style: fix formatting

rename: gitignore -> use_gitignore for clarity
Rename the Taskfile/task option from `gitignore` to `use_gitignore` to avoid ambiguity (could be read as "ignore git" vs "use .gitignore"). Consistent with Biome's `useIgnoreFile` naming convention.
2026-05-18 13:15:41 +02:00 · 2026-04-20 22:06:01 +02:00 · 2026-04-20 22:06:01 +02:00 · 2026-04-20 22:05:50 +02:00 · 2026-04-20 22:05:50 +02:00 · 2026-04-20 22:05:29 +02:00
62 changed files with 1730 additions and 2737 deletions
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -16,7 +16,7 @@ jobs:
    name: Lint
    strategy:
      matrix:
-        go-version: [1.25.10, 1.26.x]
+        go-version: [1.25.x, 1.26.x]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
@@ -28,7 +28,7 @@ jobs:
      - name: golangci-lint
        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
        with:
-          version: v2.12.2
+          version: v2.11.4

  lint-jsonschema:
    runs-on: ubuntu-latest
--- a/.github/workflows/pr-build.yml
+++ b/.github/workflows/pr-build.yml
@@ -21,7 +21,7 @@ jobs:
        with:
          go-version: "1.26.x"
          cache: true
-      - uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7
+      - uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7
        with:
          version: "~> v2"
          args: release --snapshot --clean --config .goreleaser-pr.yml
--- a/.github/workflows/release-nightly.yml
+++ b/.github/workflows/release-nightly.yml
@@ -23,7 +23,7 @@ jobs:
          go-version: 1.26.x

      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7
+        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7
        with:
          distribution: goreleaser-pro
          version: latest
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ jobs:
        with:
          go-version: 1.26.x

-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
@@ -35,20 +35,19 @@ jobs:
        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2

      - name: Install pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
        with:
          package_json_file: "website/package.json"
          run_install: "true"

      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7
+        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7
        with:
          distribution: goreleaser-pro
          version: latest
          args: release --clean --draft
        env:
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-          GH_GORELEASER_TOKEN: ${{secrets.GH_GORELEASER_TOKEN}}
          GORELEASER_KEY: ${{secrets.GORELEASER_KEY}}
          CLOUDSMITH_TOKEN: ${{secrets.CLOUDSMITH_TOKEN}}

--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -17,7 +17,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        go-version: [1.25.10, 1.26.x]
+        go-version: [1.25.x, 1.26.x]
        platform: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{matrix.platform}}
    steps:
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -2,16 +2,33 @@ version: "2"

 formatters:
  enable:
+    - gofmt
    - gofumpt
    - goimports
    - gci
  settings:
+    gofmt:
+      simplify: true
+      rewrite-rules:
+        - pattern: interface{}
+          replacement: any
+    gofumpt:
+      module-path: github.com/go-task/task/v3
+    goimports:
+      local-prefixes:
+        - github.com/go-task
    gci:
      sections:
        - standard
        - default
        - prefix(github.com/go-task)
        - localmodule
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

 linters:
  enable:
@@ -19,7 +36,6 @@ linters:
    - gosec
    - mirror
    - misspell
-    - modernize
    - noctx
    - paralleltest
    - thelper
@@ -40,8 +56,13 @@ linters:
            - pkg: errors
              desc: Use github.com/go-task/task/v3/errors instead
  exclusions:
+    generated: lax
    presets:
      - comments
      - common-false-positives
      - legacy
      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -89,7 +89,7 @@ brews:
    repository:
      owner: go-task
      name: homebrew-tap
-      token: "{{.Env.GH_GORELEASER_TOKEN}}" # So that it runs as the task-bot user
+      token: "{{secrets.GH_GORELEASER_TOKEN}}" # So that it runs as the task-bot user
    test: system "#{bin}/task", "--help"
    install: |-
      bin.install "task"
@@ -131,7 +131,7 @@ winget:
      owner: go-task
      name: winget-pkgs
      branch: 'task-{{.Version}}'
-      token: "{{.Env.GH_GORELEASER_TOKEN}}" # So that it runs as the task-bot user
+      token: "{{secrets.GH_GORELEASER_TOKEN}}" # So that it runs as the task-bot user
      pull_request:
        enabled: true
        draft: false
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,19 +1,9 @@
 # Changelog

-## v3.51.1 - 2026-05-16
+## Unreleased

- A significant performance boost was achieved for large Taskfiles (monorepos)
-  by skipping templating altogether when the string is static (#2820 by @romnn).
 - Added `absPath` template function that resolves a path to its absolute form,
  cleaning `..` and `.` components (#2681, #2788 by @mateenanjum).
- Added `joinEnv` function to join paths based on your oprating system: `;` for
-  Windows and `:` elsewhere, and `joinUrl` to join URL paths. Also, added two
-  new special variables: `FILE_PATH_SEPARATOR` which returns `\` on Windows
-  and `/` elsewhere, and `PATH_LIST_SEPARATOR` which returns `;` on Windows and
-  `:` elsewhere (#2406, #2408 by @solvingj).
- Update the shell interpreter with a regression fix (#2812, #2832 by
-  @andreynering).
- Fix potential panic with the shell interpreter (#2810 by @trulede).

 ## v3.50.0 - 2026-04-13

--- a/compiler.go
+++ b/compiler.go
@@ -15,7 +15,6 @@ import (
 	"github.com/go-task/task/v3/internal/logger"
 	"github.com/go-task/task/v3/internal/templater"
 	"github.com/go-task/task/v3/internal/version"
-	"github.com/go-task/task/v3/taskfile"
 	"github.com/go-task/task/v3/taskfile/ast"
 )

@@ -202,42 +201,18 @@ func (c *Compiler) getSpecialVars(t *ast.Task, call *Call) (map[string]string, e
 	// Use filepath.ToSlash for all paths to ensure consistent forward slashes
 	// across platforms. This prevents issues with backslashes being interpreted
 	// as escape sequences when paths are used in shell commands on Windows.
-	var rootTaskfile, rootDir string
-	if taskfile.IsRemoteEntrypoint(c.Entrypoint) {
-		rootTaskfile = c.Entrypoint
-		rootDir = ""
-	} else {
-		rootTaskfile = filepath.ToSlash(filepathext.SmartJoin(c.Dir, c.Entrypoint))
-		rootDir = filepath.ToSlash(c.Dir)
-	}
-
 	allVars := map[string]string{
-		"TASK_EXE":            filepath.ToSlash(os.Args[0]),
-		"ROOT_TASKFILE":       rootTaskfile,
-		"ROOT_DIR":            rootDir,
-		"USER_WORKING_DIR":    filepath.ToSlash(c.UserWorkingDir),
-		"TASK_VERSION":        version.GetVersion(),
-		"PATH_LIST_SEPARATOR": string(os.PathListSeparator),
-		"FILE_PATH_SEPARATOR": string(os.PathSeparator),
+		"TASK_EXE":         filepath.ToSlash(os.Args[0]),
+		"ROOT_TASKFILE":    filepath.ToSlash(filepathext.SmartJoin(c.Dir, c.Entrypoint)),
+		"ROOT_DIR":         filepath.ToSlash(c.Dir),
+		"USER_WORKING_DIR": filepath.ToSlash(c.UserWorkingDir),
+		"TASK_VERSION":     version.GetVersion(),
 	}
 	if t != nil {
 		allVars["TASK"] = t.Task
-		if taskfile.IsRemoteEntrypoint(t.Location.Taskfile) {
-			allVars["TASKFILE"] = t.Location.Taskfile
-			allVars["TASKFILE_DIR"] = ""
-			switch {
-			case t.Dir == "":
-				allVars["TASK_DIR"] = filepath.ToSlash(c.UserWorkingDir)
-			case filepath.IsAbs(t.Dir):
-				allVars["TASK_DIR"] = filepath.ToSlash(t.Dir)
-			default:
-				allVars["TASK_DIR"] = filepath.ToSlash(filepathext.SmartJoin(c.UserWorkingDir, t.Dir))
-			}
-		} else {
-			allVars["TASK_DIR"] = filepath.ToSlash(filepathext.SmartJoin(c.Dir, t.Dir))
-			allVars["TASKFILE"] = filepath.ToSlash(t.Location.Taskfile)
-			allVars["TASKFILE_DIR"] = filepath.ToSlash(filepath.Dir(t.Location.Taskfile))
-		}
+		allVars["TASK_DIR"] = filepath.ToSlash(filepathext.SmartJoin(c.Dir, t.Dir))
+		allVars["TASKFILE"] = filepath.ToSlash(t.Location.Taskfile)
+		allVars["TASKFILE_DIR"] = filepath.ToSlash(filepath.Dir(t.Location.Taskfile))
 	} else {
 		allVars["TASK"] = ""
 		allVars["TASK_DIR"] = ""
--- a/compiler_internal_test.go
+++ b/compiler_internal_test.go
@@ -1,135 +0,0 @@
-package task
-
-import (
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/go-task/task/v3/internal/filepathext"
-	"github.com/go-task/task/v3/taskfile/ast"
-)
-
-func TestGetSpecialVarsRemote(t *testing.T) {
-	t.Parallel()
-
-	uwd := t.TempDir()
-	uwdSlash := filepath.ToSlash(uwd)
-	localProj := filepath.Join(uwd, "proj")
-	localProjSlash := filepath.ToSlash(localProj)
-	localTaskfile := filepath.Join(localProj, "Taskfile.yml")
-	localTaskfileSlash := filepath.ToSlash(localTaskfile)
-	absTaskDir := filepath.Join(uwd, "opt", "work")
-	absTaskDirSlash := filepath.ToSlash(absTaskDir)
-
-	tests := []struct {
-		name             string
-		entrypoint       string
-		compilerDir      string
-		taskDir          string
-		taskfileLocation string
-		wantRootTaskfile string
-		wantRootDir      string
-		wantTaskfile     string
-		wantTaskfileDir  string
-		wantTaskDir      string
-	}{
-		{
-			name:             "local entrypoint, local task",
-			entrypoint:       localTaskfile,
-			compilerDir:      localProj,
-			taskDir:          "",
-			taskfileLocation: localTaskfile,
-			wantRootTaskfile: localTaskfileSlash,
-			wantRootDir:      localProjSlash,
-			wantTaskfile:     localTaskfileSlash,
-			wantTaskfileDir:  localProjSlash,
-			wantTaskDir:      localProjSlash,
-		},
-		{
-			name:             "https entrypoint, empty task.dir",
-			entrypoint:       "https://taskfile.dev/Taskfile.yml",
-			compilerDir:      "",
-			taskDir:          "",
-			taskfileLocation: "https://taskfile.dev/Taskfile.yml",
-			wantRootTaskfile: "https://taskfile.dev/Taskfile.yml",
-			wantRootDir:      "",
-			wantTaskfile:     "https://taskfile.dev/Taskfile.yml",
-			wantTaskfileDir:  "",
-			wantTaskDir:      uwdSlash,
-		},
-		{
-			name:             "https entrypoint, relative task.dir",
-			entrypoint:       "https://taskfile.dev/Taskfile.yml",
-			compilerDir:      "",
-			taskDir:          "subdir",
-			taskfileLocation: "https://taskfile.dev/Taskfile.yml",
-			wantRootTaskfile: "https://taskfile.dev/Taskfile.yml",
-			wantRootDir:      "",
-			wantTaskfile:     "https://taskfile.dev/Taskfile.yml",
-			wantTaskfileDir:  "",
-			wantTaskDir:      filepath.ToSlash(filepathext.SmartJoin(uwd, "subdir")),
-		},
-		{
-			name:             "https entrypoint, absolute task.dir",
-			entrypoint:       "https://taskfile.dev/Taskfile.yml",
-			compilerDir:      "",
-			taskDir:          absTaskDir,
-			taskfileLocation: "https://taskfile.dev/Taskfile.yml",
-			wantRootTaskfile: "https://taskfile.dev/Taskfile.yml",
-			wantRootDir:      "",
-			wantTaskfile:     "https://taskfile.dev/Taskfile.yml",
-			wantTaskfileDir:  "",
-			wantTaskDir:      absTaskDirSlash,
-		},
-		{
-			name:             "git entrypoint",
-			entrypoint:       "https://github.com/foo/bar.git//Taskfile.yml?ref=main",
-			compilerDir:      "",
-			taskDir:          "",
-			taskfileLocation: "https://github.com/foo/bar.git//Taskfile.yml?ref=main",
-			wantRootTaskfile: "https://github.com/foo/bar.git//Taskfile.yml?ref=main",
-			wantRootDir:      "",
-			wantTaskfile:     "https://github.com/foo/bar.git//Taskfile.yml?ref=main",
-			wantTaskfileDir:  "",
-			wantTaskDir:      uwdSlash,
-		},
-		{
-			name:             "local root, remote included task",
-			entrypoint:       localTaskfile,
-			compilerDir:      localProj,
-			taskDir:          "",
-			taskfileLocation: "https://taskfile.dev/included.yml",
-			wantRootTaskfile: localTaskfileSlash,
-			wantRootDir:      localProjSlash,
-			wantTaskfile:     "https://taskfile.dev/included.yml",
-			wantTaskfileDir:  "",
-			wantTaskDir:      uwdSlash,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			c := &Compiler{
-				Dir:            tt.compilerDir,
-				Entrypoint:     tt.entrypoint,
-				UserWorkingDir: uwd,
-			}
-			task := &ast.Task{
-				Task:     "mytask",
-				Dir:      tt.taskDir,
-				Location: &ast.Location{Taskfile: tt.taskfileLocation},
-			}
-
-			vars, err := c.getSpecialVars(task, nil)
-			assert.NoError(t, err)
-			assert.Equal(t, tt.wantRootTaskfile, vars["ROOT_TASKFILE"], "ROOT_TASKFILE")
-			assert.Equal(t, tt.wantRootDir, vars["ROOT_DIR"], "ROOT_DIR")
-			assert.Equal(t, tt.wantTaskfile, vars["TASKFILE"], "TASKFILE")
-			assert.Equal(t, tt.wantTaskfileDir, vars["TASKFILE_DIR"], "TASKFILE_DIR")
-			assert.Equal(t, tt.wantTaskDir, vars["TASK_DIR"], "TASK_DIR")
-		})
-	}
-}
--- a/go.mod
+++ b/go.mod
@@ -1,27 +1,28 @@
 module github.com/go-task/task/v3

-go 1.25.10
+go 1.25.8

 require (
 	charm.land/bubbles/v2 v2.1.0
-	charm.land/bubbletea/v2 v2.0.6
-	charm.land/lipgloss/v2 v2.0.3
+	charm.land/bubbletea/v2 v2.0.2
+	charm.land/lipgloss/v2 v2.0.2
 	github.com/Ladicle/tabwriter v1.0.0
-	github.com/Masterminds/semver/v3 v3.5.0
-	github.com/alecthomas/chroma/v2 v2.24.1
+	github.com/Masterminds/semver/v3 v3.4.0
+	github.com/alecthomas/chroma/v2 v2.23.1
 	github.com/chainguard-dev/git-urls v1.0.2
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 	github.com/dominikbraun/graph v0.23.0
 	github.com/elliotchance/orderedmap/v3 v3.1.0
 	github.com/fatih/color v1.19.0
-	github.com/fsnotify/fsnotify v1.10.1
+	github.com/fsnotify/fsnotify v1.9.0
 	github.com/go-task/slim-sprig/v3 v3.0.0
 	github.com/go-task/template v0.2.0
 	github.com/google/uuid v1.6.0
-	github.com/hashicorp/go-getter v1.8.6
+	github.com/hashicorp/go-getter v1.8.5
 	github.com/joho/godotenv v1.5.1
 	github.com/mitchellh/hashstructure/v2 v2.0.2
-	github.com/puzpuzpuz/xsync/v4 v4.5.0
+	github.com/puzpuzpuz/xsync/v4 v4.4.0
+	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06
 	github.com/sajari/fuzzy v1.0.0
 	github.com/sebdah/goldie/v2 v2.8.0
 	github.com/spf13/pflag v1.0.10
@@ -29,55 +30,55 @@ require (
 	github.com/zeebo/xxh3 v1.1.0
 	go.yaml.in/yaml/v3 v3.0.4
 	golang.org/x/sync v0.20.0
-	golang.org/x/term v0.43.0
+	golang.org/x/term v0.41.0
 	mvdan.cc/sh/moreinterp v0.0.0-20260120230322-19def062a997
-	mvdan.cc/sh/v3 v3.13.2-0.20260510185049-f5c6e2779117
+	mvdan.cc/sh/v3 v3.13.0
 )

