Bump the go group across 2 directories with 2 updates

[dependabot]

Bumps the go group with 1 update in the / directory: golang.org/x/tools.
Bumps the go group with 1 update in the /build directory: github.com/curioswitch/go-build.

Updates golang.org/x/tools from 0.33.0 to 0.36.0

Commits

• 44d18e1 go.mod: update golang.org/x dependencies
• 52b9c68 go/ast/inspector: remove obsolete unsafe import
• b155480 gopls/doc/features: add "MCP" to index.
• 992bf9c gopls/internal/golang/hover: show alias real type decl for types only
• 861996a go/ssa: pass GOEXPERIMENT=aliastypeparams only on Go 1.23
• 528efda gopls/internal/analysis/modernize/forvar: provide fix for second loop var
• bdddfd5 gopls/internal/server: add counters for add and remove struct tags
• 23dd839 gopls/internal/filewatcher: fix race condition on watcher shutdown
• 3a8978c cmd/digraph: fix bug in allpaths
• bae51bd gopls/internal/server: add windsurf and cursor as language client
• Additional commits viewable in compare view

Updates github.com/curioswitch/go-build from 0.1.0 to 0.4.0

Release notes

Sourced from github.com/curioswitch/go-build's releases.

v0.4.0

This release reverts the major change of v0.3.0, using go run again instead of go tool. After some time using the new feature, it became clear that it doesn't actually work due to not providing stable dependencies to the built CLIs. We are following the advice of popular CLIs like golangci-lint and buf to not use go tool. We will explore other options for automating the update of dependencies.

v0.3.0

This is a major release that reworks tool invocation to use go tool instead of go run. This allows tool versions to be managed in the codebase, making it easier to update them. The full dependency graph will also have checksums validated for better security.

A get-tools command is added to fetch all tools to go.mod. When updating, it can be run to quickly get setup.

GitHub actions lint now also verifies that actions use pinned versions rather than floating version tags. This check cannot be disabled without disabling the entire lint since we believe it is essential for the security of builds. The easiest way to pin versions in an existing repo is to run GITHUB_TOKEN=$(gh auth token) go tool pinact run to automatically resolve them all without rate limiting.

Finally, the output of golangci-lint is passed to reviewdog to allow formatting them as checks within PRs. This will allow errors to be printed together with the code. In the future, more lints will be passed through reviewdog.

Full Changelog: curioswitch/go-build@v0.2.0...v0.3.0

v0.2.0

This release primarily updates tool versions, notably updating to golangci-lint v2.

Full Changelog: curioswitch/go-build@v0.1.0...v0.2.0

Commits

• 27a8895 Revert from go tool back to go run (#56)
• 1d39a72 Bump the gha group with 2 updates (#55)
• ee1e91a Bump the go group across 2 directories with 1 update (#53)
• 1d73c2f Bump actions/setup-go from 5.1.0 to 5.5.0 in the gha group (#54)
• e593998 Add get-tools command (#52)
• 950b990 Check github actions are pinned (#51)
• 8738f8e Execute lints with reviewdog (#50)
• 401432b Migrate to go tool (#49)
• 66ac082 Bump actions/create-github-app-token from 2.0.2 to 2.0.6 in the gha group (#48)
• b44d5c9 Update tools, notably golangci-lint v2 (#47)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions