Update vulnerable dependencies flagged by Dependabot (#1018)

Dependabot flagged multiple vulnerable dependencies, primarily in
golang.org/x packages from October 2023 and various framework libraries.

## Security Updates

**golang.org/x packages** (Oct 2023 → Jan 2025):
- crypto: v0.14.0 → v0.46.0
- net: v0.17.0 → v0.48.0  
- sys: v0.13.0 → v0.40.0
- term: v0.13.0 → v0.39.0
- text: v0.13.0 → v0.33.0
- sync: v0.7.0 → v0.19.0

**Framework libraries**:
- spf13/cobra: v1.6.1 → v1.10.2
- spf13/viper: v1.15.0 → v1.21.0
- coder/websocket: v1.8.12 → v1.8.14
- google/uuid: v1.3.0 → v1.6.0
- hashicorp/go-version: v1.6.0 → v1.8.0

**UI libraries**:
- charmbracelet/bubbles: v0.15.0 → v0.21.0
- charmbracelet/bubbletea: v0.23.1 → v1.3.10
- charmbracelet/lipgloss: v0.6.0 → v1.1.0
- fatih/color: v1.15.0 → v1.18.0

## Code Changes

Go 1.24 enforces format string constants in `fmt.Errorf`. Fixed:

```go
// Before
return fmt.Errorf("Your DB might be archived. Please run `turso group unarchive " + db.Group + "` to unarchive it")

// After  
return fmt.Errorf("Your DB might be archived. Please run `turso group unarchive %s` to unarchive it", db.Group)
```

