[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/mdp/qrterminal/v3	v3.2.1 → v4.0.0

---

Release Notes

mdp/qrterminal (github.com/mdp/qrterminal/v3)

v4.0.0

Compare Source

Changelog

• 54842d8 Fix Sixel terminal-state handling with newer golang.org/x/term
• c421bba Fix phantom row/column in block rendering
• 6c0d149 Make sixel opt-in; fix half-block border bands and QuietZone 0
• 70ca581 Merge pull request #​41 from mdp/ci-tests
• 531e661 Merge pull request #​43 from mdp/fix/sixel-optin-halfblock-border-quietzone
• 684b5fe Remove oryxBuildBinary
• 7064f5d chore: lower go directive to 1.25.0
• 8b0c669 ci: run build and tests on PRs and main
• 6ab42b5 cli: accept flags after operands
• 9f8b1b9 fix: fix panic with newer term version for Sixel support and fix restore, update dependencies
• a7e6725 release: v4.0.0 changelog and major module bump to /v4
• 6579f03 remove oryxBuildBinary

---

Released by GoReleaser.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 48b138e5-e6fe-47db-8781-f1c655ef8032

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Stale comment

Security review

Outcome: No medium, high, or critical vulnerabilities identified in this PR.

Scope reviewed: Added lines in go.mod / go.sum only (github.com/mdp/qrterminal/v4 v4.0.0). No application or CLI code changes.

Analysis:

• The binary still imports and calls github.com/mdp/qrterminal/v3 (cli/cmd/user_totp.go); the new /v4 module is not referenced, so this change does not alter runtime behavior or attacker-reachable sinks.
• TOTP QR rendering continues to pass server-generated otpauth:// URLs to qrterminal.GenerateWithConfig on stdout (existing CLI/admin path); nothing in the diff changes that data flow.
• go mod verify succeeds for the added module path; no evidence of a dependency substitution or new externally controlled parsing surface from this diff alone.

Note: This looks like an incomplete Renovate bump (v4 declared but v3 not removed/migrated). That is a maintenance/build hygiene issue, not a demonstrated security defect in the changed lines.

No prior automation review threads were present on this PR.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Security review

Outcome: No medium, high, or critical vulnerabilities identified in this PR.

Scope reviewed: Added lines in go.mod / go.sum only (github.com/mdp/qrterminal/v4 v4.0.0). Application code still imports github.com/mdp/qrterminal/v3; the new module is not referenced, so runtime behavior and the dependency graph for the built binary are unchanged.

Prior findings: No open automation review threads on this PR. The previous assessment (no exploitable issues in the dependency-only diff) still applies after re-checking TOTP/QR usage in cli/cmd/user_totp.go and the v4 module metadata.

Supply chain note (informational, below reporting threshold): v4 is the same upstream project (MIT) as v3. A full migration would warrant reviewing new terminal/sixel code paths; this PR does not enable them.

  

_{Sent by Cursor Automation: Find vulnerabilities}