Bump the go-dependencies group across 5 directories with 5 updates

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[bgentry]

@dependabot rebase

[bgentry]

🤖 Codex review: Superseded by merged #1514; no unapplied dependency change remains. Comment only; another merge is unnecessary.

Upgrade

• github.com/jackc/puddle/v2: 2.2.2 → 2.2.3
• golang.org/x/sync: 0.23.0 → 0.24.0
• golang.org/x/text: 0.42.0 → 0.43.0
• golang.org/x/mod: 0.41.0 → 0.42.0
• turso.tech/database/tursogo: 0.8.1 → 0.8.2
• Reviewed head: 88d5fa7c41f6997d10213eee6094ac90de25f146.

Security review

• Reused the prior exact-version/checksum/source/provenance review. The head and every artifact identity remain unchanged; no blocking supply-chain finding was identified in that review.
• Independently verified that all 16 changed manifests/sums have identical Git blobs in this head, #1514's reviewed head, its merge f233f42b6e6f8c23997180e6ab950805f835039c, and current master 0b1e96d8fe1d9c8978bd4a38da5c00c8dad38f4f. The merged dependency patch is identical to this PR's patch, and that merge is an ancestor of master. No dependency delta remains to apply.

Compatibility verification

• The merged successor #1514 already passed exact-head make tidy, module verification across all ten workspace modules, make test, make test/race, make lint, module-zip/migration checks, and hosted CI. Its approval records the commands and scope: #1514 (review).
• This superseded head is intentionally unmerged. Executable checks are not rerun, and the successor's test results are not represented as a new validation of this older tree. Current-master correspondence is established by the exact manifest/sum and merged-patch comparisons above.

Residual risk

• The existing Turso native-binary/upstream-build trust documented in #1514's review remains unchanged. No new artifact, verification requirement, or upgrade remains in this PR. It can be closed as superseded.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml