Goose security updates (#3579)

Co-authored-by: Douwe Osinga <douwe@squareup.com>

crates/goose-llm/Cargo.toml

@@ -50,7 +50,7 @@ tokio = { version = "1.43", features = ["time", "sync"] }
 [dev-dependencies]
 criterion = "0.5"
 tempfile = "3.15.0"
-dotenv = "0.15"
+dotenvy = "0.15.7"
 lazy_static = "1.5"
 ctor = "0.2.7"
 tokio = { version = "1.43", features = ["full"] }

crates/goose-llm/tests/extract_session_name.rs

@@ -1,5 +1,5 @@
 use anyhow::Result;
-use dotenv::dotenv;
+use dotenvy::dotenv;
 use goose_llm::extractors::generate_session_name;
 use goose_llm::message::Message;
 use goose_llm::providers::errors::ProviderError;

crates/goose-llm/tests/extract_tooltip.rs

@@ -1,5 +1,5 @@
 use anyhow::Result;
-use dotenv::dotenv;
+use dotenvy::dotenv;
 use goose_llm::extractors::generate_tooltip;
 use goose_llm::message::{Message, MessageContent, ToolRequest};
 use goose_llm::providers::errors::ProviderError;

crates/goose-llm/tests/providers_complete.rs

@@ -1,5 +1,5 @@
 use anyhow::Result;
-use dotenv::dotenv;
+use dotenvy::dotenv;
 use goose_llm::message::{Message, MessageContent};
 use goose_llm::providers::base::Provider;
 use goose_llm::providers::errors::ProviderError;

crates/goose-llm/tests/providers_extract.rs

@@ -1,7 +1,7 @@
 // tests/providers_extract.rs
 
 use anyhow::Result;
-use dotenv::dotenv;
+use dotenvy::dotenv;
 use goose_llm::message::Message;
 use goose_llm::providers::base::Provider;
 use goose_llm::providers::{databricks::DatabricksProvider, openai::OpenAiProvider};

crates/goose-mcp/Cargo.toml

@@ -51,7 +51,7 @@ lopdf = "0.35.0"
 docx-rs = "0.4.7"
 image = "0.24.9"
 umya-spreadsheet = "2.2.3"
-keyring = { version = "3.6.1", features = [
+keyring = { version = "3.6.2", features = [
     "apple-native",
     "windows-native",
     "sync-secret-service",

crates/goose/Cargo.toml

@@ -59,7 +59,7 @@ webbrowser = "0.8"
 lazy_static = "1.5.0"
 tracing = "0.1"
 tracing-subscriber = "0.3"
-keyring = { version = "3.6.1", features = ["apple-native", "windows-native", "sync-secret-service", "vendored"] }
+keyring = { version = "3.6.2", features = ["apple-native", "windows-native", "sync-secret-service", "vendored"] }
 serde_yaml = "0.9.34"
 once_cell = "1.20.2"
 etcetera = "0.8.0"
@@ -100,7 +100,7 @@ mockall = "0.13.1"
 wiremock = "0.6.0"
 tokio = { version = "1.43", features = ["full"] }
 temp-env = "0.3.6"
-dotenv = "0.15.0"
+dotenvy = "0.15.7"
 ctor = "0.2.9"
 
 [[example]]

crates/goose/examples/agent.rs

@@ -1,6 +1,6 @@
 use std::sync::Arc;
 
-use dotenv::dotenv;
+use dotenvy::dotenv;
 use futures::StreamExt;
 use goose::agents::{Agent, AgentEvent, ExtensionConfig};
 use goose::config::{DEFAULT_EXTENSION_DESCRIPTION, DEFAULT_EXTENSION_TIMEOUT};

crates/goose/examples/databricks_oauth.rs

@@ -1,5 +1,5 @@
 use anyhow::Result;
-use dotenv::dotenv;
+use dotenvy::dotenv;
 use goose::{
     message::Message,
     providers::{

crates/goose/examples/image_tool.rs

@@ -1,6 +1,6 @@
 use anyhow::Result;
 use base64::{engine::general_purpose::STANDARD as BASE64, Engine as _};
-use dotenv::dotenv;
+use dotenvy::dotenv;
 use goose::{
     message::Message,
     providers::{bedrock::BedrockProvider, databricks::DatabricksProvider, openai::OpenAiProvider},

crates/goose/tests/providers.rs

@@ -1,5 +1,5 @@
 use anyhow::Result;
-use dotenv::dotenv;
+use dotenvy::dotenv;
 use goose::message::{Message, MessageContent};
 use goose::providers::base::Provider;
 use goose::providers::errors::ProviderError;