chore(cli): Update Go dependencies and generated CLI template (#368)

1b664d0f8282913a0c935805fa35ebb21620b40c · 2026-04-28 13:33:21 -0700 · Trevin Chow

* Update Go dependencies and generated CLI template

* Ignore upgrade progress scratch file

Files touched

M .gitignore
A UPGRADE_LOG.md
M go.mod
M go.sum
M internal/generator/templates/go.mod.tmpl

Diff

commit 1b664d0f8282913a0c935805fa35ebb21620b40c
Author: Trevin Chow <trevin@trevinchow.com>
Date:   Tue Apr 28 13:33:21 2026 -0700

    chore(cli): Update Go dependencies and generated CLI template (#368)
    
    * Update Go dependencies and generated CLI template
    
    * Ignore upgrade progress scratch file
---
 .gitignore                               |   1 +
 UPGRADE_LOG.md                           | 237 +++++++++++++++++++++++++++++++
 go.mod                                   |  45 +++---
 go.sum                                   | 111 +++++++++------
 internal/generator/templates/go.mod.tmpl |   2 +-
 5 files changed, 331 insertions(+), 65 deletions(-)

diff --git a/.gitignore b/.gitignore
index 12b35319..fed694aa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@
 /printing-press
 library/
 dist/
+claude-upgrade-progress.json
diff --git a/UPGRADE_LOG.md b/UPGRADE_LOG.md
new file mode 100644
index 00000000..954ea59b
--- /dev/null
+++ b/UPGRADE_LOG.md
@@ -0,0 +1,237 @@
+# Dependency Upgrade Log
+
+**Date:** 2026-04-28 12:38 PDT | **Project:** cli-printing-press | **Language:** Go
+
+## Summary
+
+- **Updated/retained:** 21 | **Skipped/pruned:** 10 | **Failed:** 0 | **Needs attention:** 0
+
+## Scope
+
+- Manifest: `go.mod`
+- Lock file: `go.sum`
+- Fixture manifests under `testdata/golden/` are intentionally left unchanged unless root dependency behavior requires an intentional golden update.
+- Baseline toolchain: `go1.26.2`
+- Final `go mod tidy` is treated as authoritative for whether a transitive-only module should stay pinned in the project manifest. Modules tested during the sweep but pruned by tidy are listed under **Skipped**.
+
+## Pending Updates
+
+- `github.com/enetx/surf`: v1.0.198 -> v1.0.199
+- `github.com/getkin/kin-openapi`: v0.133.0 -> v0.137.0
+- `golang.org/x/mod`: v0.33.0 -> v0.35.0
+- `golang.org/x/text`: v0.35.0 -> v0.36.0
+- Explicit indirect dependencies will be refreshed after direct dependency updates if still stale.
+
+## Updates
+
+### `github.com/enetx/surf`: v1.0.198 -> v1.0.199
+
+- **Research:** GitHub release v1.0.199 adds `SecureTLS()` and `WebSocketGuard()` builder methods. TLS defaults remain backward-compatible; WebSocket guard behavior is now opt-in.
+- **Migration:** No code changes needed. Updated `go.mod`, `go.sum`, and `internal/generator/templates/go.mod.tmpl` so newly printed CLIs use the same surf pin.
+- **Transitive movement:** `github.com/enetx/g` v1.0.223 -> v1.0.224 and `github.com/andybalholm/brotli` v1.2.0 -> v1.2.1 moved with `surf`.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/getkin/kin-openapi`: v0.133.0 -> v0.137.0
+
+- **Research:** GitHub releases from v0.134.0 through v0.137.0 include stricter request-body handling, document-scoped format validators, OpenAPI 3.1 support, origin-tracking fixes, deterministic traversal fixes, and a Go-version revert in v0.137.0.
+- **Migration:** Initial compile failed because v0.137.0 imports `github.com/santhosh-tekuri/jsonschema/v6`; ran `go get github.com/getkin/kin-openapi/openapi3@v0.137.0` to record the new dependency and checksum. No project code changes needed.
+- **Transitive movement:** `github.com/oasdiff/yaml` moved to v0.0.9, `github.com/oasdiff/yaml3` moved to v0.0.12, and `github.com/santhosh-tekuri/jsonschema/v6` v6.0.2 was added.
+- **Tests:** First `go test ./...` failed at compile time due to missing `go.sum` entry; second `go test ./...` passed.
+
+### `golang.org/x/mod`: v0.33.0 -> v0.35.0
+
+- **Research:** The Go project v0.35.0 release notes identify this as a tagged dependency refresh for the module.
+- **Migration:** No code changes needed.
