chore(deps): update dependency dagger/dagger to v0.16.3

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
dagger/dagger	patch	0.16.2 -> 0.16.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

dagger/dagger (dagger/dagger)

v0.16.3

Compare Source

Added

• Add new Directory.asGit API for converting a directory into a git repository by @​jedevc in https://github.com/dagger/dagger/pull/9730
• Allow CLI flags in dagger call for GitRepository and GitRef types by @​jedevc in https://github.com/dagger/dagger/pull/9844
• Improved caching of Container.asTarball by @​jedevc in https://github.com/dagger/dagger/pull/9395

Changed

• Improved visualization of chains with content digests by @​vito in https://github.com/dagger/dagger/pull/9739

Dependencies

• Downgrade go to 1.23 by @​jedevc in https://github.com/dagger/dagger/pull/9766
  • This is due to a regression in go 1.24, see https://github.com/dagger/dagger/issues/9759

What to do next?

• Read the documentation
• Join our Discord server
• Follow us on Twitter

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/dagger:0.16.3

📦 Image Reference ghcr.io/uniget-org/tools/dagger:0.16.3

digest	sha256:6474be5a8362f6a9ce051ae0105b4d4c41322d3686be78abb9140abd9a603b16
vulnerabilities
platform	linux/amd64
size	18 MB
packages	186

github.com/go-jose/go-jose/v4 4.0.4 (golang) pkg:golang/github.com/go-jose/go-jose/[email protected] Uncontrolled Resource Consumption Affected range <4.0.5 Fixed version 4.0.5 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Description Impact When parsing compact JWS or JWE input, go-jose could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of '.' characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Patches Version 4.0.5 fixes this issue Workarounds Applications could pre-validate payloads passed to go-jose do not contain an excessive number of '.' characters. References This is the same sort of issue as in the golang.org/x/oauth2/jws package as CVE-2025-22868 and Go issue https://go.dev/issue/71490.

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/13816811375.

[github-actions]

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/13816811375.