chore(deps): update dependency task to v3.53.1

[renovate]

This PR contains the following updates:

Package	Update	Change
task	minor	3.41.0 → 3.53.1

---

Release Notes

go-task/task (task)

v3.53.1

🚀 Features

• Remote Taskfiles are now generally available! This has been an
  experimental feature for 3 years, but is now enabled by default. Massive
  thanks to all those that contributed and gave feedback (too many to list
  here). We've also given the
  Remote Taskfiles documentation a
  bit of a polish (#​1317, #​2906 by @​pd93).
• Added a per-command timeout that terminates a command once it exceeds the
  given duration (Go duration syntax). It covers shell commands, task calls,
  deferred commands, deps and the if condition, obeys ignore_error, and
  reports exit code 124. Callers that join a run: once or when_changed
  task already running now honor their own timeout, and inherit that task's
  failure instead of being told it succeeded (#​1569, #​2898 by @​vmaerten).
• Considerably improve performance of fingerprinting on large repositories
  (monorepos). Fingerprinting is up to 86% faster and make up to 70% fewer
  memory allocations on the more advanced scenarios. Benchmarks were added as
  well. We're basically skipping work when not needed. (#​2853, #​2883 by
  @​Napolitain, #​2884 by @​Napolitain).
• Further improved fingerprinting performance on large repositories: hashing
  source files now reuses a single buffer, reducing memory allocations by ~98%
  and wall-clock time by ~7% (#​2925 by @​vmaerten).
• includes.excludes can now exclude a whole namespace: append :* to the
  namespace name, e.g. excludes: ['debug:*']. Bare entries still match a
  single task name exactly (#​2300, #​2959 by @​xmxxc).
• Added support for enum.ref in --interactive prompts. Required vars using
  enum.ref now show the selection list like static enums, instead of falling
  back to free-form input (#​2817 by @​vmaerten).
• Added Nushell completions, available via task --completion nu. They complete
  task names and aliases, every flag with its description, and the values of
  --completion, --output and --sort (#​2966 by @​vmaerten).
• Added a verbose log line for failed tasks. In --verbose mode, a task whose
  command exits non-zero now reports task: "<name>" failed: <error> instead of
  stopping without a trace (#​2240 by @​Drino).

🐛 Fixes

• Fixed a pinned checksum: not being verified when a remote Taskfile came from
  the cache (#​2980 by @​vmaerten).
• Fixed the fingerprint variable ({{.CHECKSUM}}/{{.TIMESTAMP}}) ignoring a
  method: set at the Taskfile level: the variable now follows the same method
  resolution as the up-to-date check. Only the variable matching the effective
  method is injected, so a task inheriting a Taskfile-level method: timestamp
  gets {{.TIMESTAMP}} and no longer a {{.CHECKSUM}} (which now renders as an
  empty string), and neither variable is injected when the effective method is
  none (#​2924 by @​vmaerten).
• Fixed ref: in for: matrix: and enum: only accepting literal lists. Refs
  computed with template functions like keys or splitList no longer fail
  with "must resolve to a list" (#​2544, #​2956 by @​no-hup).
• Fixed pressing Esc at an interactive variable prompt not cancelling the run
  (#​2942 by @​anilnatha).
• Fixed joinUrl collapsing the // in a URL scheme (e.g. producing
  http:/localhost instead of http://localhost) (#​2915 by @​vsaraikin).
• Fixed the JSON schema rejecting ignore_error on a command inside a for
  loop. Editors no longer flag a Taskfile that Task runs perfectly fine (#​2044
  by @​gokeefe-atb).
• Fixed the JSON schema rejecting more keys the Taskfile parser accepts:
  ignore_error on a task: call, and if, set and shopt on a command
  inside a for loop (#​2967 by @​vmaerten).

📚 Documentation & Website

• Updated taskfile versions doc to mention when version checks were introduced
  (#​2184 by @​jubr).
• Load the sidebar data and titles/excerpts from the blog post markdown document
  and its frontmatter on the website (#​2981 by @​pd93).

v3.52.0

• Fixed --interactive prompts for required vars sometimes appearing in a random
  order. Prompts now follow the order the vars are declared in the Taskfile.
  (#​2871 by @​caproven)
• Fixed Fish completions not being picked up correctly by installing them to
  Fish's vendor_completions.d directory instead of completions (#​2850, #​2859
  by @​Legimity).
• PowerShell completions now work with aliases of the task command, not just
  the task binary itself (#​2852 by @​kojiishi).
• Fixed task and namespace aliases not being completed by the Zsh completion. A
  show-aliases zstyle can turn this off (#​2865, #​2864 by @​vmaerten).
• Fixed task names containing certain characters (e.g. \, _, ^) leaking
  into checksum/timestamp filenames, breaking sources:/generates: up-to-date
  detection (#​2886 by @​s3onghyun).
• Fixed for: matrix: loops using ref: rows producing wrong values when the
  same task was run concurrently (e.g. by parallel deps) with different vars
  (#​2890, #​2894 by @​amitmishra11).
• Added a secret: true flag for variables that masks their value in logs,
  task --summary, and command output (#​2514 by @​vmaerten).
• Added the use_gitignore setting (global or per-task) to skip files matched
  by your .gitignore when fingerprinting sources/generates and when
  watching (#​2773 by @​vmaerten).
• Added support for configuring output flags (--output,
  --output-group-begin, --output-group-end, --output-group-error-only) via
  the TASK_OUTPUT* environment variables (#​2873 by @​liiight).
• Added a --temp-dir flag (with TASK_TEMP_DIR env var and temp-dir taskrc
  config) to customise the directory where Task stores temporary files such as
  checksums. Relative paths are resolved against the root Taskfile (#​2891 by
  @​kjasn).
• Defined environment variable behavior for remote taskfiles (#​2267, #​2847 by
  @​vmaerten).
• Added support for remote Taskfiles hosted on Azure DevOps, whose git URLs use
  a /_git/ path segment rather than a .git suffix (#​2904 by @​pd93).
• Re-added the example remote taskfile at
  taskfile.dev/Taskfile.yml (#​2905 by
  @​pd93).
• Fixed malformed includes: entries (missing taskfile/dir) reporting a
  misleading "include cycle detected" error instead of a clear configuration
  error (#​1881, #​2892 by @​Lewin671).

v3.51.1

• A significant performance boost was achieved for large Taskfiles (monorepos)
  by skipping templating altogether when the string is static (#​2820 by @​romnn).
• Added absPath template function that resolves a path to its absolute form,
  cleaning .. and . components (#​2681, #​2788 by @​mateenanjum).
• Added joinEnv function to join paths based on your oprating system: ; for
  Windows and : elsewhere, and joinUrl to join URL paths. Also, added two
  new special variables: FILE_PATH_SEPARATOR which returns \ on Windows and
  / elsewhere, and PATH_LIST_SEPARATOR which returns ; on Windows and :
  elsewhere (#​2406, #​2408 by @​solvingj).
• Update the shell interpreter with a regression fix (#​2812, #​2832 by
  @​andreynering).
• Fix potential panic with the shell interpreter (#​2810 by @​trulede).

v3.50.0

• Added enum.ref support in requires: enum constraints can now reference
  variables or template pipelines (e.g., ref: .ALLOWED_ENVS) instead of
  duplicating static lists. Combined with sh: variables, this enables fully
  dynamic enum validation (#​2678 by @​vmaerten).
• Fixed Fish completion using hardcoded task binary name instead of
  $GO_TASK_PROGNAME for experiments cache (#​2730, #​2727 by @​SergioChan).
• Fixed watch mode ignoring SIGHUP signal, causing the watcher to exit instead
  of restarting (#​2764, #​2642).
• Fixed a long time bug where the task wouldn't re-run as it should when using
  method: timestamp and the files listed on generates: were deleted. This
  makes method: timestamp behaves the same as method: checksum (#​1230, #​2716
  by @​drichardson).

v3.49.1

• Reverted #​2632 for now, which caused some regressions. That change will be
  reworked (#​2720, #​2722, #​2723).

v3.49.0

• Fixed included Taskfiles with watch: true not triggering watch mode when
  called from the root Taskfile (#​2686, #​1763 by @​trulede).
• Fixed Remote Git Taskfiles failing on Windows due to backslashes in URL paths
  (#​2656 by @​Trim21).
• Fixed remote Git Taskfiles timing out when resolving includes after accepting
  the trust prompt (#​2669, #​2668 by @​vmaerten).
• Fixed unclear error message when Taskfile search stops at a directory
  ownership boundary (#​2682, #​1683 by @​trulede).
• Fixed global variables from imported Taskfiles not resolving ref: values
  correctly (#​2632 by @​trulede).
• Every .taskrc.yml option can now be overridden with a TASK_-prefixed
  environment variable, making CI and container configuration easier (#​2607,
  #​1066 by @​vmaerten).

v3.48.0

• Fixed if: conditions when using to check dynamic variables. Also, skip
  variable prompt if task would be skipped by if: (#​2658, #​2660 by @​vmaerten).
• Fixed ROOT_TASKFILE variable pointing to directory instead of the actual
  Taskfile path when no explicit -t flag is provided (#​2635, #​1706 by
  @​trulede).
• Included Taskfiles with silent: true now properly propagate silence to their
  tasks, while still allowing individual tasks to override with silent: false
  (#​2640, #​1319 by @​trulede).
• Added TLS certificate options for Remote Taskfiles: use --cacert for
  self-signed certificates and --cert/--cert-key for mTLS authentication
  (#​2537, #​2242 by @​vmaerten).

v3.47.0

• Fixed remote git Taskfiles: cloning now works without explicit ref, and
  directory includes are properly resolved (#​2602 by @​vmaerten).
• For output: prefixed, print prefix: if set instead of task name (#​1566,
  #​2633 by @​trulede).
• Ensure no ANSI sequences are printed for --color=false (#​2560, #​2584 by
  @​trulede).
• Task aliases can now contain wildcards and will match accordingly (e.g., s-*
  as alias for start-*) (#​1900, #​2234 by @​vmaerten).
• Added conditional execution with the if field: skip tasks, commands, or task
  calls based on shell exit codes or template expressions like
  {{ eq .ENV "prod" }} (#​2564, #​608 by @​vmaerten).
• Task can now interactively prompt for missing required variables when running
  in a TTY, with support for enum selection menus. Enable with --interactive
  flag or interactive: true in .taskrc.yml (#​2579, #​2079 by @​vmaerten).

v3.46.4

• Fixed regressions in completion script for Fish (#​2591, #​2604, #​2592 by
  @​WinkelCode).

v3.46.3

• Fixed regression in completion script for zsh (#​2593, #​2594 by @​vmaerten).

v3.46.2

• Fixed a regression on previous release that affected variables passed via
  command line (#​2588, #​2589 by @​vmaerten).

v3.45.5

• Fixed bug that made a generic message, instead of an useful one, appear when a
  Taskfile could not be found (#​2431 by @​andreynering).
• Fixed a bug that caused an error when including a Remote Git Taskfile (#​2438
  by @​twelvelabs).
• Fixed issue where .taskrc.yml was not returned if reading it failed, and
  corrected handling of remote entrypoint Taskfiles (#​2460, #​2461 by @​vmaerten).
• Improved performance of --list and --list-all by introducing a faster
  compilation method that skips source globbing and checksum updates (#​1322,
  #​2053 by @​vmaerten).
• Fixed a concurrency bug with output: group. This ensures that begin/end
  parts won't be mixed up from different tasks (#​1208, #​2349, #​2350 by
  @​trulede).
• Do not re-evaluate variables for defer: (#​2244, #​2418 by @​trulede).
• Improve error message when a Taskfile is not found (#​2441, #​2494 by
  @​vmaerten).
• Fixed generic error message exit status 1 when a dependency task failed
  (#​2286 by @​GrahamDennis).
• Fixed YAML library from the unmaintained gopkg.in/yaml.v3 to the new fork
  maintained by the official YAML org (#​2171, #​2434 by @​andreynering).
• On Windows, the built-in version of the rm core utils contains a fix related
  to the -f flag (#​2426,
  u-root/u-root#3464,
  mvdan/sh#1199, #​2506 by
  @​andreynering).

v3.45.4

• Fixed a bug where cache-expiry could not be defined in .taskrc.yml (#​2423
  by @​vmaerten).
• Fixed a bug where .taskrc.yml files in parent folders were not read
  correctly (#​2424 by @​vmaerten).
• Fixed a bug where autocomplete in subfolders did not work with zsh (#​2425 by
  @​vmaerten).

v3.45.3

• Task now includes built-in core utilities to greatly improve compatibility on
  Windows. This means that your commands that uses cp, mv, mkdir or any
  other common core utility will now work by default on Windows, without extra
  setup. This is something we wanted to address for many many years, and it's
  finally being shipped!
  Read our blog post this the topic.
  (#​197, #​2360 by @​andreynering).
• ✨ Built and deployed a brand new website
  using VitePress (#​2359, #​2369, #​2371, #​2375, #​2378 by
  @​vmaerten, @​andreynering, @​pd93).
• Began releasing
  nightly builds. This
  will allow people to test our changes before they are fully released and
  without having to install Go to build them (#​2358 by @​vmaerten).
• Added support for global config files in $XDG_CONFIG_HOME/task/taskrc.yml or
  $HOME/.taskrc.yml. Check out our new
  configuration guide for more
  details (#​2247, #​2380, #​2390, #​2391 by @​vmaerten, @​pd93).
• Added experiments to the taskrc schema to clarify the expected keys and values
  (#​2235 by @​vmaerten).
• Added support for new properties in .taskrc.yml: insecure, verbose,
  concurrency, remote offline, remote timeout, and remote expiry. ⚠️
  Note: setting offline via environment variable is no longer supported. (#​2389
  by @​vmaerten)
• Added a --nested flag when outputting tasks using --list --json. This will
  output tasks in a nested structure when tasks are namespaced (#​2415 by @​pd93).
• Enhanced support for tasks with wildcards: they are now logged correctly, and
  wildcard parameters are fully considered during fingerprinting (#​1808, #​1795
  by @​vmaerten).
• Fixed panic when a variable was declared as an empty hash ({}) (#​2416, #​2417
  by @​trulede).