+- **Transitive movement:** `golang.org/x/crypto` v0.48.0 -> v0.49.0, `golang.org/x/net` v0.50.0 -> v0.52.0, `golang.org/x/sys` v0.41.0 -> v0.42.0, and `golang.org/x/tools` v0.42.0 -> v0.43.0 moved with `x/mod`.
+- **Tests:** `go test ./...` passed.
+
+### `golang.org/x/text`: v0.35.0 -> v0.36.0
+
+- **Research:** The Go project v0.36.0 release notes identify this as a tagged dependency refresh for the module.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/go-openapi/jsonpointer`: v0.21.0 -> v0.23.1
+
+- **Research:** Package notes announce RFC6901 trailing `-` array support and optional alternate JSON name providers. The documented API exception affects direct `Pointer.Set` array mutation semantics; this project does not call that API directly.
+- **Migration:** No code changes needed.
+- **Transitive movement:** Added `github.com/go-openapi/swag/jsonname` v0.26.0.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/go-openapi/swag`: v0.23.0 -> v0.26.0
+
+- **Research:** Release notes describe a module split/addition of helper packages, dependency updates, and a Go directive increase to Go 1.25. The project toolchain is Go 1.26.
+- **Migration:** No code changes needed.
+- **Transitive movement:** Added the new `github.com/go-openapi/swag/*` helper modules at v0.26.0.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/mailru/easyjson`: v0.7.7 -> v0.9.2
+
+- **Research:** Release notes describe bug fixes for generated JSON with non-finite floats, `MarshalText` null handling, and support for `json:",omitzero"`.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/spf13/pflag`: v1.0.9 -> v1.0.10
+
+- **Research:** Release notes describe deprecation-comment cleanup and compatibility cleanup around `errors.Is`.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/woodsbury/decimal128`: v1.3.0 -> v1.4.0
+
+- **Research:** Release notes call out a simplified binary marshaller.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `golang.org/x/crypto`: v0.49.0 -> v0.50.0
+
+- **Research:** The Go project v0.50.0 release notes identify this as a tagged dependency refresh for the module.
+- **Migration:** No code changes needed.
+- **Transitive movement:** `golang.org/x/sys` moved to v0.43.0.
+- **Tests:** First `go test ./...` failed because the filesystem ran out of space while writing Go build artifacts. Cleared Go build/test cache with `go clean -cache -testcache`; retry passed.
+
+### `golang.org/x/net`: v0.52.0 -> v0.53.0
+
+- **Research:** The Go project v0.53.0 release notes identify this as a tagged dependency refresh for the module.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `golang.org/x/tools`: v0.43.0 -> v0.44.0
+
+- **Research:** The Go project v0.44.0 release notes identify this as a tagged dependency refresh for the module.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/cpuguy83/go-md2man/v2`: v2.0.6 -> v2.0.7
+
+- **Research:** Transitive-only module; latest stable tag is v2.0.7. No direct imports in this repo.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/dave/jennifer`: v1.5.0 -> v1.7.1
+
+- **Research:** Transitive-only module via `github.com/dave/dst`; latest stable tag is v1.7.1. No direct imports in this repo.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/dlclark/regexp2`: v1.11.0 -> v1.12.0
+
+- **Research:** Transitive-only module; upstream documents .NET-compatible regex semantics. No direct imports in this repo.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/go-openapi/testify/v2`: v2.4.2 -> v2.5.0
+
+- **Research:** Upstream docs describe v2.5.0 work around non-flaky async assertions and standalone internal helper modules; Go 1.24+ is expected. This project uses Go 1.26.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/go-openapi/testify/enable/yaml/v2`: v2.4.2 -> v2.5.0
+
+- **Research:** Sibling module for `github.com/go-openapi/testify/v2`; same v2.5.0 compatibility notes apply. No direct imports in this repo.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/go-test/deep`: v1.0.8 -> v1.1.1
+
+- **Research:** Transitive-only test helper; latest stable tag is v1.1.1. No direct imports in this repo.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/gorilla/mux`: v1.8.0 -> v1.8.1
