refactor(compiler): remove unnecessary closure comments

- Fix import order in setup.go (gci)
- Fix variable alignment in experiments.go (gofmt)
- Add nolint:paralleltest directive for TestScopedTaskfiles

.gitattributes

@@ -1,5 +1,2 @@
 * text=auto
 *.mdx -linguist-detectable
-
-# Keep LF line endings in testdata for consistent checksums across platforms
-testdata/** text eol=lf

.github/pull_request_template.md

@@ -7,5 +7,3 @@ Please understand that it may take some time to be reviewed.
 Also, make sure to follow the [Contribution Guide](https://taskfile.dev/contributing/).
 
 -->
-
-- [ ] I have read and followed the [Contribution Guide](https://taskfile.dev/contributing/)

.github/workflows/issue-awaiting-response.yml

@@ -4,16 +4,13 @@ on:
   issue_comment:
     types: [created]
 
-permissions:
-  issues: write
-
 jobs:
   issue-awaiting-response:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v8
         with:
-          github-token: ${{secrets.GITHUB_TOKEN}}
+          github-token: ${{secrets.GH_PAT}}
           script: |
             const issue = await github.rest.issues.get({
               owner: context.repo.owner,

.github/workflows/issue-closed.yml

@@ -4,16 +4,13 @@ on:
   issues:
     types: [closed]
 
-permissions:
-  issues: write
-
 jobs:
   issue-closed:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v8
         with:
-          github-token: ${{secrets.GITHUB_TOKEN}}
+          github-token: ${{secrets.GH_PAT}}
           script: |
             const labels = await github.paginate(
               github.rest.issues.listLabelsOnIssue, {

.github/workflows/issue-experiment.yml

@@ -2,19 +2,16 @@ name: issue experiment
 
 on:
   issues:
-    types: [field_added]
+    types: [labeled]
-
-permissions:
-  issues: write
 
 jobs:
-  issue-experiment-proposal:
+  issue-experiment-proposed:
-    if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'proposal'
+    if: github.event.label.name == format('status{0} proposed', ':')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v8
         with:
-          github-token: ${{secrets.GITHUB_TOKEN}}
+          github-token: ${{secrets.GH_PAT}}
           script: |
             github.rest.issues.createComment({
               issue_number: context.issue.number,
@@ -23,12 +20,12 @@ jobs:
               body: 'This issue has been marked as an experiment proposal! :test_tube: It will now enter a period of consultation during which we encourage the community to provide feedback on the proposed design. Please see the [experiment workflow documentation](https://taskfile.dev/experiments#workflow) for more information on how we release experiments.'
             })
   issue-experiment-draft:
-    if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'draft'
+    if: github.event.label.name == format('status{0} draft', ':')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v8
         with:
-          github-token: ${{secrets.GITHUB_TOKEN}}
+          github-token: ${{secrets.GH_PAT}}
           script: |
             github.rest.issues.createComment({
               issue_number: context.issue.number,
@@ -37,12 +34,12 @@ jobs:
               body: 'This experiment has been marked as a draft! :sparkles: This means that an initial implementation has been added to the latest release of Task! You can find information about this experiment and how to enable it in our [experiments documentation](https://taskfile.dev/experiments). Please see the [experiment workflow documentation](https://taskfile.dev/experiments#workflow) for more information on how we release experiments.'
             })
   issue-experiment-candidate:
-    if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'candidate'
+    if: github.event.label.name == format('status{0} candidate', ':')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v8
         with:
-          github-token: ${{secrets.GITHUB_TOKEN}}
+          github-token: ${{secrets.GH_PAT}}
           script: |
             github.rest.issues.createComment({
               issue_number: context.issue.number,
@@ -51,12 +48,12 @@ jobs:
               body: 'This experiment has been marked as a candidate! :fire: This means that the  implementation is nearing completion and we are entering a period for final comments and feedback! You can find information about this experiment and how to enable it in our [experiments documentation](https://taskfile.dev/experiments). Please see the [experiment workflow documentation](https://taskfile.dev/experiments#workflow) for more information on how we release experiments.'
             })
   issue-experiment-stable:
-    if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'stable'
+    if: github.event.label.name == format('status{0} stable', ':')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v8
         with:
-          github-token: ${{secrets.GITHUB_TOKEN}}
+          github-token: ${{secrets.GH_PAT}}
           script: |
             github.rest.issues.createComment({
               issue_number: context.issue.number,
@@ -65,12 +62,12 @@ jobs:
               body: 'This experiment has been marked as stable! :metal: This means that the  implementation is now final and ready to be released. No more changes will be made and the experiment is safe to use in production! You can find information about this experiment and how to enable it in our [experiments documentation](https://taskfile.dev/experiments). Please see the [experiment workflow documentation](https://taskfile.dev/experiments#workflow) for more information on how we release experiments.'
             })
   issue-experiment-released:
-    if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'released'
+    if: github.event.label.name == format('status{0} released', ':')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v8
         with:
-          github-token: ${{secrets.GITHUB_TOKEN}}
+          github-token: ${{secrets.GH_PAT}}
           script: |
             github.rest.issues.createComment({
               issue_number: context.issue.number,
@@ -85,12 +82,12 @@ jobs:
               state: 'closed'
             })
   issue-experiment-abandoned:
-    if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'abandoned'
+    if: github.event.label.name == format('status{0} abandoned', ':')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v8
         with:
-          github-token: ${{secrets.GITHUB_TOKEN}}
+          github-token: ${{secrets.GH_PAT}}
           script: |
             github.rest.issues.createComment({
               issue_number: context.issue.number,
@@ -105,12 +102,12 @@ jobs:
               state: 'closed'
             })
   issue-experiment-superseded:
-    if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'superseded'
+    if: github.event.label.name == format('status{0} superseded', ':')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v8
         with:
-          github-token: ${{secrets.GITHUB_TOKEN}}
+          github-token: ${{secrets.GH_PAT}}
           script: |
             github.rest.issues.createComment({
               issue_number: context.issue.number,

.github/workflows/issue-needs-triage.yml

@@ -4,16 +4,13 @@ on:
   issues:
     types: [opened]
 
-permissions:
-  issues: write
-
 jobs:
   issue-needs-triage:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v8
         with:
-          github-token: ${{secrets.GITHUB_TOKEN}}
+          github-token: ${{secrets.GH_PAT}}
           script: |
             const labels = await github.paginate(
               github.rest.issues.listLabelsOnIssue, {

.github/workflows/lint.yml

@@ -8,36 +8,33 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
-
 jobs:
   lint:
     name: Lint
     strategy:
       matrix:
-        go-version: [1.25.x, 1.26.x]
+        go-version: [1.24.x, 1.25.x]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: actions/setup-go@v6
         with:
           go-version: ${{matrix.go-version}}
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.11.4
+          version: v2.8.0
 
   lint-jsonschema:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@v6
         with:
           python-version: 3.14
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6
 
       - name: install check-jsonschema
         run: python -m pip install 'check-jsonschema==0.27.3'

.github/workflows/pr-build.yml

@@ -13,51 +13,51 @@ jobs:
     if: contains(github.event.pull_request.labels.*.name, 'needs-build')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: actions/setup-go@v5
         with:
-          go-version: "1.26.x"
+          go-version: '1.25.x'
           cache: true
-      - uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7
+      - uses: goreleaser/goreleaser-action@v6
         with:
-          version: "~> v2"
+          version: '~> v2'
           args: release --snapshot --clean --config .goreleaser-pr.yml
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@v4
         with:
           name: task_linux_amd64
           path: dist/task_linux_amd64.tar.gz
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@v4
         with:
           name: task_linux_arm64
           path: dist/task_linux_arm64.tar.gz
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@v4
         with:
           name: task_darwin_amd64
           path: dist/task_darwin_amd64.tar.gz
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@v4
         with:
           name: task_darwin_arm64
           path: dist/task_darwin_arm64.tar.gz
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@v4
         with:
           name: task_windows_amd64
           path: dist/task_windows_amd64.zip
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@v4
         with:
           name: checksums
           path: dist/task_checksums.txt
-      - uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
+      - uses: peter-evans/find-comment@v3
         id: find-comment
         with:
-          token: ${{secrets.GITHUB_TOKEN}}
+          token: ${{ secrets.GH_PAT || github.token }}
           issue-number: ${{ github.event.pull_request.number }}
-          body-includes: "📦 Build artifacts ready!"
+          body-includes: '📦 Build artifacts ready!'
-      - uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
+      - uses: peter-evans/create-or-update-comment@v4
         with:
-          token: ${{secrets.GITHUB_TOKEN}}
+          token: ${{ secrets.GH_PAT || github.token }}
           comment-id: ${{ steps.find-comment.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}
           body: |

.github/workflows/release-nightly.yml

@@ -4,31 +4,27 @@ on:
   workflow_dispatch:
   schedule:
     - cron: 0 0 * * *
-
-permissions:
-  contents: write
-
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@v6
         with:
-          go-version: 1.26.x
+          go-version: 1.25.x
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7
+        uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser-pro
           version: latest
           args: release --clean --nightly -f .goreleaser-nightly.yml
         env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          GITHUB_TOKEN: ${{secrets.GH_PAT}}
           GORELEASER_KEY: ${{secrets.GORELEASER_KEY}}
           CLOUDSMITH_TOKEN: ${{secrets.CLOUDSMITH_TOKEN}}

.github/workflows/release.yml

@@ -3,51 +3,51 @@ name: goreleaser
 on:
   push:
     tags:
-      - "v*"
+      - 'v*'
 
 permissions:
-  id-token: write # Required for OIDC
+  id-token: write  # Required for OIDC
-  contents: write
+  contents: read
 
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@v6
         with:
-          go-version: 1.26.x
+          go-version: 1.25.x
 
-      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      - uses: actions/setup-node@v6
         with:
-          node-version: "24"
+          node-version: '24'
-          registry-url: "https://registry.npmjs.org"
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Update npm
         run: npm install -g npm@latest
 
       - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2
+        uses: go-task/setup-task@v1
 
       - name: Install pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+        uses: pnpm/action-setup@v4
         with:
-          package_json_file: "website/package.json"
+          package_json_file: 'website/package.json'
-          run_install: "true"
+          run_install: 'true'
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7
+        uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser-pro
           version: latest
           args: release --clean --draft
         env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          GITHUB_TOKEN: ${{secrets.GH_PAT}}
           GORELEASER_KEY: ${{secrets.GORELEASER_KEY}}
           CLOUDSMITH_TOKEN: ${{secrets.CLOUDSMITH_TOKEN}}
 
@@ -55,5 +55,3 @@ jobs:
         shell: bash
         run: |
           task website:deploy:prod
-        env:
-          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}

.github/workflows/security.yml

@@ -1,19 +0,0 @@
-name: Security
-
-on:
-  pull_request:
-  push:
-    tags:
-      - v*
-    branches:
-      - main
-
-permissions:
-  contents: read
-
-jobs:
-  govulncheck:
-    name: govulncheck
-    runs-on: ubuntu-latest
-    steps:
-      - uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4

.github/workflows/test.yml

@@ -8,26 +8,31 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
-
 jobs:
   test:
     name: Test
     strategy:
-      fail-fast: false
       matrix:
-        go-version: [1.25.x, 1.26.x]
+        go-version: [1.24.x, 1.25.x]
         platform: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{matrix.platform}}
     steps:
-      - name: Check out code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
       - name: Set up Go ${{matrix.go-version}}
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{matrix.go-version}}
+        id: go
+
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v6
+
+      - name: Download Go modules
+        run: go mod download
+        env:
+          GOPROXY: https://proxy.golang.org
+
+      - name: Build
+        run: go build -o ./bin/task -v ./cmd/task
 
       - name: Test
-        run: go run ./cmd/task test
+        run: ./bin/task test --output=group --output-group-begin='::group::{{.TASK}}' --output-group-end='::endgroup::'

.golangci.yml

@@ -33,7 +33,6 @@ formatters:
 linters:
   enable:
     - depguard
-    - gosec
     - mirror
     - misspell
     - noctx
@@ -42,9 +41,6 @@ linters:
     - tparallel
     - usetesting
   settings:
-    gosec:
-      excludes:
-        - G306
     depguard:
       rules:
         main:

.goreleaser.yml

@@ -22,8 +22,6 @@ builds:
         goarch: '386'
       - goos: darwin
         goarch: riscv64
-      - goos: windows
-        goarch: arm
       - goos: windows
         goarch: riscv64
     env:
@@ -62,7 +60,7 @@ nfpms:
   - vendor: Task
     homepage: https://taskfile.dev
     maintainer: The Task authors <task@taskfile.dev>
-    description: A fast, cross-platform build tool inspired by Make, designed for modern workflows.
+    description: Simple task runner written in Go
     section: golang
     license: MIT
     conflicts:
@@ -82,14 +80,13 @@ nfpms:
 
 brews:
   - name: go-task
-    description: A fast, cross-platform build tool inspired by Make, designed for modern workflows.
+    description: Task runner / simpler Make alternative written in Go
     license: MIT
     homepage: https://taskfile.dev
     directory: Formula
     repository:
       owner: go-task
       name: homebrew-tap
-      token: "{{secrets.GH_GORELEASER_TOKEN}}" # So that it runs as the task-bot user
     test: system "#{bin}/task", "--help"
     install: |-
       bin.install "task"
@@ -103,8 +100,8 @@ brews:
 winget:
   - name: Task
     publisher: Task
-    short_description: The modern task runner.
+    short_description: A task runner / simpler Make alternative written in Go
-    description: A fast, cross-platform build tool inspired by Make, designed for modern workflows.
+    description: Task is a task runner / build tool that aims to be simpler and easier to use than, for example, GNU Make.
     license: MIT
     homepage: https://taskfile.dev/
     publisher_url: https://taskfile.dev/
@@ -131,7 +128,6 @@ winget:
       owner: go-task
       name: winget-pkgs
       branch: 'task-{{.Version}}'
-      token: "{{secrets.GH_GORELEASER_TOKEN}}" # So that it runs as the task-bot user
       pull_request:
         enabled: true
         draft: false
@@ -143,11 +139,12 @@ winget:
         body: |
           /cc @andreynering @pd93 @vmaerten
 
+
 npms:
   - name: "@go-task/cli"
     repository: "git+https://github.com/go-task/task.git"
     bugs: https://github.com/go-task/task/issues
-    description: A fast, cross-platform build tool inspired by Make, designed for modern workflows.
+    description: A task runner / simpler Make alternative written in Go
     homepage: https://taskfile.dev
     license: MIT
     author: "The Task authors"
@@ -158,6 +155,7 @@ npms:
       - "build-tool"
       - "task-runner"
 
+
 cloudsmiths:
   - organization: "task"
     repository: "{{if not .IsNightly}}task{{end}}"

CHANGELOG.md

@@ -1,45 +1,7 @@
 # Changelog
 
-## v3.50.0 - 2026-04-13
+## Unreleased
 
-- Added `enum.ref` support in `requires`: enum constraints can now reference
-  variables or template pipelines (e.g., `ref: .ALLOWED_ENVS`) instead of
-  duplicating static lists. Combined with `sh:` variables, this enables fully
-  dynamic enum validation (#2678 by @vmaerten).
-- Fixed Fish completion using hardcoded `task` binary name instead of
-  `$GO_TASK_PROGNAME` for experiments cache (#2730, #2727 by @SergioChan).
-- Fixed watch mode ignoring SIGHUP signal, causing the watcher to exit instead
-  of restarting (#2764, #2642).
-- Fixed a long time bug where the task wouldn't re-run as it should when using
-  `method: timestamp` and the files listed on `generates:` were deleted.
-  This makes `method: timestamp` behaves the same as `method: checksum`
-  (#1230, #2716 by @drichardson).
-
-## v3.49.1 - 2026-03-08
-
-* Reverted #2632 for now, which caused some regressions. That change will be
-  reworked (#2720, #2722, #2723).
-
-## v3.49.0 - 2026-03-07
-
-- Fixed included Taskfiles with `watch: true` not triggering watch mode when
-  called from the root Taskfile (#2686, #1763 by @trulede).
-- Fixed Remote Git Taskfiles failing on Windows due to backslashes in URL paths
-  (#2656 by @Trim21).
-- Fixed remote Git Taskfiles timing out when resolving includes after accepting
-  the trust prompt (#2669, #2668 by @vmaerten).
-- Fixed unclear error message when Taskfile search stops at a directory
-  ownership boundary (#2682, #1683 by @trulede).
-- Fixed global variables from imported Taskfiles not resolving `ref:` values
-  correctly (#2632 by @trulede).
-- Every `.taskrc.yml` option can now be overridden with a `TASK_`-prefixed
-  environment variable, making CI and container configuration easier (#2607,
-  #1066 by @vmaerten).
-
-## v3.48.0 - 2026-01-26
-
-- Fixed `if:` conditions when using to check dynamic variables. Also, skip
-  variable prompt if task would be skipped by `if:` (#2658, #2660 by @vmaerten).
 - Fixed `ROOT_TASKFILE` variable pointing to directory instead of the actual
   Taskfile path when no explicit `-t` flag is provided (#2635, #1706 by
   @trulede).

README.md

@@ -3,14 +3,14 @@
     <img src="website/src/public/img/logo.svg" width="200px" height="200px" />
   </a>
 
-  <h1>Task: The Modern Task Runner</h1>
+  <h1>Task</h1>
 
   <p>
-    A fast, cross-platform build tool inspired by Make, designed for modern workflows.
+    Task is a task runner / build tool that aims to be simpler and easier to use than, for example, <a href="https://www.gnu.org/software/make/">GNU Make<a>.
   </p>
 
   <p>
-    <a href="https://taskfile.dev/docs/installation">Installation</a> &bullet; <a href="https://taskfile.dev/docs/getting-started">Getting Started</a> &bullet; <a href="https://taskfile.dev/docs/guide">Docs</a> &bullet; <a href="https://twitter.com/taskfiledev">Twitter</a> &bullet; <a href="https://bsky.app/profile/taskfile.dev">Bluesky</a> &bullet; <a href="https://fosstodon.org/@task">Mastodon</a> &bullet; <a href="https://discord.gg/6TY36E39UK">Discord</a>
+    <a href="https://taskfile.dev/docs/installation">Installation</a> | <a href="https://taskfile.dev/docs/getting-started">Getting Started</a> | <a href="https://taskfile.dev/docs/guide">Docs</a> | <a href="https://twitter.com/taskfiledev">Twitter</a> | <a href="https://bsky.app/profile/taskfile.dev">Bluesky</a> | <a href="https://fosstodon.org/@task">Mastodon</a> | <a href="https://discord.gg/6TY36E39UK">Discord</a>
   </p>
 
   <h1>Gold Sponsors</h1>
@@ -22,11 +22,6 @@
           <img src="website/src/public/img/devowl.io.svg" height="100px" width="200px" title="devowl.io" />
         </a>
       </td>
-      <td align="center" valign="middle">
-        <a target="_blank" href="https://goodx.international/">
-          <img src="website/src/public/img/goodx.svg" height="80px" width="200px" title="GoodX" />
-        </a>
-      </td>
       <td align="center" valign="middle">
         <a target="_blank" href="https://magic.dev/">
           <img src="website/src/public/img/magic.png" height="100px" width="200px" title="Magic" />
@@ -34,16 +29,4 @@
       </td>
     </tr>
   </table>
-
-  <h2>Community Sponsors</h2>
-
-  <table>
-    <tr>
-      <td align="center" valign="middle">
-        <a target="_blank" href="https://cloudsmith.com/">
-          <img src="website/src/public/img/cloudsmith.svg" height="100px" width="200px" title="Cloudsmith" />
-        </a>
-      </td>
-    </tr>
-  </table>
 </div>

cmd/release/main.go

@@ -117,7 +117,7 @@ func changelog(version *semver.Version) error {
 	changelog = changelogReleaseRegex.ReplaceAllString(changelog, fmt.Sprintf("## v%s - %s", version, date))
 
 	// Write the changelog to the source file
-	if err := os.WriteFile(changelogSource, []byte(changelog), 0o644); err != nil { //nolint:gosec
+	if err := os.WriteFile(changelogSource, []byte(changelog), 0o644); err != nil {
 		return err
 	}
 
@@ -129,7 +129,7 @@ func changelog(version *semver.Version) error {
 	changelogWithFrontmatter := fmt.Sprintf("---\n%s\n---\n\n%s", frontmatter, changelogWithVPre)
 
 	// Write the changelog to the target file
-	return os.WriteFile(changelogTarget, []byte(changelogWithFrontmatter), 0o644) //nolint:gosec
+	return os.WriteFile(changelogTarget, []byte(changelogWithFrontmatter), 0o644)
 }
 
 func setVersionFile(fileName string, version *semver.Version) error {

cmd/task/task.go

@@ -174,6 +174,8 @@ func run() error {
 
 	// Merge CLI variables first (e.g. FOO=bar) so they take priority over Taskfile defaults
 	e.Taskfile.Vars.Merge(globals, nil)
+	// Store CLI vars for scoped mode where they need highest priority
+	e.Compiler.CLIVars = globals
 
 	// Then ReverseMerge special variables so they're available for templating
 	cliArgsPostDashQuoted, err := args.ToQuotedString(cliArgsPostDash)

compiler.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/go-task/task/v3/experiments"
 	"github.com/go-task/task/v3/internal/env"
 	"github.com/go-task/task/v3/internal/execext"
 	"github.com/go-task/task/v3/internal/filepathext"
@@ -25,6 +26,8 @@ type Compiler struct {
 
 	TaskfileEnv  *ast.Vars
 	TaskfileVars *ast.Vars
+	CLIVars      *ast.Vars // CLI vars passed via command line (e.g., task foo VAR=value)
+	Graph        *ast.TaskfileGraph
 
 	Logger *logger.Logger
 
@@ -44,48 +47,268 @@ func (c *Compiler) FastGetVariables(t *ast.Task, call *Call) (*ast.Vars, error)
 	return c.getVariables(t, call, false)
 }
 
+// isScopedMode returns true if scoped variable resolution should be used.
+// Scoped mode requires the experiment to be enabled, a task with location info, and a graph.
+func (c *Compiler) isScopedMode(t *ast.Task) bool {
+	return experiments.ScopedTaskfiles.Enabled() &&
+		t != nil &&
+		t.Location != nil &&
+		c.Graph != nil
+}
+
 func (c *Compiler) getVariables(t *ast.Task, call *Call, evaluateShVars bool) (*ast.Vars, error) {
-	result := env.GetEnviron()
+	if c.isScopedMode(t) {
+		return c.getScopedVariables(t, call, evaluateShVars)
+	}
+	return c.getLegacyVariables(t, call, evaluateShVars)
+}
+
+// getScopedVariables resolves variables in scoped mode.
+// In scoped mode:
+// - OS env vars are in {{.env.XXX}} namespace, not at root
+// - Variables from sibling includes are isolated
+//
+// Variable resolution order (lowest to highest priority):
+// 1. Root Taskfile vars
+// 2. Include Taskfile vars
+// 3. Include passthrough vars (includes: name: vars:)
+// 4. Task vars
+// 5. Call vars
+// 6. CLI vars
+func (c *Compiler) getScopedVariables(t *ast.Task, call *Call, evaluateShVars bool) (*ast.Vars, error) {
+	result := ast.NewVars()
+
 	specialVars, err := c.getSpecialVars(t, call)
 	if err != nil {
 		return nil, err
 	}
 	for k, v := range specialVars {
-		result.Set(k, ast.Var{Value: v, Secret: false})
+		result.Set(k, ast.Var{Value: v})
 	}
 
 	getRangeFunc := func(dir string) func(k string, v ast.Var) error {
 		return func(k string, v ast.Var) error {
 			cache := &templater.Cache{Vars: result}
-			// Replace values
 			newVar := templater.ReplaceVar(v, cache)
-			// If the variable should not be evaluated, but is nil, set it to an empty string
-			// This stops empty interface errors when using the templater to replace values later
-			// Preserve the Sh field so it can be displayed in summary
 			if !evaluateShVars && newVar.Value == nil {
-				result.Set(k, ast.Var{Value: "", Sh: newVar.Sh, Secret: v.Secret})
+				result.Set(k, ast.Var{Value: "", Sh: newVar.Sh})
 				return nil
 			}
-			// If the variable should not be evaluated and it is set, we can set it and return
 			if !evaluateShVars {
-				result.Set(k, ast.Var{Value: newVar.Value, Sh: newVar.Sh, Secret: v.Secret})
+				result.Set(k, ast.Var{Value: newVar.Value, Sh: newVar.Sh})
 				return nil
 			}
-			// Now we can check for errors since we've handled all the cases when we don't want to evaluate
 			if err := cache.Err(); err != nil {
 				return err
 			}
-			// If the variable is already set, we can set it and return
 			if newVar.Value != nil || newVar.Sh == nil {
-				result.Set(k, ast.Var{Value: newVar.Value, Secret: v.Secret})
+				result.Set(k, ast.Var{Value: newVar.Value})
 				return nil
 			}
-			// If the variable is dynamic, we need to resolve it first
 			static, err := c.HandleDynamicVar(newVar, dir, env.GetFromVars(result))
 			if err != nil {
 				return err
 			}
-			result.Set(k, ast.Var{Value: static, Secret: v.Secret})
+			result.Set(k, ast.Var{Value: static})
+			return nil
+		}
+	}
+	rangeFunc := getRangeFunc(c.Dir)
+
+	var taskRangeFunc func(k string, v ast.Var) error
+	if t != nil {
+		cache := &templater.Cache{Vars: result}
+		dir := templater.Replace(t.Dir, cache)
+		if err := cache.Err(); err != nil {
+			return nil, err
+		}
+		dir = filepathext.SmartJoin(c.Dir, dir)
+		taskRangeFunc = getRangeFunc(dir)
+	}
+
+	rootVertex, err := c.Graph.Root()
+	if err != nil {
+		return nil, err
+	}
+
+	envMap := make(map[string]any)
+	for _, e := range os.Environ() {
+		k, v, _ := strings.Cut(e, "=")
+		envMap[k] = v
+	}
+
+	resolveEnvToMap := func(k string, v ast.Var, dir string) error {
+		cache := &templater.Cache{Vars: result}
+		newVar := templater.ReplaceVar(v, cache)
+		if err := cache.Err(); err != nil {
+			return err
+		}
+		if newVar.Value != nil || newVar.Sh == nil {
+			if newVar.Value != nil {
+				envMap[k] = newVar.Value
+			}
+			return nil
+		}
+		if evaluateShVars {
+			envSlice := os.Environ()
+			for ek, ev := range envMap {
+				if s, ok := ev.(string); ok {
+					envSlice = append(envSlice, fmt.Sprintf("%s=%s", ek, s))
+				}
+			}
+			static, err := c.HandleDynamicVar(newVar, dir, envSlice)
+			if err != nil {
+				return err
+			}
+			envMap[k] = static
+		}
+		return nil
+	}
+
+	for k, v := range rootVertex.Taskfile.Env.All() {
+		if err := resolveEnvToMap(k, v, c.Dir); err != nil {
+			return nil, err
+		}
+	}
+
+	for k, v := range rootVertex.Taskfile.Vars.All() {
+		if err := rangeFunc(k, v); err != nil {
+			return nil, err
+		}
+	}
+
+	if t.Location.Taskfile != rootVertex.URI {
+		predecessorMap, err := c.Graph.PredecessorMap()
+		if err != nil {
+			return nil, err
+		}
+
+		var parentChain []*ast.TaskfileVertex
+		currentURI := t.Location.Taskfile
+		for {
+			edges := predecessorMap[currentURI]
+			if len(edges) == 0 {
+				break
+			}
+			var parentURI string
+			for _, edge := range edges {
+				parentURI = edge.Source
+				break
+			}
+			if parentURI == rootVertex.URI {
+				break
+			}
+			parentVertex, err := c.Graph.Vertex(parentURI)
+			if err != nil {
+				return nil, err
+			}
+			parentChain = append([]*ast.TaskfileVertex{parentVertex}, parentChain...)
+			currentURI = parentURI
+		}
+
+		for _, parent := range parentChain {
+			parentDir := filepath.Dir(parent.URI)
+			for k, v := range parent.Taskfile.Env.All() {
+				if err := resolveEnvToMap(k, v, parentDir); err != nil {
+					return nil, err
+				}
+			}
+			// Vars use the parent's directory too
+			parentRangeFunc := getRangeFunc(parentDir)
+			for k, v := range parent.Taskfile.Vars.All() {
+				if err := parentRangeFunc(k, v); err != nil {
+					return nil, err
+				}
+			}
+		}
+
+		includeVertex, err := c.Graph.Vertex(t.Location.Taskfile)
+		if err != nil {
+			return nil, err
+		}
+		includeDir := filepath.Dir(includeVertex.URI)
+		for k, v := range includeVertex.Taskfile.Env.All() {
+			if err := resolveEnvToMap(k, v, includeDir); err != nil {
+				return nil, err
+			}
+		}
+		includeRangeFunc := getRangeFunc(includeDir)
+		for k, v := range includeVertex.Taskfile.Vars.All() {
+			if err := includeRangeFunc(k, v); err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	if t.IncludeVars != nil {
+		for k, v := range t.IncludeVars.All() {
+			if err := rangeFunc(k, v); err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	if call != nil {
+		for k, v := range t.Vars.All() {
+			if err := taskRangeFunc(k, v); err != nil {
+				return nil, err
+			}
+		}
+		for k, v := range call.Vars.All() {
+			if err := taskRangeFunc(k, v); err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	for k, v := range c.CLIVars.All() {
+		if err := rangeFunc(k, v); err != nil {
+			return nil, err
+		}
+	}
+
+	result.Set("env", ast.Var{Value: envMap})
+
+	return result, nil
+}
+
+// getLegacyVariables resolves variables in legacy mode.
+// In legacy mode, all variables (including OS env) are merged at root level.
+func (c *Compiler) getLegacyVariables(t *ast.Task, call *Call, evaluateShVars bool) (*ast.Vars, error) {
+	result := env.GetEnviron()
+
+	specialVars, err := c.getSpecialVars(t, call)
+	if err != nil {
+		return nil, err
+	}
+	for k, v := range specialVars {
+		result.Set(k, ast.Var{Value: v})
+	}
+
+	getRangeFunc := func(dir string) func(k string, v ast.Var) error {
+		return func(k string, v ast.Var) error {
+			cache := &templater.Cache{Vars: result}
+			newVar := templater.ReplaceVar(v, cache)
+			if !evaluateShVars && newVar.Value == nil {
+				result.Set(k, ast.Var{Value: "", Sh: newVar.Sh})
+				return nil
+			}
+			if !evaluateShVars {
+				result.Set(k, ast.Var{Value: newVar.Value, Sh: newVar.Sh})
+				return nil
+			}
+			if err := cache.Err(); err != nil {
+				return err
+			}
+			if newVar.Value != nil || newVar.Sh == nil {
+				result.Set(k, ast.Var{Value: newVar.Value})
+				return nil
+			}
+			static, err := c.HandleDynamicVar(newVar, dir, env.GetFromVars(result))
+			if err != nil {
+				return err
+			}
+			result.Set(k, ast.Var{Value: static})
 			return nil
 		}
 	}
@@ -93,8 +316,6 @@ func (c *Compiler) getVariables(t *ast.Task, call *Call, evaluateShVars bool) (*
 
 	var taskRangeFunc func(k string, v ast.Var) error
 	if t != nil {
-		// NOTE(@andreynering): We're manually joining these paths here because
-		// this is the raw task, not the compiled one.
 		cache := &templater.Cache{Vars: result}
 		dir := templater.Replace(t.Dir, cache)
 		if err := cache.Err(); err != nil {
@@ -114,6 +335,7 @@ func (c *Compiler) getVariables(t *ast.Task, call *Call, evaluateShVars bool) (*
 			return nil, err
 		}
 	}
+
 	if t != nil {
 		for k, v := range t.IncludeVars.All() {
 			if err := rangeFunc(k, v); err != nil {
@@ -149,7 +371,6 @@ func (c *Compiler) HandleDynamicVar(v ast.Var, dir string, e []string) (string,
 	c.muDynamicCache.Lock()
 	defer c.muDynamicCache.Unlock()
 
-	// If the variable is not dynamic or it is empty, return an empty string
 	if v.Sh == nil || *v.Sh == "" {
 		return "", nil
 	}
@@ -198,21 +419,18 @@ func (c *Compiler) ResetCache() {
 }
 
 func (c *Compiler) getSpecialVars(t *ast.Task, call *Call) (map[string]string, error) {
-	// Use filepath.ToSlash for all paths to ensure consistent forward slashes
-	// across platforms. This prevents issues with backslashes being interpreted
-	// as escape sequences when paths are used in shell commands on Windows.
 	allVars := map[string]string{
 		"TASK_EXE":         filepath.ToSlash(os.Args[0]),
-		"ROOT_TASKFILE":    filepath.ToSlash(filepathext.SmartJoin(c.Dir, c.Entrypoint)),
+		"ROOT_TASKFILE":    filepathext.SmartJoin(c.Dir, c.Entrypoint),
-		"ROOT_DIR":         filepath.ToSlash(c.Dir),
+		"ROOT_DIR":         c.Dir,
-		"USER_WORKING_DIR": filepath.ToSlash(c.UserWorkingDir),
+		"USER_WORKING_DIR": c.UserWorkingDir,
 		"TASK_VERSION":     version.GetVersion(),
 	}
 	if t != nil {
 		allVars["TASK"] = t.Task
-		allVars["TASK_DIR"] = filepath.ToSlash(filepathext.SmartJoin(c.Dir, t.Dir))
+		allVars["TASK_DIR"] = filepathext.SmartJoin(c.Dir, t.Dir)
-		allVars["TASKFILE"] = filepath.ToSlash(t.Location.Taskfile)
+		allVars["TASKFILE"] = t.Location.Taskfile
-		allVars["TASKFILE_DIR"] = filepath.ToSlash(filepath.Dir(t.Location.Taskfile))
+		allVars["TASKFILE_DIR"] = filepath.Dir(t.Location.Taskfile)
 	} else {
 		allVars["TASK"] = ""
 		allVars["TASK_DIR"] = ""

completion/fish/task.fish

@@ -5,7 +5,7 @@ set -g __task_experiments_cache ""
 set -g __task_experiments_cache_time 0
 
 # Helper function to get experiments with 1-second cache
-function __task_get_experiments --inherit-variable GO_TASK_PROGNAME
+function __task_get_experiments
     set -l now (date +%s)
     set -l ttl 1  # Cache for 1 second only
 
@@ -16,7 +16,7 @@ function __task_get_experiments --inherit-variable GO_TASK_PROGNAME
     end
 
     # Refresh cache
-    set -g __task_experiments_cache ($GO_TASK_PROGNAME --experiments 2>/dev/null)
+    set -g __task_experiments_cache (task --experiments 2>/dev/null)
     set -g __task_experiments_cache_time $now
     printf '%s\n' $__task_experiments_cache
 end

errors/error_taskfile_decode.go

@@ -8,7 +8,7 @@ import (
 	"strings"
 
 	"github.com/fatih/color"
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 )
 
 type (
@@ -50,10 +50,10 @@ func (err *TaskfileDecodeError) Error() string {
 			if len(te.Errors) > 1 {
 				fmt.Fprintln(buf, color.RedString("errs:"))
 				for _, message := range te.Errors {
-					fmt.Fprintln(buf, color.RedString("- %s", message))
+					fmt.Fprintln(buf, color.RedString("- %s", message.Err.Error()))
 				}
 			} else {
-				fmt.Fprintln(buf, color.RedString("err:  %s", te.Errors[0]))
+				fmt.Fprintln(buf, color.RedString("err:  %s", te.Errors[0].Err.Error()))
 			}
 		} else {
 			// Otherwise print the error message normally

errors/errors_task.go

@@ -195,9 +195,9 @@ type TaskNotAllowedVarsError struct {
 func (err *TaskNotAllowedVarsError) Error() string {
 	var builder strings.Builder
 
-	builder.WriteString(fmt.Sprintf("task: Task %q cancelled because it is missing required variables:\n", err.TaskName)) //nolint:staticcheck
+	builder.WriteString(fmt.Sprintf("task: Task %q cancelled because it is missing required variables:\n", err.TaskName))
 	for _, s := range err.NotAllowedVars {
-		builder.WriteString(fmt.Sprintf("  - %s has an invalid value : '%s' (allowed values : %v)\n", s.Name, s.Value, s.Enum)) //nolint:staticcheck
+		builder.WriteString(fmt.Sprintf("  - %s has an invalid value : '%s' (allowed values : %v)\n", s.Name, s.Value, s.Enum))
 	}
 
 	return builder.String()

errors/errors_taskfile.go

@@ -3,7 +3,6 @@ package errors
 import (
 	"fmt"
 	"net/http"
-	"path/filepath"
 	"time"
 
 	"github.com/Masterminds/semver/v3"
@@ -12,23 +11,20 @@ import (
 // TaskfileNotFoundError is returned when no appropriate Taskfile is found when
 // searching the filesystem.
 type TaskfileNotFoundError struct {
-	URI         string
+	URI     string
-	Walk        bool
+	Walk    bool
-	AskInit     bool
+	AskInit bool
-	OwnerChange bool
 }
 
 func (err TaskfileNotFoundError) Error() string {
 	var walkText string
-	if err.OwnerChange {
+	if err.Walk {
-		walkText = " (or any of the parent directories until ownership changed)."
-	} else if err.Walk {
 		walkText = " (or any of the parent directories)."
 	}
 	if err.AskInit {
 		walkText += " Run `task --init` to create a new Taskfile."
 	}
-	return fmt.Sprintf(`task: No Taskfile found at %q%s`, filepath.ToSlash(err.URI), walkText)
+	return fmt.Sprintf(`task: No Taskfile found at %q%s`, err.URI, walkText)
 }
 
 func (err TaskfileNotFoundError) Code() int {
@@ -55,7 +51,7 @@ type TaskfileInvalidError struct {
 }
 
 func (err TaskfileInvalidError) Error() string {
-	return fmt.Sprintf("task: Failed to parse %s:\n%v", filepath.ToSlash(err.URI), err.Err)
+	return fmt.Sprintf("task: Failed to parse %s:\n%v", err.URI, err.Err)
 }
 
 func (err TaskfileInvalidError) Code() int {
@@ -74,7 +70,7 @@ func (err TaskfileFetchFailedError) Error() string {
 	if err.HTTPStatusCode != 0 {
 		statusText = fmt.Sprintf(" with status code %d (%s)", err.HTTPStatusCode, http.StatusText(err.HTTPStatusCode))
 	}
-	return fmt.Sprintf(`task: Download of %q failed%s`, filepath.ToSlash(err.URI), statusText)
+	return fmt.Sprintf(`task: Download of %q failed%s`, err.URI, statusText)
 }
 
 func (err TaskfileFetchFailedError) Code() int {
@@ -90,7 +86,7 @@ type TaskfileNotTrustedError struct {
 func (err *TaskfileNotTrustedError) Error() string {
 	return fmt.Sprintf(
 		`task: Taskfile %q not trusted by user`,
-		filepath.ToSlash(err.URI),
+		err.URI,
 	)
 }
 
@@ -107,7 +103,7 @@ type TaskfileNotSecureError struct {
 func (err *TaskfileNotSecureError) Error() string {
 	return fmt.Sprintf(
 		`task: Taskfile %q cannot be downloaded over an insecure connection. You can override this by using the --insecure flag`,
-		filepath.ToSlash(err.URI),
+		err.URI,
 	)
 }
 
@@ -124,7 +120,7 @@ type TaskfileCacheNotFoundError struct {
 func (err *TaskfileCacheNotFoundError) Error() string {
 	return fmt.Sprintf(
 		`task: Taskfile %q was not found in the cache. Remove the --offline flag to use a remote copy or download it using the --download flag`,
-		filepath.ToSlash(err.URI),
+		err.URI,
 	)
 }
 
@@ -145,12 +141,12 @@ func (err *TaskfileVersionCheckError) Error() string {
 	if err.SchemaVersion == nil {
 		return fmt.Sprintf(
 			`task: Missing schema version in Taskfile %q`,
-			filepath.ToSlash(err.URI),
+			err.URI,
 		)
 	}
 	return fmt.Sprintf(
 		"task: Invalid schema version in Taskfile %q:\nSchema version (%s) %s",
-		filepath.ToSlash(err.URI),
+		err.URI,
 		err.SchemaVersion.String(),
 		err.Message,
 	)
@@ -170,7 +166,7 @@ type TaskfileNetworkTimeoutError struct {
 func (err *TaskfileNetworkTimeoutError) Error() string {
 	return fmt.Sprintf(
 		`task: Network connection timed out after %s while attempting to download Taskfile %q`,
-		err.Timeout, filepath.ToSlash(err.URI),
+		err.Timeout, err.URI,
 	)
 }
 
@@ -187,8 +183,8 @@ type TaskfileCycleError struct {
 
 func (err TaskfileCycleError) Error() string {
 	return fmt.Sprintf("task: include cycle detected between %s <--> %s",
-		filepath.ToSlash(err.Source),
+		err.Source,
-		filepath.ToSlash(err.Destination),
+		err.Destination,
 	)
 }
 
@@ -207,7 +203,7 @@ type TaskfileDoesNotMatchChecksum struct {
 func (err *TaskfileDoesNotMatchChecksum) Error() string {
 	return fmt.Sprintf(
 		"task: The checksum of the Taskfile at %q does not match!\ngot: %q\nwant: %q",
-		filepath.ToSlash(err.URI),
+		err.URI,
 		err.ActualChecksum,
 		err.ExpectedChecksum,
 	)

executor.go

@@ -63,6 +63,7 @@ type (
 
 		// Internal
 		Taskfile           *ast.Taskfile
+		Graph              *ast.TaskfileGraph
 		Logger             *logger.Logger
 		Compiler           *Compiler
 		Output             output.Output

executor_test.go

@@ -165,7 +165,6 @@ func (tt *ExecutorTest) run(t *testing.T) {
 		// Create a golden fixture file for the output
 		g := goldie.New(t,
 			goldie.WithFixtureDir(filepath.Join(e.Dir, "testdata")),
-			goldie.WithEqualFn(NormalizedEqual),
 		)
 
 		// Call setup and check for errors
@@ -283,45 +282,6 @@ func TestVars(t *testing.T) {
 	)
 }
 
-func TestSecretVars(t *testing.T) {
-	t.Parallel()
-	NewExecutorTest(t,
-		WithName("secret vars are masked in logs"),
-		WithExecutorOptions(
-			task.WithDir("testdata/secrets"),
-		),
-		WithTask("test-secret-masking"),
-	)
-	NewExecutorTest(t,
-		WithName("multiple secrets masked"),
-		WithExecutorOptions(
-			task.WithDir("testdata/secrets"),
-		),
-		WithTask("test-multiple-secrets"),
-	)
-	NewExecutorTest(t,
-		WithName("mixed secret and public vars"),
-		WithExecutorOptions(
-			task.WithDir("testdata/secrets"),
-		),
-		WithTask("test-mixed"),
-	)
-	NewExecutorTest(t,
-		WithName("deferred command with secrets"),
-		WithExecutorOptions(
-			task.WithDir("testdata/secrets"),
-		),
-		WithTask("test-deferred-secret"),
-	)
-	NewExecutorTest(t,
-		WithName("env secret limitation"),
-		WithExecutorOptions(
-			task.WithDir("testdata/secrets"),
-		),
-		WithTask("test-env-secret-limitation"),
-	)
-}
-
 func TestRequires(t *testing.T) {
 	t.Parallel()
 	NewExecutorTest(t,
@@ -391,41 +351,6 @@ func TestRequires(t *testing.T) {
 		),
 		WithTask("var-defined-in-task"),
 	)
-	NewExecutorTest(t,
-		WithName("enum ref - passes validation"),
-		WithExecutorOptions(
-			task.WithDir("testdata/requires"),
-		),
-		WithTask("validation-var-ref"),
-		WithVar("ENV", "dev"),
-	)
-	NewExecutorTest(t,
-		WithName("enum ref - fails validation"),
-		WithExecutorOptions(
-			task.WithDir("testdata/requires"),
-		),
-		WithTask("validation-var-ref"),
-		WithVar("ENV", "invalid"),
-		WithRunError(),
-	)
-	NewExecutorTest(t,
-		WithName("enum ref - ref to non-list"),
-		WithExecutorOptions(
-			task.WithDir("testdata/requires"),
-		),
-		WithTask("validation-var-ref-invalid"),
-		WithVar("VALUE", "test"),
-		WithRunError(),
-	)
-	NewExecutorTest(t,
-		WithName("enum ref - ref to nonexistent var"),
-		WithExecutorOptions(
-			task.WithDir("testdata/requires"),
-		),
-		WithTask("validation-var-ref-nonexistent"),
-		WithVar("ENV", "dev"),
-		WithRunError(),
-	)
 }
 
 // TODO: mock fs
@@ -1235,10 +1160,6 @@ func TestIf(t *testing.T) {
 
 		// For loop with if
 		{name: "if-in-for-loop", task: "if-in-for-loop", verbose: true},
-
-		// Task-level if with dynamic variable
-		{name: "task-if-dynamic-true", task: "task-if-dynamic-true"},
-		{name: "task-if-dynamic-false", task: "task-if-dynamic-false", verbose: true},
 	}
 
 	for _, test := range tests {
@@ -1259,3 +1180,114 @@ func TestIf(t *testing.T) {
 		NewExecutorTest(t, opts...)
 	}
 }
+
+//nolint:paralleltest // enableExperimentForTest modifies global state
+func TestScopedTaskfiles(t *testing.T) {
+	// Legacy tests (without experiment) - vars should be merged globally
+	t.Run("legacy", func(t *testing.T) {
+		// Test with scoped taskfiles disabled (legacy) - vars should be merged globally
+		NewExecutorTest(t,
+			WithName("default"),
+			WithExecutorOptions(
+				task.WithDir("testdata/scoped_taskfiles"),
+				task.WithSilent(true),
+			),
+		)
+		// In legacy mode, UNIQUE_B should be accessible (merged globally)
+		NewExecutorTest(t,
+			WithName("cross-include"),
+			WithExecutorOptions(
+				task.WithDir("testdata/scoped_taskfiles"),
+				task.WithSilent(true),
+			),
+			WithTask("a:try-access-b"),
+		)
+	})
+
+	// Scoped tests (with experiment enabled) - vars should be isolated
+	t.Run("scoped", func(t *testing.T) {
+		enableExperimentForTest(t, &experiments.ScopedTaskfiles, 1)
+
+		// Test with scoped taskfiles enabled - vars should be isolated
+		NewExecutorTest(t,
+			WithName("default"),
+			WithExecutorOptions(
+				task.WithDir("testdata/scoped_taskfiles"),
+				task.WithSilent(true),
+			),
+		)
+		// Test inheritance: include can access root vars
+		NewExecutorTest(t,
+			WithName("inheritance-a"),
+			WithExecutorOptions(
+				task.WithDir("testdata/scoped_taskfiles"),
+				task.WithSilent(true),
+			),
+			WithTask("a:print"),
+		)
+		// Test isolation: each include sees its own vars
+		NewExecutorTest(t,
+			WithName("isolation-b"),
+			WithExecutorOptions(
+				task.WithDir("testdata/scoped_taskfiles"),
+				task.WithSilent(true),
+			),
+			WithTask("b:print"),
+		)
+		// In scoped mode, UNIQUE_B should be empty (isolated)
+		NewExecutorTest(t,
+			WithName("cross-include"),
+			WithExecutorOptions(
+				task.WithDir("testdata/scoped_taskfiles"),
+				task.WithSilent(true),
+			),
+			WithTask("a:try-access-b"),
+		)
+		// Test env namespace: {{.env.XXX}} should access env vars
+		NewExecutorTest(t,
+			WithName("env-namespace"),
+			WithExecutorOptions(
+				task.WithDir("testdata/scoped_taskfiles"),
+				task.WithSilent(true),
+			),
+			WithTask("print-env"),
+		)
+		// Test env separation: {{.ROOT_ENV}} at root should be empty (env not at root level)
+		NewExecutorTest(t,
+			WithName("env-separation"),
+			WithExecutorOptions(
+				task.WithDir("testdata/scoped_taskfiles"),
+				task.WithSilent(true),
+			),
+			WithTask("test-env-separation"),
+		)
+		// Test include env: include's env is accessible via {{.env.XXX}}
+		NewExecutorTest(t,
+			WithName("include-env"),
+			WithExecutorOptions(
+				task.WithDir("testdata/scoped_taskfiles"),
+				task.WithSilent(true),
+			),
+			WithTask("a:print-env"),
+		)
+		// Test call vars: vars passed when calling a task override task vars
+		NewExecutorTest(t,
+			WithName("call-vars"),
+			WithExecutorOptions(
+				task.WithDir("testdata/scoped_taskfiles"),
+				task.WithSilent(true),
+			),
+			WithTask("call-with-vars"),
+		)
+		// Test nested includes (3 levels: root → a → nested)
+		// Verifies that nested includes inherit vars from their parent chain
+		NewExecutorTest(t,
+			WithName("nested"),
+			WithExecutorOptions(
+				task.WithDir("testdata/scoped_taskfiles"),
+				task.WithSilent(true),
+			),
+			WithTask("a:nested:print"),
+		)
+	})
+}

experiments/experiments.go

@@ -19,6 +19,7 @@ var (
 	GentleForce     Experiment
 	RemoteTaskfiles Experiment
 	EnvPrecedence   Experiment
+	ScopedTaskfiles Experiment
 )
 
 // Inactive experiments. These are experiments that cannot be enabled, but are
@@ -43,6 +44,7 @@ func ParseWithConfig(dir string, config *ast.TaskRC) {
 	GentleForce = New("GENTLE_FORCE", config, 1)
 	RemoteTaskfiles = New("REMOTE_TASKFILES", config, 1)
 	EnvPrecedence = New("ENV_PRECEDENCE", config, 1)
+	ScopedTaskfiles = New("SCOPED_TASKFILES", config, 1)
 	AnyVariables = New("ANY_VARIABLES", config)
 	MapVariables = New("MAP_VARIABLES", config)
 }

formatter_test.go

@@ -127,7 +127,6 @@ func (tt *FormatterTest) run(t *testing.T) {
 		// Create a golden fixture file for the output
 		g := goldie.New(t,
 			goldie.WithFixtureDir(filepath.Join(e.Dir, "testdata")),
-			goldie.WithEqualFn(NormalizedEqual),
 		)
 
 		// Call setup and check for errors

go.mod

@@ -1,103 +1,106 @@
 module github.com/go-task/task/v3
 
-go 1.25.8
+go 1.24.6
+
+toolchain go1.25.6
 
 require (
-	charm.land/bubbles/v2 v2.1.0
+	charm.land/bubbles/v2 v2.0.0-rc.1
-	charm.land/bubbletea/v2 v2.0.2
+	charm.land/bubbletea/v2 v2.0.0-rc.2
-	charm.land/lipgloss/v2 v2.0.2
+	charm.land/lipgloss/v2 v2.0.0-beta.3.0.20251106192539-4b304240aab7
 	github.com/Ladicle/tabwriter v1.0.0
 	github.com/Masterminds/semver/v3 v3.4.0
-	github.com/alecthomas/chroma/v2 v2.23.1
+	github.com/alecthomas/chroma/v2 v2.23.0
 	github.com/chainguard-dev/git-urls v1.0.2
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 	github.com/dominikbraun/graph v0.23.0
 	github.com/elliotchance/orderedmap/v3 v3.1.0
-	github.com/fatih/color v1.19.0
+	github.com/fatih/color v1.18.0
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/go-task/slim-sprig/v3 v3.0.0
 	github.com/go-task/template v0.2.0
 	github.com/google/uuid v1.6.0
-	github.com/hashicorp/go-getter v1.8.6
+	github.com/hashicorp/go-getter v1.8.4
 	github.com/joho/godotenv v1.5.1
 	github.com/mitchellh/hashstructure/v2 v2.0.2
-	github.com/puzpuzpuz/xsync/v4 v4.4.0
+	github.com/puzpuzpuz/xsync/v4 v4.3.0
 	github.com/sajari/fuzzy v1.0.0
 	github.com/sebdah/goldie/v2 v2.8.0
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
-	github.com/zeebo/xxh3 v1.1.0
+	github.com/zeebo/xxh3 v1.0.2
-	go.yaml.in/yaml/v3 v3.0.4
+	go.yaml.in/yaml/v4 v4.0.0-rc.3
-	golang.org/x/sync v0.20.0
+	golang.org/x/sync v0.19.0
-	golang.org/x/term v0.42.0
+	golang.org/x/term v0.39.0
 	mvdan.cc/sh/moreinterp v0.0.0-20260120230322-19def062a997
-	mvdan.cc/sh/v3 v3.13.1
+	mvdan.cc/sh/v3 v3.12.1-0.20260124232039-e74afc18e65b
 )
 
 require (
-	cel.dev/expr v0.25.1 // indirect
+	cel.dev/expr v0.24.0 // indirect
 	cloud.google.com/go v0.123.0 // indirect
-	cloud.google.com/go/auth v0.18.2 // indirect
+	cloud.google.com/go/auth v0.17.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	cloud.google.com/go/iam v1.5.3 // indirect
-	cloud.google.com/go/monitoring v1.24.3 // indirect
+	cloud.google.com/go/monitoring v1.24.2 // indirect
-	cloud.google.com/go/storage v1.61.3 // indirect
+	cloud.google.com/go/storage v1.58.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.41.0 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.32.12 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.32.6 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.12 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.6 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 // indirect
-	github.com/aws/smithy-go v1.24.2 // indirect
+	github.com/aws/smithy-go v1.24.0 // indirect
 	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charmbracelet/colorprofile v0.4.2 // indirect
+	github.com/charmbracelet/colorprofile v0.3.3 // indirect
-	github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20251116181749-377898bcce38 // indirect
-	github.com/charmbracelet/x/ansi v0.11.6 // indirect
+	github.com/charmbracelet/x/ansi v0.11.1 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
 	github.com/charmbracelet/x/termios v0.1.1 // indirect
 	github.com/charmbracelet/x/windows v0.2.2 // indirect
-	github.com/clipperhouse/displaywidth v0.11.0 // indirect
+	github.com/clipperhouse/displaywidth v0.5.0 // indirect
-	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
+	github.com/clipperhouse/stringish v0.1.1 // indirect
-	github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
+	github.com/clipperhouse/uax29/v2 v2.3.0 // indirect
+	github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect
 	github.com/dlclark/regexp2 v1.11.5 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
-	github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.2 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect
-	github.com/googleapis/gax-go/v2 v2.17.0 // indirect
+	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
-	github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72 // indirect
+	github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.70 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-version v1.8.0 // indirect
-	github.com/klauspost/compress v1.18.5 // indirect
+	github.com/klauspost/compress v1.18.2 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-runewidth v0.0.21 // indirect
+	github.com/mattn/go-runewidth v0.0.19 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/pierrec/lz4/v4 v4.1.22 // indirect
@@ -105,32 +108,33 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/u-root/u-root v0.15.1-0.20251208185023-2f8c7e763cf8 // indirect
 	github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 // indirect
 	github.com/ulikunitz/xz v0.5.15 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	github.com/zeebo/errs v1.4.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
+	go.opentelemetry.io/otel v1.39.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
+	go.opentelemetry.io/otel/metric v1.39.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.39.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.39.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/otel/trace v1.39.0 // indirect
-	golang.org/x/crypto v0.49.0 // indirect
+	golang.org/x/crypto v0.46.0 // indirect
-	golang.org/x/net v0.52.0 // indirect
+	golang.org/x/net v0.48.0 // indirect
-	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/oauth2 v0.33.0 // indirect
-	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/sys v0.40.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
-	golang.org/x/time v0.15.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
-	google.golang.org/api v0.271.0 // indirect
+	google.golang.org/api v0.256.0 // indirect
-	google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
+	google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251111163417-95abcf5c77ba // indirect
-	google.golang.org/grpc v1.79.3 // indirect
+	google.golang.org/grpc v1.76.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -1,103 +1,103 @@
-cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
+cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
-cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
+cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
-charm.land/bubbles/v2 v2.1.0 h1:YSnNh5cPYlYjPxRrzs5VEn3vwhtEn3jVGRBT3M7/I0g=
+charm.land/bubbles/v2 v2.0.0-rc.1 h1:EiIFVAc3Zi/yY86td+79mPhHR7AqZ1OxF+6ztpOCRaM=
-charm.land/bubbles/v2 v2.1.0/go.mod h1:l97h4hym2hvWBVfmJDtrEHHCtkIKeTEb3TTJ4ZOB3wY=
+charm.land/bubbles/v2 v2.0.0-rc.1/go.mod h1:5AbN6cEd/47gkEf8TgiQ2O3RZ5QxMS14l9W+7F9fPC4=
-charm.land/bubbletea/v2 v2.0.2 h1:4CRtRnuZOdFDTWSff9r8QFt/9+z6Emubz3aDMnf/dx0=
+charm.land/bubbletea/v2 v2.0.0-rc.2 h1:TdTbUOFzbufDJmSz/3gomL6q+fR6HwfY+P13hXQzD7k=
-charm.land/bubbletea/v2 v2.0.2/go.mod h1:3LRff2U4WIYXy7MTxfbAQ+AdfM3D8Xuvz2wbsOD9OHQ=
+charm.land/bubbletea/v2 v2.0.0-rc.2/go.mod h1:IXFmnCnMLTWw/KQ9rEatSYqbAPAYi8kA3Yqwa1SFnLk=
-charm.land/lipgloss/v2 v2.0.2 h1:xFolbF8JdpNkM2cEPTfXEcW1p6NRzOWTSamRfYEw8cs=
+charm.land/lipgloss/v2 v2.0.0-beta.3.0.20251106192539-4b304240aab7 h1:059k1h5vvZ4ASinki9nmBguxu9Rq0UDDSa6q8LOUphk=
-charm.land/lipgloss/v2 v2.0.2/go.mod h1:KjPle2Qd3YmvP1KL5OMHiHysGcNwq6u83MUjYkFvEkM=
+charm.land/lipgloss/v2 v2.0.0-beta.3.0.20251106192539-4b304240aab7/go.mod h1:1qZyvvVCenJO2M1ac2mX0yyiIZJoZmDM4DG4s0udJkU=
 cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
-cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
+cloud.google.com/go/auth v0.17.0 h1:74yCm7hCj2rUyyAocqnFzsAYXgJhrG26XCFimrc/Kz4=
-cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
+cloud.google.com/go/auth v0.17.0/go.mod h1:6wv/t5/6rOPAX4fJiRjKkJCvswLwdet7G8+UGXt7nCQ=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
 cloud.google.com/go/iam v1.5.3 h1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc=
 cloud.google.com/go/iam v1.5.3/go.mod h1:MR3v9oLkZCTlaqljW6Eb2d3HGDGK5/bDv93jhfISFvU=
-cloud.google.com/go/logging v1.13.1 h1:O7LvmO0kGLaHY/gq8cV7T0dyp6zJhYAOtZPX4TF3QtY=
+cloud.google.com/go/logging v1.13.0 h1:7j0HgAp0B94o1YRDqiqm26w4q1rDMH7XNRU34lJXHYc=
-cloud.google.com/go/logging v1.13.1/go.mod h1:XAQkfkMBxQRjQek96WLPNze7vsOmay9H5PqfsNYDqvw=
+cloud.google.com/go/logging v1.13.0/go.mod h1:36CoKh6KA/M0PbhPKMq6/qety2DCAErbhXT62TuXALA=
-cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7EhfW8=
+cloud.google.com/go/longrunning v0.7.0 h1:FV0+SYF1RIj59gyoWDRi45GiYUMM3K1qO51qoboQT1E=
-cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk=
+cloud.google.com/go/longrunning v0.7.0/go.mod h1:ySn2yXmjbK9Ba0zsQqunhDkYi0+9rlXIwnoAf+h+TPY=
-cloud.google.com/go/monitoring v1.24.3 h1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=
+cloud.google.com/go/monitoring v1.24.2 h1:5OTsoJ1dXYIiMiuL+sYscLc9BumrL3CarVLL7dd7lHM=
-cloud.google.com/go/monitoring v1.24.3/go.mod h1:nYP6W0tm3N9H/bOw8am7t62YTzZY+zUeQ+Bi6+2eonI=
+cloud.google.com/go/monitoring v1.24.2/go.mod h1:x7yzPWcgDRnPEv3sI+jJGBkwl5qINf+6qY4eq0I9B4U=
-cloud.google.com/go/storage v1.61.3 h1:VS//ZfBuPGDvakfD9xyPW1RGF1Vy3BWUoVZXgW1KMOg=
+cloud.google.com/go/storage v1.58.0 h1:PflFXlmFJjG/nBeR9B7pKddLQWaFaRWx4uUi/LyNxxo=
-cloud.google.com/go/storage v1.61.3/go.mod h1:JtqK8BBB7TWv0HVGHubtUdzYYrakOQIsMLffZ2Z/HWk=
+cloud.google.com/go/storage v1.58.0/go.mod h1:cMWbtM+anpC74gn6qjLh+exqYcfmB9Hqe5z6adx+CLI=
-cloud.google.com/go/trace v1.11.7 h1:kDNDX8JkaAG3R2nq1lIdkb7FCSi1rCmsEtKVsty7p+U=
+cloud.google.com/go/trace v1.11.6 h1:2O2zjPzqPYAHrn3OKl029qlqG6W8ZdYaOWRyr8NgMT4=
-cloud.google.com/go/trace v1.11.7/go.mod h1:TNn9d5V3fQVf6s4SCveVMIBS2LJUqo73GACmq/Tky0s=
+cloud.google.com/go/trace v1.11.6/go.mod h1:GA855OeDEBiBMzcckLPE2kDunIpC72N+Pq8WFieFjnI=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 h1:sBEjpZlNHzK1voKq9695PJSX2o5NEXl7/OL3coiIY0c=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 h1:UQUsRi8WTzhZntp5313l+CHIAT95ojUI2lpP/ExlZa4=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0/go.mod h1:Cz6ft6Dkn3Et6l2v2a9/RpN7epQ1GtDlO6lj8bEcOvw=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 h1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0 h1:lhhYARPUu3LmHysQ/igznQphfzynnqI3D75oUyw1HXk=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0/go.mod h1:IA1C1U7jO/ENqm/vhi7V9YYpBsp+IMyqNrEN94N7tVc=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0/go.mod h1:l9rva3ApbBpEJxSNYnwT9N4CDLrWgtq3u8736C5hyJw=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 h1:7t/qx5Ost0s0wbA/VDrByOooURhp+ikYwv20i9Y07TQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.54.0 h1:xfK3bbi6F2RDtaZFtUdKO3osOBIhNb+xTs8lFW6yx9o=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0/go.mod h1:vB2GH9GAYYJTO3mEn8oYwzEdhlayZIdQz6zdzgUIRvA=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.54.0/go.mod h1:vB2GH9GAYYJTO3mEn8oYwzEdhlayZIdQz6zdzgUIRvA=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 h1:0s6TxfCu2KHkkZPnBfsQ2y5qia0jl3MMrmBhu3nCOYk=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0 h1:s0WlVbf9qpvkh1c/uDAPElam0WrL7fHRIidgZJ7UqZI=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0/go.mod h1:Mf6O40IAyB9zR/1J8nGDDPirZQQPbYJni8Yisy7NTMc=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0/go.mod h1:Mf6O40IAyB9zR/1J8nGDDPirZQQPbYJni8Yisy7NTMc=
 github.com/Ladicle/tabwriter v1.0.0 h1:DZQqPvMumBDwVNElso13afjYLNp0Z7pHqHnu0r4t9Dg=
 github.com/Ladicle/tabwriter v1.0.0/go.mod h1:c4MdCjxQyTbGuQO/gvqJ+IA/89UEwrsD6hUCW98dyp4=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
 github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
-github.com/alecthomas/chroma/v2 v2.23.1 h1:nv2AVZdTyClGbVQkIzlDm/rnhk1E9bU9nXwmZ/Vk/iY=
+github.com/alecthomas/chroma/v2 v2.23.0 h1:u/Orux1J0eLuZDeQ44froV8smumheieI0EofhbyKhhk=
-github.com/alecthomas/chroma/v2 v2.23.1/go.mod h1:NqVhfBR0lte5Ouh3DcthuUCTUpDC9cxBOfyMbMQPs3o=
+github.com/alecthomas/chroma/v2 v2.23.0/go.mod h1:NqVhfBR0lte5Ouh3DcthuUCTUpDC9cxBOfyMbMQPs3o=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
-github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
+github.com/aws/aws-sdk-go-v2 v1.41.0 h1:tNvqh1s+v0vFYdA1xq0aOJH+Y5cRyZ5upu6roPgPKd4=
-github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
+github.com/aws/aws-sdk-go-v2 v1.41.0/go.mod h1:MayyLB8y+buD9hZqkCW3kX1AKq07Y5pXxtgB+rRFhz0=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 h1:489krEF9xIGkOaaX3CE/Be2uWjiXrkCH6gUX+bZA/BU=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4/go.mod h1:IOAPF6oT9KCsceNTvvYMNHy0+kMF8akOjeDvPENWxp4=
-github.com/aws/aws-sdk-go-v2/config v1.32.12 h1:O3csC7HUGn2895eNrLytOJQdoL2xyJy0iYXhoZ1OmP0=
+github.com/aws/aws-sdk-go-v2/config v1.32.6 h1:hFLBGUKjmLAekvi1evLi5hVvFQtSo3GYwi+Bx4lpJf8=
-github.com/aws/aws-sdk-go-v2/config v1.32.12/go.mod h1:96zTvoOFR4FURjI+/5wY1vc1ABceROO4lWgWJuxgy0g=
+github.com/aws/aws-sdk-go-v2/config v1.32.6/go.mod h1:lcUL/gcd8WyjCrMnxez5OXkO3/rwcNmvfno62tnXNcI=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.12 h1:oqtA6v+y5fZg//tcTWahyN9PEn5eDU/Wpvc2+kJ4aY8=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.6 h1:F9vWao2TwjV2MyiyVS+duza0NIRtAslgLUM0vTA1ZaE=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.12/go.mod h1:U3R1RtSHx6NB0DvEQFGyf/0sbrpJrluENHdPy1j/3TE=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.6/go.mod h1:SgHzKjEVsdQr6Opor0ihgWtkWdfRAIwxYzSJ8O85VHY=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 h1:zOgq3uezl5nznfoK3ODuqbhVg1JzAGDUhXOsU0IDCAo=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16 h1:80+uETIWS1BqjnN9uJ0dBUaETh+P1XwFy5vwHwK5r9k=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20/go.mod h1:z/MVwUARehy6GAg/yQ1GO2IMl0k++cu1ohP9zo887wE=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16/go.mod h1:wOOsYuxYuB/7FlnVtzeBYRcjSRtQpAW0hCP7tIULMwo=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 h1:Rgg6wvjjtX8bNHcvi9OnXWwcE0a2vGpbwmtICOsvcf4=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 h1:rgGwPzb82iBYSvHMHXc8h9mRoOUBZIGFgKb9qniaZZc=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21/go.mod h1:A/kJFst/nm//cyqonihbdpQZwiUhhzpqTsdbhDdRF9c=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16/go.mod h1:L/UxsGeKpGoIj6DxfhOWHWQ/kGKcd4I1VncE4++IyKA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgqSE5hE/o47Ij9qk/SEZFbUOe9A=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 h1:1jtGzuV7c82xnqOVfx2F0xmJcOw5374L7N6juGW6x6U=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16/go.mod h1:M2E5OQf+XLe+SZGmmpaI2yy+J326aFf6/+54PoxSANc=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 h1:qYQ4pzQ2Oz6WpQ8T3HvGHnZydA72MnLuFK9tJwmrbHw=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 h1:rWyie/PxDRIdhNf4DzRk0lvjVOqFJuNnO8WwaIRVxzQ=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16 h1:CjMzUs78RDDv4ROu3JnJn/Ig1r6ZD7/T2DXLLRpejic=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22/go.mod h1:zd/JsJ4P7oGfUhXn1VyLqaRZwPmZwg44Jf2dS84Dm3Y=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16/go.mod h1:uVW4OLBqbJXSHJYA9svT9BluSvvwbzLQ2Crf6UPzR3c=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 h1:0ryTNEdJbzUCEWkVXEXoqlXV72J5keC1GvILMOuD00E=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4/go.mod h1:HQ4qwNZh32C3CBeO6iJLQlgtMzqeG17ziAA/3KDJFow=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 h1:JRaIgADQS/U6uXDqlPiefP32yXTda7Kqfx+LgspooZM=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7 h1:DIBqIrJ7hv+e4CmIk2z3pyKT+3B6qVMgRsawHiR3qso=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13/go.mod h1:CEuVn5WqOMilYl+tbccq8+N2ieCy0gVn3OtRb0vBNNM=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7/go.mod h1:vLm00xmBke75UmpNvOcZQ/Q30ZFjbczeLFqGx5urmGo=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3xgIJMSC8S6hEVq+38DcvUlgFY0FM6mSI5oto=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 h1:oHjJHeUy0ImIV0bsrX0X91GkV5nJAyv1l1CC9lnO0TI=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16/go.mod h1:iRSNGgOYmiYwSCXxXaKb9HfOEj40+oTKn8pTxMlYkRM=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 h1:ZlvrNcHSFFWURB8avufQq9gFsheUgjVD9536obIknfM=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16 h1:NSbvS17MlI2lurYgXnCOLvCFX38sBW4eiVER7+kkgsU=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21/go.mod h1:cv3TNhVrssKR0O/xxLJVRfd2oazSnZnkUeTf6ctUwfQ=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16/go.mod h1:SwT8Tmqd4sA6G1qaGdzWCJN99bUmPGHfRwwq3G5Qb+A=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 h1:HwxWTbTrIHm5qY+CAEur0s/figc3qwvLWsNkF4RPToo=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0 h1:MIWra+MSq53CFaXXAywB2qg9YvVZifkk6vEGl/1Qor0=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0/go.mod h1:79S2BdqCJpScXZA2y+cpZuocWsjGjJINyXnOsf5DTz8=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 h1:0GFOLzEbOyZABS3PhYfBIx2rNBACYcKty+XGkTgw1ow=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.4 h1:HpI7aMmJ+mm1wkSHIA2t5EaFFv5EFYXePW30p1EIrbQ=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.8/go.mod h1:LXypKvk85AROkKhOG6/YEcHFPoX+prKTowKnVdcaIxE=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.4/go.mod h1:C5RdGMYGlfM0gYq/tifqgn4EbyX99V15P2V3R+VHbQU=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 h1:kiIDLZ005EcKomYYITtfsjn7dtOwHDOFy7IbPXKek2o=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.8 h1:aM/Q24rIlS3bRAhTyFurowU8A0SMyGDtEOY/l/s/1Uw=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.13/go.mod h1:2h/xGEowcW/g38g06g3KpRWDlT+OTfxxI0o1KqayAB8=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.8/go.mod h1:+fWt2UHSb4kS7Pu8y+BMBvJF0EWx+4H0hzNwtDNRTrg=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 h1:jzKAXIlhZhJbnYwHbvUQZEB8KfgAEuG0dc08Bkda7NU=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12 h1:AHDr0DaHIAo8c9t1emrzAlVDFp+iMMKnPdYy6XO4MCE=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17/go.mod h1:Al9fFsXjv4KfbzQHGe6V4NZSZQXecFcvaIF4e70FoRA=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12/go.mod h1:GQ73XawFFiWxyWXMHWfhiomvP3tXtdNar/fi8z18sx0=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 h1:Cng+OOwCHmFljXIxpEVXAGMnBia8MSU6Ch5i9PgBkcU=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 h1:SciGFVNZ4mHdm7gpD1dgZYnCuVdX1s+lFTg4+4DOy70=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.9/go.mod h1:LrlIndBDdjA/EeXeyNBle+gyCwTlizzW5ycgWnvIxkk=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.5/go.mod h1:iW40X4QBmUxdP+fZNOpfmkdMZqsovezbAeO+Ubiv2pk=
-github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
+github.com/aws/smithy-go v1.24.0 h1:LpilSUItNPFr1eY85RYgTIg5eIEPtvFbskaFcmmIUnk=
-github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/smithy-go v1.24.0/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
-github.com/aymanbagabas/go-udiff v0.4.1 h1:OEIrQ8maEeDBXQDoGCbbTTXYJMYRCRO1fnodZ12Gv5o=
+github.com/aymanbagabas/go-udiff v0.3.1 h1:LV+qyBQ2pqe0u42ZsUEtPiCaUoqgA9gYRDs3vj1nolY=
-github.com/aymanbagabas/go-udiff v0.4.1/go.mod h1:0L9PGwj20lrtmEMeyw4WKJ/TMyDtvAoK9bf2u/mNo3w=
+github.com/aymanbagabas/go-udiff v0.3.1/go.mod h1:G0fsKmG+P6ylD0r6N/KgQD/nWzgfnl8ZBcNLgcbrw8E=
 github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d h1:xDfNPAt8lFiC1UJrqV3uuy861HCTo708pDMbjHHdCas=
 github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d/go.mod h1:6QX/PXZ00z/TKoufEY6K/a0k6AhaJrQKdFe6OfVXsa4=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chainguard-dev/git-urls v1.0.2 h1:pSpT7ifrpc5X55n4aTTm7FFUE+ZQHKiqpiwNkJrVcKQ=
 github.com/chainguard-dev/git-urls v1.0.2/go.mod h1:rbGgj10OS7UgZlbzdUQIQpT0k/D4+An04HJY7Ol+Y/o=
-github.com/charmbracelet/colorprofile v0.4.2 h1:BdSNuMjRbotnxHSfxy+PCSa4xAmz7szw70ktAtWRYrY=
+github.com/charmbracelet/colorprofile v0.3.3 h1:DjJzJtLP6/NZ8p7Cgjno0CKGr7wwRJGxWUwh2IyhfAI=
-github.com/charmbracelet/colorprofile v0.4.2/go.mod h1:0rTi81QpwDElInthtrQ6Ni7cG0sDtwAd4C4le060fT8=
+github.com/charmbracelet/colorprofile v0.3.3/go.mod h1:nB1FugsAbzq284eJcjfah2nhdSLppN2NqvfotkfRYP4=
-github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8 h1:eyFRbAmexyt43hVfeyBofiGSEmJ7krjLOYt/9CF5NKA=
+github.com/charmbracelet/ultraviolet v0.0.0-20251116181749-377898bcce38 h1:7Rs87fbKJoIIxsQS8YKJYGYa0tlsDwwb0twQjV1KB+g=
-github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8/go.mod h1:SQpCTRNBtzJkwku5ye4S3HEuthAlGy2n9VXZnWkEW98=
+github.com/charmbracelet/ultraviolet v0.0.0-20251116181749-377898bcce38/go.mod h1:6lfcr3MNP+kZR25sF1nQwJFuQnNYBlFy3PGX5rvslXc=
-github.com/charmbracelet/x/ansi v0.11.6 h1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8=
+github.com/charmbracelet/x/ansi v0.11.1 h1:iXAC8SyMQDJgtcz9Jnw+HU8WMEctHzoTAETIeA3JXMk=
-github.com/charmbracelet/x/ansi v0.11.6/go.mod h1:2JNYLgQUsyqaiLovhU2Rv/pb8r6ydXKS3NIttu3VGZQ=
+github.com/charmbracelet/x/ansi v0.11.1/go.mod h1:M49wjzpIujwPceJ+t5w3qh2i87+HRtHohgb5iTyepL0=
 github.com/charmbracelet/x/exp/golden v0.0.0-20250806222409-83e3a29d542f h1:pk6gmGpCE7F3FcjaOEKYriCvpmIN4+6OS/RD0vm4uIA=
 github.com/charmbracelet/x/exp/golden v0.0.0-20250806222409-83e3a29d542f/go.mod h1:IfZAMTHB6XkZSeXUqriemErjAWCCzT0LwjKFYCZyw0I=
 github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
@@ -106,12 +106,14 @@ github.com/charmbracelet/x/termios v0.1.1 h1:o3Q2bT8eqzGnGPOYheoYS8eEleT5ZVNYNy8
 github.com/charmbracelet/x/termios v0.1.1/go.mod h1:rB7fnv1TgOPOyyKRJ9o+AsTU/vK5WHJ2ivHeut/Pcwo=
 github.com/charmbracelet/x/windows v0.2.2 h1:IofanmuvaxnKHuV04sC0eBy/smG6kIKrWG2/jYn2GuM=
 github.com/charmbracelet/x/windows v0.2.2/go.mod h1:/8XtdKZzedat74NQFn0NGlGL4soHB0YQZrETF96h75k=
-github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=
+github.com/clipperhouse/displaywidth v0.5.0 h1:AIG5vQaSL2EKqzt0M9JMnvNxOCRTKUc4vUnLWGgP89I=
-github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
+github.com/clipperhouse/displaywidth v0.5.0/go.mod h1:R+kHuzaYWFkTm7xoMmK1lFydbci4X2CicfbGstSGg0o=
-github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
+github.com/clipperhouse/stringish v0.1.1 h1:+NSqMOr3GR6k1FdRhhnXrLfztGzuG+VuFDfatpWHKCs=
-github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
+github.com/clipperhouse/stringish v0.1.1/go.mod h1:v/WhFtE1q0ovMta2+m+UbpZ+2/HEXNWYXQgCt4hdOzA=
-github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w=
+github.com/clipperhouse/uax29/v2 v2.3.0 h1:SNdx9DVUqMoBuBoW3iLOj4FQv3dN5mDtuqwuhIGpJy4=
-github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
+github.com/clipperhouse/uax29/v2 v2.3.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
+github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls=
+github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
 github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
 github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -126,22 +128,22 @@ github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkp
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/elliotchance/orderedmap/v3 v3.1.0 h1:j4DJ5ObEmMBt/lcwIecKcoRxIQUEnw0L804lXYDt/pg=
 github.com/elliotchance/orderedmap/v3 v3.1.0/go.mod h1:G+Hc2RwaZvJMcS4JpGCOyViCnGeKf0bTYCGTO4uhjSo=
-github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
+github.com/envoyproxy/go-control-plane v0.13.4 h1:zEqyPVyku6IvWCFwux4x9RxkLOMUL+1vC9xUFv5l2/M=
-github.com/envoyproxy/go-control-plane v0.14.0/go.mod h1:NcS5X47pLl/hfqxU70yPwL9ZMkUlwlKxtAohpi2wBEU=
+github.com/envoyproxy/go-control-plane v0.13.4/go.mod h1:kDfuBlDVsSj2MjrLEtRWtHlsWIFcGyB2RMO44Dc5GZA=
-github.com/envoyproxy/go-control-plane/envoy v1.36.0 h1:yg/JjO5E7ubRyKX3m07GF3reDNEnfOboJ0QySbH736g=
+github.com/envoyproxy/go-control-plane/envoy v1.32.4 h1:jb83lalDRZSpPWW2Z7Mck/8kXZ5CQAFYVjQcdVIr83A=
-github.com/envoyproxy/go-control-plane/envoy v1.36.0/go.mod h1:ty89S1YCCVruQAm9OtKeEkQLTb+Lkz0k8v9W0Oxsv98=
+github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
-github.com/envoyproxy/protoc-gen-validate v1.3.0 h1:TvGH1wof4H33rezVKWSpqKz5NXWg5VPuZ0uONDT6eb4=
+github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
-github.com/envoyproxy/protoc-gen-validate v1.3.0/go.mod h1:HvYl7zwPa5mffgyeTUHA9zHIH36nmrm7oCbo4YKoSWA=
+github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
-github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
-github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.2 h1:TK/7NqRQZfgAh+Td8AlsrvtPoUyiHh0LqVvokh+1vHI=
-github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.2/go.mod h1:22cg9HWM1pOlnRiY+9cQYJ9XHmya1bYW8OeDM6Ku6Oo=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -163,26 +165,26 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=
+github.com/googleapis/enterprise-certificate-proxy v0.3.7 h1:zrn2Ee/nWmHulBx5sAVrGgAa0f2/R35S4DJwfFaUPFQ=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
+github.com/googleapis/enterprise-certificate-proxy v0.3.7/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
-github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc=
+github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
-github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY=
+github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
-github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72 h1:vTCWu1wbdYo7PEZFem/rlr01+Un+wwVmI7wiegFdRLk=
+github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.70 h1:0HADrxxqaQkGycO1JoUUA+B4FnIkuo8d2bz/hSaTFFQ=
-github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72/go.mod h1:Vn+BBgKQHVQYdVQ4NZDICE1Brb+JfaONyDHr3q07oQc=
+github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.70/go.mod h1:fm2FdDCzJdtbXF7WKAMvBb5NEPouXPHFbGNYs9ShFns=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-getter v1.8.6 h1:9sQboWULaydVphxc4S64oAI4YqpuCk7nPmvbk131ebY=
+github.com/hashicorp/go-getter v1.8.4 h1:hGEd2xsuVKgwkMtPVufq73fAmZU/x65PPcqH3cb0D9A=
-github.com/hashicorp/go-getter v1.8.6/go.mod h1:nVH12eOV2P58dIiL3rsU6Fh3wLeJEKBOJzhMmzlSWoo=
+github.com/hashicorp/go-getter v1.8.4/go.mod h1:x27pPGSg9kzoB147QXI8d/nDvp2IgYGcwuRjpaXE9Yg=
 github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4=
 github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
-github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
-github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
+github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM=
-github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
 github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
@@ -198,8 +200,8 @@ github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHP
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-runewidth v0.0.21 h1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w=
+github.com/mattn/go-runewidth v0.0.19 h1:v++JhqYnZuu5jSKrk9RbgF5v4CGUjqRfBm05byFGLdw=
-github.com/mattn/go-runewidth v0.0.21/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mattn/go-runewidth v0.0.19/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
@@ -214,8 +216,8 @@ github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/puzpuzpuz/xsync/v4 v4.4.0 h1:vlSN6/CkEY0pY8KaB0yqo/pCLZvp9nhdbBdjipT4gWo=
+github.com/puzpuzpuz/xsync/v4 v4.3.0 h1:w/bWkEJdYuRNYhHn5eXnIT8LzDM1O629X1I9MJSkD7Q=
-github.com/puzpuzpuz/xsync/v4 v4.4.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
+github.com/puzpuzpuz/xsync/v4 v4.3.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
@@ -229,8 +231,8 @@ github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
+github.com/spiffe/go-spiffe/v2 v2.5.0 h1:N2I01KCUkv1FAjZXJMwh95KK1ZIQLYbPfhaxw8WS0hE=
-github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
+github.com/spiffe/go-spiffe/v2 v2.5.0/go.mod h1:P+NxobPc6wXhVtINNtFjNWGBTreew1GBUCwT2wPmb7g=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
@@ -248,67 +250,66 @@ github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavM
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
 github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
-github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
+github.com/zeebo/errs v1.4.0 h1:XNdoD/RRMKP7HD0UhJnIzUy74ISdGGxURlYG8HSWSfM=
-github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
+github.com/zeebo/errs v1.4.0/go.mod h1:sgbWHsvVuTPHcqJJGQ1WhI5KbWlHYz+2+2C/LSEtCw4=
+github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
+github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/detectors/gcp v1.39.0 h1:kWRNZMsfBHZ+uHjiH4y7Etn2FK26LAGkNFw7RHv1DhE=
+go.opentelemetry.io/contrib/detectors/gcp v1.36.0 h1:F7q2tNlCaHY9nMKHR6XH9/qkp8FktLnIcy6jJNyOCQw=
-go.opentelemetry.io/contrib/detectors/gcp v1.39.0/go.mod h1:t/OGqzHBa5v6RHZwrDBJ2OirWc+4q/w2fTbLZwAKjTk=
+go.opentelemetry.io/contrib/detectors/gcp v1.36.0/go.mod h1:IbBN8uAIIx734PTonTPxAxnjc2pQTxWNkwfstZ+6H2k=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 h1:YH4g8lQroajqUwWbq/tr2QX1JFmEXaDLgG+ew9bLMWo=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0/go.mod h1:fvPi2qXDqFs8M4B4fmJhE92TyQs9Ydjlg3RvfUp+NbQ=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
+go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0 h1:ZrPRak/kS4xI3AVXy8F7pipuDXmDsrO8Lg+yQjBLjw0=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.38.0 h1:wm/Q0GAAykXv83wzcKzGGqAnnfLFyFe7RslekZuv+VI=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0/go.mod h1:3y6kQCWztq6hyW8Z9YxQDDm0Je9AJoFar2G0yDcmhRk=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.38.0/go.mod h1:ra3Pa40+oKjvYh+ZD3EdxFZZB0xdMfuileHAm4nNN7w=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
+go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
+go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
+go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
+go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
+go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
+go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
+go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v4 v4.0.0-rc.3 h1:3h1fjsh1CTAPjW7q/EMe+C8shx5d8ctzZTrLcs/j8Go=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v4 v4.0.0-rc.3/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
+golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
 golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw=
 golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.33.0 h1:4Q+qn+E5z8gPRJfmRy7C2gGG3T4jIprK6aSYgTXGRpo=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/oauth2 v0.33.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
+golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
-golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
-golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
-golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
 gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/api v0.271.0 h1:cIPN4qcUc61jlh7oXu6pwOQqbJW2GqYh5PS6rB2C/JY=
+google.golang.org/api v0.256.0 h1:u6Khm8+F9sxbCTYNoBHg6/Hwv0N/i+V94MvkOSor6oI=
-google.golang.org/api v0.271.0/go.mod h1:CGT29bhwkbF+i11qkRUJb2KMKqcJ1hdFceEIRd9u64Q=
+google.golang.org/api v0.256.0/go.mod h1:KIgPhksXADEKJlnEoRa9qAII4rXcy40vfI8HRqcU964=
-google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 h1:VQZ/yAbAtjkHgH80teYd2em3xtIkkHd7ZhqfH2N9CsM=
+google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9 h1:LvZVVaPE0JSqL+ZWb6ErZfnEOKIqqFWUJE2D0fObSmc=
-google.golang.org/genproto v0.0.0-20260128011058-8636f8732409/go.mod h1:rxKD3IEILWEu3P44seeNOAwZN4SaoKaQ/2eTg4mM6EM=
+google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9/go.mod h1:QFOrLhdAe2PsTp3vQY4quuLKTi9j3XG3r6JPPaw7MSc=
-google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 h1:7ei4lp52gK1uSejlA8AZl5AJjeLUOHBQscRQZUgAcu0=
+google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba h1:B14OtaXuMaCQsl2deSvNkyPKIzq3BjfxQp8d00QyWx4=
-google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20/go.mod h1:ZdbssH/1SOVnjnDlXzxDHK2MCidiqXtbYccJNzNYPEE=
+google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba/go.mod h1:G5IanEx8/PgI9w6CFcYQf7jMtHQhZruvfM1i3qOqk5U=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251111163417-95abcf5c77ba h1:UKgtfRM7Yh93Sya0Fo8ZzhDP4qBckrrxEr2oF5UIVb8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251111163417-95abcf5c77ba/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
-google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
+google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A=
-google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -319,5 +320,5 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 mvdan.cc/sh/moreinterp v0.0.0-20260120230322-19def062a997 h1:3bbJwtPFh98dJ6lxRdR3eLHTH1CmR3BcU6TriIMiXjE=
 mvdan.cc/sh/moreinterp v0.0.0-20260120230322-19def062a997/go.mod h1:Qy/zdaMDxq9sT72Gi43K3gsV+TtTohyDO3f1cyBVwuo=
-mvdan.cc/sh/v3 v3.13.1 h1:DP3TfgZhDkT7lerUdnp6PTGKyxxzz6T+cOlY/xEvfWk=
+mvdan.cc/sh/v3 v3.12.1-0.20260124232039-e74afc18e65b h1:PUPnLxbDzRO9kg/03l7TZk7+ywTv7FxmOhDHOtOdOtk=
-mvdan.cc/sh/v3 v3.13.1/go.mod h1:lXJ8SexMvEVcHCoDvAGLZgFJ9Wsm2sulmoNEXGhYZD0=
+mvdan.cc/sh/v3 v3.12.1-0.20260124232039-e74afc18e65b/go.mod h1:mencVHx2sy9XZG5wJbCA9nRUOE3zvMtoRXOmXMxH7sc=

internal/env/env.go

@@ -3,9 +3,7 @@ package env
 import (
 	"fmt"
 	"os"
-	"strconv"
 	"strings"
-	"time"
 
 	"github.com/go-task/task/v3/experiments"
 	"github.com/go-task/task/v3/taskfile/ast"
@@ -63,63 +61,3 @@ func isTypeAllowed(v any) bool {
 func GetTaskEnv(key string) string {
 	return os.Getenv(taskVarPrefix + key)
 }
-
-// GetTaskEnvBool returns the boolean value of a TASK_ prefixed env var.
-// Returns the value and true if set and valid, or false and false if not set or invalid.
-func GetTaskEnvBool(key string) (bool, bool) {
-	v := GetTaskEnv(key)
-	if v == "" {
-		return false, false
-	}
-	b, err := strconv.ParseBool(v)
-	return b, err == nil
-}
-
-// GetTaskEnvInt returns the integer value of a TASK_ prefixed env var.
-// Returns the value and true if set and valid, or 0 and false if not set or invalid.
-func GetTaskEnvInt(key string) (int, bool) {
-	v := GetTaskEnv(key)
-	if v == "" {
-		return 0, false
-	}
-	i, err := strconv.Atoi(v)
-	return i, err == nil
-}
-
-// GetTaskEnvDuration returns the duration value of a TASK_ prefixed env var.
-// Returns the value and true if set and valid, or 0 and false if not set or invalid.
-func GetTaskEnvDuration(key string) (time.Duration, bool) {
-	v := GetTaskEnv(key)
-	if v == "" {
-		return 0, false
-	}
-	d, err := time.ParseDuration(v)
-	return d, err == nil
-}
-
-// GetTaskEnvString returns the string value of a TASK_ prefixed env var.
-// Returns the value and true if set (non-empty), or empty string and false if not set.
-func GetTaskEnvString(key string) (string, bool) {
-	v := GetTaskEnv(key)
-	return v, v != ""
-}
-
-// GetTaskEnvStringSlice returns a comma-separated list from a TASK_ prefixed env var.
-// Returns the slice and true if set (non-empty), or nil and false if not set.
-func GetTaskEnvStringSlice(key string) ([]string, bool) {
-	v := GetTaskEnv(key)
-	if v == "" {
-		return nil, false
-	}
-	parts := strings.Split(v, ",")
-	result := make([]string, 0, len(parts))
-	for _, p := range parts {
-		if trimmed := strings.TrimSpace(p); trimmed != "" {
-			result = append(result, trimmed)
-		}
-	}
-	if len(result) == 0 {
-		return nil, false
-	}
-	return result, true
-}

internal/fingerprint/glob.go

@@ -2,7 +2,6 @@ package fingerprint
 
 import (
 	"os"
-	"path/filepath"
 	"sort"
 
 	"github.com/go-task/task/v3/internal/execext"
@@ -51,8 +50,7 @@ func collectKeys(m map[string]bool) []string {
 	keys := make([]string, 0, len(m))
 	for k, v := range m {
 		if v {
-			// Normalize path separators for consistent sorting across platforms
+			keys = append(keys, k)
-			keys = append(keys, filepath.ToSlash(k))
 		}
 	}
 	sort.Strings(keys)

internal/fingerprint/sources_checksum.go

@@ -53,7 +53,6 @@ func (checker *ChecksumChecker) IsUpToDate(t *ast.Task) (bool, error) {
 	if len(t.Generates) > 0 {
 		// For each specified 'generates' field, check whether the files actually exist
 		for _, g := range t.Generates {
-			// Exclusion patterns don't represent output files; skip them.
 			if g.Negate {
 				continue
 			}

internal/fingerprint/sources_timestamp.go

@@ -32,28 +32,6 @@ func (checker *TimestampChecker) IsUpToDate(t *ast.Task) (bool, error) {
 	if err != nil {
 		return false, nil
 	}
-
-	// If generates are declared, ensure they all exist. A missing generated
-	// file means the task must run regardless of timestamps.
-	if len(t.Generates) > 0 {
-		for _, g := range t.Generates {
-			// Exclusion patterns don't represent output files; skip them.
-			if g.Negate {
-				continue
-			}
-			files, err := glob(t.Dir, g.Glob)
-			if os.IsNotExist(err) {
-				return false, nil
-			}
-			if err != nil {
-				return false, err
-			}
-			if len(files) == 0 {
-				return false, nil
-			}
-		}
-	}
-
 	generates, err := Globs(t.Dir, t.Generates)
 	if err != nil {
 		return false, nil

internal/flags/flags.go

@@ -130,15 +130,15 @@ func init() {
 	pflag.BoolVar(&Status, "status", false, "Exits with non-zero exit code if any of the given tasks is not up-to-date.")
 	pflag.BoolVar(&NoStatus, "no-status", false, "Ignore status when listing tasks as JSON")
 	pflag.BoolVar(&Nested, "nested", false, "Nest namespaces when listing tasks as JSON")
-	pflag.BoolVar(&Insecure, "insecure", getConfig(config, "REMOTE_INSECURE", func() *bool { return config.Remote.Insecure }, false), "Forces Task to download Taskfiles over insecure connections.")
+	pflag.BoolVar(&Insecure, "insecure", getConfig(config, func() *bool { return config.Remote.Insecure }, false), "Forces Task to download Taskfiles over insecure connections.")
 	pflag.BoolVarP(&Watch, "watch", "w", false, "Enables watch of the given task.")
-	pflag.BoolVarP(&Verbose, "verbose", "v", getConfig(config, "VERBOSE", func() *bool { return config.Verbose }, false), "Enables verbose mode.")
+	pflag.BoolVarP(&Verbose, "verbose", "v", getConfig(config, func() *bool { return config.Verbose }, false), "Enables verbose mode.")
-	pflag.BoolVarP(&Silent, "silent", "s", getConfig(config, "SILENT", func() *bool { return config.Silent }, false), "Disables echoing.")
+	pflag.BoolVarP(&Silent, "silent", "s", false, "Disables echoing.")
-	pflag.BoolVar(&DisableFuzzy, "disable-fuzzy", getConfig(config, "DISABLE_FUZZY", func() *bool { return config.DisableFuzzy }, false), "Disables fuzzy matching for task names.")
+	pflag.BoolVar(&DisableFuzzy, "disable-fuzzy", getConfig(config, func() *bool { return config.DisableFuzzy }, false), "Disables fuzzy matching for task names.")
-	pflag.BoolVarP(&AssumeYes, "yes", "y", getConfig(config, "ASSUME_YES", func() *bool { return nil }, false), "Assume \"yes\" as answer to all prompts.")
+	pflag.BoolVarP(&AssumeYes, "yes", "y", false, "Assume \"yes\" as answer to all prompts.")
-	pflag.BoolVar(&Interactive, "interactive", getConfig(config, "INTERACTIVE", func() *bool { return config.Interactive }, false), "Prompt for missing required variables.")
+	pflag.BoolVar(&Interactive, "interactive", getConfig(config, func() *bool { return config.Interactive }, false), "Prompt for missing required variables.")
 	pflag.BoolVarP(&Parallel, "parallel", "p", false, "Executes tasks provided on command line in parallel.")
-	pflag.BoolVarP(&Dry, "dry", "n", getConfig(config, "DRY", func() *bool { return nil }, false), "Compiles and prints tasks in the order that they would be run, without executing them.")
+	pflag.BoolVarP(&Dry, "dry", "n", false, "Compiles and prints tasks in the order that they would be run, without executing them.")
 	pflag.BoolVar(&Summary, "summary", false, "Show summary about a task.")
 	pflag.BoolVarP(&ExitCode, "exit-code", "x", false, "Pass-through the exit code of the task command.")
 	pflag.StringVarP(&Dir, "dir", "d", "", "Sets the directory in which Task will execute and look for a Taskfile.")
@@ -147,10 +147,10 @@ func init() {
 	pflag.StringVar(&Output.Group.Begin, "output-group-begin", "", "Message template to print before a task's grouped output.")
 	pflag.StringVar(&Output.Group.End, "output-group-end", "", "Message template to print after a task's grouped output.")
 	pflag.BoolVar(&Output.Group.ErrorOnly, "output-group-error-only", false, "Swallow output from successful tasks.")
-	pflag.BoolVarP(&Color, "color", "c", getConfig(config, "COLOR", func() *bool { return config.Color }, true), "Colored output. Enabled by default. Set flag to false or use NO_COLOR=1 to disable.")
+	pflag.BoolVarP(&Color, "color", "c", getConfig(config, func() *bool { return config.Color }, true), "Colored output. Enabled by default. Set flag to false or use NO_COLOR=1 to disable.")
-	pflag.IntVarP(&Concurrency, "concurrency", "C", getConfig(config, "CONCURRENCY", func() *int { return config.Concurrency }, 0), "Limit number of tasks to run concurrently.")
+	pflag.IntVarP(&Concurrency, "concurrency", "C", getConfig(config, func() *int { return config.Concurrency }, 0), "Limit number of tasks to run concurrently.")
 	pflag.DurationVarP(&Interval, "interval", "I", 0, "Interval to watch for changes.")
-	pflag.BoolVarP(&Failfast, "failfast", "F", getConfig(config, "FAILFAST", func() *bool { return &config.Failfast }, false), "When running tasks in parallel, stop all tasks if one fails.")
+	pflag.BoolVarP(&Failfast, "failfast", "F", getConfig(config, func() *bool { return &config.Failfast }, false), "When running tasks in parallel, stop all tasks if one fails.")
 	pflag.BoolVarP(&Global, "global", "g", false, "Runs global Taskfile, from $HOME/{T,t}askfile.{yml,yaml}.")
 	pflag.BoolVar(&Experiments, "experiments", false, "Lists all the available experiments and whether or not they are enabled.")
 
@@ -165,21 +165,21 @@ func init() {
 	// Remote Taskfiles experiment will adds the "download" and "offline" flags
 	if experiments.RemoteTaskfiles.Enabled() {
 		pflag.BoolVar(&Download, "download", false, "Downloads a cached version of a remote Taskfile.")
-		pflag.BoolVar(&Offline, "offline", getConfig(config, "REMOTE_OFFLINE", func() *bool { return config.Remote.Offline }, false), "Forces Task to only use local or cached Taskfiles.")
+		pflag.BoolVar(&Offline, "offline", getConfig(config, func() *bool { return config.Remote.Offline }, false), "Forces Task to only use local or cached Taskfiles.")
-		pflag.StringSliceVar(&TrustedHosts, "trusted-hosts", getConfig(config, "REMOTE_TRUSTED_HOSTS", func() *[]string { return &config.Remote.TrustedHosts }, nil), "List of trusted hosts for remote Taskfiles (comma-separated).")
+		pflag.StringSliceVar(&TrustedHosts, "trusted-hosts", getConfig(config, func() *[]string { return &config.Remote.TrustedHosts }, nil), "List of trusted hosts for remote Taskfiles (comma-separated).")
-		pflag.DurationVar(&Timeout, "timeout", getConfig(config, "REMOTE_TIMEOUT", func() *time.Duration { return config.Remote.Timeout }, time.Second*10), "Timeout for downloading remote Taskfiles.")
+		pflag.DurationVar(&Timeout, "timeout", getConfig(config, func() *time.Duration { return config.Remote.Timeout }, time.Second*10), "Timeout for downloading remote Taskfiles.")
 		pflag.BoolVar(&ClearCache, "clear-cache", false, "Clear the remote cache.")
-		pflag.DurationVar(&CacheExpiryDuration, "expiry", getConfig(config, "REMOTE_CACHE_EXPIRY", func() *time.Duration { return config.Remote.CacheExpiry }, 0), "Expiry duration for cached remote Taskfiles.")
+		pflag.DurationVar(&CacheExpiryDuration, "expiry", getConfig(config, func() *time.Duration { return config.Remote.CacheExpiry }, 0), "Expiry duration for cached remote Taskfiles.")
-		pflag.StringVar(&RemoteCacheDir, "remote-cache-dir", getConfig(config, "REMOTE_CACHE_DIR", func() *string { return config.Remote.CacheDir }, env.GetTaskEnv("REMOTE_DIR")), "Directory to cache remote Taskfiles.")
+		pflag.StringVar(&RemoteCacheDir, "remote-cache-dir", getConfig(config, func() *string { return config.Remote.CacheDir }, env.GetTaskEnv("REMOTE_DIR")), "Directory to cache remote Taskfiles.")
-		pflag.StringVar(&CACert, "cacert", getConfig(config, "REMOTE_CACERT", func() *string { return config.Remote.CACert }, ""), "Path to a custom CA certificate for HTTPS connections.")
+		pflag.StringVar(&CACert, "cacert", getConfig(config, func() *string { return config.Remote.CACert }, ""), "Path to a custom CA certificate for HTTPS connections.")
-		pflag.StringVar(&Cert, "cert", getConfig(config, "REMOTE_CERT", func() *string { return config.Remote.Cert }, ""), "Path to a client certificate for HTTPS connections.")
+		pflag.StringVar(&Cert, "cert", getConfig(config, func() *string { return config.Remote.Cert }, ""), "Path to a client certificate for HTTPS connections.")
-		pflag.StringVar(&CertKey, "cert-key", getConfig(config, "REMOTE_CERT_KEY", func() *string { return config.Remote.CertKey }, ""), "Path to a client certificate key for HTTPS connections.")
+		pflag.StringVar(&CertKey, "cert-key", getConfig(config, func() *string { return config.Remote.CertKey }, ""), "Path to a client certificate key for HTTPS connections.")
 	}
 	pflag.Parse()
 
 	// Auto-detect color based on environment when not explicitly configured
-	// Priority: CLI flag > TASK_COLOR env > taskrc config > NO_COLOR > FORCE_COLOR/CI > default
+	// Priority: CLI flag > taskrc config > NO_COLOR > FORCE_COLOR/CI > default
-	colorExplicitlySet := pflag.Lookup("color").Changed || env.GetTaskEnv("COLOR") != "" || (config != nil && config.Color != nil)
+	colorExplicitlySet := pflag.Lookup("color").Changed || (config != nil && config.Color != nil)
 	if !colorExplicitlySet {
 		if os.Getenv("NO_COLOR") != "" {
 			Color = false
@@ -311,45 +311,15 @@ func (o *flagsOption) ApplyToExecutor(e *task.Executor) {
 	)
 }
 
-// getConfig extracts a config value with priority: env var > taskrc config > fallback
+// getConfig extracts a config value directly from a pointer field with a fallback default
-func getConfig[T any](config *taskrcast.TaskRC, envKey string, fieldFunc func() *T, fallback T) T {
+func getConfig[T any](config *taskrcast.TaskRC, fieldFunc func() *T, fallback T) T {
-	if envKey != "" {
+	if config == nil {
-		if val, ok := getEnvAs[T](envKey); ok {
+		return fallback
-			return val
-		}
 	}
-	if config != nil {
+
-		if field := fieldFunc(); field != nil {
+	field := fieldFunc()
-			return *field
+	if field != nil {
-		}
+		return *field
 	}
 	return fallback
 }
-
-// getEnvAs parses a TASK_ prefixed env var as type T
-func getEnvAs[T any](envKey string) (T, bool) {
-	var zero T
-	switch any(zero).(type) {
-	case bool:
-		if val, ok := env.GetTaskEnvBool(envKey); ok {
-			return any(val).(T), true
-		}
-	case int:
-		if val, ok := env.GetTaskEnvInt(envKey); ok {
-			return any(val).(T), true
-		}
-	case time.Duration:
-		if val, ok := env.GetTaskEnvDuration(envKey); ok {
-			return any(val).(T), true
-		}
-	case string:
-		if val, ok := env.GetTaskEnvString(envKey); ok {
-			return any(val).(T), true
-		}
-	case []string:
-		if val, ok := env.GetTaskEnvStringSlice(envKey); ok {
-			return any(val).(T), true
-		}
-	}
-	return zero, false
-}

internal/fsext/fs.go

@@ -108,10 +108,10 @@ func SearchAll(entrypoint, dir string, possibleFilenames []string) ([]string, er
 		}
 	}
 	paths, err := SearchNPathRecursively(dir, possibleFilenames, -1)
-	// The call to SearchNPathRecursively is ambiguous and may return
+	if err != nil {
-	// os.ErrPermission if its search ends, however it may have still
+		return nil, err
-	// returned valid paths. Caller may choose to ignore that error.
+	}
-	return append(entrypoints, paths...), err
+	return append(entrypoints, paths...), nil
 }
 
 // SearchPath will check if a file at the given path exists or not. If it does,
@@ -153,16 +153,13 @@ func SearchPath(path string, possibleFilenames []string) (string, error) {
 // also check if the user ID of the directory changes and abort if it does.
 func SearchPathRecursively(path string, possibleFilenames []string) (string, error) {
 	paths, err := SearchNPathRecursively(path, possibleFilenames, 1)
-	if len(paths) > 0 {
+	if err != nil {
-		// Regardless of the error, return the first possible filename.
+		return "", err
-		return paths[0], nil
-	} else {
-		if err != nil {
-			return "", err
-		} else {
-			return "", os.ErrNotExist
-		}
 	}
+	if len(paths) == 0 {
+		return "", os.ErrNotExist
+	}
+	return paths[0], nil
 }
 
 // SearchNPathRecursively walks up the directory tree starting at the given
@@ -191,13 +188,10 @@ func SearchNPathRecursively(path string, possibleFilenames []string, n int) ([]s
 			return nil, err
 		}
 
-		// If the user id of the directory changes indicate a permission error, otherwise
+		// Error if we reached the root directory and still haven't found a file
-		// the calling code will infer an error condition based on the accumulated
+		// OR if the user id of the directory changes
-		// contents of paths.
+		if path == parentPath || (parentOwner != owner) {
-		if path == parentPath {
 			return paths, nil
-		} else if parentOwner != owner {
-			return paths, os.ErrPermission
 		}
 
 		owner = parentOwner

internal/summary/summary.go

@@ -231,7 +231,7 @@ func formatMap(m map[string]any, indent int) string {
 	spaces := strings.Repeat(" ", indent)
 
 	for k, v := range m {
-		result.WriteString(fmt.Sprintf("%s%s: %v\n", spaces, k, v)) //nolint:staticcheck
+		result.WriteString(fmt.Sprintf("%s%s: %v\n", spaces, k, v))
 	}
 
 	return result.String()
@@ -247,17 +247,15 @@ func printTaskRequires(l *logger.Logger, t *ast.Task) {
 	l.Outf(logger.Default, "  vars:\n")
 
 	for _, v := range t.Requires.Vars {
-		if v.Enum != nil && len(v.Enum.Value) > 0 {
+		// If the variable has enum constraints, format accordingly
+		if len(v.Enum) > 0 {
 			l.Outf(logger.Yellow, "    - %s:\n", v.Name)
 			l.Outf(logger.Yellow, "        enum:\n")
-			for _, enumValue := range v.Enum.Value {
+			for _, enumValue := range v.Enum {
 				l.Outf(logger.Yellow, "          - %s\n", enumValue)
 			}
-		} else if v.Enum != nil && v.Enum.Ref != "" {
-			l.Outf(logger.Yellow, "    - %s:\n", v.Name)
-			l.Outf(logger.Yellow, "        enum:\n")
-			l.Outf(logger.Yellow, "          ref: %s\n", v.Enum.Ref)
 		} else {
+			// Simple required variable
 			l.Outf(logger.Yellow, "    - %s\n", v.Name)
 		}
 	}

internal/templater/funcs.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/davecgh/go-spew/spew"
 	"github.com/google/uuid"
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 	"mvdan.cc/sh/v3/shell"
 	"mvdan.cc/sh/v3/syntax"
 

internal/templater/secrets.go

@@ -1,70 +0,0 @@
-package templater
-
-import (
-	"github.com/go-task/task/v3/taskfile/ast"
-)
-
-// MaskSecrets replaces template placeholders with their values, masking secrets.
-// This function uses the Go templater to resolve all variables ({{.VAR}}) while
-// masking secret ones as "*****".
-func MaskSecrets(cmdTemplate string, vars *ast.Vars) string {
-	if vars == nil || vars.Len() == 0 {
-		return cmdTemplate
-	}
-
-	// Create a cache map with secrets masked
-	maskedVars := vars.DeepCopy()
-	for name, v := range maskedVars.All() {
-		if v.Secret {
-			// Replace secret value with mask
-			maskedVars.Set(name, ast.Var{
-				Value:  "*****",
-				Secret: true,
-			})
-		}
-	}
-
-	// Use the templater to resolve the template with masked secrets
-	cache := &Cache{Vars: maskedVars}
-	result := Replace(cmdTemplate, cache)
-
-	// If there was an error, return the original template
-	if cache.Err() != nil {
-		return cmdTemplate
-	}
-
-	return result
-}
-
-// MaskSecretsWithExtra is like MaskSecrets but also resolves extra variables (e.g., loop vars).
-func MaskSecretsWithExtra(cmdTemplate string, vars *ast.Vars, extra map[string]any) string {
-	if vars == nil || vars.Len() == 0 {
-		// Still need to resolve extra vars even if no vars
-		cache := &Cache{Vars: ast.NewVars()}
-		result := ReplaceWithExtra(cmdTemplate, cache, extra)
-		if cache.Err() != nil {
-			return cmdTemplate
-		}
-		return result
-	}
-
-	// Create a cache map with secrets masked
-	maskedVars := vars.DeepCopy()
-	for name, v := range maskedVars.All() {
-		if v.Secret {
-			maskedVars.Set(name, ast.Var{
-				Value:  "*****",
-				Secret: true,
-			})
-		}
-	}
-
-	cache := &Cache{Vars: maskedVars}
-	result := ReplaceWithExtra(cmdTemplate, cache, extra)
-
-	if cache.Err() != nil {
-		return cmdTemplate
-	}
-
-	return result
-}

internal/templater/templater.go

@@ -121,15 +121,14 @@ func ReplaceVar(v ast.Var, cache *Cache) ast.Var {
 
 func ReplaceVarWithExtra(v ast.Var, cache *Cache, extra map[string]any) ast.Var {
 	if v.Ref != "" {
-		return ast.Var{Value: ResolveRef(v.Ref, cache), Secret: v.Secret}
+		return ast.Var{Value: ResolveRef(v.Ref, cache)}
 	}
 	return ast.Var{
-		Value:  ReplaceWithExtra(v.Value, cache, extra),
+		Value: ReplaceWithExtra(v.Value, cache, extra),
-		Sh:     ReplaceWithExtra(v.Sh, cache, extra),
+		Sh:    ReplaceWithExtra(v.Sh, cache, extra),
-		Live:   v.Live,
+		Live:  v.Live,
-		Ref:    v.Ref,
+		Ref:   v.Ref,
-		Dir:    v.Dir,
+		Dir:   v.Dir,
-		Secret: v.Secret,
 	}
 }
 

internal/term/term.go

@@ -7,5 +7,5 @@ import (
 )
 
 func IsTerminal() bool {
-	return term.IsTerminal(int(os.Stdin.Fd())) && term.IsTerminal(int(os.Stdout.Fd())) //nolint:gosec
+	return term.IsTerminal(int(os.Stdin.Fd())) && term.IsTerminal(int(os.Stdout.Fd()))
 }

internal/version/version.txt

@@ -1 +1 @@
-3.50.0
+3.47.0

requires.go

@@ -81,7 +81,7 @@ func (e *Executor) promptDepsVars(calls []*Call) error {
 	e.promptedVars = ast.NewVars()
 
 	for _, v := range varsMap {
-		value, err := prompter.Prompt(v.Name, getEnumValues(v.Enum))
+		value, err := prompter.Prompt(v.Name, v.Enum)
 		if err != nil {
 			if errors.Is(err, input.ErrCancelled) {
 				return &errors.TaskCancelledByUserError{TaskName: "interactive prompt"}
@@ -120,7 +120,7 @@ func (e *Executor) promptTaskVars(t *ast.Task, call *Call) (bool, error) {
 	prompter := e.newPrompter()
 
 	for _, v := range missing {
-		value, err := prompter.Prompt(v.Name, getEnumValues(v.Enum))
+		value, err := prompter.Prompt(v.Name, v.Enum)
 		if err != nil {
 			if errors.Is(err, input.ErrCancelled) {
 				return false, &errors.TaskCancelledByUserError{TaskName: t.Name()}
@@ -168,7 +168,7 @@ func (e *Executor) areTaskRequiredVarsSet(t *ast.Task) error {
 	for i, v := range missing {
 		missingVars[i] = errors.MissingVar{
 			Name:          v.Name,
-			AllowedValues: getEnumValues(v.Enum),
+			AllowedValues: v.Enum,
 		}
 	}
 
@@ -187,12 +187,11 @@ func (e *Executor) areTaskRequiredVarsAllowedValuesSet(t *ast.Task) error {
 	for _, requiredVar := range t.Requires.Vars {
 		varValue, _ := t.Vars.Get(requiredVar.Name)
 
-		enumValues := getEnumValues(requiredVar.Enum)
 		value, isString := varValue.Value.(string)
-		if isString && len(enumValues) > 0 && !slices.Contains(enumValues, value) {
+		if isString && requiredVar.Enum != nil && !slices.Contains(requiredVar.Enum, value) {
 			notAllowedValuesVars = append(notAllowedValuesVars, errors.NotAllowedVar{
 				Value: value,
-				Enum:  enumValues,
+				Enum:  requiredVar.Enum,
 				Name:  requiredVar.Name,
 			})
 		}
@@ -207,10 +206,3 @@ func (e *Executor) areTaskRequiredVarsAllowedValuesSet(t *ast.Task) error {
 
 	return nil
 }
-
-func getEnumValues(e *ast.Enum) []string {
-	if e == nil {
-		return nil
-	}
-	return e.Value
-}

setup.go

@@ -13,9 +13,11 @@ import (
 	"github.com/sajari/fuzzy"
 
 	"github.com/go-task/task/v3/errors"
+	"github.com/go-task/task/v3/experiments"
 	"github.com/go-task/task/v3/internal/env"
 	"github.com/go-task/task/v3/internal/execext"
 	"github.com/go-task/task/v3/internal/filepathext"
+	"github.com/go-task/task/v3/internal/fsext"
 	"github.com/go-task/task/v3/internal/logger"
 	"github.com/go-task/task/v3/internal/output"
 	"github.com/go-task/task/v3/internal/version"
@@ -59,10 +61,12 @@ func (e *Executor) getRootNode() (taskfile.Node, error) {
 		taskfile.WithCert(e.Cert),
 		taskfile.WithCertKey(e.CertKey),
 	)
-	var taskNotFoundError errors.TaskfileNotFoundError
+	if os.IsNotExist(err) {
-	if errors.As(err, &taskNotFoundError) {
+		return nil, errors.TaskfileNotFoundError{
-		taskNotFoundError.AskInit = true
+			URI:     fsext.DefaultDir(e.Entrypoint, e.Dir),
-		return nil, taskNotFoundError
+			Walk:    true,
+			AskInit: true,
+		}
 	}
 	if err != nil {
 		return nil, err
@@ -101,7 +105,8 @@ func (e *Executor) readTaskfile(node taskfile.Node) error {
 		}
 		return err
 	}
-	if e.Taskfile, err = graph.Merge(); err != nil {
+	e.Graph = graph
+	if e.Taskfile, err = graph.Merge(experiments.ScopedTaskfiles.Enabled()); err != nil {
 		return err
 	}
 	return nil
@@ -223,6 +228,7 @@ func (e *Executor) setupCompiler() error {
 		UserWorkingDir: e.UserWorkingDir,
 		TaskfileEnv:    e.Taskfile.Env,
 		TaskfileVars:   e.Taskfile.Vars,
+		Graph:          e.Graph,
 		Logger:         e.Logger,
 	}
 	return nil

signals.go

@@ -15,7 +15,7 @@ const maxInterruptSignals = 3
 // time to do cleanup work.
 func (e *Executor) InterceptInterruptSignals() {
 	ch := make(chan os.Signal, maxInterruptSignals)
-	signal.Notify(ch, os.Interrupt, syscall.SIGTERM, syscall.SIGHUP)
+	signal.Notify(ch, os.Interrupt, syscall.SIGTERM)
 
 	go func() {
 		for i := range maxInterruptSignals {

task.go

@@ -148,20 +148,6 @@ func (e *Executor) RunTask(ctx context.Context, call *Call) error {
 		return nil
 	}
 
-	// Check required vars early (before template compilation) if we can't prompt.
-	// This gives a clear "missing required variables" error instead of a template error.
-	if !e.canPrompt() {
-		if err := e.areTaskRequiredVarsSet(t); err != nil {
-			return err
-		}
-	}
-
-	t, err = e.CompiledTask(call)
-	if err != nil {
-		return err
-	}
-
-	// Check if condition after CompiledTask so dynamic variables are resolved
 	if strings.TrimSpace(t.If) != "" {
 		if err := execext.RunCommand(ctx, &execext.RunCommandOptions{
 			Command: t.If,
@@ -173,7 +159,7 @@ func (e *Executor) RunTask(ctx context.Context, call *Call) error {
 		}
 	}
 
-	// Prompt for missing required vars after if check (avoid prompting if task won't run)
+	// Prompt for missing required vars (just-in-time for sequential task calls)
 	prompted, err := e.promptTaskVars(t, call)
 	if err != nil {
 		return err
@@ -190,6 +176,11 @@ func (e *Executor) RunTask(ctx context.Context, call *Call) error {
 		return err
 	}
 
+	t, err = e.CompiledTask(call)
+	if err != nil {
+		return err
+	}
+
 	if err := e.areTaskRequiredVarsAllowedValuesSet(t); err != nil {
 		return err
 	}
@@ -349,8 +340,6 @@ func (e *Executor) runDeferred(t *ast.Task, call *Call, i int, vars *ast.Vars, d
 		extra["EXIT_CODE"] = fmt.Sprintf("%d", *deferredExitCode)
 	}
 
-	// Resolve template with secrets masked for logging
-	cmd.LogCmd = templater.MaskSecretsWithExtra(cmd.Cmd, vars, extra)
 	cmd.Cmd = templater.ReplaceWithExtra(cmd.Cmd, cache, extra)
 	cmd.Task = templater.ReplaceWithExtra(cmd.Task, cache, extra)
 	cmd.If = templater.ReplaceWithExtra(cmd.If, cache, extra)
@@ -395,7 +384,7 @@ func (e *Executor) runCommand(ctx context.Context, t *ast.Task, call *Call, i in
 		}
 
 		if e.Verbose || (!call.Silent && !cmd.Silent && !t.IsSilent() && !e.Taskfile.Silent && !e.Silent) {
-			e.Logger.Errf(logger.Green, "task: [%s] %s\n", t.Name(), cmd.LogCmd)
+			e.Logger.Errf(logger.Green, "task: [%s] %s\n", t.Name(), cmd.Cmd)
 		}
 
 		if e.Dry {

task_test.go

@@ -88,14 +88,13 @@ func (tt *TaskTest) writeFixture(
 	if tt.fixtureTemplatingEnabled {
 		fixtureTemplateData := map[string]any{
 			"TEST_NAME": t.Name(),
-			"TEST_DIR":  filepath.ToSlash(wd),
+			"TEST_DIR":  wd,
 		}
 		// If the test has additional template data, copy it into the map
 		if tt.fixtureTemplateData != nil {
 			maps.Copy(fixtureTemplateData, tt.fixtureTemplateData)
 		}
-		// Normalize output before comparison (CRLF→LF, backslash→forward slash)
+		g.AssertWithTemplate(t, goldenFileName, fixtureTemplateData, b)
-		g.AssertWithTemplate(t, goldenFileName, fixtureTemplateData, normalizeOutput(b))
 	} else {
 		g.Assert(t, goldenFileName, b)
 	}
@@ -309,73 +308,6 @@ func PPSortedLines(t *testing.T, b []byte) []byte {
 	return []byte(strings.Join(lines, "\n") + "\n")
 }
 
-// normalizeOutput normalizes cross-platform differences for byte slice comparison:
-// - Converts CRLF and CR to LF (line endings)
-// - Converts backslashes to forward slashes (Windows paths)
-// - Handles escaped backslashes in JSON (\\) by converting to single forward slash
-func normalizeOutput(b []byte) []byte {
-	b = bytes.ReplaceAll(b, []byte("\r\n"), []byte("\n"))
-	b = bytes.ReplaceAll(b, []byte("\r"), []byte("\n"))
-	// First replace escaped backslashes (common in JSON), then single backslashes
-	b = bytes.ReplaceAll(b, []byte("\\\\"), []byte("/"))
-	b = bytes.ReplaceAll(b, []byte("\\"), []byte("/"))
-	return b
-}
-
-// normalizePathSeparators converts backslashes to forward slashes for cross-platform path comparison.
-func normalizePathSeparators(s string) string {
-	return strings.ReplaceAll(s, "\\", "/")
-}
-
-// NormalizedEqual compares two byte slices after normalizing output.
-// This is used as a custom goldie.EqualFn for cross-platform golden file tests.
-func NormalizedEqual(actual, expected []byte) bool {
-	return bytes.Equal(normalizeOutput(actual), normalizeOutput(expected))
-}
-
-func TestNormalizeOutput(t *testing.T) {
-	t.Parallel()
-	tests := []struct {
-		name     string
-		input    []byte
-		expected []byte
-	}{
-		{"CRLF to LF", []byte("line1\r\nline2\r\n"), []byte("line1\nline2\n")},
-		{"CR to LF", []byte("line1\rline2\r"), []byte("line1\nline2\n")},
-		{"Windows path", []byte(`D:\a\task\task`), []byte(`D:/a/task/task`)},
-		{"JSON escaped backslash", []byte(`{"path":"D:\\a\\task"}`), []byte(`{"path":"D:/a/task"}`)},
-		{"Mixed", []byte("D:\\a\\task\r\n"), []byte("D:/a/task\n")},
-		{"Unix path unchanged", []byte("/home/user/task\n"), []byte("/home/user/task\n")},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-			got := normalizeOutput(tt.input)
-			assert.Equal(t, tt.expected, got)
-		})
-	}
-}
-
-func TestNormalizePathSeparators(t *testing.T) {
-	t.Parallel()
-	tests := []struct {
-		name     string
-		input    string
-		expected string
-	}{
-		{"Windows path", `D:\a\task\task`, `D:/a/task/task`},
-		{"Unix path unchanged", `/home/user/task`, `/home/user/task`},
-		{"Mixed separators", `C:\Users/name\file`, `C:/Users/name/file`},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-			got := normalizePathSeparators(tt.input)
-			assert.Equal(t, tt.expected, got)
-		})
-	}
-}
-
 // SyncBuffer is a threadsafe buffer for testing.
 // Some times replace stdout/stderr with a buffer to capture output.
 // stdout and stderr are threadsafe, but a regular bytes.Buffer is not.
@@ -555,104 +487,6 @@ func TestStatusChecksum(t *testing.T) { // nolint:paralleltest // cannot run in
 	}
 }
 