## Toolchain

Go: 1.22.0 → 1.24.11

> [!WARNING]
>
> <details>
> <summary>Firewall rules blocked me from connecting to one or more
addresses (expand for details)</summary>
>
> #### I tried to connect to the following addresses, but was blocked by
firewall rules:
>
> - `cloud.google.com`
> - Triggering command: `/update-job-proxy /update-job-proxy
992919/b124/_cgo--64 ux_amd64/vet x64/pkg/tool/lin/tmp/cco9BoZs.o test��
/x86_64-linux-gnu/13/liblto_plugin.so
/libexec/gcc/x86_64-linux-gnu/13/lto-wrapper nfig/composer/vendor/bin/as
s-through=-lgcc s-through=-lgcc_rev-parse s-through=-lc s-through=-lgcc
s-th�� /tmp/go-build295992919/b143/_pkg_.a -trimpath ux_amd64/vet -p`
(dns block)
> - `go.googlesource.com`
> - Triggering command: `/update-job-proxy /update-job-proxy
992919/b124/_cgo--64 ux_amd64/vet x64/pkg/tool/lin/tmp/cco9BoZs.o test��
/x86_64-linux-gnu/13/liblto_plugin.so
/libexec/gcc/x86_64-linux-gnu/13/lto-wrapper nfig/composer/vendor/bin/as
s-through=-lgcc s-through=-lgcc_rev-parse s-through=-lc s-through=-lgcc
s-th�� /tmp/go-build295992919/b143/_pkg_.a -trimpath ux_amd64/vet -p`
(dns block)
> - Triggering command: `/update-job-proxy /update-job-proxy -o
br-f12b104abc1b -j DROP add origin /home/dependabot/bin/git weatherman
ache/go/1.24.11/cat-file test git cat-�� blob to /usr/lib/git-core/git m
/usr/bin/php8.3 /usr/bin/test /usr/lib/git-corfilter` (dns block)
> - `go.yaml.in`
> - Triggering command: `/update-job-proxy /update-job-proxy -o
br-f12b104abc1b -j DROP add origin /home/dependabot/bin/git weatherman
ache/go/1.24.11/cat-file test git cat-�� blob to /usr/lib/git-core/git m
/usr/bin/php8.3 /usr/bin/test /usr/lib/git-corfilter` (dns block)
> - `google.golang.org`
> - Triggering command: `/update-job-proxy /update-job-proxy
992919/b124/_cgo--64 ux_amd64/vet x64/pkg/tool/lin/tmp/cco9BoZs.o test��
/x86_64-linux-gnu/13/liblto_plugin.so
/libexec/gcc/x86_64-linux-gnu/13/lto-wrapper nfig/composer/vendor/bin/as
s-through=-lgcc s-through=-lgcc_rev-parse s-through=-lc s-through=-lgcc
s-th�� /tmp/go-build295992919/b143/_pkg_.a -trimpath ux_amd64/vet -p`
(dns block)
> - `gopkg.in`
> - Triggering command: `/update-job-proxy /update-job-proxy
992919/b124/_cgo--64 ux_amd64/vet x64/pkg/tool/lin/tmp/cco9BoZs.o test��
/x86_64-linux-gnu/13/liblto_plugin.so
/libexec/gcc/x86_64-linux-gnu/13/lto-wrapper nfig/composer/vendor/bin/as
s-through=-lgcc s-through=-lgcc_rev-parse s-through=-lc s-through=-lgcc
s-th�� /tmp/go-build295992919/b143/_pkg_.a -trimpath ux_amd64/vet -p`
(dns block)
> - Triggering command: `/update-job-proxy /update-job-proxy -o
br-f12b104abc1b -j DROP add origin /home/dependabot/bin/git weatherman
ache/go/1.24.11/cat-file test git cat-�� blob to /usr/lib/git-core/git m
/usr/bin/php8.3 /usr/bin/test /usr/lib/git-corfilter` (dns block)
> - `honnef.co`
> - Triggering command: `/update-job-proxy /update-job-proxy
992919/b124/_cgo--64 ux_amd64/vet x64/pkg/tool/lin/tmp/cco9BoZs.o test��
/x86_64-linux-gnu/13/liblto_plugin.so
/libexec/gcc/x86_64-linux-gnu/13/lto-wrapper nfig/composer/vendor/bin/as
s-through=-lgcc s-through=-lgcc_rev-parse s-through=-lc s-through=-lgcc
s-th�� /tmp/go-build295992919/b143/_pkg_.a -trimpath ux_amd64/vet -p`
(dns block)
> - `vuln.go.dev`
> - Triggering command: `/home/REDACTED/go/bin/govulncheck
/home/REDACTED/go/bin/govulncheck ./... -march=x86-64 -gdwarf-2` (dns
block)
>
> If you need me to access, download, or install something from one of
these locations, you can either:
>
> - Configure [Actions setup
steps](https://gh.io/copilot/actions-setup-steps) to set up my
environment, which run before the firewall is enabled
> - Add the appropriate URLs or hosts to the custom allowlist in this
repository's [Copilot coding agent
settings](https://github.com/tursodatabase/turso-cli/settings/copilot/coding_agent)
(admins only)
>
> </details>

<!-- START COPILOT ORIGINAL PROMPT -->



<details>

<summary>Original prompt</summary>

> 
> ----
> 
> *This section details on the original issue you should resolve*
> 
> <issue_title>Dependabot security warnings</issue_title>
> <issue_description>Opening this issue just to tag copilot.
> 
> Dependabot flags a few vulnerable dependencies, we need to upgrade
them:
https://github.com/tursodatabase/turso-cli/security/dependabot</issue_description>
> 
> ## Comments on the Issue (you are @copilot in this section)
> 
> <comments>
> </comments>
> 


</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

- Fixes #1017

<!-- START COPILOT CODING AGENT TIPS -->
---

💡 You can make Copilot smarter by setting up custom instructions,
customizing its development environment and configuring Model Context
Protocol (MCP) servers. Learn more [Copilot coding agent
tips](https://gh.io/copilot-coding-agent-tips) in the docs.