+
+- **Research:** Transitive-only HTTP router dependency; latest stable tag is v1.8.1. No direct imports in this repo.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/rogpeppe/go-internal`: v1.12.0 -> v1.14.1
+
+- **Research:** Transitive-only helper dependency; latest stable tag is v1.14.1. No direct imports in this repo.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/sergi/go-diff`: v1.2.0 -> v1.4.0
+
+- **Research:** Transitive-only diff helper; latest stable tag is v1.4.0. No direct imports in this repo.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/stretchr/objx`: v0.5.2 -> v0.5.3
+
+- **Research:** Transitive-only assertion helper; latest stable tag is v0.5.3. No direct imports in this repo.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/ugorji/go/codec`: v1.2.7 -> v1.3.1
+
+- **Research:** Transitive-only codec helper; latest stable tag is v1.3.1. No direct imports in this repo.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/xyproto/randomstring`: v1.0.5 -> v1.2.0
+
+- **Research:** Transitive-only random string helper; latest stable tag is v1.2.0. No direct imports in this repo.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/yuin/goldmark`: v1.4.13 -> v1.8.2
+
+- **Research:** Transitive-only Markdown parser; latest stable tag is v1.8.2. No direct imports in this repo.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `go.uber.org/mock`: v0.5.2 -> v0.6.0
+
+- **Research:** Transitive-only mock helper; latest stable tag is v0.6.0. No direct imports in this repo.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/kr/pty`: v1.1.1 -> v1.1.8
+
+- **Research:** Transitive-only PTY helper; latest stable tag is v1.1.8. No direct imports in this repo.
+- **Migration:** No code changes needed.
+- **Transitive movement:** Added `github.com/creack/pty` v1.1.7.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/kr/text`: v0.1.0 -> v0.2.0
+
+- **Research:** Transitive-only text helper; latest stable tag is v0.2.0. No direct imports in this repo.
+- **Migration:** No code changes needed.
+- **Transitive movement:** `github.com/creack/pty` moved to v1.1.9.
+- **Tests:** `go test ./...` passed.
+
+### `github.com/creack/pty`: v1.1.9 -> v1.1.24
+
+- **Research:** Transitive-only PTY helper exposed by the post-`kr/text` dependency graph; latest stable tag is v1.1.24. No direct imports in this repo.
+- **Migration:** No code changes needed.
+- **Tests:** `go test ./...` passed.
+
+## Skipped
+
+### `github.com/jordanlewis/gcassert`: v0.0.0-20250430164644-389ef753e22e
+
+- **Reason:** Available update is another pseudo-version (`v0.0.0-20260313214104-ad3fae17affe`), not a stable release tag. Preserved under the skill's git/pseudo-ref rule.
+
+### `golang.org/x/telemetry`: v0.0.0-20260409153401-be6f6cb8b1fa
+
+- **Reason:** Available update is another pseudo-version (`v0.0.0-20260428171046-76f71b9afea0`), not a stable release tag. Preserved under the skill's git/pseudo-ref rule.
+
+### Tidy-pruned transitive-only modules
+
+- **Reason:** These were updated and tested during the sweep, but final `go mod tidy` removed their explicit pins. `go mod why -m` reports that the main module does not need them, so retaining them would artificially pin metadata-only transitive modules.
+- **Modules:** `github.com/cpuguy83/go-md2man/v2`, `github.com/creack/pty`, `github.com/go-openapi/swag`, `github.com/go-openapi/testify/enable/yaml/v2`, `github.com/gorilla/mux`, `github.com/kr/pty`, `github.com/stretchr/objx`, `github.com/yuin/goldmark`.
+
+## Failed
+
+## Needs Attention
+
+## Final Validation
+
+- `go mod tidy` applied.
+- `go fmt ./...` passed.
+- `go test ./...` passed.
+- `go build -o ./printing-press ./cmd/printing-press` passed.
+- `scripts/golden.sh verify` passed with 8 golden cases.
+- `go vet ./...` passed.
+- `golangci-lint run ./...` passed.
+- `go run golang.org/x/vuln/cmd/govulncheck@latest ./...` passed; no vulnerabilities found.
diff --git a/go.mod b/go.mod
index 978b038a..8ea72aac 100644
--- a/go.mod
+++ b/go.mod
@@ -4,44 +4,55 @@ go 1.26.1
 