Package API

• Bumped the minimum version of Go to 1.24 (#​2358 by @​vmaerten).

Other news

We recently released our
official GitHub Action. This is based
on the fantastic work by the Arduino team who created and maintained the
community version. Now that this is officially adopted, fixes/updates should be
more timely. We have already merged a couple of longstanding PRs in our
first release (by
@​pd93, @​shrink, @​trim21 and all the previous contributors to
arduino/setup-task).

v3.44.1

• Internal tasks will no longer be shown as suggestions since they cannot be
  called (#​2309, #​2323 by @​maxmzkrcensys)
• Fixed install script for some ARM platforms (#​1516, #​2291 by @​trulede).
• Fixed a regression where fingerprinting was not working correctly if the path
  to you Taskfile contained a space (#​2321, #​2322 by @​pd93).
• Reverted a breaking change to randInt (#​2312, #​2316 by @​pd93).
• Made new variables TEST_NAME and TEST_DIR available in fixture tests
  (#​2265 by @​pd93).

v3.44.0

• Added uuid, randInt and randIntN template functions (#​1346, #​2225 by
  @​pd93).
• Added new CLI_ARGS_LIST array variable which contains the arguments passed
  to Task after the -- (the same as CLI_ARGS, but an array instead of a
  string). (#​2138, #​2139, #​2140 by @​pd93).
• Added toYaml and fromYaml templating functions (#​2217, #​2219 by @​pd93).
• Added task field the --list --json output (#​2256 by @​aleksandersh).
• Added the ability to
  pin included taskfiles
  by specifying a checksum. This works with both local and remote Taskfiles
  (#​2222, #​2223 by @​pd93).
• When using the
  Remote Taskfiles experiment,
  any credentials used in the URL will now be redacted in Task's output (#​2100,
  #​2220 by @​pd93).
• Fixed fuzzy suggestions not working when misspelling a task name (#​2192, #​2200
  by @​vmaerten).
• Fixed a bug where taskfiles in directories containing spaces created
  directories in the wrong location (#​2208, #​2216 by @​pd93).
• Added support for dual JSON schema files, allowing changes without affecting
  the current schema. The current schemas will only be updated during releases.
  (#​2211 by @​vmaerten).
• Improved fingerprint documentation by specifying that the method can be set at
  the root level to apply to all tasks (#​2233 by @​vmaerten).
• Fixed some watcher regressions after #​2048 (#​2199, #​2202, #​2241, #​2196 by
  @​wazazaby, #​2271 by @​andreynering).

v3.43.3

Reverted the changes made in #​2113 and #​2186 that affected the
USER_WORKING_DIR and built-in variables. This fixes #​2206, #​2195, #​2207 and
#​2208.

v3.43.2

• Fixed regresion of CLI_ARGS being exposed as the wrong type (#​2190, #​2191 by
  @​vmaerten).

v3.42.1

• Fixed a bug where some special variables caused a type error when used global
  variables (#​2106, #​2107 by @​pd93).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[polylane]

Warning

Polylane could not verify the production impact of this pull request.

task is a Hermit-managed dev tool this repo never invokes: there is no Taskfile, and neither CI workflow nor any npm script calls it, so the 3.41.0→3.53.1 bump touches no build or deploy path.

View the full analysis →

Failure trajectories: none plausible. 1 failure mode was considered and refuted against observed production traffic.

Refuted trajectory (1): what was ruled out, and why

• Task binary bump breaks a build or deploy that consumes it: git grep for 'task' across tracked files matches only an unrelated .gitignore comment; package.json scripts use parcel/pnpm/npm; test.yml and release.yml invoke npm/pnpm/node only, never task; no Taskfile exists (find returned nothing); the .task-3.53.1.pkg → hermit symlink chain is intact, so nothing dangles.

Polylane could not find the cloud resources this repository manages, so this review looked at the entire cloud account. Connect this repository to its resources and the next review will focus on exactly what this code deploys to.

_{Polylane analysed c3412d9 for production impact.}