Author: LeMikaelF

go.mod

@@ -7,70 +7,74 @@ toolchain go1.25.0
 require (
 	github.com/Clever/csvlint v0.3.0
 	github.com/athoscouto/codename v0.0.3
-	github.com/charmbracelet/bubbles v0.15.0
-	github.com/charmbracelet/bubbletea v0.23.1
+	github.com/charmbracelet/bubbles v0.21.0
+	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/dustin/go-humanize v1.0.1
-	github.com/fatih/color v1.15.0
+	github.com/fatih/color v1.18.0
 	github.com/gdamore/tcell v1.4.0
-	github.com/google/uuid v1.3.0
-	github.com/hashicorp/go-version v1.6.0
+	github.com/google/uuid v1.6.0
+	github.com/hashicorp/go-version v1.8.0
 	github.com/kirsle/configdir v0.0.0-20170128060238-e45d2f54772f
 	github.com/libsql/libsql-shell-go v0.10.7-0.20251205123613-0342ea2584be
 	github.com/manifoldco/promptui v0.9.0
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/olekukonko/tablewriter v0.0.5
 	github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8
-	github.com/spf13/cobra v1.6.1
-	github.com/spf13/viper v1.15.0
-	github.com/stretchr/testify v1.9.0
+	github.com/spf13/cobra v1.10.2
+	github.com/spf13/viper v1.21.0
+	github.com/stretchr/testify v1.11.1
 	golang.org/x/exp v0.0.0-20240716160929-1d5bc16f04a8
-	golang.org/x/sync v0.7.0
+	golang.org/x/sync v0.19.0
 )
 
 require (
+	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
+	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
+	github.com/charmbracelet/x/ansi v0.10.1 // indirect
+	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
+	github.com/charmbracelet/x/term v0.2.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/sagikazarmark/locafero v0.11.0 // indirect
+	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
+	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
 )
 
 require (
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/aymanbagabas/go-osc52 v1.0.3 // indirect
-	github.com/charmbracelet/lipgloss v0.6.0 // indirect
+	github.com/charmbracelet/lipgloss v1.1.0 // indirect
 	github.com/chzyer/readline v1.5.1 // indirect
-	github.com/coder/websocket v1.8.12 // indirect
-	github.com/containerd/console v1.0.3 // indirect
-	github.com/fsnotify/fsnotify v1.6.0 // indirect
+	github.com/coder/websocket v1.8.14 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/gdamore/encoding v1.0.0 // indirect
 	github.com/go-playground/validator/v10 v10.14.1 // indirect
-	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
-	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.19
+	github.com/mattn/go-isatty v0.0.20
 	github.com/mattn/go-localereader v0.0.1 // indirect
-	github.com/mattn/go-runewidth v0.0.14 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mattn/go-sqlite3 v1.14.16 // indirect
-	github.com/muesli/ansi v0.0.0-20211018074035-2e021307bc4b // indirect
+	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
-	github.com/muesli/reflow v0.3.0 // indirect
-	github.com/muesli/termenv v0.13.0 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.8 // indirect
-	github.com/rivo/uniseg v0.4.3 // indirect
+	github.com/muesli/termenv v0.16.0 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rodaine/table v1.1.0
-	github.com/spf13/afero v1.9.3 // indirect
-	github.com/spf13/cast v1.5.0 // indirect
-	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/subosito/gotenv v1.4.2 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/tursodatabase/libsql-client-go v0.0.0-20251205113610-b69dd6e475fc // indirect
-	golang.org/x/crypto v0.14.0 // indirect
-	golang.org/x/net v0.17.0 // indirect
-	golang.org/x/sys v0.13.0
-	golang.org/x/term v0.13.0
-	golang.org/x/text v0.13.0 // indirect
+	golang.org/x/crypto v0.46.0 // indirect
+	golang.org/x/net v0.48.0 // indirect
+	golang.org/x/sys v0.40.0
+	golang.org/x/term v0.39.0
+	golang.org/x/text v0.33.0 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
-	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )