalidPath, and a symbolic link resolving outside the directory is refused (b8dcc6f)
• File provider: Get returns an error matching file.ErrInsecurePermissions for a secret file that group or others can access, unless Config.AllowInsecurePermissions is set (86e8974)
• The module now requires Go 1.26 (2c62f21)

Upgrade Guide

• Replace every secret.String() call with secret.Reveal(); the compiler finds these
• Search for code that obtains the value by formatting a secret, such as fmt.Sprintf("%s", secret) or fmt.Sprint(secret), and use secret.Reveal() instead; these still compile but now yield [REDACTED]
• File provider: make secret files private (chmod 600); for a mounted volume you cannot change, set defaultMode: 0600 or, if access is restricted another way, file.Config{AllowInsecurePermissions: true}
• File provider: use secret paths relative to Directory, without .. segments or absolute paths, and replace symbolic links that point outside the directory with the files themselves
• Build with Go 1.26 or later, then run go get github.com/plexusone/omnivault@v0.6.0 and go mod tidy

Security

• Secret.String returned the plaintext value, so passing a secret to fmt, wrapping it into an error with %v, or logging it with log/slog wrote the value into logs; formatting a Secret value (not a pointer) also printed its Value and Fields. GoString, Format and LogValue now produce [REDACTED] (vault.Redacted) for Secret and *Secret, for every fmt verb and for log/slog. JSON encoding is unchanged, since providers use it to store and transfer secrets (45cd023)
• The file provider joined the secret path onto its directory without checking the result, so a path such as ../other/secret read, wrote or deleted files outside the directory, and a symbolic link inside the directory could point anywhere. Secret paths must now be local, and files are opened through os.Root, which also refuses symbolic links that resolve outside the directory (b8dcc6f)
• The file provider wrote secret files with a private mode but read any file regardless of its mode, so a group- or world-readable secret was accepted silently. Get now checks the mode of the opened file; platforms that do not enforce file modes are unaffected (86e8974)

Added

• Secret.Reveal returns the primary value (ValueBytes as a string if set, otherwise Value), and vault.Redacted is the marker a secret prints as (45cd023)
• file.Config.AllowInsecurePermissions and file.ErrInsecurePermissions (86e8974)
• SQL table-backed provider (providers/sqlstore) storing AES-GCM encrypted secrets in an application-owned table, for MySQL-compatible databases (including Dolt), PostgreSQL and SQLite, with optional auto-migration and read-only mode (bbd1643)
• ProviderSQL and the SQLConfig alias, so sql:// URIs resolve through the same config-based provider dispatch as the other built-in providers (7d9e569)

Changed

• Bump github.com/grokify/oscompat from 0.3.0 to 0.9.0, which provides the private-permission check the file provider uses (571a8ac)
• Bump golang.org/x/crypto from 0.52.0 to 0.57.0 (65e0815)
• Bump golang.org/x/term from 0.43.0 to 0.46.0 (2c62f21)
• sqlstore: drop an unused placeholder index parameter (ea28ca4)

Documentation

• README documents the sql:// SQL store provider (a591464)
• Provider guide documents the file provider's path and permission rules and uses the Directory config field (86e8974)
• Client and quickstart guides read secrets with Reveal (45cd023)

Tests

• Tests for the SQL provider (5cf5d99)

... (truncated)

Commits

• 62229af test(integration): report the daemon's error when it stops
• c7c8b91 chore(deps): go mod: update dependencies
• 79cf9ef Merge pull request #24 from plexusone/dependabot/go_modules/golang.org/x/term...
• 1ee6afe chore(deps): bump golang.org/x/term from 0.46.0 to 0.47.0
• 1506bfe Merge pull request #26 from plexusone/fix/review-findings
• d156062 docs(release): add v0.6.0 release notes
• 0215fc8 docs(changelog): add v0.6.0 entry
• 45cd023 fix(vault)!: redact secrets when formatted or logged
• 86e8974 fix(file): refuse secret files that other users can read
• b8dcc6f fix(file): keep secret paths inside the vault directory
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 20b22d72-a505-4fb7-8131-9e3be92d01ee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}