 require (
 	cel.dev/expr v0.25.1 // indirect
 	cloud.google.com/go v0.123.0 // indirect
-	cloud.google.com/go/auth v0.18.2 // indirect
+	cloud.google.com/go/auth v0.18.1 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	cloud.google.com/go/iam v1.5.3 // indirect
 	cloud.google.com/go/monitoring v1.24.3 // indirect
-	cloud.google.com/go/storage v1.61.3 // indirect
+	cloud.google.com/go/storage v1.60.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.32.12 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.12 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 // indirect
-	github.com/aws/smithy-go v1.24.2 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.41.1 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.32.9 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.9 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.96.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.10 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.14 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 // indirect
+	github.com/aws/smithy-go v1.24.0 // indirect
 	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charmbracelet/colorprofile v0.4.3 // indirect
-	github.com/charmbracelet/ultraviolet v0.0.0-20260416155717-489999b90468 // indirect
-	github.com/charmbracelet/x/ansi v0.11.7 // indirect
+	github.com/charmbracelet/colorprofile v0.4.2 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8 // indirect
+	github.com/charmbracelet/x/ansi v0.11.6 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
 	github.com/charmbracelet/x/termios v0.1.1 // indirect
 	github.com/charmbracelet/x/windows v0.2.2 // indirect
 	github.com/clipperhouse/displaywidth v0.11.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
-	github.com/dlclark/regexp2 v1.12.0 // indirect
+	github.com/dlclark/regexp2 v1.11.5 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
@@ -86,18 +87,18 @@ require (
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect
 	github.com/googleapis/gax-go/v2 v2.17.0 // indirect
-	github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72 // indirect
+	github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.70 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-version v1.8.0 // indirect
-	github.com/klauspost/compress v1.18.5 // indirect
+	github.com/klauspost/compress v1.18.4 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
-	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
+	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-runewidth v0.0.23 // indirect
+	github.com/mattn/go-runewidth v0.0.21 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/pierrec/lz4/v4 v4.1.22 // indirect
@@ -115,21 +116,21 @@ require (
 	go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
-	golang.org/x/crypto v0.51.0 // indirect
-	golang.org/x/net v0.54.0 // indirect
+	go.opentelemetry.io/otel v1.40.0 // indirect
+	go.opentelemetry.io/otel/metric v1.40.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.40.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.40.0 // indirect
+	go.opentelemetry.io/otel/trace v1.40.0 // indirect
+	golang.org/x/crypto v0.48.0 // indirect
+	golang.org/x/net v0.51.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	google.golang.org/api v0.271.0 // indirect
+	google.golang.org/api v0.267.0 // indirect
 	google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 // indirect
 	google.golang.org/grpc v1.79.3 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
--- a/go.sum
+++ b/go.sum
@@ -2,14 +2,14 @@ cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
 cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
 charm.land/bubbles/v2 v2.1.0 h1:YSnNh5cPYlYjPxRrzs5VEn3vwhtEn3jVGRBT3M7/I0g=
 charm.land/bubbles/v2 v2.1.0/go.mod h1:l97h4hym2hvWBVfmJDtrEHHCtkIKeTEb3TTJ4ZOB3wY=
-charm.land/bubbletea/v2 v2.0.6 h1:UHN/91OyuhaOFGSrBXQ/hMZD8IO1Uc4BvHlgHXL2WJo=
-charm.land/bubbletea/v2 v2.0.6/go.mod h1:MH/D8ZLlN3op37vQvijKuU29g3rqTp+aQapURFonF9g=
-charm.land/lipgloss/v2 v2.0.3 h1:yM2zJ4Cf5Y51b7RHIwioil4ApI/aypFXXVHSwlM6RzU=
-charm.land/lipgloss/v2 v2.0.3/go.mod h1:7myLU9iG/3xluAWzpY/fSxYYHCgoKTie7laxk6ATwXA=
+charm.land/bubbletea/v2 v2.0.2 h1:4CRtRnuZOdFDTWSff9r8QFt/9+z6Emubz3aDMnf/dx0=
+charm.land/bubbletea/v2 v2.0.2/go.mod h1:3LRff2U4WIYXy7MTxfbAQ+AdfM3D8Xuvz2wbsOD9OHQ=
+charm.land/lipgloss/v2 v2.0.2 h1:xFolbF8JdpNkM2cEPTfXEcW1p6NRzOWTSamRfYEw8cs=
+charm.land/lipgloss/v2 v2.0.2/go.mod h1:KjPle2Qd3YmvP1KL5OMHiHysGcNwq6u83MUjYkFvEkM=
 cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
-cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
-cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
+cloud.google.com/go/auth v0.18.1 h1:IwTEx92GFUo2pJ6Qea0EU3zYvKnTAeRCODxfA/G5UWs=
+cloud.google.com/go/auth v0.18.1/go.mod h1:GfTYoS9G3CWpRA3Va9doKN9mjPGRS+v41jmZAhBzbrA=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
@@ -22,8 +22,8 @@ cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7
 cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk=
 cloud.google.com/go/monitoring v1.24.3 h1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=
 cloud.google.com/go/monitoring v1.24.3/go.mod h1:nYP6W0tm3N9H/bOw8am7t62YTzZY+zUeQ+Bi6+2eonI=
-cloud.google.com/go/storage v1.61.3 h1:VS//ZfBuPGDvakfD9xyPW1RGF1Vy3BWUoVZXgW1KMOg=
-cloud.google.com/go/storage v1.61.3/go.mod h1:JtqK8BBB7TWv0HVGHubtUdzYYrakOQIsMLffZ2Z/HWk=
+cloud.google.com/go/storage v1.60.0 h1:oBfZrSOCimggVNz9Y/bXY35uUcts7OViubeddTTVzQ8=
+cloud.google.com/go/storage v1.60.0/go.mod h1:q+5196hXfejkctrnx+VYU8RKQr/L3c0cBIlrjmiAKE0=
 cloud.google.com/go/trace v1.11.7 h1:kDNDX8JkaAG3R2nq1lIdkb7FCSi1rCmsEtKVsty7p+U=
 cloud.google.com/go/trace v1.11.7/go.mod h1:TNn9d5V3fQVf6s4SCveVMIBS2LJUqo73GACmq/Tky0s=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 h1:sBEjpZlNHzK1voKq9695PJSX2o5NEXl7/OL3coiIY0c=
@@ -38,56 +38,52 @@ github.com/Ladicle/tabwriter v1.0.0 h1:DZQqPvMumBDwVNElso13afjYLNp0Z7pHqHnu0r4t9
 github.com/Ladicle/tabwriter v1.0.0/go.mod h1:c4MdCjxQyTbGuQO/gvqJ+IA/89UEwrsD6hUCW98dyp4=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
 github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
-github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
-github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/chroma/v2 v2.23.1 h1:nv2AVZdTyClGbVQkIzlDm/rnhk1E9bU9nXwmZ/Vk/iY=
 github.com/alecthomas/chroma/v2 v2.23.1/go.mod h1:NqVhfBR0lte5Ouh3DcthuUCTUpDC9cxBOfyMbMQPs3o=
-github.com/alecthomas/chroma/v2 v2.24.1 h1:m5ffpfZbIb++k8AqFEKy9uVgY12xIQtBsQlc6DfZJQM=
-github.com/alecthomas/chroma/v2 v2.24.1/go.mod h1:l+ohZ9xRXIbGe7cIW+YZgOGbvuVLjMps/FYN/CwuabI=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
-github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
-github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
-github.com/aws/aws-sdk-go-v2/config v1.32.12 h1:O3csC7HUGn2895eNrLytOJQdoL2xyJy0iYXhoZ1OmP0=
-github.com/aws/aws-sdk-go-v2/config v1.32.12/go.mod h1:96zTvoOFR4FURjI+/5wY1vc1ABceROO4lWgWJuxgy0g=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.12 h1:oqtA6v+y5fZg//tcTWahyN9PEn5eDU/Wpvc2+kJ4aY8=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.12/go.mod h1:U3R1RtSHx6NB0DvEQFGyf/0sbrpJrluENHdPy1j/3TE=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 h1:zOgq3uezl5nznfoK3ODuqbhVg1JzAGDUhXOsU0IDCAo=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20/go.mod h1:z/MVwUARehy6GAg/yQ1GO2IMl0k++cu1ohP9zo887wE=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 h1:Rgg6wvjjtX8bNHcvi9OnXWwcE0a2vGpbwmtICOsvcf4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21/go.mod h1:A/kJFst/nm//cyqonihbdpQZwiUhhzpqTsdbhDdRF9c=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgqSE5hE/o47Ij9qk/SEZFbUOe9A=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 h1:qYQ4pzQ2Oz6WpQ8T3HvGHnZydA72MnLuFK9tJwmrbHw=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 h1:rWyie/PxDRIdhNf4DzRk0lvjVOqFJuNnO8WwaIRVxzQ=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22/go.mod h1:zd/JsJ4P7oGfUhXn1VyLqaRZwPmZwg44Jf2dS84Dm3Y=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 h1:JRaIgADQS/U6uXDqlPiefP32yXTda7Kqfx+LgspooZM=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13/go.mod h1:CEuVn5WqOMilYl+tbccq8+N2ieCy0gVn3OtRb0vBNNM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3xgIJMSC8S6hEVq+38DcvUlgFY0FM6mSI5oto=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 h1:ZlvrNcHSFFWURB8avufQq9gFsheUgjVD9536obIknfM=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21/go.mod h1:cv3TNhVrssKR0O/xxLJVRfd2oazSnZnkUeTf6ctUwfQ=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 h1:HwxWTbTrIHm5qY+CAEur0s/figc3qwvLWsNkF4RPToo=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 h1:0GFOLzEbOyZABS3PhYfBIx2rNBACYcKty+XGkTgw1ow=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.8/go.mod h1:LXypKvk85AROkKhOG6/YEcHFPoX+prKTowKnVdcaIxE=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 h1:kiIDLZ005EcKomYYITtfsjn7dtOwHDOFy7IbPXKek2o=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.13/go.mod h1:2h/xGEowcW/g38g06g3KpRWDlT+OTfxxI0o1KqayAB8=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 h1:jzKAXIlhZhJbnYwHbvUQZEB8KfgAEuG0dc08Bkda7NU=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17/go.mod h1:Al9fFsXjv4KfbzQHGe6V4NZSZQXecFcvaIF4e70FoRA=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 h1:Cng+OOwCHmFljXIxpEVXAGMnBia8MSU6Ch5i9PgBkcU=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.9/go.mod h1:LrlIndBDdjA/EeXeyNBle+gyCwTlizzW5ycgWnvIxkk=
-github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
-github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/aws-sdk-go-v2 v1.41.1 h1:ABlyEARCDLN034NhxlRUSZr4l71mh+T5KAeGh6cerhU=
+github.com/aws/aws-sdk-go-v2 v1.41.1/go.mod h1:MayyLB8y+buD9hZqkCW3kX1AKq07Y5pXxtgB+rRFhz0=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 h1:489krEF9xIGkOaaX3CE/Be2uWjiXrkCH6gUX+bZA/BU=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4/go.mod h1:IOAPF6oT9KCsceNTvvYMNHy0+kMF8akOjeDvPENWxp4=
+github.com/aws/aws-sdk-go-v2/config v1.32.9 h1:ktda/mtAydeObvJXlHzyGpK1xcsLaP16zfUPDGoW90A=
+github.com/aws/aws-sdk-go-v2/config v1.32.9/go.mod h1:U+fCQ+9QKsLW786BCfEjYRj34VVTbPdsLP3CHSYXMOI=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.9 h1:sWvTKsyrMlJGEuj/WgrwilpoJ6Xa1+KhIpGdzw7mMU8=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.9/go.mod h1:+J44MBhmfVY/lETFiKI+klz0Vym2aCmIjqgClMmW82w=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 h1:I0GyV8wiYrP8XpA70g1HBcQO1JlQxCMTW9npl5UbDHY=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17/go.mod h1:tyw7BOl5bBe/oqvoIeECFJjMdzXoa/dfVz3QQ5lgHGA=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 h1:xOLELNKGp2vsiteLsvLPwxC+mYmO6OZ8PYgiuPJzF8U=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17/go.mod h1:5M5CI3D12dNOtH3/mk6minaRwI2/37ifCURZISxA/IQ=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 h1:WWLqlh79iO48yLkj1v3ISRNiv+3KdQoZ6JWyfcsyQik=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17/go.mod h1:EhG22vHRrvF8oXSTYStZhJc1aUgKtnJe+aOiFEV90cM=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.17 h1:JqcdRG//czea7Ppjb+g/n4o8i/R50aTBHkA7vu0lK+k=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.17/go.mod h1:CO+WeGmIdj/MlPel2KwID9Gt7CNq4M65HUfBW97liM0=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 h1:0ryTNEdJbzUCEWkVXEXoqlXV72J5keC1GvILMOuD00E=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4/go.mod h1:HQ4qwNZh32C3CBeO6iJLQlgtMzqeG17ziAA/3KDJFow=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.8 h1:Z5EiPIzXKewUQK0QTMkutjiaPVeVYXX7KIqhXu/0fXs=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.8/go.mod h1:FsTpJtvC4U1fyDXk7c71XoDv3HlRm8V3NiYLeYLh5YE=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 h1:RuNSMoozM8oXlgLG/n6WLaFGoea7/CddrCfIiSA+xdY=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17/go.mod h1:F2xxQ9TZz5gDWsclCtPQscGpP0VUOc8RqgFM3vDENmU=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.17 h1:bGeHBsGZx0Dvu/eJC0Lh9adJa3M1xREcndxLNZlve2U=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.17/go.mod h1:dcW24lbU0CzHusTE8LLHhRLI42ejmINN8Lcr22bwh/g=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.96.0 h1:oeu8VPlOre74lBA/PMhxa5vewaMIMmILM+RraSyB8KA=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.96.0/go.mod h1:5jggDlZ2CLQhwJBiZJb4vfk4f0GxWdEDruWKEJ1xOdo=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 h1:VrhDvQib/i0lxvr3zqlUwLwJP4fpmpyD9wYG1vfSu+Y=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.5/go.mod h1:k029+U8SY30/3/ras4G/Fnv/b88N4mAfliNn08Dem4M=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.10 h1:+VTRawC4iVY58pS/lzpo0lnoa/SYNGF4/B/3/U5ro8Y=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.10/go.mod h1:yifAsgBxgJWn3ggx70A3urX2AN49Y5sJTD1UQFlfqBw=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.14 h1:0jbJeuEHlwKJ9PfXtpSFc4MF+WIWORdhN1n30ITZGFM=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.14/go.mod h1:sTGThjphYE4Ohw8vJiRStAcu3rbjtXRsdNB0TvZ5wwo=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 h1:5fFjR/ToSOzB2OQ/XqWpZBmNvmP/pJ1jOWYlFDJTjRQ=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.6/go.mod h1:qgFDZQSD/Kys7nJnVqYlWKnh0SSdMjAi0uSwON4wgYQ=
+github.com/aws/smithy-go v1.24.0 h1:LpilSUItNPFr1eY85RYgTIg5eIEPtvFbskaFcmmIUnk=
+github.com/aws/smithy-go v1.24.0/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/aymanbagabas/go-udiff v0.4.1 h1:OEIrQ8maEeDBXQDoGCbbTTXYJMYRCRO1fnodZ12Gv5o=
 github.com/aymanbagabas/go-udiff v0.4.1/go.mod h1:0L9PGwj20lrtmEMeyw4WKJ/TMyDtvAoK9bf2u/mNo3w=
 github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d h1:xDfNPAt8lFiC1UJrqV3uuy861HCTo708pDMbjHHdCas=
@@ -96,12 +92,12 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chainguard-dev/git-urls v1.0.2 h1:pSpT7ifrpc5X55n4aTTm7FFUE+ZQHKiqpiwNkJrVcKQ=
 github.com/chainguard-dev/git-urls v1.0.2/go.mod h1:rbGgj10OS7UgZlbzdUQIQpT0k/D4+An04HJY7Ol+Y/o=
-github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
-github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
-github.com/charmbracelet/ultraviolet v0.0.0-20260416155717-489999b90468 h1:Q9fO0y1Zo5KB/5Vu8JZoLGm1N3RzF9bNj3Ao3xoR+Ac=
-github.com/charmbracelet/ultraviolet v0.0.0-20260416155717-489999b90468/go.mod h1:bAAz7dh/FTYfC+oiHavL4mX1tOIBZ0ZwYjSi3qE6ivM=
-github.com/charmbracelet/x/ansi v0.11.7 h1:kzv1kJvjg2S3r9KHo8hDdHFQLEqn4RBCb39dAYC84jI=
-github.com/charmbracelet/x/ansi v0.11.7/go.mod h1:9qGpnAVYz+8ACONkZBUWPtL7lulP9No6p1epAihUZwQ=
+github.com/charmbracelet/colorprofile v0.4.2 h1:BdSNuMjRbotnxHSfxy+PCSa4xAmz7szw70ktAtWRYrY=
+github.com/charmbracelet/colorprofile v0.4.2/go.mod h1:0rTi81QpwDElInthtrQ6Ni7cG0sDtwAd4C4le060fT8=
+github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8 h1:eyFRbAmexyt43hVfeyBofiGSEmJ7krjLOYt/9CF5NKA=
+github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8/go.mod h1:SQpCTRNBtzJkwku5ye4S3HEuthAlGy2n9VXZnWkEW98=
+github.com/charmbracelet/x/ansi v0.11.6 h1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8=
+github.com/charmbracelet/x/ansi v0.11.6/go.mod h1:2JNYLgQUsyqaiLovhU2Rv/pb8r6ydXKS3NIttu3VGZQ=
 github.com/charmbracelet/x/exp/golden v0.0.0-20250806222409-83e3a29d542f h1:pk6gmGpCE7F3FcjaOEKYriCvpmIN4+6OS/RD0vm4uIA=
 github.com/charmbracelet/x/exp/golden v0.0.0-20250806222409-83e3a29d542f/go.mod h1:IfZAMTHB6XkZSeXUqriemErjAWCCzT0LwjKFYCZyw0I=
 github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
@@ -124,8 +120,6 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
 github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
-github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dominikbraun/graph v0.23.0 h1:TdZB4pPqCLFxYhdyMFb1TBdFxp8XLcJfTTBQucVPgCo=
 github.com/dominikbraun/graph v0.23.0/go.mod h1:yOjYyogZLY1LSG9E33JWZJiq5k83Qy2C6POAuiViluc=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
@@ -146,8 +140,6 @@ github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
-github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -171,24 +163,24 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
+github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dqh/NZMz7475yUvmRIkXr4oN2ao=
+github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8=
 github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc=
 github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY=
-github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72 h1:vTCWu1wbdYo7PEZFem/rlr01+Un+wwVmI7wiegFdRLk=
-github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72/go.mod h1:Vn+BBgKQHVQYdVQ4NZDICE1Brb+JfaONyDHr3q07oQc=
+github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.70 h1:0HADrxxqaQkGycO1JoUUA+B4FnIkuo8d2bz/hSaTFFQ=
+github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.70/go.mod h1:fm2FdDCzJdtbXF7WKAMvBb5NEPouXPHFbGNYs9ShFns=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-getter v1.8.6 h1:9sQboWULaydVphxc4S64oAI4YqpuCk7nPmvbk131ebY=
-github.com/hashicorp/go-getter v1.8.6/go.mod h1:nVH12eOV2P58dIiL3rsU6Fh3wLeJEKBOJzhMmzlSWoo=
+github.com/hashicorp/go-getter v1.8.5 h1:DMPV5CSw5JrNg/IK7kDZt3+l2REKXOi3oAw7uYLh2NM=
+github.com/hashicorp/go-getter v1.8.5/go.mod h1:WIffejwAyDSJhoVptc3UEshEMkR9O63rw34V7k43O3Q=
 github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4=
 github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
-github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
+github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
 github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
 github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
@@ -200,14 +192,14 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4=
-github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
+github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw=
-github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mattn/go-runewidth v0.0.21 h1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w=
+github.com/mattn/go-runewidth v0.0.21/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
@@ -222,12 +214,14 @@ github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/puzpuzpuz/xsync/v4 v4.5.0 h1:vOSWu6b57/emh+L/Cw0BeQfvxa/cogFywXHeGUxQxAg=
-github.com/puzpuzpuz/xsync/v4 v4.5.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
+github.com/puzpuzpuz/xsync/v4 v4.4.0 h1:vlSN6/CkEY0pY8KaB0yqo/pCLZvp9nhdbBdjipT4gWo=
+github.com/puzpuzpuz/xsync/v4 v4.4.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 h1:OkMGxebDjyw0ULyrTYWeN0UNCCkmCWfjPnIA2W6oviI=
+github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06/go.mod h1:+ePHsJ1keEjQtpvf9HHw0f4ZeJ0TLRsxhunSI2hYJSs=
 github.com/sajari/fuzzy v1.0.0 h1:+FmwVvJErsd0d0hAPlj4CxqxUtQY/fOoY0DwX4ykpRY=
 github.com/sajari/fuzzy v1.0.0/go.mod h1:OjYR6KxoWOe9+dOlXeiCJd4dIbED4Oo8wpS89o0pwOo=
 github.com/sebdah/goldie/v2 v2.8.0 h1:dZb9wR8q5++oplmEiJT+U/5KyotVD+HNGCAc5gNr8rc=
@@ -244,6 +238,7 @@ github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/u-root/u-root v0.15.1-0.20251208185023-2f8c7e763cf8 h1:cq+DjLAjz3ZPwh0+G571O/jMH0c0DzReDPLjQGL2/BA=
@@ -266,49 +261,49 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.6
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0/go.mod h1:fvPi2qXDqFs8M4B4fmJhE92TyQs9Ydjlg3RvfUp+NbQ=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0 h1:ZrPRak/kS4xI3AVXy8F7pipuDXmDsrO8Lg+yQjBLjw0=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0/go.mod h1:3y6kQCWztq6hyW8Z9YxQDDm0Je9AJoFar2G0yDcmhRk=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms=
+go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.39.0 h1:5gn2urDL/FBnK8OkCfD1j3/ER79rUuTYmCvlXBKeYL8=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.39.0/go.mod h1:0fBG6ZJxhqByfFZDwSwpZGzJU671HkwpWaNe2t4VUPI=
+go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g=
+go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc=
+go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8=
+go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE=
+go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw=
+go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg=
+go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw=
+go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
-golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
 golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw=
 golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
+golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
+golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
+golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
 gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/api v0.271.0 h1:cIPN4qcUc61jlh7oXu6pwOQqbJW2GqYh5PS6rB2C/JY=
-google.golang.org/api v0.271.0/go.mod h1:CGT29bhwkbF+i11qkRUJb2KMKqcJ1hdFceEIRd9u64Q=
+google.golang.org/api v0.267.0 h1:w+vfWPMPYeRs8qH1aYYsFX68jMls5acWl/jocfLomwE=
+google.golang.org/api v0.267.0/go.mod h1:Jzc0+ZfLnyvXma3UtaTl023TdhZu6OMBP9tJ+0EmFD0=
 google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 h1:VQZ/yAbAtjkHgH80teYd2em3xtIkkHd7ZhqfH2N9CsM=
 google.golang.org/genproto v0.0.0-20260128011058-8636f8732409/go.mod h1:rxKD3IEILWEu3P44seeNOAwZN4SaoKaQ/2eTg4mM6EM=
 google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 h1:7ei4lp52gK1uSejlA8AZl5AJjeLUOHBQscRQZUgAcu0=
 google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20/go.mod h1:ZdbssH/1SOVnjnDlXzxDHK2MCidiqXtbYccJNzNYPEE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 h1:Jr5R2J6F6qWyzINc+4AM8t5pfUz6beZpHp678GNrMbE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
 google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
 google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
@@ -319,11 +314,10 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntN
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 mvdan.cc/sh/moreinterp v0.0.0-20260120230322-19def062a997 h1:3bbJwtPFh98dJ6lxRdR3eLHTH1CmR3BcU6TriIMiXjE=
 mvdan.cc/sh/moreinterp v0.0.0-20260120230322-19def062a997/go.mod h1:Qy/zdaMDxq9sT72Gi43K3gsV+TtTohyDO3f1cyBVwuo=
-mvdan.cc/sh/v3 v3.13.2-0.20260503214111-9e7dd28c81cf h1:3mGRe/xSr7fd9m+c5FSab/CSCtADsbdMcyhYGdVR6DY=
-mvdan.cc/sh/v3 v3.13.2-0.20260503214111-9e7dd28c81cf/go.mod h1:lXJ8SexMvEVcHCoDvAGLZgFJ9Wsm2sulmoNEXGhYZD0=
-mvdan.cc/sh/v3 v3.13.2-0.20260510185049-f5c6e2779117 h1:BfzdGSjcnJBb8sPNLudpzTml8zFUxS1N0N/v9IIS6tQ=
-mvdan.cc/sh/v3 v3.13.2-0.20260510185049-f5c6e2779117/go.mod h1:lXJ8SexMvEVcHCoDvAGLZgFJ9Wsm2sulmoNEXGhYZD0=
+mvdan.cc/sh/v3 v3.13.0 h1:dSfq/MVsY4w0Vsi6Lbs0IcQquMVqLdKLESAOZjuHdLg=
+mvdan.cc/sh/v3 v3.13.0/go.mod h1:KV1GByGPc/Ho0X1E6Uz9euhsIQEj4hwyKnodLlFLoDM=
--- a/internal/deepcopy/deepcopy.go
+++ b/internal/deepcopy/deepcopy.go
@@ -81,7 +81,7 @@ func TraverseStringsFunc[T any](v T, fn func(v string) (string, error)) (T, erro
 	traverseFunc = func(copy, v reflect.Value) error {
 		switch v.Kind() {

-		case reflect.Pointer:
+		case reflect.Ptr:
 			// Unwrap the pointer
 			originalValue := v.Elem()
 			// If the pointer is nil, do nothing
--- a/internal/execext/exec.go
+++ b/internal/execext/exec.go
@@ -127,10 +127,7 @@ func ExpandFields(s string) ([]string, error) {
 	s = escape(s)
 	p := syntax.NewParser()
 	var words []*syntax.Word
-	for w, err := range p.WordsSeq(strings.NewReader(s)) {
-		if err != nil {
-			return nil, err
-		}
+	for w := range p.WordsSeq(strings.NewReader(s)) {
 		words = append(words, w)
 	}
 	cfg := &expand.Config{
--- a/internal/fingerprint/gitignore.go
+++ b/internal/fingerprint/gitignore.go
@@ -0,0 +1,92 @@
+package fingerprint
+
+import (
+	"bufio"
+	"os"
+	"path/filepath"
+	"strings"
+
+	ignore "github.com/sabhiram/go-gitignore"
+)
+
+type gitignoreRule struct {
+	dir     string
+	matcher *ignore.GitIgnore
+}
+
+// loadGitignoreRules walks up from dir collecting .gitignore files.
+// Stops at the first .git (file or directory) found.
+// Returns nil if no .git is found (not in a git repo).
+func loadGitignoreRules(dir string) []gitignoreRule {
+	dir, _ = filepath.Abs(dir)
+
+	var rules []gitignoreRule
+	foundGit := false
+	current := dir
+
+	for {
+		lines := readGitignoreLines(filepath.Join(current, ".gitignore"))
+		if len(lines) > 0 {
+			rules = append(rules, gitignoreRule{
+				dir:     current,
+				matcher: ignore.CompileIgnoreLines(lines...),
+			})
+		}
+		if _, err := os.Stat(filepath.Join(current, ".git")); err == nil {
+			foundGit = true
+			break
+		}
+		parent := filepath.Dir(current)
+		if parent == current {
+			break
+		}
+		current = parent
+	}
+
+	if !foundGit {
+		return nil
+	}
+
+	return rules
+}
+
+func readGitignoreLines(path string) []string {
+	f, err := os.Open(path)
+	if err != nil {
+		return nil
+	}
+	defer f.Close()
+
+	var lines []string
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := scanner.Text()
+		if line != "" && !strings.HasPrefix(line, "#") {
+			lines = append(lines, line)
+		}
+	}
+	return lines
+}
+
+// filterGitignored removes entries from the file map that match gitignore rules.
+func filterGitignored(files map[string]bool, dir string) map[string]bool {
+	rules := loadGitignoreRules(dir)
+	if len(rules) == 0 {
+		return files
+	}
+
+	for path := range files {
+		for _, rule := range rules {
+			relPath, err := filepath.Rel(rule.dir, path)
+			if err != nil || strings.HasPrefix(relPath, "..") {
+				continue
+			}
+			if rule.matcher.MatchesPath(filepath.ToSlash(relPath)) {
+				files[path] = false
+				break
+			}
+		}
+	}
+
+	return files
+}
--- a/internal/fingerprint/gitignore_test.go
+++ b/internal/fingerprint/gitignore_test.go
@@ -0,0 +1,112 @@
+package fingerprint
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/go-task/task/v3/taskfile/ast"
+)
+
+func initGitRepo(t *testing.T, dir string) {
+	t.Helper()
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, ".git"), 0o755))
+}
+
+func TestGlobsWithGitignore(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	initGitRepo(t, dir)
+
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "included.txt"), []byte("included"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "ignored.log"), []byte("ignored"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "also-included.txt"), []byte("also included"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, ".gitignore"), []byte("*.log\n"), 0o644))
+
+	globs := []*ast.Glob{
+		{Glob: "./*"},
+	}
+
+	filesWithout, err := Globs(dir, globs, false)
+	require.NoError(t, err)
+
+	filesWith, err := Globs(dir, globs, true)
+	require.NoError(t, err)
+
+	hasLog := false
+	for _, f := range filesWithout {
+		if filepath.Base(f) == "ignored.log" {
+			hasLog = true
+			break
+		}
+	}
+	assert.True(t, hasLog, "ignored.log should be present without gitignore filter")
+
+	hasLog = false
+	for _, f := range filesWith {
+		if filepath.Base(f) == "ignored.log" {
+			hasLog = true
+			break
+		}
+	}
+	assert.False(t, hasLog, "ignored.log should be excluded with gitignore filter")
+
+	txtCount := 0
+	for _, f := range filesWith {
+		if filepath.Ext(f) == ".txt" {
+			txtCount++
+		}
+	}
+	assert.Equal(t, 2, txtCount, "both .txt files should remain")
+}
+
+func TestGlobsWithGitignoreNested(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	initGitRepo(t, dir)
+
+	subDir := filepath.Join(dir, "sub")
+	require.NoError(t, os.MkdirAll(subDir, 0o755))
+
+	require.NoError(t, os.WriteFile(filepath.Join(subDir, "keep.txt"), []byte("keep"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(subDir, "build.out"), []byte("build"), 0o644))
+
+	require.NoError(t, os.WriteFile(filepath.Join(dir, ".gitignore"), []byte("*.log\n"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(subDir, ".gitignore"), []byte("*.out\n"), 0o644))
+
+	globs := []*ast.Glob{
+		{Glob: "./*"},
+	}
+
+	files, err := Globs(subDir, globs, true)
+	require.NoError(t, err)
+
+	for _, f := range files {
+		assert.NotEqual(t, "build.out", filepath.Base(f), "build.out should be excluded by nested .gitignore")
+	}
+}
+
+func TestGlobsWithGitignoreNoRepo(t *testing.T) {
+	t.Parallel()
+
+	// Cannot use t.TempDir() here because it creates a dir inside the
+	// go-task repo which has a .git parent, defeating the "no repo" test.
+	dir, err := os.MkdirTemp("", "task-gitignore-norepo-*") //nolint:usetesting
+	require.NoError(t, err)
+	t.Cleanup(func() { os.RemoveAll(dir) })
+
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "file.txt"), []byte("content"), 0o644))
+
+	globs := []*ast.Glob{
+		{Glob: "./*"},
+	}
+
+	files, err := Globs(dir, globs, true)
+	require.NoError(t, err)
+	assert.Len(t, files, 1)
+}
--- a/internal/fingerprint/glob.go
+++ b/internal/fingerprint/glob.go
@@ -10,7 +10,7 @@ import (
 	"github.com/go-task/task/v3/taskfile/ast"
 )

-func Globs(dir string, globs []*ast.Glob) ([]string, error) {
+func Globs(dir string, globs []*ast.Glob, useGitignore bool) ([]string, error) {
 	resultMap := make(map[string]bool)
 	for _, g := range globs {
 		matches, err := glob(dir, g.Glob)
@@ -21,6 +21,11 @@ func Globs(dir string, globs []*ast.Glob) ([]string, error) {
 			resultMap[match] = !g.Negate
 		}
 	}
+
+	if useGitignore {
+		resultMap = filterGitignored(resultMap, dir)
+	}
+
 	return collectKeys(resultMap), nil
 }

--- a/internal/fingerprint/sources_checksum.go
+++ b/internal/fingerprint/sources_checksum.go
@@ -89,7 +89,7 @@ func (*ChecksumChecker) Kind() string {
 }

 func (c *ChecksumChecker) checksum(t *ast.Task) (string, error) {
-	sources, err := Globs(t.Dir, t.Sources)
+	sources, err := Globs(t.Dir, t.Sources, t.ShouldUseGitignore())
 	if err != nil {
 		return "", err
 	}
--- a/internal/fingerprint/sources_timestamp.go
+++ b/internal/fingerprint/sources_timestamp.go
@@ -28,7 +28,7 @@ func (checker *TimestampChecker) IsUpToDate(t *ast.Task) (bool, error) {
 		return false, nil
 	}

-	sources, err := Globs(t.Dir, t.Sources)
+	sources, err := Globs(t.Dir, t.Sources, t.ShouldUseGitignore())
 	if err != nil {
 		return false, nil
 	}
@@ -54,7 +54,7 @@ func (checker *TimestampChecker) IsUpToDate(t *ast.Task) (bool, error) {
 		}
 	}

-	generates, err := Globs(t.Dir, t.Generates)
+	generates, err := Globs(t.Dir, t.Generates, t.ShouldUseGitignore())
 	if err != nil {
 		return false, nil
 	}
@@ -112,7 +112,7 @@ func (checker *TimestampChecker) Kind() string {

 // Value implements the Checker Interface
 func (checker *TimestampChecker) Value(t *ast.Task) (any, error) {
-	sources, err := Globs(t.Dir, t.Sources)
+	sources, err := Globs(t.Dir, t.Sources, t.ShouldUseGitignore())
 	if err != nil {
 		return time.Now(), err
 	}
--- a/internal/summary/summary.go
+++ b/internal/summary/summary.go
@@ -285,9 +285,7 @@ func isEnvVar(key string, envVars map[string]bool) bool {
 		key == "TASKFILE_DIR" ||
 		key == "USER_WORKING_DIR" ||
 		key == "ALIAS" ||
-		key == "MATCH" ||
-		key == "PATH_LIST_SEPARATOR" ||
-		key == "FILE_PATH_SEPARATOR" {
+		key == "MATCH" {
 		return true
 	}
 	return envVars[key]
--- a/internal/templater/funcs.go
+++ b/internal/templater/funcs.go
@@ -3,8 +3,6 @@ package templater
 import (
 	"maps"
 	"math/rand/v2"
-	"os"
-	"path"
 	"path/filepath"
 	"runtime"
 	"strings"
@@ -23,8 +21,8 @@ var templateFuncs template.FuncMap

 func init() {
 	taskFuncs := template.FuncMap{
-		"OS":           goos,
-		"ARCH":         goarch,
+		"OS":           os,
+		"ARCH":         arch,
 		"numCPU":       runtime.NumCPU,
 		"catLines":     catLines,
 		"splitLines":   splitLines,
@@ -35,8 +33,6 @@ func init() {
 		"splitArgs":    splitArgs,
 		"IsSH":         IsSH, // Deprecated
 		"joinPath":     filepath.Join,
-		"joinEnv":      joinEnv,
-		"joinUrl":      joinUrl,
 		"relPath":      filepath.Rel,
 		"absPath":      filepath.Abs,
 		"merge":        merge,
@@ -61,11 +57,11 @@ func init() {
 	maps.Copy(templateFuncs, taskFuncs)
 }

-func goos() string {
+func os() string {
 	return runtime.GOOS
 }

-func goarch() string {
+func arch() string {
 	return runtime.GOARCH
 }

@@ -99,14 +95,6 @@ func IsSH() bool {
 	return true
 }

-func joinEnv(elem ...string) string {
-	return strings.Join(elem, string(os.PathListSeparator))
-}
-
-func joinUrl(elem ...string) string {
-	return path.Join(elem...)
-}
-
 func merge(base map[string]any, v ...map[string]any) map[string]any {
 	cap := len(v)
 	for _, m := range v {
--- a/internal/templater/templater.go
+++ b/internal/templater/templater.go
@@ -68,13 +68,6 @@ func ReplaceWithExtra[T any](v T, cache *Cache, extra map[string]any) T {
 		return v
 	}

-	// Optimization: skip if string is not a template
-	if s, ok := any(v).(string); ok {
-		if !strings.Contains(s, "{{") {
-			return v
-		}
-	}
-
 	// Initialize the cache map if it's not already initialized
 	if cache.cacheMap == nil {
 		cache.cacheMap = cache.Vars.ToCacheMap()
@@ -89,10 +82,6 @@ func ReplaceWithExtra[T any](v T, cache *Cache, extra map[string]any) T {

 	// Traverse the value and parse any template variables
 	copy, err := deepcopy.TraverseStringsFunc(v, func(v string) (string, error) {
-		// Optimization: skip if string is not a template
-		if !strings.Contains(v, "{{") {
-			return v, nil
-		}
 		tpl, err := template.New("").Funcs(templateFuncs).Parse(v)
 		if err != nil {
 			return v, err
--- a/internal/version/version.txt
+++ b/internal/version/version.txt
@@ -1 +1 @@
-3.51.1
+3.50.0
--- a/task_test.go
+++ b/task_test.go
@@ -653,6 +653,55 @@ func TestStatusChecksumMissingGenerated(t *testing.T) { // nolint:paralleltest /
 	require.NoError(t, err, "generated.txt should be recreated after third run")
 }

+func TestGitignoreChecksum(t *testing.T) { //nolint:paralleltest // cannot run in parallel
+	const dir = "testdata/gitignore"
+
+	// Clean up
+	_ = os.RemoveAll(filepathext.SmartJoin(dir, ".task"))
+	_ = os.Remove(filepathext.SmartJoin(dir, "generated.txt"))
+
+	var buff bytes.Buffer
+	tempDir := task.TempDir{
+		Remote:      filepathext.SmartJoin(dir, ".task"),
+		Fingerprint: filepathext.SmartJoin(dir, ".task"),
+	}
+	e := task.NewExecutor(
+		task.WithDir(dir),
+		task.WithStdout(&buff),
+		task.WithStderr(&buff),
+		task.WithTempDir(tempDir),
+	)
+	require.NoError(t, e.Setup())
+
+	// First run - should execute
+	require.NoError(t, e.Run(t.Context(), &task.Call{Task: "build"}))
+
+	// Second run - should be up to date
+	buff.Reset()
+	require.NoError(t, e.Run(t.Context(), &task.Call{Task: "build"}))
+	assert.Equal(t, "task: Task \"build\" is up to date\n", buff.String())
+
+	// Modify the ignored file - should still be up to date
+	require.NoError(t, os.WriteFile(filepathext.SmartJoin(dir, "ignored.txt"), []byte("modified\n"), 0o644))
+	buff.Reset()
+	require.NoError(t, e.Run(t.Context(), &task.Call{Task: "build"}))
+	assert.Equal(t, "task: Task \"build\" is up to date\n", buff.String())
+
+	// Modify the source file - should re-execute
+	require.NoError(t, os.WriteFile(filepathext.SmartJoin(dir, "source.txt"), []byte("modified source\n"), 0o644))
+	buff.Reset()
+	require.NoError(t, e.Run(t.Context(), &task.Call{Task: "build"}))
+	assert.NotEqual(t, "task: Task \"build\" is up to date\n", buff.String())
+
+	// Restore source file
+	require.NoError(t, os.WriteFile(filepathext.SmartJoin(dir, "source.txt"), []byte("source content\n"), 0o644))
+	require.NoError(t, os.WriteFile(filepathext.SmartJoin(dir, "ignored.txt"), []byte("ignored content\n"), 0o644))
+
+	// Clean up
+	_ = os.RemoveAll(filepathext.SmartJoin(dir, ".task"))
+	_ = os.Remove(filepathext.SmartJoin(dir, "generated.txt"))
+}
+
 func TestStatusVariables(t *testing.T) {
 	t.Parallel()

--- a/taskfile/ast/task.go
+++ b/taskfile/ast/task.go
@@ -38,6 +38,7 @@ type Task struct {
 	Method        string
 	Prefix        string `hash:"ignore"`
 	IgnoreError   bool
+	UseGitignore  *bool
 	Run           string
 	Platforms     []*Platform
 	If            string
@@ -75,6 +76,12 @@ func (t *Task) IsSilent() bool {
 	return t.Silent != nil && *t.Silent
 }

+// ShouldUseGitignore returns true if the task has gitignore filtering explicitly enabled.
+// Returns false if UseGitignore is nil (not set) or explicitly set to false.
+func (t *Task) ShouldUseGitignore() bool {
+	return t.UseGitignore != nil && *t.UseGitignore
+}
+
 // WildcardMatch will check if the given string matches the name of the Task and returns any wildcard values.
 func (t *Task) WildcardMatch(name string) (bool, []string) {
 	names := append([]string{t.Task}, t.Aliases...)
@@ -149,7 +156,8 @@ func (t *Task) UnmarshalYAML(node *yaml.Node) error {
 			Internal      bool
 			Method        string
 			Prefix        string
-			IgnoreError   bool `yaml:"ignore_error"`
+			IgnoreError   bool  `yaml:"ignore_error"`
+			UseGitignore  *bool `yaml:"use_gitignore,omitempty"`
 			Run           string
 			Platforms     []*Platform
 			If            string
@@ -190,6 +198,7 @@ func (t *Task) UnmarshalYAML(node *yaml.Node) error {
 		t.Method = task.Method
 		t.Prefix = task.Prefix
 		t.IgnoreError = task.IgnoreError
+		t.UseGitignore = deepcopy.Scalar(task.UseGitignore)
 		t.Run = task.Run
 		t.Platforms = task.Platforms
 		t.If = task.If
@@ -233,6 +242,7 @@ func (t *Task) DeepCopy() *Task {
 		Method:               t.Method,
 		Prefix:               t.Prefix,
 		IgnoreError:          t.IgnoreError,
+		UseGitignore:         deepcopy.Scalar(t.UseGitignore),
 		Run:                  t.Run,
 		IncludeVars:          t.IncludeVars.DeepCopy(),
 		IncludedTaskfileVars: t.IncludedTaskfileVars.DeepCopy(),
--- a/taskfile/ast/taskfile.go
+++ b/taskfile/ast/taskfile.go
@@ -20,20 +20,21 @@ var ErrIncludedTaskfilesCantHaveDotenvs = errors.New("task: Included Taskfiles c

 // Taskfile is the abstract syntax tree for a Taskfile
 type Taskfile struct {
-	Location string
-	Version  *semver.Version
-	Output   Output
-	Method   string
-	Includes *Includes
-	Set      []string
-	Shopt    []string
-	Vars     *Vars
-	Env      *Vars
-	Tasks    *Tasks
-	Silent   bool
-	Dotenv   []string
-	Run      string
-	Interval time.Duration
+	Location     string
+	Version      *semver.Version
+	Output       Output
+	Method       string
+	Includes     *Includes
+	Set          []string
+	Shopt        []string
+	Vars         *Vars
+	Env          *Vars
+	Tasks        *Tasks
+	Silent       bool
+	Dotenv       []string
+	Run          string
+	Interval     time.Duration
+	UseGitignore bool `yaml:"use_gitignore"`
 }

 // Merge merges the second Taskfile into the first
@@ -76,19 +77,20 @@ func (tf *Taskfile) UnmarshalYAML(node *yaml.Node) error {
 	switch node.Kind {
 	case yaml.MappingNode:
 		var taskfile struct {
-			Version  *semver.Version
-			Output   Output
-			Method   string
-			Includes *Includes
-			Set      []string
-			Shopt    []string
-			Vars     *Vars
-			Env      *Vars
-			Tasks    *Tasks
-			Silent   bool
-			Dotenv   []string
-			Run      string
-			Interval time.Duration
+			Version      *semver.Version
+			Output       Output
+			Method       string
+			Includes     *Includes
+			Set          []string
+			Shopt        []string
+			Vars         *Vars
+			Env          *Vars
+			Tasks        *Tasks
+			Silent       bool
+			Dotenv       []string
+			Run          string
+			Interval     time.Duration
+			UseGitignore bool `yaml:"use_gitignore"`
 		}
 		if err := node.Decode(&taskfile); err != nil {
 			return errors.NewTaskfileDecodeError(err, node)
@@ -106,6 +108,7 @@ func (tf *Taskfile) UnmarshalYAML(node *yaml.Node) error {
 		tf.Dotenv = taskfile.Dotenv
 		tf.Run = taskfile.Run
 		tf.Interval = taskfile.Interval
+		tf.UseGitignore = taskfile.UseGitignore
 		if tf.Includes == nil {
 			tf.Includes = NewIncludes()
 		}
--- a/taskfile/node.go
+++ b/taskfile/node.go
@@ -73,7 +73,7 @@ func NewNode(
 	return node, err
 }

-func IsRemoteEntrypoint(entrypoint string) bool {
+func isRemoteEntrypoint(entrypoint string) bool {
 	scheme, _ := getScheme(entrypoint)
 	switch scheme {
 	case "git", "http", "https":
@@ -93,8 +93,8 @@ func getScheme(uri string) (string, error) {
 		return "git", nil
 	}

-	if before, _, ok := strings.Cut(uri, "://"); ok {
-		return before, nil
+	if i := strings.Index(uri, "://"); i != -1 {
+		return uri[:i], nil
 	}

 	return "", nil
--- a/taskfile/node_file.go
+++ b/taskfile/node_file.go
@@ -60,7 +60,7 @@ func (node *FileNode) Read() ([]byte, error) {

 func (node *FileNode) ResolveEntrypoint(entrypoint string) (string, error) {
 	// If the file is remote, we don't need to resolve the path
-	if IsRemoteEntrypoint(entrypoint) {
+	if isRemoteEntrypoint(entrypoint) {
 		return entrypoint, nil
 	}

--- a/taskfile/node_git.go
+++ b/taskfile/node_git.go
@@ -188,7 +188,7 @@ func (node *GitNode) ReadContext(ctx context.Context) ([]byte, error) {

 func (node *GitNode) ResolveEntrypoint(entrypoint string) (string, error) {
 	// If the file is remote, we don't need to resolve the path
-	if IsRemoteEntrypoint(entrypoint) {
+	if isRemoteEntrypoint(entrypoint) {
 		return entrypoint, nil
 	}

--- a/taskfile/node_stdin.go
+++ b/taskfile/node_stdin.go
@@ -42,7 +42,7 @@ func (node *StdinNode) Read() ([]byte, error) {

 func (node *StdinNode) ResolveEntrypoint(entrypoint string) (string, error) {
 	// If the file is remote, we don't need to resolve the path
-	if IsRemoteEntrypoint(entrypoint) {
+	if isRemoteEntrypoint(entrypoint) {
 		return entrypoint, nil
 	}

--- a/taskfile/reader.go
+++ b/taskfile/reader.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"net/url"
 	"os"
-	"slices"
 	"sync"
 	"time"

@@ -286,7 +285,12 @@ func (r *Reader) isTrusted(uri string) bool {
 	host := parsedURL.Host

 	// Check against each trusted pattern (exact match including port if provided)
-	return slices.Contains(r.trustedHosts, host)
+	for _, pattern := range r.trustedHosts {
+		if host == pattern {
+			return true
+		}
+	}
+	return false
 }

 func (r *Reader) include(ctx context.Context, node Node) error {
--- a/testdata/gitignore/.gitignore
+++ b/testdata/gitignore/.gitignore
@@ -0,0 +1 @@
+ignored.txt
--- a/testdata/gitignore/Taskfile.yml
+++ b/testdata/gitignore/Taskfile.yml
@@ -0,0 +1,25 @@
+version: '3'
+
+use_gitignore: true
+
+tasks:
+  build:
+    cmds:
+      - cp ./source.txt ./generated.txt
+    sources:
+      - ./*.txt
+      - exclude: ./generated.txt
+    generates:
+      - ./generated.txt
+    method: checksum
+
+  build-no-use_gitignore:
+    use_gitignore: false
+    cmds:
+      - cp ./source.txt ./generated.txt
+    sources:
+      - ./*.txt
+      - exclude: ./generated.txt
+    generates:
+      - ./generated.txt
+    method: checksum
--- a/testdata/gitignore/source.txt
+++ b/testdata/gitignore/source.txt
@@ -0,0 +1 @@
+source content
--- a/variables.go
+++ b/variables.go
@@ -59,6 +59,7 @@ func (e *Executor) CompiledTaskForTaskList(call *Call) (*ast.Task, error) {
 		Env:                  nil,
 		Dotenv:               origTask.Dotenv,
 		Silent:               deepcopy.Scalar(origTask.Silent),
+		UseGitignore:         deepcopy.Scalar(origTask.UseGitignore),
 		Interactive:          origTask.Interactive,
 		Internal:             origTask.Internal,
 		Method:               origTask.Method,
@@ -110,6 +111,11 @@ func (e *Executor) compiledTask(call *Call, evaluateShVars bool) (*ast.Task, err
 		}
 	}

+	gitignore := origTask.ShouldUseGitignore()
+	if origTask.UseGitignore == nil {
+		gitignore = e.Taskfile.UseGitignore
+	}
+
 	new := ast.Task{
 		Task:                 origTask.Task,
 		Label:                templater.Replace(origTask.Label, cache),
@@ -126,6 +132,7 @@ func (e *Executor) compiledTask(call *Call, evaluateShVars bool) (*ast.Task, err
 		Env:                  nil,
 		Dotenv:               templater.Replace(origTask.Dotenv, cache),
 		Silent:               deepcopy.Scalar(origTask.Silent),
+		UseGitignore:         &gitignore,
 		Interactive:          origTask.Interactive,
 		Internal:             origTask.Internal,
 		Method:               templater.Replace(origTask.Method, cache),
@@ -219,7 +226,7 @@ func (e *Executor) compiledTask(call *Call, evaluateShVars bool) (*ast.Task, err
 				continue
 			}
 			if cmd.For != nil {
-				list, keys, err := itemsFromFor(cmd.For, new.Dir, new.Sources, new.Generates, vars, origTask.Location, cache)
+				list, keys, err := itemsFromFor(cmd.For, new.Dir, new.Sources, new.Generates, gitignore, vars, origTask.Location, cache)
 				if err != nil {
 					return nil, err
 				}
@@ -268,7 +275,7 @@ func (e *Executor) compiledTask(call *Call, evaluateShVars bool) (*ast.Task, err
 				continue
 			}
 			if dep.For != nil {
-				list, keys, err := itemsFromFor(dep.For, new.Dir, new.Sources, new.Generates, vars, origTask.Location, cache)
+				list, keys, err := itemsFromFor(dep.For, new.Dir, new.Sources, new.Generates, gitignore, vars, origTask.Location, cache)
 				if err != nil {
 					return nil, err
 				}
@@ -339,6 +346,7 @@ func itemsFromFor(
 	dir string,
 	sources []*ast.Glob,
 	generates []*ast.Glob,
+	gitignore bool,
 	vars *ast.Vars,
 	location *ast.Location,
 	cache *templater.Cache,
@@ -361,7 +369,7 @@ func itemsFromFor(
 	}
 	// Get the list from the task sources
 	if f.From == "sources" {
-		glist, err := fingerprint.Globs(dir, sources)
+		glist, err := fingerprint.Globs(dir, sources, gitignore)
 		if err != nil {
 			return nil, nil, err
 		}
@@ -375,7 +383,7 @@ func itemsFromFor(
 	}
 	// Get the list from the task generates
 	if f.From == "generates" {
-		glist, err := fingerprint.Globs(dir, generates)
+		glist, err := fingerprint.Globs(dir, generates, gitignore)
 		if err != nil {
 			return nil, nil, err
 		}
--- a/watch.go
+++ b/watch.go
@@ -205,7 +205,7 @@ func (e *Executor) collectSources(calls []*Call) ([]string, error) {
 	var sources []string

 	err := e.traverse(calls, func(task *ast.Task) error {
-		files, err := fingerprint.Globs(task.Dir, task.Sources)
+		files, err := fingerprint.Globs(task.Dir, task.Sources, task.ShouldUseGitignore())
 		if err != nil {
 			return err
 		}
--- a/website/.vitepress/adopters.ts
+++ b/website/.vitepress/adopters.ts
@@ -1,138 +0,0 @@
-export interface Adopter {
-  name: string;
-  url: string;
-  img: string;
-  description: string;
-}
-
-export const adopters: Adopter[] = [
-  // Big brand names (first three double as the "featured" showcase)
-  {
-    name: 'Docker',
-    url: 'https://github.com/docker/mcp-registry',
-    img: 'https://github.com/docker.png',
-    description:
-      'The industry-standard container platform uses Task in mcp-registry, the official registry for Docker Model Context Protocol servers.'
-  },
-  {
-    name: 'Vercel',
-    url: 'https://github.com/vercel/terraform-provider-vercel',
-    img: 'https://github.com/vercel.png',
-    description:
-      'The team behind Next.js and the leading frontend cloud platform uses Task to run and release the official Vercel Terraform provider.'
-  },
-  {
-    name: 'HashiCorp',
-    url: 'https://github.com/hashicorp/terraform-aws-terraform-enterprise-hvd',
-    img: 'https://github.com/hashicorp.png',
-    description:
-      'HashiCorp ships Task across its Validated Design modules for Terraform, Vault, Consul, Nomad, and Boundary on AWS, Azure, and GCP.'
-  },
-  // Other big brands
-  {
-    name: 'Microsoft',
-    url: 'https://github.com/Azure/Azure-Sentinel',
-    img: 'https://github.com/microsoft.png',
-    description:
-      'Azure Sentinel, Microsoft’s cloud-native SIEM used by enterprises worldwide, relies on Task to orchestrate its repository automation.'
-  },
-  {
-    name: 'Google Cloud',
-    url: 'https://github.com/GoogleCloudPlatform/deploystack',
-    img: 'https://github.com/GoogleCloudPlatform.png',
-    description:
-      'DeployStack, Google Cloud’s one-click Terraform deployment tool, automates its workflows with Task.'
-  },
-  {
-    name: 'AWS',
-    url: 'https://github.com/aws-samples/appmod-blueprints',
-    img: 'https://github.com/aws-samples.png',
-    description:
-      'The AWS Samples AppMod Blueprints reference platform uses Task to orchestrate its demo environments.'
-  },
-  {
-    name: 'Anthropic',
-    url: 'https://github.com/anthropics/buffa',
-    img: 'https://github.com/anthropics.png',
-    description:
-      'Anthropic’s Rust protobuf implementation, buffa, uses Task for its build and release tooling.'
-  },
-  {
-    name: 'MongoDB',
-    url: 'https://github.com/mongodb/mongo-go-driver',
-    img: 'https://github.com/mongodb.png',
-    description:
-      'The official Go driver for MongoDB uses Task to orchestrate its build, lint, formatting, and full test suite across every commit.'
-  },
-  {
-    name: 'Redpanda',
-    url: 'https://github.com/redpanda-data/connect',
-    img: 'https://github.com/redpanda-data.png',
-    description:
-      'Redpanda Connect, the stream processor formerly known as Benthos, uses Task to orchestrate builds, Docker images, test suites, and its GitHub release pipeline.'
-  },
-  // Notable open source projects
-  {
-    name: 'Flet',
-    url: 'https://github.com/flet-dev/flet',
-    img: 'https://github.com/flet-dev.png',
-    description:
-      'Build realtime web, mobile and desktop apps in Python, with no frontend experience required.'
-  },
-  {
-    name: 'GoReleaser',
-    url: 'https://github.com/goreleaser/goreleaser',
-    img: 'https://github.com/goreleaser.png',
-    description:
-      'Release engineering, simplified. GoReleaser is the de-facto release automation tool for Go projects.'
-  },
-  {
-    name: 'Arduino CLI',
-    url: 'https://github.com/arduino/arduino-cli',
-    img: 'https://github.com/arduino.png',
-    description:
-      'The official Arduino command-line tool. Task powers the entire Arduino developer tooling stack across 70+ repositories.'
-  },
-  {
-    name: 'FerretDB',
-    url: 'https://github.com/FerretDB/FerretDB',
-    img: 'https://github.com/FerretDB.png',
-    description:
-      'A truly open-source MongoDB alternative built on PostgreSQL, with Task driving every build and release step.'
-  },
-  {
-    name: 'Tyk',
-    url: 'https://github.com/TykTechnologies/tyk',
-    img: 'https://github.com/TykTechnologies.png',
-    description:
-      'Open source API gateway supporting REST, GraphQL, TCP and gRPC, automated end-to-end with Task.'
-  },
-  {
-    name: 'Charmbracelet',
-    url: 'https://github.com/charmbracelet/glamour',
-    img: 'https://github.com/charmbracelet.png',
-    description:
-      'The team behind Bubble Tea uses Task to build Glamour, the stylesheet-based markdown renderer for CLI apps.'
-  },
-  {
-    name: 'Outline',
-    url: 'https://github.com/OutlineFoundation/outline-server',
-    img: 'https://github.com/OutlineFoundation.png',
-    description:
-      'Outline, the open-source proxy server originally built by Jigsaw (Google), uses Task for its build pipeline.'
-  },
-  {
-    name: 'werf',
-    url: 'https://github.com/werf/werf',
-    img: 'https://github.com/werf.png',
-    description:
-      'werf, the CNCF-hosted CI/CD tool for shipping software to Kubernetes, uses Task as its build and development entry point.'
-  },
-  {
-    name: 'Gobuster',
-    url: 'https://github.com/OJ/gobuster',
-    img: 'https://github.com/OJ.png',
-    description:
-      'The ubiquitous directory, DNS and virtual-host brute-forcing tool trusted by pen testers worldwide runs its entire build through Task.'
-  }
-];
--- a/website/.vitepress/components/Adopters.vue
+++ b/website/.vitepress/components/Adopters.vue
@@ -1,629 +0,0 @@
-<script setup lang="ts">
-import { adopters } from '../adopters';
-
-const featured = adopters.slice(0, 3);
-const rest = adopters.slice(3);
-
-const pad = (n: number) => String(n).padStart(2, '0');
-const githubPath = (url: string) =>
-  url.replace(/^https?:\/\/github\.com\//, '').replace(/\/$/, '');
-</script>
-
-<template>
-  <article class="adopters-page">
-    <header class="hero">
-      <p class="kicker">
-        <span class="slashes">//</span>
-        Who builds with Task
-      </p>
-      <h1 class="title">
-        Trusted by teams shipping<br />
-        production software.
-      </h1>
-      <p class="lead">
-        Thousands of open source projects use Task as their build and release
-        orchestrator, from hyperscaler platforms and enterprise security tools
-        to CLI utilities downloaded millions of times. Below are a few
-        organizations whose public repositories ship a
-        <code>Taskfile.yml</code>. Every entry links to real, production code
-        you can inspect yourself.
-      </p>
-    </header>
-
-    <section class="featured" aria-labelledby="featured-heading">
-      <h2 id="featured-heading" class="section-title">
-        <span class="slashes">//</span>
-        Featured adopters
-      </h2>
-      <div class="featured-grid">
-        <a
-          v-for="item in featured"
-          :key="item.name"
-          :href="item.url"
-          target="_blank"
-          rel="noopener"
-          class="featured-card"
-          :aria-label="`${item.name} on GitHub`"
-        >
-          <span class="corner tl" aria-hidden="true"></span>
-          <span class="corner tr" aria-hidden="true"></span>
-          <span class="corner bl" aria-hidden="true"></span>
-          <span class="corner br" aria-hidden="true"></span>
-
-          <img
-            :src="item.img"
-            :alt="`${item.name} logo`"
-            class="featured-logo"
-            loading="lazy"
-            decoding="async"
-            width="64"
-            height="64"
-          />
-          <h3 class="featured-name">{{ item.name }}</h3>
-          <p class="featured-desc">{{ item.description }}</p>
-          <span class="featured-cta">
-            <span class="cta-label">View Taskfile on GitHub</span>
-            <span class="cta-arrow" aria-hidden="true">&rarr;</span>
-          </span>
-        </a>
-      </div>
-    </section>
-
-    <section class="grid-section" aria-labelledby="grid-heading">
-      <h2 id="grid-heading" class="section-title">
-        <span class="slashes">//</span>
-        More projects using Task
-      </h2>
-      <div class="grid">
-        <a
-          v-for="(item, i) in rest"
-          :key="item.name"
-          :href="item.url"
-          target="_blank"
-          rel="noopener"
-          class="card"
-          :aria-label="`${item.name} on GitHub`"
-        >
-          <div class="card-head">
-            <img
-              :src="item.img"
-              :alt="`${item.name} logo`"
-              class="card-logo"
-              loading="lazy"
-              decoding="async"
-              width="44"
-              height="44"
-            />
-            <span class="card-index"
-              >N&deg; {{ pad(i + featured.length + 1) }}</span
-            >
-          </div>
-          <h3 class="card-name">{{ item.name }}</h3>
-          <p class="card-desc">{{ item.description }}</p>
-          <div class="card-foot">
-            <span class="card-path">{{ githubPath(item.url) }}</span>
-            <span class="card-arrow" aria-hidden="true">&rarr;</span>
-          </div>
-        </a>
-      </div>
-    </section>
-
-    <section class="faq" aria-labelledby="why-heading">
-      <h2 id="why-heading" class="section-title">
-        <span class="slashes">//</span>
-        Why Task?
-      </h2>
-      <dl class="faq-list">
-        <div class="faq-item">
-          <dt>Is Task production-ready?</dt>
-          <dd>
-            Yes. Task ships as a single static binary, has been in wide
-            production use since 2018, and powers the release workflows of
-            projects with millions of downloads including Arduino CLI,
-            GoReleaser, FerretDB, and Gogs.
-          </dd>
-        </div>
-        <div class="faq-item">
-          <dt>Who uses Task in enterprise?</dt>
-          <dd>
-            Docker, Vercel, HashiCorp, Microsoft (Azure Sentinel), Google Cloud,
-            AWS, and Anthropic are among the organizations that ship code with a
-            <code>Taskfile.yml</code>. Task is also embedded end-to-end in
-            Arduino’s developer tooling stack across more than 70 repositories.
-          </dd>
-        </div>
-        <div class="faq-item">
-          <dt>How is Task different from Make?</dt>
-          <dd>
-            Task uses plain YAML instead of Make’s tab-sensitive syntax, runs
-            identically on Linux, macOS, and Windows, and provides built-in
-            caching based on file fingerprints. It also comes with an
-            <a href="/docs/integrations"
-              >ecosystem of editor and CI integrations</a
-            >
-            that Make lacks by default.
-          </dd>
-        </div>
-        <div class="faq-item">
-          <dt>Where can I find real-world Taskfile examples?</dt>
-          <dd>
-            Every project above links directly to a public repository containing
-            a production <code>Taskfile.yml</code>. Browsing those is the
-            fastest way to see Task used in real codebases at different scales.
-          </dd>
-        </div>
-      </dl>
-    </section>
-
-    <aside class="submit-cta">
-      <div class="submit-body">
-        <p class="submit-kicker">
-          <span class="slashes">//</span>
-          Using Task in your project?
-        </p>
-        <p class="submit-text">
-          Open a pull request on
-          <a
-            href="https://github.com/go-task/task/blob/main/website/.vitepress/adopters.ts"
-            target="_blank"
-            rel="noopener"
-            ><code>.vitepress/adopters.ts</code></a
-          >
-          to get featured here.
-        </p>
-      </div>
-    </aside>
-  </article>
-</template>
-
-<style scoped>
-.adopters-page {
-  max-width: 1152px;
-  margin: 0 auto;
-  padding: 0 24px 6rem;
-}
-
-.slashes {
-  color: var(--vp-c-brand-1);
-  margin-right: 0.4em;
-}
-
-.section-title {
-  font-family: var(--vp-font-family-mono);
-  font-size: 0.8rem;
-  font-weight: 500;
-  letter-spacing: 0.04em;
-  color: var(--vp-c-text-2);
-  text-transform: uppercase;
-  margin: 0 0 1.5rem;
-}
-
-/* ---------- Hero ---------- */
-.hero {
-  padding: 3.5rem 0 4rem;
-  max-width: 48rem;
-}
-
-.kicker {
-  font-family: var(--vp-font-family-mono);
-  font-size: 0.8rem;
-  font-weight: 500;
-  letter-spacing: 0.04em;
-  color: var(--vp-c-text-2);
-  text-transform: uppercase;
-  margin: 0 0 1.25rem;
-}
-
-.title {
-  font-size: clamp(2.25rem, 5vw, 3.5rem);
-  font-weight: 700;
-  letter-spacing: -0.03em;
-  line-height: 1.05;
-  margin: 0 0 1.75rem;
-  color: var(--vp-c-text-1);
-}
-
-.lead {
-  font-size: 1.1rem;
-  line-height: 1.65;
-  color: var(--vp-c-text-2);
-  margin: 0;
-}
-
-.lead code {
-  font-family: var(--vp-font-family-mono);
-  font-size: 0.9em;
-  padding: 0.1rem 0.4rem;
-  border-radius: 4px;
-  background: var(--vp-c-bg-alt);
-  color: var(--vp-c-brand-1);
-}
-
-/* ---------- Featured ---------- */
-.featured {
-  margin-bottom: 4rem;
-}
-
-.featured-grid {
-  display: grid;
-  grid-template-columns: repeat(auto-fit, minmax(280px, 1fr));
-  gap: 1.25rem;
-}
-
-.featured-card {
-  position: relative;
-  display: flex;
-  flex-direction: column;
-  gap: 1rem;
-  padding: 2rem 1.75rem;
-  border: 1px solid var(--vp-c-divider);
-  border-radius: 16px;
-  background: var(--vp-c-bg-soft);
-  color: var(--vp-c-text-1);
-  text-decoration: none !important;
-  transition:
-    border-color 0.3s ease,
-    transform 0.3s ease,
-    box-shadow 0.3s ease;
-  isolation: isolate;
-  overflow: hidden;
-}
-
-.featured-card::before {
-  content: '';
-  position: absolute;
-  inset: 0;
-  background: radial-gradient(
-    600px circle at 50% 0%,
-    color-mix(in srgb, var(--vp-c-brand-1) 14%, transparent),
-    transparent 50%
-  );
-  opacity: 0;
-  transition: opacity 0.3s ease;
-  pointer-events: none;
-  z-index: -1;
-}
-
-.featured-card:hover {
-  border-color: color-mix(
-    in srgb,
-    var(--vp-c-brand-1) 50%,
-    var(--vp-c-divider)
-  );
-  transform: translateY(-3px);
-  box-shadow: 0 18px 48px -28px
-    color-mix(in srgb, var(--vp-c-brand-1) 50%, transparent);
-}
-
-.featured-card:hover::before {
-  opacity: 1;
-}
-
-.featured-logo {
-  width: 56px;
-  height: 56px;
-  border-radius: 12px;
-  object-fit: cover;
-  background: #fff;
-}
-
-.featured-name {
-  font-size: 1.4rem;
-  font-weight: 700;
-  letter-spacing: -0.02em;
-  margin: 0;
-  line-height: 1.2;
-}
-
-.featured-desc {
-  font-size: 0.95rem;
-  line-height: 1.55;
-  color: var(--vp-c-text-2);
-  margin: 0;
-  flex: 1;
-}
-
-.featured-cta {
-  display: inline-flex;
-  align-items: center;
-  gap: 0.4rem;
-  font-family: var(--vp-font-family-mono);
-  font-size: 0.78rem;
-  color: var(--vp-c-text-2);
-  transition: color 0.3s ease;
-  margin-top: 0.5rem;
-}
-
-.featured-card:hover .featured-cta {
-  color: var(--vp-c-brand-1);
-}
-
-.cta-arrow {
-  display: inline-block;
-  transition: transform 0.3s ease;
-}
-
-.featured-card:hover .cta-arrow {
-  transform: translateX(4px);
-}
-
-/* Crosshair corner marks (shared with grid cards) */
-.corner {
-  position: absolute;
-  width: 10px;
-  height: 10px;
-  opacity: 0;
-  transition: opacity 0.3s ease;
-  pointer-events: none;
-}
-
-.corner::before,
-.corner::after {
-  content: '';
-  position: absolute;
-  background: var(--vp-c-brand-1);
-}
-
-.corner::before {
-  width: 10px;
-  height: 1px;
-  top: 50%;
-  left: 0;
-}
-
-.corner::after {
-  width: 1px;
-  height: 10px;
-  top: 0;
-  left: 50%;
-}
-
-.corner.tl {
-  top: 8px;
-  left: 8px;
-}
-.corner.tr {
-  top: 8px;
-  right: 8px;
-}
-.corner.bl {
-  bottom: 8px;
-  left: 8px;
-}
-.corner.br {
-  bottom: 8px;
-  right: 8px;
-}
-
-.featured-card:hover .corner {
-  opacity: 0.8;
-}
-
-/* ---------- Grid ---------- */
-.grid-section {
-  margin-bottom: 4rem;
-}
-
-.grid {
-  display: grid;
-  grid-template-columns: repeat(auto-fill, minmax(260px, 1fr));
-  gap: 1rem;
-}
-
-.card {
-  position: relative;
-  display: flex;
-  flex-direction: column;
-  gap: 1rem;
-  padding: 1.25rem 1.25rem 1rem;
-  border: 1px solid var(--vp-c-divider);
-  border-radius: 12px;
-  background: var(--vp-c-bg-soft);
-  color: var(--vp-c-text-1);
-  text-decoration: none !important;
-  transition:
-    border-color 0.25s ease,
-    transform 0.25s ease,
-    box-shadow 0.25s ease;
-}
-
-.card:hover {
-  border-color: color-mix(
-    in srgb,
-    var(--vp-c-brand-1) 45%,
-    var(--vp-c-divider)
-  );
-  transform: translateY(-2px);
-  box-shadow: 0 10px 28px -22px
-    color-mix(in srgb, var(--vp-c-brand-1) 40%, transparent);
-}
-
-.card-head {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 0.75rem;
-}
-
-.card-logo {
-  width: 40px;
-  height: 40px;
-  border-radius: 8px;
-  object-fit: cover;
-  background: #fff;
-  flex-shrink: 0;
-}
-
-.card-index {
-  font-family: var(--vp-font-family-mono);
-  font-size: 0.7rem;
-  letter-spacing: 0.04em;
-  color: var(--vp-c-text-3);
-  font-variant-numeric: tabular-nums;
-  transition: color 0.25s ease;
-}
-
-.card:hover .card-index {
-  color: var(--vp-c-brand-1);
-}
-
-.card-name {
-  font-size: 1.05rem;
-  font-weight: 600;
-  letter-spacing: -0.01em;
-  line-height: 1.25;
-  margin: 0;
-}
-
-.card-desc {
-  font-size: 0.85rem;
-  line-height: 1.5;
-  color: var(--vp-c-text-2);
-  margin: 0;
-  flex: 1;
-}
-
-.card-foot {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 0.5rem;
-  padding-top: 0.75rem;
-  border-top: 1px dashed var(--vp-c-divider);
-}
-
-.card-path {
-  font-family: var(--vp-font-family-mono);
-  font-size: 0.72rem;
-  color: var(--vp-c-text-3);
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-  min-width: 0;
-  flex: 1;
-}
-
-.card-arrow {
-  font-family: var(--vp-font-family-mono);
-  font-size: 0.8rem;
-  color: var(--vp-c-text-2);
-  transition:
-    transform 0.25s ease,
-    color 0.25s ease;
-}
-
-.card:hover .card-arrow {
-  transform: translateX(3px);
-  color: var(--vp-c-brand-1);
-}
-
-/* ---------- FAQ ---------- */
-.faq {
-  margin-bottom: 3.5rem;
-  max-width: 48rem;
-}
-
-.faq-list {
-  margin: 0;
-}
-
-.faq-item {
-  padding: 1.25rem 0;
-  border-bottom: 1px solid var(--vp-c-divider);
-}
-
-.faq-item:first-of-type {
-  border-top: 1px solid var(--vp-c-divider);
-}
-
-.faq-item dt {
-  font-size: 1.05rem;
-  font-weight: 600;
-  color: var(--vp-c-text-1);
-  margin: 0 0 0.5rem;
-  letter-spacing: -0.01em;
-}
-
-.faq-item dd {
-  font-size: 0.95rem;
-  line-height: 1.65;
-  color: var(--vp-c-text-2);
-  margin: 0;
-}
-
-.faq-item dd a {
-  color: var(--vp-c-brand-1);
-  font-weight: 500;
-}
-
-.faq-item dd code {
-  font-family: var(--vp-font-family-mono);
-  font-size: 0.88em;
-  padding: 0.08rem 0.35rem;
-  border-radius: 4px;
-  background: var(--vp-c-bg-alt);
-  color: var(--vp-c-brand-1);
-}
-
-/* ---------- Submit CTA ---------- */
-.submit-cta {
-  padding: 1.75rem 2rem;
-  border: 1px solid var(--vp-c-divider);
-  border-radius: 14px;
-  background:
-    linear-gradient(
-      135deg,
-      color-mix(in srgb, var(--vp-c-brand-1) 6%, transparent) 0%,
-      transparent 60%
-    ),
-    var(--vp-c-bg-soft);
-  position: relative;
-  overflow: hidden;
-}
-
-.submit-cta::before {
-  content: '';
-  position: absolute;
-  top: -1px;
-  left: 2rem;
-  right: 2rem;
-  height: 1px;
-  background: linear-gradient(
-    90deg,
-    transparent,
-    var(--vp-c-brand-1),
-    transparent
-  );
-  opacity: 0.5;
-}
-
-.submit-kicker {
-  font-family: var(--vp-font-family-mono);
-  font-size: 0.75rem;
-  font-weight: 500;
-  letter-spacing: 0.04em;
-  color: var(--vp-c-text-2);
-  text-transform: uppercase;
-  margin: 0 0 0.5rem;
-}
-
-.submit-text {
-  font-size: 0.95rem;
-  line-height: 1.55;
-  color: var(--vp-c-text-2);
-  margin: 0;
-}
-
-.submit-text a {
-  color: var(--vp-c-brand-1);
-  font-weight: 500;
-}
-
-.submit-text code {
-  font-family: var(--vp-font-family-mono);
-  font-size: 0.88em;
-  padding: 0.08rem 0.4rem;
-  border-radius: 4px;
-  background: var(--vp-c-bg-alt);
-}
-</style>
--- a/website/.vitepress/components/AdoptersCarousel.vue
+++ b/website/.vitepress/components/AdoptersCarousel.vue
@@ -1,227 +0,0 @@
-<script setup lang="ts">
-import { adopters } from '../adopters';
-
-const loop = [...adopters, ...adopters];
-</script>
-
-<template>
-  <section class="adopters-carousel" aria-labelledby="adopters-heading">
-    <h2 id="adopters-heading" class="label">
-      <span class="slashes">//</span>
-      Trusted by open source projects
-    </h2>
-    <p class="subline">
-      Adopted by <strong>Docker</strong>, <strong>Vercel</strong>,
-      <strong>HashiCorp</strong>, <strong>Microsoft</strong>,
-      <strong>Google Cloud</strong>, <strong>AWS</strong>,
-      <strong>Anthropic</strong> and more.
-      <a class="see-all" href="/adopters">
-        See all adopters
-        <span class="see-all-arrow" aria-hidden="true">&rarr;</span>
-      </a>
-    </p>
-
-    <div class="viewport">
-      <div class="track">
-        <a
-          v-for="(item, i) in loop"
-          :key="`${item.name}-${i}`"
-          :href="item.url"
-          target="_blank"
-          rel="noopener"
-          class="chip"
-          :aria-label="`${item.name} on GitHub`"
-        >
-          <img
-            :src="item.img"
-            :alt="`${item.name} logo`"
-            class="logo"
-            loading="lazy"
-            decoding="async"
-            width="28"
-            height="28"
-          />
-          <span class="name">{{ item.name }}</span>
-          <span class="chevron" aria-hidden="true">&rarr;</span>
-        </a>
-      </div>
-    </div>
-  </section>
-</template>
-
-<style scoped>
-.adopters-carousel {
-  max-width: 1248px;
-  margin: 5rem auto 2rem;
-  padding: 0 24px;
-}
-
-.label {
-  font-family: var(--vp-font-family-mono);
-  font-size: 0.8rem;
-  font-weight: 500;
-  letter-spacing: 0.04em;
-  color: var(--vp-c-text-2);
-  text-transform: uppercase;
-  text-align: center;
-  margin: 0 0 0.75rem;
-}
-
-.slashes {
-  color: var(--vp-c-brand-1);
-  margin-right: 0.4em;
-}
-
-.subline {
-  text-align: center;
-  font-size: 0.95rem;
-  color: var(--vp-c-text-2);
-  max-width: 640px;
-  margin: 0 auto 2rem;
-  line-height: 1.5;
-}
-
-.subline strong {
-  color: var(--vp-c-text-1);
-  font-weight: 600;
-}
-
-.see-all {
-  display: inline-block;
-  margin-left: 0.4em;
-  color: var(--vp-c-brand-1);
-  font-weight: 500;
-  white-space: nowrap;
-  text-decoration: none !important;
-}
-
-.see-all:hover {
-  text-decoration: underline !important;
-}
-
-.see-all-arrow {
-  display: inline-block;
-  transition: transform 0.25s ease;
-}
-
-.see-all:hover .see-all-arrow {
-  transform: translateX(3px);
-}
-
-.viewport {
-  overflow: hidden;
-  -webkit-mask-image: linear-gradient(
-    90deg,
-    transparent 0,
-    #000 6%,
-    #000 94%,
-    transparent 100%
-  );
-  mask-image: linear-gradient(
-    90deg,
-    transparent 0,
-    #000 6%,
-    #000 94%,
-    transparent 100%
-  );
-}
-
-.track {
-  display: flex;
-  gap: 0.875rem;
-  width: max-content;
-  animation: scroll 55s linear infinite;
-  padding: 6px 0;
-}
-
-.track:hover {
-  animation-play-state: paused;
-}
-
-.chip {
-  display: inline-flex;
-  align-items: center;
-  gap: 0.75rem;
-  padding: 0.625rem 1.125rem 0.625rem 0.625rem;
-  border: 1px solid var(--vp-c-divider);
-  border-radius: 999px;
-  background: var(--vp-c-bg-soft);
-  color: var(--vp-c-text-1);
-  text-decoration: none !important;
-  white-space: nowrap;
-  transition:
-    border-color 0.25s ease,
-    background 0.25s ease,
-    transform 0.25s ease,
-    box-shadow 0.25s ease;
-}
-
-.chip:hover {
-  border-color: var(--vp-c-brand-1);
-  background: var(--vp-c-bg);
-  transform: translateY(-2px);
-  box-shadow: 0 6px 20px -10px
-    color-mix(in srgb, var(--vp-c-brand-1) 60%, transparent);
-}
-
-.logo {
-  width: 28px;
-  height: 28px;
-  border-radius: 6px;
-  object-fit: cover;
-  flex-shrink: 0;
-  background: #fff;
-}
-
-.name {
-  font-size: 0.9rem;
-  font-weight: 500;
-  letter-spacing: -0.005em;
-}
-
-.chevron {
-  font-family: var(--vp-font-family-mono);
-  font-size: 0.85rem;
-  color: var(--vp-c-text-3);
-  opacity: 0;
-  transform: translateX(-4px);
-  transition:
-    opacity 0.25s ease,
-    transform 0.25s ease,
-    color 0.25s ease;
-  margin-left: -0.25rem;
-}
-
-.chip:hover .chevron {
-  opacity: 1;
-  transform: translateX(0);
-  color: var(--vp-c-brand-1);
-}
-
-@keyframes scroll {
-  from {
-    transform: translateX(0);
-  }
-  to {
-    transform: translateX(calc(-50% - 0.4375rem));
-  }
-}
-
-@media (max-width: 640px) {
-  .adopters-carousel {
-    margin-top: 3.5rem;
-  }
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .track {
-    animation: none;
-    flex-wrap: wrap;
-    justify-content: center;
-    width: 100%;
-  }
-  .chip:hover {
-    transform: none;
-  }
-}
-</style>
--- a/website/.vitepress/components/HomePage.vue
+++ b/website/.vitepress/components/HomePage.vue
@@ -1,14 +1,12 @@
 <script setup lang="ts">
 import { VPHomeSponsors } from 'vitepress/theme';
 import { sponsors } from '../sponsors';
-import AdoptersCarousel from './AdoptersCarousel.vue';
 </script>

 <template>
  <div class="content">
    <div class="content-container">
      <main class="main">
-        <AdoptersCarousel />
        <VPHomeSponsors
          v-if="sponsors"
          message="Task is free and open source, made possible by wonderful sponsors."
--- a/website/.vitepress/config.ts
+++ b/website/.vitepress/config.ts
@@ -9,7 +9,6 @@ import {
  localIconLoader
 } from 'vitepress-plugin-group-icons';
 import { team } from './team.ts';
-import { adopters } from './adopters.ts';
 import { taskDescription, taskName, ogUrl, ogImage } from './meta.ts';
 import { fileURLToPath, URL } from 'node:url';
 import llmstxt from 'vitepress-plugin-llms';
@@ -108,112 +107,6 @@ export default defineConfig({
      head.push(['meta', { name: 'robots', content: 'noindex, nofollow' }])
    }

-    // Structured data for the adopters carousel on the homepage: an ItemList
-    // of Organization entities so search engines can surface Task's adopters
-    // directly in rich results.
-    if (isHome) {
-      head.push([
-        'script',
-        { type: 'application/ld+json' },
-        JSON.stringify({
-          '@context': 'https://schema.org',
-          '@type': 'ItemList',
-          name: 'Organizations and projects using Task',
-          itemListOrder: 'https://schema.org/ItemListUnordered',
-          numberOfItems: adopters.length,
-          itemListElement: adopters.map((a, i) => ({
-            '@type': 'ListItem',
-            position: i + 1,
-            item: {
-              '@type': 'Organization',
-              name: a.name,
-              url: a.url,
-              logo: a.img,
-              sameAs: [a.url]
-            }
-          }))
-        })
-      ])
-    }
-
-    // On the /adopters page, emit CollectionPage + ItemList (richer than the
-    // homepage snippet because it targets this specific URL) and FAQPage for
-    // the question block at the bottom of the page. Kept in sync by hand with
-    // components/Adopters.vue.
-    if (pageData.relativePath === 'adopters.md') {
-      head.push([
-        'script',
-        { type: 'application/ld+json' },
-        JSON.stringify({
-          '@context': 'https://schema.org',
-          '@type': 'CollectionPage',
-          name: 'Who uses Task',
-          url: 'https://taskfile.dev/adopters',
-          description:
-            'Organizations and open source projects that use Task as their build and release runner.',
-          mainEntity: {
-            '@type': 'ItemList',
-            numberOfItems: adopters.length,
-            itemListElement: adopters.map((a, i) => ({
-              '@type': 'ListItem',
-              position: i + 1,
-              item: {
-                '@type': 'Organization',
-                name: a.name,
-                url: a.url,
-                logo: a.img,
-                description: a.description,
-                sameAs: [a.url]
-              }
-            }))
-          }
-        })
-      ])
-
-      head.push([
-        'script',
-        { type: 'application/ld+json' },
-        JSON.stringify({
-          '@context': 'https://schema.org',
-          '@type': 'FAQPage',
-          mainEntity: [
-            {
-              '@type': 'Question',
-              name: 'Is Task production-ready?',
-              acceptedAnswer: {
-                '@type': 'Answer',
-                text: 'Yes. Task ships as a single static binary, has been in wide production use since 2018, and powers the release workflows of projects with millions of downloads including Arduino CLI, GoReleaser, FerretDB, and Gogs.'
-              }
-            },
-            {
-              '@type': 'Question',
-              name: 'Who uses Task in enterprise?',
-              acceptedAnswer: {
-                '@type': 'Answer',
-                text: 'Docker, Vercel, HashiCorp, Microsoft (Azure Sentinel), Google Cloud, AWS, and Anthropic are among the organizations that ship code with a Taskfile.yml. Task is also embedded end-to-end in Arduino’s developer tooling stack across more than 70 repositories.'
-              }
-            },
-            {
-              '@type': 'Question',
-              name: 'How is Task different from Make?',
-              acceptedAnswer: {
-                '@type': 'Answer',
-                text: 'Task uses plain YAML instead of Make’s tab-sensitive syntax, runs identically on Linux, macOS, and Windows, and provides built-in caching based on file fingerprints. It also comes with an ecosystem of editor and CI integrations that Make lacks by default.'
-              }
-            },
-            {
-              '@type': 'Question',
-              name: 'Where can I find real-world Taskfile examples?',
-              acceptedAnswer: {
-                '@type': 'Answer',
-                text: 'Every adopter listed above links directly to a public repository containing a production Taskfile.yml. Browsing those is the fastest way to see Task used in real codebases at different scales.'
-              }
-            }
-          ]
-        })
-      ])
-    }
-
    return head
  },
  srcDir: 'src',
@@ -470,10 +363,6 @@ export default defineConfig({
            {
              text: 'Incident Response Plan',
              link: '/docs/security/incident-response-plan'
-            },
-            {
-              text: 'Threat Model',
-              link: '/docs/security/threat-model'
            }
          ]
        },
@@ -488,8 +377,7 @@ export default defineConfig({
      ],
      // Hacky to disable sidebar for these pages
      '/donate': [],
-      '/team': [],
-      '/adopters': []
+      '/team': []
    },

    socialLinks: [
--- a/website/.vitepress/theme/icons/danger.svg
+++ b/website/.vitepress/theme/icons/danger.svg
@@ -1 +1,3 @@
-<svg xmlns="http://www.w3.org/2000/svg" fill="currentColor" viewBox="0 0 16 16"><path d="M7.998 14.5c2.832 0 5-1.98 5-4.5 0-1.463-.68-2.19-1.879-3.383l-.036-.037c-1.013-1.008-2.3-2.29-2.834-4.434-.322.256-.63.579-.864.953-.432.696-.621 1.58-.046 2.73.473.947.67 2.284-.278 3.232-.61.61-1.545.84-2.403.633a2.788 2.788 0 0 1-1.436-.874A3.21 3.21 0 0 0 3 10c0 2.53 2.164 4.5 4.998 4.5zM9.533.753C9.496.34 9.16.009 8.77.146 7.035.75 4.34 3.187 5.997 6.5c.344.689.285 1.218.003 1.5-.419.419-1.54.487-2.04-.832-.173-.454-.659-.762-1.035-.454C2.036 7.44 1.5 8.702 1.5 10c0 3.512 2.998 6 6.498 6s6.5-2.5 6.5-6c0-2.137-1.128-3.26-2.312-4.438-1.19-1.184-2.436-2.425-2.653-4.81z"/></svg>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" fill="currentColor">
+  <path d="M7.998 14.5c2.832 0 5-1.98 5-4.5 0-1.463-.68-2.19-1.879-3.383l-.036-.037c-1.013-1.008-2.3-2.29-2.834-4.434-.322.256-.63.579-.864.953-.432.696-.621 1.58-.046 2.73.473.947.67 2.284-.278 3.232-.61.61-1.545.84-2.403.633a2.788 2.788 0 0 1-1.436-.874A3.21 3.21 0 0 0 3 10c0 2.53 2.164 4.5 4.998 4.5zM9.533.753C9.496.34 9.16.009 8.77.146 7.035.75 4.34 3.187 5.997 6.5c.344.689.285 1.218.003 1.5-.419.419-1.54.487-2.04-.832-.173-.454-.659-.762-1.035-.454C2.036 7.44 1.5 8.702 1.5 10c0 3.512 2.998 6 6.498 6s6.5-2.5 6.5-6c0-2.137-1.128-3.26-2.312-4.438-1.19-1.184-2.436-2.425-2.653-4.81z"/>
+</svg>
--- a/website/.vitepress/theme/icons/info.svg
+++ b/website/.vitepress/theme/icons/info.svg
@@ -1 +1,3 @@
-<svg xmlns="http://www.w3.org/2000/svg" fill="currentColor" viewBox="0 0 16 16"><path d="M0 8a8 8 0 1 1 16 0A8 8 0 0 1 0 8Zm8-6.5a6.5 6.5 0 1 0 0 13 6.5 6.5 0 0 0 0-13ZM6.5 7.75A.75.75 0 0 1 7.25 7h1a.75.75 0 0 1 .75.75v2.75h.25a.75.75 0 0 1 0 1.5h-2a.75.75 0 0 1 0-1.5h.25v-2h-.25a.75.75 0 0 1-.75-.75ZM8 6a1 1 0 1 1 0-2 1 1 0 0 1 0 2Z"/></svg>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" fill="currentColor">
+  <path d="M0 8a8 8 0 1 1 16 0A8 8 0 0 1 0 8Zm8-6.5a6.5 6.5 0 1 0 0 13 6.5 6.5 0 0 0 0-13ZM6.5 7.75A.75.75 0 0 1 7.25 7h1a.75.75 0 0 1 .75.75v2.75h.25a.75.75 0 0 1 0 1.5h-2a.75.75 0 0 1 0-1.5h.25v-2h-.25a.75.75 0 0 1-.75-.75ZM8 6a1 1 0 1 1 0-2 1 1 0 0 1 0 2Z"/>
+</svg>
--- a/website/.vitepress/theme/icons/tip.svg
+++ b/website/.vitepress/theme/icons/tip.svg
@@ -1 +1,3 @@
-<svg xmlns="http://www.w3.org/2000/svg" fill="currentColor" viewBox="0 0 16 16"><path d="M8 1.5c-2.363 0-4 1.69-4 3.75 0 .984.424 1.625.984 2.304l.214.253c.223.264.47.556.673.848.284.411.537.896.621 1.49a.75.75 0 0 1-1.484.211c-.04-.282-.163-.547-.37-.847a8.456 8.456 0 0 0-.542-.68c-.084-.1-.173-.205-.268-.32C3.201 7.75 2.5 6.766 2.5 5.25 2.5 2.31 4.863 0 8 0s5.5 2.31 5.5 5.25c0 1.516-.701 2.5-1.328 3.259-.095.115-.184.22-.268.319-.207.245-.383.453-.541.681-.208.3-.33.565-.37.847a.751.751 0 0 1-1.485-.212c.084-.593.337-1.078.621-1.489.203-.292.45-.584.673-.848.075-.088.147-.173.213-.253.561-.679.985-1.32.985-2.304 0-2.06-1.637-3.75-4-3.75ZM5.75 12h4.5a.75.75 0 0 1 0 1.5h-4.5a.75.75 0 0 1 0-1.5ZM6 15.25a.75.75 0 0 1 .75-.75h2.5a.75.75 0 0 1 0 1.5h-2.5a.75.75 0 0 1-.75-.75Z"/></svg>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" fill="currentColor">
+  <path d="M8 1.5c-2.363 0-4 1.69-4 3.75 0 .984.424 1.625.984 2.304l.214.253c.223.264.47.556.673.848.284.411.537.896.621 1.49a.75.75 0 0 1-1.484.211c-.04-.282-.163-.547-.37-.847a8.456 8.456 0 0 0-.542-.68c-.084-.1-.173-.205-.268-.32C3.201 7.75 2.5 6.766 2.5 5.25 2.5 2.31 4.863 0 8 0s5.5 2.31 5.5 5.25c0 1.516-.701 2.5-1.328 3.259-.095.115-.184.22-.268.319-.207.245-.383.453-.541.681-.208.3-.33.565-.37.847a.751.751 0 0 1-1.485-.212c.084-.593.337-1.078.621-1.489.203-.292.45-.584.673-.848.075-.088.147-.173.213-.253.561-.679.985-1.32.985-2.304 0-2.06-1.637-3.75-4-3.75ZM5.75 12h4.5a.75.75 0 0 1 0 1.5h-4.5a.75.75 0 0 1 0-1.5ZM6 15.25a.75.75 0 0 1 .75-.75h2.5a.75.75 0 0 1 0 1.5h-2.5a.75.75 0 0 1-.75-.75Z"/>
+</svg>
--- a/website/.vitepress/theme/icons/warning.svg
+++ b/website/.vitepress/theme/icons/warning.svg
@@ -1 +1,3 @@
-<svg xmlns="http://www.w3.org/2000/svg" fill="currentColor" viewBox="0 0 16 16"><path d="M6.457 1.047c.659-1.234 2.427-1.234 3.086 0l6.082 11.378A1.75 1.75 0 0 1 14.082 15H1.918a1.75 1.75 0 0 1-1.543-2.575Zm1.763.707a.25.25 0 0 0-.44 0L1.698 13.132a.25.25 0 0 0 .22.368h12.164a.25.25 0 0 0 .22-.368Zm.53 3.996v2.5a.75.75 0 0 1-1.5 0v-2.5a.75.75 0 0 1 1.5 0ZM9 11a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z"/></svg>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" fill="currentColor">
+  <path d="M6.457 1.047c.659-1.234 2.427-1.234 3.086 0l6.082 11.378A1.75 1.75 0 0 1 14.082 15H1.918a1.75 1.75 0 0 1-1.543-2.575Zm1.763.707a.25.25 0 0 0-.44 0L1.698 13.132a.25.25 0 0 0 .22.368h12.164a.25.25 0 0 0 .22-.368Zm.53 3.996v2.5a.75.75 0 0 1-1.5 0v-2.5a.75.75 0 0 1 1.5 0ZM9 11a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z"/>
+</svg>
--- a/website/.vitepress/theme/index.ts
+++ b/website/.vitepress/theme/index.ts
@@ -5,7 +5,6 @@ import HomePage from '../components/HomePage.vue';
 import AuthorCard from '../components/AuthorCard.vue';
 import BlogPost from '../components/BlogPost.vue';
 import Version from '../components/Version.vue';
-import Adopters from '../components/Adopters.vue';
 import { enhanceAppWithTabs } from 'vitepress-plugin-tabs/client';
 import { h } from 'vue';
 import 'virtual:group-icons.css';
@@ -22,7 +21,6 @@ export default {
    app.component('AuthorCard', AuthorCard);
    app.component('BlogPost', BlogPost);
    app.component('Version', Version);
-    app.component('Adopters', Adopters);
    app.component('CopyOrDownloadAsMarkdownButtons', CopyOrDownloadAsMarkdownButtons);
    enhanceAppWithTabs(app);
  }
--- a/website/package.json
+++ b/website/package.json
@@ -15,13 +15,13 @@
  "devDependencies": {
    "@types/markdown-it": "^14.1.2",
    "@types/node": "^24.1.0",
-    "netlify-cli": "^26.0.0",
+    "netlify-cli": "^24.0.0",
    "prettier": "^3.6.2",
    "vitepress": "^1.6.3",
    "vitepress-plugin-group-icons": "^1.6.1",
-    "vitepress-plugin-tabs": "^0.9.0",
+    "vitepress-plugin-tabs": "^0.8.0",
    "vitepress-plugin-llms": "^1.9.1",
    "vue": "^3.5.18"
  },
-  "packageManager": "pnpm@11.1.2+sha512.415a1cc25974731e75455c1468371be74c5aa5fb7621b50d4056d222451609f11412f23fd602e6169f1e060466641f798597e1be961a10688836a67b16569499"
+  "packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319"
 }
--- a/website/pnpm-lock.yaml
+++ b/website/pnpm-lock.yaml
--- a/website/pnpm-workspace.yaml
+++ b/website/pnpm-workspace.yaml
@@ -1,6 +0,0 @@
-allowBuilds:
-  '@parcel/watcher': true
-  esbuild: true
-  netlify-cli: true
-  sharp: true
-  unix-dgram: true
--- a/website/src/adopters.md
+++ b/website/src/adopters.md
@@ -1,11 +0,0 @@
---
-title: Who uses Task
-description:
-  Organizations and open source projects that use Task as their build and
-  release runner, including Docker, Microsoft, HashiCorp, Vercel, Google Cloud,
-  AWS, Anthropic, Arduino, GoReleaser, and more.
-layout: page
-sidebar: false
---
-
-<Adopters />
--- a/website/src/docs/changelog.md
+++ b/website/src/docs/changelog.md
@@ -8,21 +8,6 @@ editLink: false

 ::: v-pre

-## v3.51.1 - 2026-05-16
-
- A significant performance boost was achieved for large Taskfiles (monorepos)
-  by skipping templating altogether when the string is static (#2820 by @romnn).
- Added `absPath` template function that resolves a path to its absolute form,
-  cleaning `..` and `.` components (#2681, #2788 by @mateenanjum).
- Added `joinEnv` function to join paths based on your oprating system: `;` for
-  Windows and `:` elsewhere, and `joinUrl` to join URL paths. Also, added two
-  new special variables: `FILE_PATH_SEPARATOR` which returns `\` on Windows
-  and `/` elsewhere, and `PATH_LIST_SEPARATOR` which returns `;` on Windows and
-  `:` elsewhere (#2406, #2408 by @solvingj).
- Update the shell interpreter with a regression fix (#2812, #2832 by
-  @andreynering).
- Fix potential panic with the shell interpreter (#2810 by @trulede).
-
 ## v3.50.0 - 2026-04-13

 - Added `enum.ref` support in `requires`: enum constraints can now reference
--- a/website/src/docs/experiments/remote-taskfiles.md
+++ b/website/src/docs/experiments/remote-taskfiles.md
@@ -190,21 +190,6 @@ includes:
  my-remote-namespace: https://{{.TOKEN}}@raw.githubusercontent.com/my-org/my-repo/main/Taskfile.yml
 ```

-## Special Variables
-
-The file-path [special variables](../reference/templating.md#file-paths) behave
-differently when a Taskfile is loaded from a remote source, because there is no
-local file or directory that corresponds 1:1 to the Taskfile:
-
-| Variable                     | Value when loaded remotely                                                                                                                             |
-| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `TASKFILE` / `ROOT_TASKFILE` | The original URL, unchanged                                                                                                                            |
-| `TASKFILE_DIR` / `ROOT_DIR`  | Empty string — a directory variable cannot point to a URL                                                                                              |
-| `TASK_DIR`                   | Resolved against `USER_WORKING_DIR` (relative `dir:` → joined with `USER_WORKING_DIR`, empty `dir:` → `USER_WORKING_DIR`, absolute `dir:` → kept as-is) |
-
-If a remote Taskfile includes a local Taskfile (or vice-versa), each variable
-reflects the source of the Taskfile it refers to.
-
 ## Security

 ### Automatic checksums
--- a/website/src/docs/reference/templating.md
+++ b/website/src/docs/reference/templating.md
@@ -249,32 +249,6 @@ tasks:
      - echo "Working {{.USER_WORKING_DIR}}"
 ```

-#### `FILE_PATH_SEPARATOR`
-
- **Type**: `string`
- **Description**: OS-specific path separator: Windows = `\`, others = `/`
-
-::: info
-
-> See `joinPath` in [Path Functions](#path-functions) for joining filesystem paths for use with
-> file system operations.
-
-:::
-
-### Environment Variables
-
-#### `PATH_LIST_SEPARATOR`
-
- **Type**: `string`
- **Description**: OS-specific path separator for environment variables: Windows = `;`, others = `:`
-
-::: info
-
-> See `joinEnv` in [Environment Variable Functions](#environment-variable-functions) for joining
-> paths for use in environment variables.
-
-:::
-
 ### Status

 #### `CHECKSUM`
@@ -623,9 +597,9 @@ tasks:
 tasks:
  platform:
    cmds:
-      - echo "OS {{OS}}"                    # linux, darwin, windows, etc.
-      - echo "Architecture {{ARCH}}"        # amd64, arm64, etc.
-      - echo "CPU cores {{numCPU}}"         # Number of CPU cores
+      - echo "OS {{OS}}"                         # linux, darwin, windows, etc.
+      - echo "Architecture {{ARCH}}"             # amd64, arm64, etc.
+      - echo "CPU cores {{numCPU}}"              # Number of CPU cores
      - echo "Building for {{OS}}/{{ARCH}}"
 ```

@@ -639,52 +613,11 @@ tasks:
      OUTPUT_DIR: 'dist'
      BINARY_NAME: 'myapp'
    cmds:
-      - echo "{{.WIN_PATH | toSlash}}"                      # Convert to forward slashes
-      - echo "{{.WIN_PATH | fromSlash}}"                    # Convert to OS-specific slashes
-      - echo "{{joinPath .OUTPUT_DIR .BINARY_NAME}}"        # Join path elements
-      - echo "Relative {{relPath .ROOT_DIR .TASKFILE_DIR}}" # Get relative path
-      - echo '{{absPath "../sibling"}}'                     # Resolve to an absolute path
-```
-
-#### Environment Variable Functions
-
-```yaml
-tasks:
-  paths:
-    vars:
-      WIN_PATH1: 'C:\Users\Person\bin'
-      WIN_PATH2: 'C:\Shared\bin'
-    cmds:
-      # Join paths for Windows ENV vars:
-      # C:\Users\Person\bin;C:\Shared\bin
-      - echo "{{joinEnv .WIN_PATH1 .WIN_PATH2}}"
-```
-
-```yaml
-tasks:
-  paths:
-    vars:
-      POSIX_PATH1: '/users/person/.local/bin'
-      POSIX_PATH2: '/usr/bin'
-    cmds:
-      # Join paths for POSIX ENV vars:
-      # /users/person/.local/bin:/usr/bin
-      - echo "{{joinEnv .POSIX_PATH1 .POSIX_PATH2}}"
-```
-
-#### URLs
-
-```yaml
-tasks:
-  paths:
-    vars:
-      SERVER: 'http://localhost'
-      PATH1: 'path1'
-      PATH2: 'path2'
-    cmds:
-      # Join paths for URL:
-      # http://localhost/path1/path2
-      - echo "{{joinUrl .SERVER .PATH1 .PATH2}}"
+      - echo "{{.WIN_PATH | toSlash}}"                          # Convert to forward slashes
+      - echo "{{.WIN_PATH | fromSlash}}"                        # Convert to OS-specific slashes
+      - echo "{{joinPath .OUTPUT_DIR .BINARY_NAME}}"            # Join path elements
+      - echo "Relative {{relPath .ROOT_DIR .TASKFILE_DIR}}"    # Get relative path
+      - echo '{{absPath "../sibling"}}'                         # Resolve to an absolute path
 ```

 ### Data Structure Functions
--- a/website/src/docs/security/index.md
+++ b/website/src/docs/security/index.md
@@ -15,8 +15,7 @@ A member of the team will investigate as soon as possible and we will keep you
 updated throughout the process.

 You can read more about how we handle security-related issues in our [Incident
-Response Plan][irp] and [Threat Model][tm].
+Response Plan][irp].