 require (
 	github.com/dave/dst v0.27.4
-	github.com/enetx/surf v1.0.198
-	github.com/getkin/kin-openapi v0.133.0
+	github.com/enetx/surf v1.0.199
+	github.com/getkin/kin-openapi v0.137.0
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.11.1
-	golang.org/x/mod v0.33.0
+	golang.org/x/mod v0.35.0
 	golang.org/x/sync v0.20.0
-	golang.org/x/text v0.35.0
+	golang.org/x/text v0.36.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
-	github.com/andybalholm/brotli v1.2.0 // indirect
+	github.com/andybalholm/brotli v1.2.1 // indirect
+	github.com/dave/jennifer v1.7.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/enetx/g v1.0.223 // indirect
+	github.com/dlclark/regexp2 v1.12.0 // indirect
+	github.com/enetx/g v1.0.224 // indirect
 	github.com/enetx/http v1.0.28 // indirect
 	github.com/enetx/http2 v1.0.26 // indirect
 	github.com/enetx/http3 v1.0.7 // indirect
 	github.com/enetx/iter v0.0.0-20250912135656-f1583323588f // indirect
-	github.com/go-openapi/jsonpointer v0.21.0 // indirect
-	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-openapi/jsonpointer v0.23.1 // indirect
+	github.com/go-openapi/swag/jsonname v0.26.0 // indirect
+	github.com/go-openapi/testify/v2 v2.5.0 // indirect
+	github.com/go-test/deep v1.1.1 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/klauspost/compress v1.18.5 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/mailru/easyjson v0.9.2 // indirect
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
-	github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 // indirect
-	github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect
+	github.com/oasdiff/yaml v0.0.9 // indirect
+	github.com/oasdiff/yaml3 v0.0.12 // indirect
 	github.com/perimeterx/marshmallow v1.1.5 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
 	github.com/quic-go/quic-go v0.59.0 // indirect
 	github.com/refraction-networking/utls v1.8.3-0.20260301010127-aa6edf4b11af // indirect
-	github.com/spf13/pflag v1.0.9 // indirect
-	github.com/woodsbury/decimal128 v1.3.0 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
+	github.com/sergi/go-diff v1.4.0 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/ugorji/go/codec v1.3.1 // indirect
+	github.com/woodsbury/decimal128 v1.4.0 // indirect
 	github.com/wzshiming/socks5 v0.7.0 // indirect
-	golang.org/x/crypto v0.48.0 // indirect
-	golang.org/x/net v0.50.0 // indirect
-	golang.org/x/sys v0.41.0 // indirect
-	golang.org/x/tools v0.42.0 // indirect
+	github.com/xyproto/randomstring v1.2.0 // indirect
+	go.uber.org/mock v0.6.0 // indirect
+	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/tools v0.44.0 // indirect
 )
diff --git a/go.sum b/go.sum
index de73e686..db8f5195 100644
--- a/go.sum
+++ b/go.sum
@@ -1,14 +1,18 @@
-github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
-github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
+github.com/andybalholm/brotli v1.2.1 h1:R+f5xP285VArJDRgowrfb9DqL18yVK0gKAW/F+eTWro=
+github.com/andybalholm/brotli v1.2.1/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/dave/dst v0.27.4 h1:d+EVnOZmphH+lUEXq9rit4GjsFSKJ3AhfRWf7eobTps=
 github.com/dave/dst v0.27.4/go.mod h1:jHh6EOibnHgcUW3WjKHisiooEkYwqpHLBSX1iOBhEyc=
-github.com/dave/jennifer v1.5.0 h1:HmgPN93bVDpkQyYbqhCHj5QlgvUkvEOzMyEvKLgCRrg=
-github.com/dave/jennifer v1.5.0/go.mod h1:4MnyiFIlZS3l5tSDn8VnzE6ffAhYBMB2SZntBsZGUok=
+github.com/dave/jennifer v1.7.1 h1:B4jJJDHelWcDhlRQxWeo0Npa/pYKBLrirAQoTN45txo=
+github.com/dave/jennifer v1.7.1/go.mod h1:nXbxhEmQfOZhWml3D1cDK5M1FLnMSozpbFN/m3RmGZc=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/enetx/g v1.0.223 h1:9J8y76uiBLvNlMDyaLyCBUWELKNaHsRST+93Zxm2+No=