-// TestStatusTimestamp is a regression test for https://github.com/go-task/task/issues/1230.
-// When using method: timestamp, deleting a generated file should cause the task to re-run,
-// not be skipped because the timestamp file is still present.
-func TestStatusTimestamp(t *testing.T) { // nolint:paralleltest // cannot run in parallel
-	const dir = "testdata/timestamp"
-
-	generatedFile := filepathext.SmartJoin(dir, "generated.txt")
-	tempDir := task.TempDir{
-		Remote:      filepathext.SmartJoin(dir, ".task"),
-		Fingerprint: filepathext.SmartJoin(dir, ".task"),
-	}
-
-	// Clean up any state from previous runs.
-	_ = os.Remove(generatedFile)
-	_ = os.RemoveAll(filepathext.SmartJoin(dir, ".task"))
-
-	var buff bytes.Buffer
-	e := task.NewExecutor(
-		task.WithDir(dir),
-		task.WithStdout(&buff),
-		task.WithStderr(&buff),
-		task.WithTempDir(tempDir),
-	)
-	require.NoError(t, e.Setup())
-
-	// First run: task should execute and create generated.txt.
-	require.NoError(t, e.Run(t.Context(), &task.Call{Task: "build"}))
-	_, err := os.Stat(generatedFile)
-	require.NoError(t, err, "generated.txt should exist after first run")
-	buff.Reset()
-
-	// Second run: task should be up to date.
-	require.NoError(t, e.Run(t.Context(), &task.Call{Task: "build"}))
-	assert.Equal(t, `task: Task "build" is up to date`+"\n", buff.String())
-	buff.Reset()
-
-	// Delete the generated file (simulate a clean), but leave the timestamp file.
-	require.NoError(t, os.Remove(generatedFile))
-	_, err = os.Stat(generatedFile)
-	require.Error(t, err, "generated.txt should be gone")
-
-	// Third run: task MUST re-run because generated.txt is missing.
-	// This is the regression: previously the task was incorrectly skipped.
-	require.NoError(t, e.Run(t.Context(), &task.Call{Task: "build"}))
-	assert.NotContains(t, buff.String(), "is up to date", "task should re-run when generated file is missing")
-	_, err = os.Stat(generatedFile)
-	require.NoError(t, err, "generated.txt should be recreated after third run")
-}
-
-// TestStatusChecksumMissingGenerated is a regression test for https://github.com/go-task/task/issues/1230.
-// When using method: checksum, deleting a generated file should cause the task to re-run,
-// not be skipped because the checksum file still matches.
-func TestStatusChecksumMissingGenerated(t *testing.T) { // nolint:paralleltest // cannot run in parallel
-	const dir = "testdata/checksum"
-
-	generatedFile := filepathext.SmartJoin(dir, "generated.txt")
-	tempDir := task.TempDir{
-		Remote:      filepathext.SmartJoin(dir, ".task"),
-		Fingerprint: filepathext.SmartJoin(dir, ".task"),
-	}
-
-	// Clean up any state from previous runs.
-	_ = os.Remove(generatedFile)
-	_ = os.RemoveAll(filepathext.SmartJoin(dir, ".task"))
-
-	var buff bytes.Buffer
-	e := task.NewExecutor(
-		task.WithDir(dir),
-		task.WithStdout(&buff),
-		task.WithStderr(&buff),
-		task.WithTempDir(tempDir),
-	)
-	require.NoError(t, e.Setup())
-
-	// First run: task should execute and create generated.txt.
-	require.NoError(t, e.Run(t.Context(), &task.Call{Task: "build"}))
-	_, err := os.Stat(generatedFile)
-	require.NoError(t, err, "generated.txt should exist after first run")
-	buff.Reset()
-
-	// Second run: task should be up to date.
-	require.NoError(t, e.Run(t.Context(), &task.Call{Task: "build"}))
-	assert.Equal(t, `task: Task "build" is up to date`+"\n", buff.String())
-	buff.Reset()
-
-	// Delete the generated file (simulate a clean), but leave the checksum file.
-	require.NoError(t, os.Remove(generatedFile))
-	_, err = os.Stat(generatedFile)
-	require.Error(t, err, "generated.txt should be gone")
-
-	// Third run: task MUST re-run because generated.txt is missing.
-	// This is the regression: previously the task was incorrectly skipped.
-	require.NoError(t, e.Run(t.Context(), &task.Call{Task: "build"}))
-	assert.NotContains(t, buff.String(), "is up to date", "task should re-run when generated file is missing")
-	_, err = os.Stat(generatedFile)
-	require.NoError(t, err, "generated.txt should be recreated after third run")
-}
-
 func TestStatusVariables(t *testing.T) {
 	t.Parallel()
 
@@ -1022,7 +856,7 @@ func TestIncludesRemote(t *testing.T) {
 
 					for k, taskCall := range taskCalls {
 						t.Run(taskCall.Task, func(t *testing.T) {
-							expectedContent := fmt.Sprint(rand.Int64()) //nolint:gosec
+							expectedContent := fmt.Sprint(rand.Int64())
 							t.Setenv("CONTENT", expectedContent)
 
 							outputFile := fmt.Sprintf("%d.%d.txt", i, k)
@@ -1244,7 +1078,7 @@ func TestIncludesOptionalImplicitFalse(t *testing.T) {
 	wd, _ := os.Getwd()
 
 	message := "task: No Taskfile found at \"%s/%s/TaskfileOptional.yml\""
-	expected := fmt.Sprintf(message, filepath.ToSlash(wd), dir)
+	expected := fmt.Sprintf(message, wd, dir)
 
 	e := task.NewExecutor(
 		task.WithDir(dir),
@@ -1264,7 +1098,7 @@ func TestIncludesOptionalExplicitFalse(t *testing.T) {
 	wd, _ := os.Getwd()
 
 	message := "task: No Taskfile found at \"%s/%s/TaskfileOptional.yml\""
-	expected := fmt.Sprintf(message, filepath.ToSlash(wd), dir)
+	expected := fmt.Sprintf(message, wd, dir)
 
 	e := task.NewExecutor(
 		task.WithDir(dir),
@@ -1312,11 +1146,11 @@ func TestIncludesRelativePath(t *testing.T) {
 	require.NoError(t, e.Setup())
 
 	require.NoError(t, e.Run(t.Context(), &task.Call{Task: "common:pwd"}))
-	assert.Contains(t, filepath.ToSlash(buff.String()), "testdata/includes_rel_path/common")
+	assert.Contains(t, buff.String(), "testdata/includes_rel_path/common")
 
 	buff.Reset()
 	require.NoError(t, e.Run(t.Context(), &task.Call{Task: "included:common:pwd"}))
-	assert.Contains(t, filepath.ToSlash(buff.String()), "testdata/includes_rel_path/common")
+	assert.Contains(t, buff.String(), "testdata/includes_rel_path/common")
 }
 
 func TestIncludesInternal(t *testing.T) {
@@ -1494,7 +1328,7 @@ func TestIncludedTaskfileVarMerging(t *testing.T) {
 
 			err := e.Run(t.Context(), &task.Call{Task: test.task})
 			require.NoError(t, err)
-			assert.Contains(t, filepath.ToSlash(buff.String()), test.expectedOutput)
+			assert.Contains(t, buff.String(), test.expectedOutput)
 		})
 	}
 }
@@ -1641,9 +1475,7 @@ func TestWhenNoDirAttributeItRunsInSameDirAsTaskfile(t *testing.T) {
 	require.NoError(t, e.Run(t.Context(), &task.Call{Task: "whereami"}))
 
 	// got should be the "dir" part of "testdata/dir"
-	// Normalize path separators for cross-platform compatibility (Windows uses backslashes)
+	got := strings.TrimSuffix(filepath.Base(out.String()), "\n")
-	normalized := normalizePathSeparators(out.String())
-	got := strings.TrimSuffix(filepath.Base(normalized), "\n")
 	assert.Equal(t, expected, got, "Mismatch in the working directory")
 }
 
@@ -1662,9 +1494,7 @@ func TestWhenDirAttributeAndDirExistsItRunsInThatDir(t *testing.T) {
 	require.NoError(t, e.Setup())
 	require.NoError(t, e.Run(t.Context(), &task.Call{Task: "whereami"}))
 
-	// Normalize path separators for cross-platform compatibility (Windows uses backslashes)
+	got := strings.TrimSuffix(filepath.Base(out.String()), "\n")
-	normalized := normalizePathSeparators(out.String())
-	got := strings.TrimSuffix(filepath.Base(normalized), "\n")
 	assert.Equal(t, expected, got, "Mismatch in the working directory")
 }
 
@@ -1690,9 +1520,7 @@ func TestWhenDirAttributeItCreatesMissingAndRunsInThatDir(t *testing.T) {
 	require.NoError(t, e.Setup())
 	require.NoError(t, e.Run(t.Context(), &task.Call{Task: target}))
 
-	// Normalize path separators for cross-platform compatibility (Windows uses backslashes)
+	got := strings.TrimSuffix(filepath.Base(out.String()), "\n")
-	normalized := normalizePathSeparators(out.String())
-	got := strings.TrimSuffix(filepath.Base(normalized), "\n")
 	assert.Equal(t, expected, got, "Mismatch in the working directory")
 
 	// Clean-up after ourselves only if no error.
@@ -1721,11 +1549,7 @@ func TestDynamicVariablesRunOnTheNewCreatedDir(t *testing.T) {
 	require.NoError(t, e.Setup())
 	require.NoError(t, e.Run(t.Context(), &task.Call{Task: target}))
 
-	// Normalize path separators for cross-platform compatibility (Windows uses backslashes)
+	got := strings.TrimSuffix(filepath.Base(out.String()), "\n")
-	// Take only the first line as Windows may output additional debug info
-	normalized := normalizePathSeparators(out.String())
-	firstLine := strings.Split(normalized, "\n")[0]
-	got := filepath.Base(firstLine)
 	assert.Equal(t, expected, got, "Mismatch in the working directory")
 
 	// Clean-up after ourselves only if no error.
@@ -2444,8 +2268,7 @@ func TestUserWorkingDirectory(t *testing.T) {
 	require.NoError(t, err)
 	require.NoError(t, e.Setup())
 	require.NoError(t, e.Run(t.Context(), &task.Call{Task: "default"}))
-	// Use filepath.ToSlash because USER_WORKING_DIR uses forward slashes on all platforms
+	assert.Equal(t, fmt.Sprintf("%s\n", wd), buff.String())
-	assert.Equal(t, fmt.Sprintf("%s\n", filepath.ToSlash(wd)), buff.String())
 }
 
 func TestUserWorkingDirectoryWithIncluded(t *testing.T) {
@@ -2454,7 +2277,7 @@ func TestUserWorkingDirectoryWithIncluded(t *testing.T) {
 	wd, err := os.Getwd()
 	require.NoError(t, err)
 
-	wd = filepath.ToSlash(filepathext.SmartJoin(wd, "testdata/user_working_dir_with_includes/somedir"))
+	wd = filepathext.SmartJoin(wd, "testdata/user_working_dir_with_includes/somedir")
 
 	var buff bytes.Buffer
 	e := task.NewExecutor(
@@ -2467,8 +2290,7 @@ func TestUserWorkingDirectoryWithIncluded(t *testing.T) {
 	require.NoError(t, err)
 	require.NoError(t, e.Setup())
 	require.NoError(t, e.Run(t.Context(), &task.Call{Task: "included:echo"}))
-	// Normalize path separators for cross-platform compatibility (Windows uses backslashes)
+	assert.Equal(t, fmt.Sprintf("%s\n", wd), buff.String())
-	assert.Equal(t, fmt.Sprintf("%s\n", wd), normalizePathSeparators(buff.String()))
 }
 
 func TestPlatforms(t *testing.T) {

taskfile/ast/cmd.go

@@ -1,7 +1,7 @@
 package ast
 
 import (
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 	"github.com/go-task/task/v3/internal/deepcopy"
@@ -9,8 +9,7 @@ import (
 
 // Cmd is a task command
 type Cmd struct {
-	Cmd         string // Resolved command (used for execution and fingerprinting)
+	Cmd         string
-	LogCmd      string // Command with secrets masked (used for logging)
 	Task        string
 	For         *For
 	If          string
@@ -29,7 +28,6 @@ func (c *Cmd) DeepCopy() *Cmd {
 	}
 	return &Cmd{
 		Cmd:         c.Cmd,
-		LogCmd:      c.LogCmd,
 		Task:        c.Task,
 		For:         c.For.DeepCopy(),
 		If:          c.If,

taskfile/ast/defer.go

@@ -1,7 +1,7 @@
 package ast
 
 import (
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 )

taskfile/ast/dep.go

@@ -1,7 +1,7 @@
 package ast
 
 import (
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 )

taskfile/ast/for.go

@@ -1,7 +1,7 @@
 package ast
 
 import (
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 	"github.com/go-task/task/v3/internal/deepcopy"

taskfile/ast/glob.go

@@ -1,7 +1,7 @@
 package ast
 
 import (
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 )

taskfile/ast/graph.go

@@ -45,7 +45,21 @@ func (tfg *TaskfileGraph) Visualize(filename string) error {
 	return draw.DOT(tfg.Graph, f)
 }
 
-func (tfg *TaskfileGraph) Merge() (*Taskfile, error) {
+// Root returns the root vertex of the graph (the entrypoint Taskfile).
+func (tfg *TaskfileGraph) Root() (*TaskfileVertex, error) {
+	hashes, err := graph.TopologicalSort(tfg.Graph)
+	if err != nil {
+		return nil, err
+	}
+	if len(hashes) == 0 {
+		return nil, fmt.Errorf("task: graph has no vertices")
+	}
+	return tfg.Vertex(hashes[0])
+}
+
+// Merge merges all included Taskfiles into the root Taskfile.
+// If skipVarsMerge is true, variables are not merged (used for scoped includes).
+func (tfg *TaskfileGraph) Merge(skipVarsMerge bool) (*Taskfile, error) {
 	hashes, err := graph.TopologicalSort(tfg.Graph)
 	if err != nil {
 		return nil, err
@@ -92,6 +106,7 @@ func (tfg *TaskfileGraph) Merge() (*Taskfile, error) {
 					if err := vertex.Taskfile.Merge(
 						includedVertex.Taskfile,
 						include,
+						skipVarsMerge,
 					); err != nil {
 						return err
 					}

taskfile/ast/include.go

@@ -5,7 +5,7 @@ import (
 	"sync"
 
 	"github.com/elliotchance/orderedmap/v3"
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 	"github.com/go-task/task/v3/internal/deepcopy"

taskfile/ast/matrix.go

@@ -4,7 +4,7 @@ import (
 	"iter"
 
 	"github.com/elliotchance/orderedmap/v3"
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 	"github.com/go-task/task/v3/internal/deepcopy"

taskfile/ast/output.go

@@ -1,7 +1,7 @@
 package ast
 
 import (
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 )

taskfile/ast/platforms.go

@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"strings"
 
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 	"github.com/go-task/task/v3/internal/goext"

taskfile/ast/precondition.go

@@ -3,7 +3,7 @@ package ast
 import (
 	"fmt"
 
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 )

taskfile/ast/precondition_test.go

@@ -5,7 +5,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/taskfile/ast"
 )

taskfile/ast/prompt.go

@@ -1,7 +1,7 @@
 package ast
 
 import (
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 )

taskfile/ast/requires.go

@@ -1,7 +1,7 @@
 package ast
 
 import (
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 	"github.com/go-task/task/v3/internal/deepcopy"
@@ -22,56 +22,9 @@ func (r *Requires) DeepCopy() *Requires {
 	}
 }
 
-// Enum represents an enum constraint for a required variable.
-// It can either be a static list of values or a reference to another variable.
-type Enum struct {
-	Ref   string
-	Value []string
-}
-
-func (e *Enum) DeepCopy() *Enum {
-	if e == nil {
-		return nil
-	}
-	return &Enum{
-		Ref:   e.Ref,
-		Value: deepcopy.Slice(e.Value),
-	}
-}
-
-// UnmarshalYAML implements yaml.Unmarshaler interface.
-func (e *Enum) UnmarshalYAML(node *yaml.Node) error {
-	switch node.Kind {
-	case yaml.SequenceNode:
-		// Static list of values: enum: ["a", "b"]
-		var values []string
-		if err := node.Decode(&values); err != nil {
-			return errors.NewTaskfileDecodeError(err, node)
-		}
-		e.Value = values
-		return nil
-
-	case yaml.MappingNode:
-		// Reference to another variable: enum: { ref: .VAR }
-		var refStruct struct {
-			Ref string
-		}
-		if err := node.Decode(&refStruct); err != nil {
-			return errors.NewTaskfileDecodeError(err, node)
-		}
-		if refStruct.Ref == "" {
-			return errors.NewTaskfileDecodeError(nil, node).WithTypeMessage("enum")
-		}
-		e.Ref = refStruct.Ref
-		return nil
-	}
-
-	return errors.NewTaskfileDecodeError(nil, node).WithTypeMessage("enum")
-}
-
 type VarsWithValidation struct {
 	Name string
-	Enum *Enum
+	Enum []string
 }
 
 func (v *VarsWithValidation) DeepCopy() *VarsWithValidation {
@@ -80,7 +33,7 @@ func (v *VarsWithValidation) DeepCopy() *VarsWithValidation {
 	}
 	return &VarsWithValidation{
 		Name: v.Name,
-		Enum: v.Enum.DeepCopy(),
+		Enum: v.Enum,
 	}
 }
 
@@ -100,7 +53,7 @@ func (v *VarsWithValidation) UnmarshalYAML(node *yaml.Node) error {
 	case yaml.MappingNode:
 		var vv struct {
 			Name string
-			Enum *Enum
+			Enum []string
 		}
 		if err := node.Decode(&vv); err != nil {
 			return errors.NewTaskfileDecodeError(err, node)

taskfile/ast/task.go

@@ -5,7 +5,7 @@ import (
 	"regexp"
 	"strings"
 
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 	"github.com/go-task/task/v3/internal/deepcopy"
@@ -242,7 +242,6 @@ func (t *Task) DeepCopy() *Task {
 		Requires:             t.Requires.DeepCopy(),
 		Namespace:            t.Namespace,
 		FullName:             t.FullName,
-		Watch:                t.Watch,
 		Failfast:             t.Failfast,
 	}
 	return c

taskfile/ast/taskfile.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	"github.com/Masterminds/semver/v3"
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 )
@@ -36,8 +36,9 @@ type Taskfile struct {
 	Interval time.Duration
 }
 
-// Merge merges the second Taskfile into the first
+// Merge merges the second Taskfile into the first.
-func (t1 *Taskfile) Merge(t2 *Taskfile, include *Include) error {
+// If skipVarsMerge is true, variables are not merged (used for scoped includes).
+func (t1 *Taskfile) Merge(t2 *Taskfile, include *Include, skipVarsMerge bool) error {
 	if !t1.Version.Equal(t2.Version) {
 		return fmt.Errorf(`task: Taskfiles versions should match. First is "%s" but second is "%s"`, t1.Version, t2.Version)
 	}
@@ -67,8 +68,11 @@ func (t1 *Taskfile) Merge(t2 *Taskfile, include *Include) error {
 			}
 		}
 	}
-	t1.Vars.Merge(t2.Vars, include)
+	// Only merge vars if not using scoped includes, or if flattening
-	t1.Env.Merge(t2.Env, include)
+	if !skipVarsMerge || include.Flatten {
+		t1.Vars.Merge(t2.Vars, include)
+		t1.Env.Merge(t2.Env, include)
+	}
 	return t1.Tasks.Merge(t2.Tasks, include, t1.Vars)
 }
 

taskfile/ast/taskfile_test.go

@@ -5,7 +5,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/taskfile/ast"
 )

taskfile/ast/tasks.go

@@ -8,7 +8,7 @@ import (
 	"sync"
 
 	"github.com/elliotchance/orderedmap/v3"
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 	"github.com/go-task/task/v3/internal/filepathext"

taskfile/ast/var.go

@@ -1,19 +1,18 @@
 package ast
 
 import (
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 )
 
 // Var represents either a static or dynamic variable.
 type Var struct {
-	Value  any
+	Value any
-	Live   any
+	Live  any
-	Sh     *string
+	Sh    *string
-	Ref    string
+	Ref   string
-	Dir    string
+	Dir   string
-	Secret bool
 }
 
 func (v *Var) UnmarshalYAML(node *yaml.Node) error {
@@ -24,29 +23,21 @@ func (v *Var) UnmarshalYAML(node *yaml.Node) error {
 			key = node.Content[0].Value
 		}
 		switch key {
-		case "sh", "ref", "map", "value":
+		case "sh", "ref", "map":
 			var m struct {
-				Sh     *string
+				Sh  *string
-				Ref    string
+				Ref string
-				Map    any
+				Map any
-				Value  any
-				Secret bool
 			}
 			if err := node.Decode(&m); err != nil {
 				return errors.NewTaskfileDecodeError(err, node)
 			}
 			v.Sh = m.Sh
 			v.Ref = m.Ref
-			v.Secret = m.Secret
+			v.Value = m.Map
-			// Handle both "map" and "value" keys
-			if m.Map != nil {
-				v.Value = m.Map
-			} else if m.Value != nil {
-				v.Value = m.Value
-			}
 			return nil
 		default:
-			return errors.NewTaskfileDecodeError(nil, node).WithMessage(`%q is not a valid variable type. Try "sh", "ref", "map", "value" or using a scalar value`, key)
+			return errors.NewTaskfileDecodeError(nil, node).WithMessage(`%q is not a valid variable type. Try "sh", "ref", "map" or using a scalar value`, key)
 		}
 	default:
 		var value any

taskfile/ast/vars.go

@@ -5,7 +5,7 @@ import (
 	"sync"
 
 	"github.com/elliotchance/orderedmap/v3"
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/errors"
 	"github.com/go-task/task/v3/internal/deepcopy"

taskfile/node_file.go

@@ -22,13 +22,7 @@ func NewFileNode(entrypoint, dir string, opts ...NodeOption) (*FileNode, error)
 	resolvedEntrypoint, err := fsext.Search(entrypoint, dir, DefaultTaskfiles)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			if entrypoint == "" {
+			return nil, errors.TaskfileNotFoundError{URI: entrypoint, Walk: false}
-				return nil, errors.TaskfileNotFoundError{URI: entrypoint, Walk: true}
-			} else {
-				return nil, errors.TaskfileNotFoundError{URI: entrypoint, Walk: false}
-			}
-		} else if errors.Is(err, os.ErrPermission) {
-			return nil, errors.TaskfileNotFoundError{URI: entrypoint, Walk: true, OwnerChange: true}
 		}
 		return nil, err
 	}

taskfile/node_git.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"net/url"
 	"os"
-	"path"
 	"path/filepath"
 	"strings"
 	"sync"
@@ -128,19 +127,19 @@ func (node *GitNode) getOrCloneRepo(ctx context.Context) (string, error) {
 	repoMutex.Lock()
 	defer repoMutex.Unlock()
 
+	// Check if context was cancelled while waiting for lock
+	if err := ctx.Err(); err != nil {
+		return "", fmt.Errorf("context cancelled while waiting for repository lock: %w", err)
+	}
+
 	cacheDir := filepath.Join(os.TempDir(), "task-git-repos", cacheKey)
 
-	// Check cache FIRST - if already cloned, no network needed, timeout irrelevant
+	// check if repo is already cached (under the lock)
 	gitDir := filepath.Join(cacheDir, ".git")
 	if _, err := os.Stat(gitDir); err == nil {
 		return cacheDir, nil
 	}
 
-	// Only check context if we need to clone (requires network)
-	if err := ctx.Err(); err != nil {
-		return "", fmt.Errorf("context cancelled while waiting for repository lock: %w", err)
-	}
-
 	getterURL := node.buildURL()
 
 	client := &getter.Client{
@@ -192,8 +191,8 @@ func (node *GitNode) ResolveEntrypoint(entrypoint string) (string, error) {
 		return entrypoint, nil
 	}
 
-	dir, _ := path.Split(node.path)
+	dir, _ := filepath.Split(node.path)
-	resolvedEntrypoint := fmt.Sprintf("%s//%s", node.url, path.Join(dir, entrypoint))
+	resolvedEntrypoint := fmt.Sprintf("%s//%s", node.url, filepath.Join(dir, entrypoint))
 	if node.ref != "" {
 		return fmt.Sprintf("%s?ref=%s", resolvedEntrypoint, node.ref), nil
 	}

taskfile/node_http.go

@@ -38,7 +38,7 @@ func buildHTTPClient(insecure bool, caCert, cert, certKey string) (*http.Client,
 	}
 
 	tlsConfig := &tls.Config{
-		InsecureSkipVerify: insecure, //nolint:gosec
+		InsecureSkipVerify: insecure,
 	}
 
 	// Load custom CA certificate if provided

taskfile/reader.go

@@ -9,7 +9,7 @@ import (
 	"time"
 
 	"github.com/dominikbraun/graph"
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 	"golang.org/x/sync/errgroup"
 
 	"github.com/go-task/task/v3/errors"

taskrc/ast/taskrc.go

@@ -12,7 +12,6 @@ import (
 type TaskRC struct {
 	Version      *semver.Version `yaml:"version"`
 	Verbose      *bool           `yaml:"verbose"`
-	Silent       *bool           `yaml:"silent"`
 	Color        *bool           `yaml:"color"`
 	DisableFuzzy *bool           `yaml:"disable-fuzzy"`
 	Concurrency  *int            `yaml:"concurrency"`
@@ -64,7 +63,6 @@ func (t *TaskRC) Merge(other *TaskRC) {
 	t.Remote.CertKey = cmp.Or(other.Remote.CertKey, t.Remote.CertKey)
 
 	t.Verbose = cmp.Or(other.Verbose, t.Verbose)
-	t.Silent = cmp.Or(other.Silent, t.Silent)
 	t.Color = cmp.Or(other.Color, t.Color)
 	t.DisableFuzzy = cmp.Or(other.DisableFuzzy, t.DisableFuzzy)
 	t.Concurrency = cmp.Or(other.Concurrency, t.Concurrency)

taskrc/reader.go

@@ -3,7 +3,7 @@ package taskrc
 import (
 	"os"
 
-	"go.yaml.in/yaml/v3"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/go-task/task/v3/taskrc/ast"
 )
@@ -65,7 +65,7 @@ func (r *Reader) Read(node *Node) (*ast.TaskRC, error) {
 	}
 
 	// Read the file
-	b, err := os.ReadFile(node.entrypoint) //nolint:gosec
+	b, err := os.ReadFile(node.entrypoint)
 	if err != nil {
 		return nil, err
 	}

taskrc/taskrc.go

@@ -6,7 +6,6 @@ import (
 	"slices"
 	"strings"
 
-	"github.com/go-task/task/v3/errors"
 	"github.com/go-task/task/v3/internal/fsext"
 	"github.com/go-task/task/v3/taskrc/ast"
 )
@@ -63,9 +62,6 @@ func GetConfig(dir string) (*ast.TaskRC, error) {
 		return config, err
 	}
 	entrypoints, err := fsext.SearchAll("", absDir, defaultTaskRCs)
-	if errors.Is(err, os.ErrPermission) {
-		err = nil
-	}
 	if err != nil {
 		return config, err
 	}

testdata/if/Taskfile.yml

@@ -158,21 +158,3 @@ tasks:
     if: '{{ eq .ENV "dev" }}'
     cmds:
       - echo "should not appear"
-
-  # Task-level if with dynamic variable (condition met)
-  task-if-dynamic-true:
-    vars:
-      ENABLE_FEATURE:
-        sh: 'echo "true"'
-    if: '{{ eq .ENABLE_FEATURE "true" }}'
-    cmds:
-      - echo "dynamic feature enabled"
-
-  # Task-level if with dynamic variable (condition not met)
-  task-if-dynamic-false:
-    vars:
-      ENABLE_FEATURE:
-        sh: 'echo "false"'
-    if: '{{ eq .ENABLE_FEATURE "true" }}'
-    cmds:
-      - echo "should not appear"

testdata/if/testdata/TestIf-task-if-dynamic-false.golden

@@ -1,2 +0,0 @@
-task: dynamic variable: "echo \"false\"" result: "false"
-task: if condition not met - skipped: "task-if-dynamic-false"

testdata/if/testdata/TestIf-task-if-dynamic-true.golden

@@ -1 +0,0 @@
-dynamic feature enabled

testdata/requires/Taskfile.yml

@@ -1,9 +1,5 @@
 version: '3'
 
-vars:
-  ALLOWED_ENVS: ["dev", "staging", "prod"]
-  NOT_A_LIST: "this is a string"
-
 tasks:
   default:
     - task: missing-var
@@ -45,27 +41,3 @@ tasks:
       {{range .MY_VAR | splitList " " }}
         echo {{.}}
       {{end}}
-
-  validation-var-ref:
-    requires:
-      vars:
-        - name: ENV
-          enum:
-            ref: .ALLOWED_ENVS
-    cmd: echo "{{.ENV}}"
-
-  validation-var-ref-invalid:
-    requires:
-      vars:
-        - name: VALUE
-          enum:
-            ref: .NOT_A_LIST
-    cmd: echo "{{.VALUE}}"
-
-  validation-var-ref-nonexistent:
-    requires:
-      vars:
-        - name: ENV
-          enum:
-            ref: .NONEXISTENT_VAR
-    cmd: echo "{{.ENV}}"

testdata/requires/testdata/TestRequires-enum_ref_-_fails_validation-err-run.golden

@@ -1,2 +0,0 @@
-task: Task "validation-var-ref" cancelled because it is missing required variables:
-  - ENV has an invalid value : 'invalid' (allowed values : [dev staging prod])

testdata/requires/testdata/TestRequires-enum_ref_-_passes_validation.golden

@@ -1,2 +0,0 @@
-task: [validation-var-ref] echo "dev"
-dev

testdata/requires/testdata/TestRequires-enum_ref_-_ref_to_non-list-err-run.golden

@@ -1 +0,0 @@
-enum reference ".NOT_A_LIST" must resolve to a list

testdata/requires/testdata/TestRequires-enum_ref_-_ref_to_nonexistent_var-err-run.golden

@@ -1 +0,0 @@
-enum reference ".NONEXISTENT_VAR" must resolve to a list

testdata/scoped_taskfiles/Taskfile.yml

@@ -0,0 +1,57 @@
+version: "3"
+
+env:
+  ROOT_ENV: env_from_root
+  SHARED_ENV: shared_from_root
+
+vars:
+  ROOT_VAR: from_root
+
+includes:
+  a: ./inc_a
+  b: ./inc_b
+
+tasks:
+  default:
+    desc: Test scoped includes - vars should be isolated
+    cmds:
+      - task: a:print
+      - task: b:print
+
+  print-root-var:
+    desc: Print ROOT_VAR from root
+    cmds:
+      - echo "ROOT_VAR={{.ROOT_VAR}}"
+
+  print-env:
+    desc: Print env vars using {{.env.XXX}} syntax
+    cmds:
+      - echo "ROOT_ENV={{.env.ROOT_ENV}}"
+      - echo "SHARED_ENV={{.env.SHARED_ENV}}"
+      - echo "PATH_EXISTS={{if .env.PATH}}yes{{else}}no{{end}}"
+
+  test-env-separation:
+    desc: Test that env is NOT at root level in scoped mode
+    cmds:
+      # In scoped mode, {{.ROOT_ENV}} should be empty (env not at root)
+      # In legacy mode, {{.ROOT_ENV}} would have the value
+      - echo "ROOT_ENV_AT_ROOT={{.ROOT_ENV}}"
+
+  prout:
+    vars:
+      LOL: prout_from_root
+    cmds:
+      - echo "{{.LOL}}"
+
+  call-with-vars:
+    desc: Test calling a task with vars override
+    cmds:
+      - task: print-name
+        vars:
+          NAME: from_caller
+
+  print-name:
+    vars:
+      NAME: default_name
+    cmds:
+      - echo "NAME={{.NAME}}"

testdata/scoped_taskfiles/inc_a/Taskfile.yml

@@ -0,0 +1,38 @@
+version: "3"
+
+env:
+  INC_A_ENV: env_from_a
+  SHARED_ENV: shared_from_a
+
+vars:
+  VAR: value_from_a
+  UNIQUE_A: only_in_a
+
+includes:
+  nested: ./nested
+
+tasks:
+  print:
+    desc: Print vars from include A
+    cmds:
+      - echo "A:UNIQUE_A={{.UNIQUE_A}}"
+      - echo "A:ROOT_VAR={{.ROOT_VAR}}"
+
+  try-access-b:
+    desc: Try to access B's unique var (should fail in scoped mode)
+    cmds:
+      - echo "A:UNIQUE_B={{.UNIQUE_B}}"
+
+  print-env:
+    desc: Print env vars from include A
+    cmds:
+      - echo "A:INC_A_ENV={{.env.INC_A_ENV}}"
+      - echo "A:ROOT_ENV={{.env.ROOT_ENV}}"
+      - echo "A:SHARED_ENV={{.env.SHARED_ENV}}"
+
+  test-env-in-var:
+    desc: Test using env in a var template
+    vars:
+      COMPOSED: "env={{.env.ROOT_ENV}}"
+    cmds:
+      - echo "{{.COMPOSED}}"

testdata/scoped_taskfiles/inc_a/nested/Taskfile.yml

@@ -0,0 +1,22 @@
+version: "3"
+
+env:
+  NESTED_ENV: env_from_nested
+
+vars:
+  NESTED_VAR: from_nested
+
+tasks:
+  print:
+    desc: Print vars from nested include (3 levels deep)
+    cmds:
+      - echo "NESTED:ROOT_VAR={{.ROOT_VAR}}"
+      - echo "NESTED:UNIQUE_A={{.UNIQUE_A}}"
+      - echo "NESTED:NESTED_VAR={{.NESTED_VAR}}"
+      - echo "NESTED:NESTED_ENV={{.env.NESTED_ENV}}"
+      - echo "NESTED:ROOT_ENV={{.env.ROOT_ENV}}"
+
+  try-access-b:
+    desc: Try to access B's unique var (should fail - sibling isolation)
+    cmds:
+      - echo "NESTED:UNIQUE_B={{.UNIQUE_B}}"

testdata/scoped_taskfiles/inc_b/Taskfile.yml

@@ -0,0 +1,23 @@
+version: "3"
+
+env:
+  INC_B_ENV: env_from_b
+  SHARED_ENV: shared_from_b
+
+vars:
+  VAR: value_from_b
+  UNIQUE_B: only_in_b
+
+tasks:
+  print:
+    desc: Print vars from include B
+    cmds:
+      - echo "B:UNIQUE_B={{.UNIQUE_B}}"
+      - echo "B:ROOT_VAR={{.ROOT_VAR}}"
+
+  print-env:
+    desc: Print env vars from include B
+    cmds:
+      - echo "B:INC_B_ENV={{.env.INC_B_ENV}}"
+      - echo "B:ROOT_ENV={{.env.ROOT_ENV}}"
+      - echo "B:SHARED_ENV={{.env.SHARED_ENV}}"

testdata/scoped_taskfiles/testdata/TestScopedTaskfiles-legacy-cross-include.golden

@@ -0,0 +1 @@
+A:UNIQUE_B=only_in_b

testdata/scoped_taskfiles/testdata/TestScopedTaskfiles-legacy-default.golden

@@ -0,0 +1,4 @@
+A:UNIQUE_A=only_in_a
+A:ROOT_VAR=from_root
+B:UNIQUE_B=only_in_b
+B:ROOT_VAR=from_root

testdata/scoped_taskfiles/testdata/TestScopedTaskfiles-scoped-call-vars.golden

@@ -0,0 +1 @@
+NAME=from_caller

testdata/scoped_taskfiles/testdata/TestScopedTaskfiles-scoped-cross-include.golden

@@ -0,0 +1 @@
+A:UNIQUE_B=

testdata/scoped_taskfiles/testdata/TestScopedTaskfiles-scoped-default.golden

@@ -0,0 +1,4 @@
+A:UNIQUE_A=only_in_a
+A:ROOT_VAR=from_root
+B:UNIQUE_B=only_in_b
+B:ROOT_VAR=from_root

testdata/scoped_taskfiles/testdata/TestScopedTaskfiles-scoped-env-namespace.golden

@@ -0,0 +1,3 @@
+ROOT_ENV=env_from_root
+SHARED_ENV=shared_from_root
+PATH_EXISTS=yes

testdata/scoped_taskfiles/testdata/TestScopedTaskfiles-scoped-env-separation.golden

@@ -0,0 +1 @@
+ROOT_ENV_AT_ROOT=

testdata/scoped_taskfiles/testdata/TestScopedTaskfiles-scoped-include-env.golden

@@ -0,0 +1,3 @@
+A:INC_A_ENV=env_from_a
+A:ROOT_ENV=env_from_root
+A:SHARED_ENV=shared_from_a

testdata/scoped_taskfiles/testdata/TestScopedTaskfiles-scoped-inheritance-a.golden

@@ -0,0 +1,2 @@
+A:UNIQUE_A=only_in_a
+A:ROOT_VAR=from_root

testdata/scoped_taskfiles/testdata/TestScopedTaskfiles-scoped-isolation-b.golden

@@ -0,0 +1,2 @@
+B:UNIQUE_B=only_in_b
+B:ROOT_VAR=from_root

testdata/scoped_taskfiles/testdata/TestScopedTaskfiles-scoped-nested.golden

@@ -0,0 +1,5 @@
+NESTED:ROOT_VAR=from_root
+NESTED:UNIQUE_A=only_in_a
+NESTED:NESTED_VAR=from_nested
+NESTED:NESTED_ENV=env_from_nested
+NESTED:ROOT_ENV=env_from_root

testdata/secrets/Taskfile.yml

@@ -1,65 +0,0 @@
-version: '3'
-
-vars:
-  # Public variable
-  APP_NAME: myapp
-
-  # Secret variable with value
-  API_KEY:
-    value: "secret-api-key-123"
-    secret: true
-
-  # Secret variable from shell command
-  PASSWORD:
-    sh: "echo 'my-super-secret-password'"
-    secret: true
-
-  # Non-secret variable
-  PUBLIC_URL: https://example.com
-
-tasks:
-  test-secret-masking:
-    desc: Test that secret variables are masked in logs
-    cmds:
-      - echo "Deploying {{.APP_NAME}} to {{.PUBLIC_URL}}"
-      - echo "Using API key {{.API_KEY}}"
-      - echo "Password is {{.PASSWORD}}"
-      - echo "Public app name is {{.APP_NAME}}"
-
-  test-multiple-secrets:
-    desc: Test multiple secrets in one command
-    cmds:
-      - echo "API={{.API_KEY}} PWD={{.PASSWORD}}"
-
-  test-mixed:
-    desc: Test mix of secret and public vars
-    vars:
-      LOCAL_SECRET:
-        value: "task-level-secret"
-        secret: true
-    cmds:
-      - echo "App={{.APP_NAME}} Secret={{.LOCAL_SECRET}} URL={{.PUBLIC_URL}}"
-
-  test-deferred-secret:
-    desc: Test that deferred commands mask secrets
-    vars:
-      DEFERRED_SECRET:
-        value: "deferred-secret-value"
-        secret: true
-    cmds:
-      - echo "Starting task"
-      - defer: echo "Cleanup with secret={{.DEFERRED_SECRET}} and app={{.APP_NAME}}"
-      - echo "Main command executed"
-
-  test-env-secret-limitation:
-    desc: Test showing that env vars with secret flag are NOT masked (limitation)
-    env:
-      SECRET_TOKEN:
-        value: "env-secret-token-123"
-      PUBLIC_ENV: "public-value"
-    cmds:
-      # Templates {{.VAR}} don't work with env - they're empty
-      - echo "Token via template is {{.SECRET_TOKEN}}"
-      # Shell $VAR works but is NOT masked (env vars not in template system)
-      - echo "Token via shell is $SECRET_TOKEN"
-      - echo "Public env is {{.PUBLIC_ENV}}"