 [pvr]: https://github.com/go-task/task/security/advisories/new
 [irp]: ./incident-response-plan
-[tm]: ./threat-model
--- a/website/src/docs/security/threat-model.md
+++ b/website/src/docs/security/threat-model.md
@@ -1,174 +0,0 @@
---
-title: Threat Model
-outline: deep
---
-
-# Threat Model
-
-This document outlines the security threats, assets, and mitigations for the
-Task project. It serves as a high-level, public guide and is published as part
-of our commitment to transparency.
-
-## Asset Inventory
-
-### Critical Assets
-
- **Source Code:** The Task CLI, build scripts, and configuration files
-  (e.g., `Taskfile.yml`, `.goreleaser.yml`).
- **Build Artifacts:** Compiled binaries, packages, and containers distributed
-  to users.
- **Secrets:** API tokens, signing keys, and repository credentials used in
-  CI/CD and release pipelines.
- **Release Metadata:** Version numbers, changelogs, and checksums.
- **CI/CD Pipelines & Runners:** GitHub Actions workflows that build, test, and
-  release the project.
- **Third-party Dependencies:** Go modules and tools used to build and
-  distribute Task.
- **Website & Documentation:** The taskfile.dev site and installation scripts.
-
-### Asset Locations
-
- Local developer machines
- GitHub Actions runners
- GitHub Releases
- Public package registries (npm, Homebrew, Winget, Cloudsmith)
- Source control platforms (GitHub)
- Netlify (website hosting)
-
-## Threat Model
-
-### Actors
-
- **Maintainers & Contributors:** Trusted users with varying levels of
-  repository access.
- **External Attackers:** Untrusted users seeking to compromise builds,
-  releases, or user systems.
- **Supply Chain Threats:** Malicious dependencies or compromised third-party
-  services.
- **CI/CD Systems:** Automated agents that may be exploited if misconfigured.
-
-### Entry Points
-
- Source code contributions (pull requests, issues)
- Configuration files and build scripts
- CI/CD integration and environment variables
- Third-party dependencies
- Release pipelines and artifact repositories
- Remote Taskfile fetching (HTTP, Git)
- Installation scripts
-
-### Trust Boundaries
-
- Between the project repository and the CI/CD environment
- Between Task and remote Taskfiles fetched over the network
- Between artifact generation and distribution channels
- Between the Task binary and user-defined shell commands
-
-### Threats
-
-#### Supply Chain Attacks
-
- Compromised Go dependencies or build tools
- Unauthorized changes to source code or configuration
- Exploitation of third-party CI/CD or package registry services
- Compromised installation scripts or distribution channels
-
-#### Secrets Leakage
-
- Exposure of tokens, credentials, or signing keys in logs, error messages,
-  or artifacts
- Hardcoded secrets in code or configuration
- Improper secret management in CI/CD environments
-
-#### Code Execution / Injection
-
- Malicious code execution via compromised pull requests or dependencies
- Remote code execution vulnerabilities in Task or its dependencies
- **Note:** Task intentionally executes user-defined shell commands as part of
-  its core functionality. Users are responsible for the commands they define in
-  their Taskfiles.
-
-#### Unauthorized Access
-
- Unauthorized users triggering releases or accessing sensitive artifacts
- Insecure permissions on runners, repositories, or artifact stores
- Compromised maintainer accounts
-
-#### Data Integrity & Tampering
-
- Tampering with build artifacts, changelogs, or metadata
- Compromise of signing keys, leading to malicious releases
- Man-in-the-middle attacks against remote Taskfile fetching
-
-#### Denial of Service
-
- Abuse of CI/CD resources, bandwidth, or artifact storage
- Overloading automated processes or API endpoints
- Malicious Taskfiles designed to exhaust system resources
-
-## Mitigations
-
-### Supply Chain Security
-
- Pin dependencies and use trusted sources
- Mandatory code review and CI checks on all incoming pull requests
- Signed commits and release tags
- Enable immutable releases where supported
- Run `govulncheck` on every commit and tag
- Pin GitHub Actions to specific commit SHAs
-
-### Secrets Management
-
- Secure storage using GitHub Secrets
- Never log or expose secrets in build or release outputs
- Regularly rotate secrets and monitor for suspicious activity
- Use least-privilege tokens scoped to specific repositories
-
-### Secure Code Execution
-
- Validate and sanitize configuration files and user inputs
- Audit dependencies for vulnerabilities
- HTTP is rejected for remote Taskfiles by default (requires `--insecure` flag)
- TLS certificate verification for remote Git repositories
-
-### Access Control
-
- Enforce least privilege for CI/CD runners, repositories, and artifact stores
- Require multi-factor authentication for maintainers
- Restrict release triggers to tagged releases only
- Lower permissions of less active maintainers
-
-### Artifact Integrity
-
- Generate checksums for all release artifacts
- Distribute artifacts via trusted, access-controlled repositories
- Verify signatures and checksums in installation scripts where possible
-
-### Availability Protection
-
- Implement rate limiting and resource quotas on CI/CD jobs
- Monitor for abnormal activity and automate alerts
- Set timeouts on network operations (e.g., remote Taskfile fetching)
-
-## Residual Risks
-
- Zero-day vulnerabilities in dependencies, CI/CD systems, or Task itself
- Social engineering attacks targeting maintainers
- Unnoticed supply chain compromises
- Human error in configuration or secret management
- Users fetching malicious remote Taskfiles from untrusted sources
-
-## Security Best Practices
-
- Regularly update dependencies and build tools
- Monitor security advisories and patch vulnerabilities promptly
- Educate contributors on secure coding and secrets hygiene
- Document security policies and incident response procedures
-
-## References
-
- [Task Documentation](https://taskfile.dev/)
- [Incident Response Plan](./incident-response-plan)
- [OWASP Top 10](https://owasp.org/www-project-top-ten/)
- [Supply Chain Security](https://slsa.dev/)
- [GitHub Security Best Practices](https://docs.github.com/en/code-security)
--- a/website/src/public/img/cloudsmith.svg
+++ b/website/src/public/img/cloudsmith.svg
@@ -1 +1,4 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="2507" height="687" fill="none" viewBox="0 0 2507 687"><path fill="#2A6FE1" fill-rule="evenodd" d="M499.999 325.98V360.535L361.332 498.757H326.665L187.999 360.535V325.98L326.665 187.757H361.332L499.999 325.98ZM343.997 436.159C395.468 436.159 437.193 394.568 437.193 343.263C437.193 291.957 395.468 250.366 343.997 250.366C292.527 250.366 250.802 291.957 250.802 343.263C250.802 394.568 292.527 436.159 343.997 436.159Z" clip-rule="evenodd"/><path fill="#092F45" fill-rule="evenodd" d="M1440.66 186.26V433.188L1437.03 436.819H1411.61L1407.98 433.188L1404.35 418.663H1400.72C1389.82 432.461 1372.76 440.45 1353.51 440.45C1302.67 440.45 1273.62 400.506 1273.62 346.037C1273.62 291.567 1302.67 251.623 1353.51 251.623C1371.67 251.623 1389.46 258.886 1400.72 273.411H1404.35V186.26L1407.98 182.628H1437.03L1440.66 186.26ZM1357.14 407.769C1386.19 407.769 1404.35 389.612 1404.35 346.037C1404.35 302.461 1386.19 284.305 1357.14 284.305C1328.09 284.305 1309.93 305.729 1309.93 346.037C1309.93 386.344 1328.09 407.769 1357.14 407.769ZM884.959 346.037C884.959 404.137 917.641 440.45 972.11 440.45C1026.58 440.45 1059.26 404.137 1059.26 346.037C1059.26 287.936 1026.58 251.623 972.11 251.623C917.641 251.623 884.959 287.936 884.959 346.037ZM921.272 346.037C921.272 306.092 939.429 284.305 972.11 284.305C1004.79 284.305 1022.95 306.092 1022.95 346.037C1022.95 385.981 1004.79 407.769 972.11 407.769C939.429 407.769 921.272 385.981 921.272 346.037ZM1240.84 258.886L1237.21 255.254H1208.16L1204.53 258.886V346.037C1204.53 389.612 1186.01 407.769 1160.95 407.769C1131.9 407.769 1124.64 385.981 1124.64 364.193V258.886L1121.01 255.254H1091.96L1088.33 258.886V364.193C1088.33 403.774 1106.48 440.45 1157.32 440.45C1174.75 440.45 1191.45 431.735 1200.9 418.663H1204.53L1208.16 433.188L1211.79 436.819H1237.21L1240.84 433.188V258.886ZM1618.52 385.981C1618.52 353.299 1600.37 338.774 1564.05 331.511C1527.74 324.249 1513.22 320.618 1513.22 302.461C1513.22 287.936 1527.74 284.305 1545.9 284.305C1571.32 284.305 1578.58 295.199 1578.58 306.092L1582.21 309.724H1611.26L1614.89 306.092C1614.89 269.779 1585.84 251.623 1545.9 251.623C1495.06 251.623 1476.9 277.042 1476.9 302.461C1476.9 335.143 1498.69 349.668 1535 356.931C1571.32 364.193 1582.21 367.824 1582.21 385.981C1582.21 400.506 1571.32 407.769 1545.9 407.769C1520.48 407.769 1509.58 396.875 1509.58 378.718L1505.95 375.087H1476.9L1473.27 378.718C1473.27 418.663 1498.69 440.45 1545.9 440.45C1596.74 440.45 1618.52 415.031 1618.52 385.981ZM1843.65 251.623C1894.49 251.623 1905.38 284.305 1905.38 324.249V433.188L1901.75 436.819H1872.7L1869.07 433.188V324.249C1869.07 302.461 1865.44 284.305 1836.39 284.305C1810.97 284.305 1796.44 302.461 1796.44 331.511V433.188L1792.81 436.819H1763.76L1760.13 433.188V324.249C1760.13 302.461 1756.5 284.305 1727.45 284.305C1709.29 284.305 1687.5 295.199 1687.5 331.511V433.188L1683.87 436.819H1654.82L1651.19 433.188V258.886L1654.82 255.254H1680.24L1683.87 258.886L1687.5 273.411H1691.13C1698.4 262.517 1712.92 251.623 1738.34 251.623C1767.39 251.623 1778.29 266.148 1785.55 277.042H1789.18C1800.07 262.517 1818.23 251.623 1843.65 251.623ZM1981.48 222.573V193.522L1977.85 189.891H1948.8L1945.17 193.522V222.573L1948.8 226.204H1977.85L1981.48 222.573ZM1981.48 258.886L1977.85 255.254H1948.8L1945.17 258.886V433.188L1948.8 436.819H1977.85L1981.48 433.188V258.886ZM2126.63 407.769V433.188L2123 436.819H2093.95C2068.53 436.819 2043.11 422.294 2043.11 389.612V291.567L2039.48 287.936H2014.06L2010.43 284.305V258.886L2014.06 255.254H2039.48L2043.11 251.623V218.941L2046.75 215.31H2075.8L2079.43 218.941V251.623L2083.06 255.254H2123L2126.63 258.886V284.305L2123 287.936H2083.06L2079.43 291.567V389.612C2079.43 400.506 2086.69 404.137 2093.95 404.137H2123L2126.63 407.769ZM2319.05 433.188V327.88C2319.05 288.299 2304.53 251.623 2250.06 251.623C2230.81 251.623 2213.38 259.612 2202.85 273.411H2199.22V186.26L2195.59 182.628H2166.54L2162.91 186.26V433.188L2166.54 436.819H2195.59L2199.22 433.188V342.405C2199.22 298.83 2217.37 284.305 2246.42 284.305C2275.48 284.305 2282.74 306.092 2282.74 327.88V433.188L2286.37 436.819H2315.42L2319.05 433.188ZM631.176 345.959C631.176 305.983 649.347 284.178 682.055 284.178C711.129 284.178 722.031 298.715 725.665 313.252L729.3 316.886H758.373L762.007 313.252C758.373 280.544 732.934 251.47 682.055 251.47C627.542 251.47 594.834 287.812 594.834 345.959C594.834 404.107 627.542 440.449 682.055 440.449C732.934 440.449 758.373 411.375 762.007 378.667L758.373 375.033H729.3L725.665 378.667C722.031 393.204 711.129 407.741 682.055 407.741C649.347 407.741 631.176 385.936 631.176 345.959ZM868.926 408.456V433.875L865.294 437.507H846.064C820.645 437.507 795.226 422.982 795.226 390.3L795.224 186.26L798.856 182.628H827.906L831.537 186.26L831.539 390.3C831.539 401.194 838.802 404.825 846.064 404.825H865.294L868.926 408.456Z" clip-rule="evenodd"/></svg>
+<svg width="2507" height="687" viewBox="0 0 2507 687" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M499.999 325.98V360.535L361.332 498.757H326.665L187.999 360.535V325.98L326.665 187.757H361.332L499.999 325.98ZM343.997 436.159C395.468 436.159 437.193 394.568 437.193 343.263C437.193 291.957 395.468 250.366 343.997 250.366C292.527 250.366 250.802 291.957 250.802 343.263C250.802 394.568 292.527 436.159 343.997 436.159Z" fill="#2A6FE1"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M1440.66 186.26V433.188L1437.03 436.819H1411.61L1407.98 433.188L1404.35 418.663H1400.72C1389.82 432.461 1372.76 440.45 1353.51 440.45C1302.67 440.45 1273.62 400.506 1273.62 346.037C1273.62 291.567 1302.67 251.623 1353.51 251.623C1371.67 251.623 1389.46 258.886 1400.72 273.411H1404.35V186.26L1407.98 182.628H1437.03L1440.66 186.26ZM1357.14 407.769C1386.19 407.769 1404.35 389.612 1404.35 346.037C1404.35 302.461 1386.19 284.305 1357.14 284.305C1328.09 284.305 1309.93 305.729 1309.93 346.037C1309.93 386.344 1328.09 407.769 1357.14 407.769ZM884.959 346.037C884.959 404.137 917.641 440.45 972.11 440.45C1026.58 440.45 1059.26 404.137 1059.26 346.037C1059.26 287.936 1026.58 251.623 972.11 251.623C917.641 251.623 884.959 287.936 884.959 346.037ZM921.272 346.037C921.272 306.092 939.429 284.305 972.11 284.305C1004.79 284.305 1022.95 306.092 1022.95 346.037C1022.95 385.981 1004.79 407.769 972.11 407.769C939.429 407.769 921.272 385.981 921.272 346.037ZM1240.84 258.886L1237.21 255.254H1208.16L1204.53 258.886V346.037C1204.53 389.612 1186.01 407.769 1160.95 407.769C1131.9 407.769 1124.64 385.981 1124.64 364.193V258.886L1121.01 255.254H1091.96L1088.33 258.886V364.193C1088.33 403.774 1106.48 440.45 1157.32 440.45C1174.75 440.45 1191.45 431.735 1200.9 418.663H1204.53L1208.16 433.188L1211.79 436.819H1237.21L1240.84 433.188V258.886ZM1618.52 385.981C1618.52 353.299 1600.37 338.774 1564.05 331.511C1527.74 324.249 1513.22 320.618 1513.22 302.461C1513.22 287.936 1527.74 284.305 1545.9 284.305C1571.32 284.305 1578.58 295.199 1578.58 306.092L1582.21 309.724H1611.26L1614.89 306.092C1614.89 269.779 1585.84 251.623 1545.9 251.623C1495.06 251.623 1476.9 277.042 1476.9 302.461C1476.9 335.143 1498.69 349.668 1535 356.931C1571.32 364.193 1582.21 367.824 1582.21 385.981C1582.21 400.506 1571.32 407.769 1545.9 407.769C1520.48 407.769 1509.58 396.875 1509.58 378.718L1505.95 375.087H1476.9L1473.27 378.718C1473.27 418.663 1498.69 440.45 1545.9 440.45C1596.74 440.45 1618.52 415.031 1618.52 385.981ZM1843.65 251.623C1894.49 251.623 1905.38 284.305 1905.38 324.249V433.188L1901.75 436.819H1872.7L1869.07 433.188V324.249C1869.07 302.461 1865.44 284.305 1836.39 284.305C1810.97 284.305 1796.44 302.461 1796.44 331.511V433.188L1792.81 436.819H1763.76L1760.13 433.188V324.249C1760.13 302.461 1756.5 284.305 1727.45 284.305C1709.29 284.305 1687.5 295.199 1687.5 331.511V433.188L1683.87 436.819H1654.82L1651.19 433.188V258.886L1654.82 255.254H1680.24L1683.87 258.886L1687.5 273.411H1691.13C1698.4 262.517 1712.92 251.623 1738.34 251.623C1767.39 251.623 1778.29 266.148 1785.55 277.042H1789.18C1800.07 262.517 1818.23 251.623 1843.65 251.623ZM1981.48 222.573V193.522L1977.85 189.891H1948.8L1945.17 193.522V222.573L1948.8 226.204H1977.85L1981.48 222.573ZM1981.48 258.886L1977.85 255.254H1948.8L1945.17 258.886V433.188L1948.8 436.819H1977.85L1981.48 433.188V258.886ZM2126.63 407.769V433.188L2123 436.819H2093.95C2068.53 436.819 2043.11 422.294 2043.11 389.612V291.567L2039.48 287.936H2014.06L2010.43 284.305V258.886L2014.06 255.254H2039.48L2043.11 251.623V218.941L2046.75 215.31H2075.8L2079.43 218.941V251.623L2083.06 255.254H2123L2126.63 258.886V284.305L2123 287.936H2083.06L2079.43 291.567V389.612C2079.43 400.506 2086.69 404.137 2093.95 404.137H2123L2126.63 407.769ZM2319.05 433.188V327.88C2319.05 288.299 2304.53 251.623 2250.06 251.623C2230.81 251.623 2213.38 259.612 2202.85 273.411H2199.22V186.26L2195.59 182.628H2166.54L2162.91 186.26V433.188L2166.54 436.819H2195.59L2199.22 433.188V342.405C2199.22 298.83 2217.37 284.305 2246.42 284.305C2275.48 284.305 2282.74 306.092 2282.74 327.88V433.188L2286.37 436.819H2315.42L2319.05 433.188ZM631.176 345.959C631.176 305.983 649.347 284.178 682.055 284.178C711.129 284.178 722.031 298.715 725.665 313.252L729.3 316.886H758.373L762.007 313.252C758.373 280.544 732.934 251.47 682.055 251.47C627.542 251.47 594.834 287.812 594.834 345.959C594.834 404.107 627.542 440.449 682.055 440.449C732.934 440.449 758.373 411.375 762.007 378.667L758.373 375.033H729.3L725.665 378.667C722.031 393.204 711.129 407.741 682.055 407.741C649.347 407.741 631.176 385.936 631.176 345.959ZM868.926 408.456V433.875L865.294 437.507H846.064C820.645 437.507 795.226 422.982 795.226 390.3L795.224 186.26L798.856 182.628H827.906L831.537 186.26L831.539 390.3C831.539 401.194 838.802 404.825 846.064 404.825H865.294L868.926 408.456Z" fill="#092F45"/>
+</svg>
--- a/website/src/public/img/config-namespace-change.png
+++ b/website/src/public/img/config-namespace-change.png
--- a/website/src/public/img/config-namespace-diff.png
+++ b/website/src/public/img/config-namespace-diff.png
--- a/website/src/public/img/goodx.svg
+++ b/website/src/public/img/goodx.svg
--- a/website/src/public/img/magic.png
+++ b/website/src/public/img/magic.png
--- a/website/src/public/img/og_image.png
+++ b/website/src/public/img/og_image.png
--- a/website/src/public/schema.json
+++ b/website/src/public/schema.json
@@ -177,6 +177,11 @@
          "enum": ["none", "checksum", "timestamp"],
          "default": "none"
        },
+        "use_gitignore": {
+          "description": "When set to true, files matching .gitignore rules will be excluded from sources and generates glob resolution. Overrides the global gitignore setting.",
+          "type": "boolean",
+          "default": false
+        },
        "prefix": {
          "description": "Defines a string to prefix the output of tasks running in parallel. Only used when the output mode is `prefixed`.",
          "type": "string"
@@ -687,6 +692,11 @@
          "enum": ["none", "checksum", "timestamp"],
          "default": "checksum"
        },
+        "use_gitignore": {
+          "description": "When set to true, files matching .gitignore rules will be excluded from sources and generates glob resolution for all tasks. Can be overridden per task.",
+          "type": "boolean",
+          "default": false
+        },
        "includes": {
          "description": "Imports tasks from the specified taskfiles. The tasks described in the given Taskfiles will be available with the informed namespace.",
          "type": "object",
Author	SHA1	Message	Date
Valentin Maerten	fa03d6e507	style: fix formatting	2026-04-20 22:06:01 +02:00
Valentin Maerten	37d6b7155f	rename: gitignore -> use_gitignore for clarity Rename the Taskfile/task option from `gitignore` to `use_gitignore` to avoid ambiguity (could be read as "ignore git" vs "use .gitignore"). Consistent with Biome's `useIgnoreFile` naming convention.	2026-04-20 22:06:01 +02:00
Valentin Maerten	43e28d9d0b	refactor: remove rootDir param, auto-detect .git as boundary Walk up from task dir to find .git instead of threading rootDir through Globs, checkers, and itemsFromFor. Gitignore rules are discarded if no .git is found, matching ripgrep's require_git behavior. This keeps the Globs signature clean and makes the future .taskignore integration straightforward (loaded at setup like .taskrc, separate boundary).	2026-04-20 22:05:50 +02:00
Valentin Maerten	78e057e9cb	wip	2026-04-20 22:05:50 +02:00
Valentin Maerten	714ffdb1b5	refactor: replace go-git with sabhiram/go-gitignore for lighter dependency go-git pulled ~30 transitive dependencies and recursively walked the entire worktree on every Globs() call. Replace with sabhiram/go-gitignore (zero dependencies) and a simple walk from task dir up to rootDir to collect .gitignore files. Pass rootDir (Taskfile ROOT_DIR) through the checker chain to bound the search scope.	2026-04-20 22:05:29 +02:00
Valentin Maerten	092663a2f2	feat: add gitignore option to exclude ignored files from sources/generates When `gitignore: true` is set at the Taskfile or task level, files matching .gitignore rules are automatically excluded from sources and generates glob resolution. This prevents rebuilds triggered by changes to files that are in .gitignore (build artifacts, generated files, etc.). Uses go-git to load .gitignore patterns including nested .gitignore files, .git/info/exclude, and global gitignore configuration.	2026-04-20 22:05:02 +02:00
@@ -1 +1 @@
 .51.1
 .50.0