-github.com/enetx/g v1.0.223/go.mod h1:dxOHnNkhdZkwwOvgbJKcniq187TqyLO3DuTJpmk1tLQ=
+github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
+github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/enetx/g v1.0.224 h1:H/uonguFE4qG8YCn5bSpZX5Wh+wTSb+jgf3I2ZM25XM=
+github.com/enetx/g v1.0.224/go.mod h1:lxhby3LjP8jOTGbxJ/PCd+2Zq1gYiSBbtL/llPhAg5c=
 github.com/enetx/http v1.0.28 h1:IaNSSDFlAVVdHnYhNIR9wAN7GY4TWL/kkvYC3jOaueY=
 github.com/enetx/http v1.0.28/go.mod h1:1f4mytfF/SfjATEJnynpwGS6aa1ALjb8DtmYgFVblY0=
 github.com/enetx/http2 v1.0.26 h1:wy3lYGVwnIUY4Q+gyPPQCJ1a+BMXD1B7Unpyc/Csrxc=
@@ -17,16 +21,18 @@ github.com/enetx/http3 v1.0.7 h1:daFhveKBtv8rRallCjaHErzzSHIrq07ovoSvVkvhcMM=
 github.com/enetx/http3 v1.0.7/go.mod h1:sqpVGZ9F1/wCiW6sjBUS2errKAh3SUYn6VlWE7LL6KM=
 github.com/enetx/iter v0.0.0-20250912135656-f1583323588f h1:GUW+4AWfECIEJ9oAxgEAVGCpaozMCjRiUYnuR6Q0bCQ=
 github.com/enetx/iter v0.0.0-20250912135656-f1583323588f/go.mod h1:oMZN8hGLUpi7QBlMEUqailocNy0NFAO/7Lu+Nwh9HMM=
-github.com/enetx/surf v1.0.198 h1:TJkyEyy5M+GnLZlGKmByeXwG7K2vv7F5L+0SgwlDu7g=
-github.com/enetx/surf v1.0.198/go.mod h1:BtLmZDYAny66azybFr9UdFVnwy8WRV4FTAzElsd7bvE=
-github.com/getkin/kin-openapi v0.133.0 h1:pJdmNohVIJ97r4AUFtEXRXwESr8b0bD721u/Tz6k8PQ=
-github.com/getkin/kin-openapi v0.133.0/go.mod h1:boAciF6cXk5FhPqe/NQeBTeenbjqU4LhWBf09ILVvWE=
-github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
-github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
-github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
-github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
-github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
-github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/enetx/surf v1.0.199 h1:RtqcwlyLM8O4U+43laNnNJwx5hALkH5cJRxDX1F2VjM=
+github.com/enetx/surf v1.0.199/go.mod h1:c6g53gi273RBiZFO4THWIqpn5n9RLC6vw5WpUwHrT4U=
+github.com/getkin/kin-openapi v0.137.0 h1:Q3HhawNQV0GfvO2mIYMUBUSEFrDsVlzcYz4VydL9YEo=
+github.com/getkin/kin-openapi v0.137.0/go.mod h1:vUYWaKyMqj7PfTybelXtLuLN9tReS12vxnzMRK+z2GY=
+github.com/go-openapi/jsonpointer v0.23.1 h1:1HBACs7XIwR2RcmItfdSFlALhGbe6S92p0ry4d1GWg4=
+github.com/go-openapi/jsonpointer v0.23.1/go.mod h1:iWRmZTrGn7XwYhtPt/fvdSFj1OfNBngqRT2UG3BxSqY=
+github.com/go-openapi/swag/jsonname v0.26.0 h1:gV1NFX9M8avo0YSpmWogqfQISigCmpaiNci8cGECU5w=
+github.com/go-openapi/swag/jsonname v0.26.0/go.mod h1:urBBR8bZNoDYGr653ynhIx+gTeIz0ARZxHkAPktJK2M=
+github.com/go-openapi/testify/v2 v2.5.0 h1:UOCr63aAsMIDydZbZGqo5Ev01D4eydItRbekDuZMJLw=
+github.com/go-openapi/testify/v2 v2.5.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -35,18 +41,21 @@ github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8Hm
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
-github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mailru/easyjson v0.9.2 h1:dX8U45hQsZpxd80nLvDGihsQ/OxlvTkVUXH2r/8cb2M=
+github.com/mailru/easyjson v0.9.2/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9M+97sNutRR1RKhG96O6jWumTTnw=
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
-github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 h1:G7ERwszslrBzRxj//JalHPu/3yz+De2J+4aLtSRlHiY=
-github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037/go.mod h1:2bpvgLBZEtENV5scfDFEtB/5+1M4hkQhDQrccEJ/qGw=
-github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 h1:bQx3WeLcUWy+RletIKwUIt4x3t8n2SxavmoclizMb8c=
-github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
+github.com/oasdiff/yaml v0.0.9 h1:zQOvd2UKoozsSsAknnWoDJlSK4lC0mpmjfDsfqNwX48=
+github.com/oasdiff/yaml v0.0.9/go.mod h1:8lvhgJG4xiKPj3HN5lDow4jZHPlx1i7dIwzkdAo6oAM=
+github.com/oasdiff/yaml3 v0.0.12 h1:75urAtPeDg2/iDEWwzNrLOWxI9N/dCh81nTTJtokt2M=
+github.com/oasdiff/yaml3 v0.0.12/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
 github.com/perimeterx/marshmallow v1.1.5 h1:a2LALqQ1BlHM8PZblsDdidgv1mWi1DgC2UmX50IvK2s=
 github.com/perimeterx/marshmallow v1.1.5/go.mod h1:dsXbUu8CRzfYP5a87xpp0xq9S3u0Vchtcl8we9tYaXw=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -57,44 +66,52 @@ github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SA
 github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
 github.com/refraction-networking/utls v1.8.3-0.20260301010127-aa6edf4b11af h1:er2acxbi3N1nvEq6HXHUAR1nTWEJmQfqiGR8EVT9rfs=
 github.com/refraction-networking/utls v1.8.3-0.20260301010127-aa6edf4b11af/go.mod h1:jkSOEkLqn+S/jtpEHPOsVv/4V4EVnelwbMQl4vCWXAM=
-github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
-github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
-github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
+github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
-github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/ugorji/go/codec v1.2.7 h1:YPXUKf7fYbp/y8xloBqZOw2qaVggbfwMlI8WM3wZUJ0=
-github.com/ugorji/go/codec v1.2.7/go.mod h1:WGN1fab3R1fzQlVQTkfxVtIBhWDRqOviHU95kRgeqEY=
-github.com/woodsbury/decimal128 v1.3.0 h1:8pffMNWIlC0O5vbyHWFZAt5yWvWcrHA+3ovIIjVWss0=
-github.com/woodsbury/decimal128 v1.3.0/go.mod h1:C5UTmyTjW3JftjUFzOVhC20BEQa2a4ZKOB5I6Zjb+ds=
+github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
+github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
+github.com/woodsbury/decimal128 v1.4.0 h1:xJATj7lLu4f2oObouMt2tgGiElE5gO6mSWUjQsBgUlc=
+github.com/woodsbury/decimal128 v1.4.0/go.mod h1:BP46FUrVjVhdTbKT+XuQh2xfQaGki9LMIRJSFuh6THU=
 github.com/wzshiming/socks5 v0.7.0 h1:euJ+U48WrvVngi+opC8vAnpZ5sK12y1C2hPvb1f48Rg=
 github.com/wzshiming/socks5 v0.7.0/go.mod h1:BvCAqlzocQN5xwLjBZDBbvWlrx8sCYSSbHEOf2wZgT0=
-github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
-github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
-go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
-go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
+github.com/xyproto/randomstring v1.2.0 h1:y7PXAEBM3XlwJjPG2JQg4voxBYZ4+hPgRdGKCfU8wik=
+github.com/xyproto/randomstring v1.2.0/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
+go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
+go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
-golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
-golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
-golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
-golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
-golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
-golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
-golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
-golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/internal/generator/templates/go.mod.tmpl b/internal/generator/templates/go.mod.tmpl
index 1b4b8fac..3f759389 100644
--- a/internal/generator/templates/go.mod.tmpl
+++ b/internal/generator/templates/go.mod.tmpl
@@ -4,7 +4,7 @@ go {{if .UsesBrowserHTTPTransport}}1.25{{else}}1.23{{end}}
 
 require (
 {{- if .UsesBrowserHTTPTransport}}
-	github.com/enetx/surf v1.0.198
+	github.com/enetx/surf v1.0.199
 {{- end}}
 	github.com/spf13/cobra v1.9.1
 {{- if .HasHTMLExtraction}}

← 4a2caae0 docs(cli): plan MCP tool surface mirrors Cobra tree, with mc · back to Cli Printing Press · feat(cli): MCP tool surface mirrors Cobra tree at runtime, w 358ff782 →