Update go modules (release-v0.7) (patch) by renovate[bot] · Pull Request #3146 · conforma/cli

renovate · 2026-03-02T02:08:37Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
cuelang.org/go	`v0.16.0` → `v0.16.1`
cuelang.org/go	`v0.15.1` → `v0.15.4`
github.com/conforma/go-containerregistry	`v0.20.7-0.20250703195040-6f40a3734728` → `v0.20.7`
github.com/enterprise-contract/enterprise-contract-controller/api	`v0.1.257` → `v0.1.281`
github.com/gkampitakis/go-snaps	`v0.5.19` → `v0.5.23`
github.com/go-git/go-billy/v5	`v5.9.0` → `v5.9.1`
github.com/go-logr/logr	`v1.4.3` → `v1.4.4`
github.com/google/go-containerregistry	`v0.21.7` → `v0.21.9`
github.com/mattn/go-isatty	`v0.0.20` → `v0.0.24`
github.com/package-url/packageurl-go	`v0.1.3` → `v0.1.6`
github.com/secure-systems-lab/go-securesystemslib	`v0.11.0` → `v0.11.1`
github.com/sigstore/cosign/v2	`v2.4.1` → `v2.4.3`
github.com/sigstore/cosign/v2	`v2.6.2` → `v2.6.5`
github.com/sigstore/rekor	`v1.5.3` → `v1.5.4`
github.com/sigstore/sigstore	`v1.10.8` → `v1.10.9`
github.com/tektoncd/chains	`v0.26.2` → `v0.26.9`
github.com/tektoncd/cli	`v0.44.1` → `v0.44.2`
github.com/tektoncd/cli	`v0.44.0` → `v0.44.2`
k8s.io/api	`v0.36.0` → `v0.36.4`
k8s.io/apiextensions-apiserver	`v0.35.4` → `v0.35.7`
k8s.io/apimachinery	`v0.36.0` → `v0.36.4`
k8s.io/client-go	`v0.36.0` → `v0.36.4`
k8s.io/kubernetes	`v1.34.3` → `v1.34.10`

Release Notes

cue-lang/cue (cuelang.org/go)

`v0.16.1`

Compare Source

Language

The fallback keyword in the aliasv2 experiment is replaced by otherwise, which is clearer. cue fmt or cue fix can be used to rewrite existing code.

Evaluator

Fix a regression where the compiler could add comments to the input AST value, which could lead to increased memory usage.

Fix a bug where exporting certain schemas could result in "cannot have both alias and field in same scope" errors.

`cmd/cue`

Fix a panic which could occur when using non-label expressions in the --path flag.

Teach cue login to give helpful errors when used with OCI registries which don't support the OAuth2 device flow.

Go API

Fix a regression where cue.Context.Encode could panic on custom marshaler types with pointer receivers.

Full list of changes since v0.16.0

internal/cueversion: bump to v0.16.1 by @mvdan in 6d609d7
internal/ci: build releases with Go 1.26.2 by @mvdan in cedf4c8
update all golang.org/x/... dependencies by @mvdan in b4efeef
all: rename fallback keyword to otherwise by @mpvl in f813811
lsp/cache: improve rename by @cuematthew in 8e47027
integration/workspace: add test showing bad behaviour by @cuematthew in a5e0ef5
cmd/cue: suggest docker/podman login when OAuth2 device flow is unsupported by @mvdan in c169605
cmd/cue: add testscript for cue login when device code endpoint is unsupported by @mvdan in d7c882a
cmd/cue: clarify how to authenticate with standard OCI registries by @mvdan in 2613edf
internal/core/compile: avoid mutating AST by @rogpeppe in e4b0516
internal/core/export: fix alias/field name conflict in pattern constraints by @mvdan in 1e46409
internal/core/export: add regression test for alias/field name conflict by @mvdan in 1654f66
pkg: fix godoc mistakes across several packages by @mvdan in eae9aaf
internal/core/convert: fix panic when encoding pointer-receiver marshalers by @mvdan in 8e39aec
cmd/cue: return an error for non-label --path expressions instead of panicking by @mvdan in 5a55849
encoding: add godoc hints for cue/ast result types by @mvdan in 682c663

conforma/go-containerregistry (github.com/conforma/go-containerregistry)

`v0.20.7`

Compare Source

gkampitakis/go-snaps (github.com/gkampitakis/go-snaps)

`v0.5.23`

Compare Source

What's Changed

Fix Skipf test format for Go vet by @HNO3Miracle in #160
feat: support labeling snapshots by @G-Rath in #152

New Contributors

@HNO3Miracle made their first contribution in #160

Full Changelog: gkampitakis/go-snaps@v0.5.22...v0.5.23

`v0.5.22`

Compare Source

What's Changed

Enhance README with additional Any matcher example by @MoritzHeld in #157
fix: create snapshot files with 0644 instead of os.ModePerm by @gkampitakis in #159

New Contributors

@MoritzHeld made their first contribution in #157

Full Changelog: gkampitakis/go-snaps@v0.5.21...v0.5.22

`v0.5.21`

Compare Source

What's Changed

support nested arrays in json matchers by @gkampitakis in #145

Full Changelog: gkampitakis/go-snaps@v0.5.20...v0.5.21

`v0.5.20`

Compare Source

What's Changed

feat: support setting serializer on config by @gkampitakis in #154

Full Changelog: gkampitakis/go-snaps@v0.5.19...v0.5.20

go-git/go-billy (github.com/go-git/go-billy/v5)

`v5.9.1`

Compare Source

What's Changed

build: Update module golang.org/x/net to v0.55.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #216
build: Update module golang.org/x/text to v0.39.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #230
build: Update module golang.org/x/net to v0.56.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #229

Full Changelog: go-git/go-billy@v5.9.0...v5.9.1

go-logr/logr (github.com/go-logr/logr)

`v1.4.4`

Compare Source

What's Changed

drop +build tags by @pohly in #401
CI: avoid floating dependencies, fix issues by @pohly in #432
Bump to Go 1.26 by @thockin in #445
funcr: bound slog.Group nesting depth to prevent stack overflow by @martinholovsky in #447
funcr: Handle and test recursive values by @thockin in #446

New Contributors

@martinholovsky made their first contribution in #447

Full Changelog: go-logr/logr@v1.4.3...v1.4.4

google/go-containerregistry (github.com/google/go-containerregistry)

`v0.21.9`

Compare Source

What's Changed

actions: pin slsa generator by version by @Subserial in #2395
fix: prevent data race on scope refreshes within remote.writer by @Subserial in #2396
fix: remove '.' from unsafe path prefixes by @Subserial in #2400
build(deps): bump the actions group with 3 updates by @dependabot[bot] in #2398

Full Changelog: google/go-containerregistry@v0.21.8...v0.21.9

`v0.21.8`

Compare Source

The artifacts attached to this release are missing SLSA provenance, see #2390.

What's Changed

build(deps): bump the go-deps group across 1 directory with 3 updates by @dependabot[bot] in #2353
build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /cmd/krane by @dependabot[bot] in #2367
build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /pkg/authn/k8schain by @dependabot[bot] in #2368
build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in /pkg/authn/kubernetes by @dependabot[bot] in #2363
build(deps): bump the go-deps group across 3 directories with 7 updates by @dependabot[bot] in #2377
build(deps): bump the actions group across 1 directory with 5 updates by @dependabot[bot] in #2375
Reject unsafe Windows archive paths in Extract by @Haihan-Jiang in #2330
feat(goreleaser): add loong64 build support for crane/gcrane/krane by @xuxiaowei-com-cn in #2358
Document tag and digest reference semantics by @Haihan-Jiang in #2325
remote: release pull limiter slot when body is read to EOF by @knQzx in #2373
tarball: bounds-check layer index in uncompressed LayerByDiffID by @arpitjain099 in #2370
authn: read Podman auth from XDG config by @vigneshakaviki in #2379
transport: per-host bearer token exchange on cross-host redirect by @amitzig in #2360
mutate: bounds-check layer index when building rebase addendums by @arpitjain099 in #2371
fix(daemon): copy ExposedPorts from source config in computeImageConfig by @x64vps in #2356
feat(remote): add WithReferrersTagFallback option by @kevinmdavis in #2366
mutate: apply opaque-directory whiteouts (.wh..wh..opq) in Extract by @sadmanf in #2372
tarball: use correct file extension for zstd/uncompressed by @milas in #2382
build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in the go-deps group across 1 directory by @dependabot[bot] in #2380
actions: update actions to be pinned by hash by @Subserial in #2384
Bump go version to 1.26.5 by @Subserial in #2388

New Contributors

@xuxiaowei-com-cn made their first contribution in #2358
@knQzx made their first contribution in #2373
@arpitjain099 made their first contribution in #2370
@vigneshakaviki made their first contribution in #2379
@amitzig made their first contribution in #2360
@x64vps made their first contribution in #2356
@kevinmdavis made their first contribution in #2366
@sadmanf made their first contribution in #2372

Full Changelog: google/go-containerregistry@v0.21.7...v0.21.8

mattn/go-isatty (github.com/mattn/go-isatty)

package-url/packageurl-go (github.com/package-url/packageurl-go)

`v0.1.6`

Compare Source

What's Changed

Optimize parsing and serialization performance by @andrew in #86

New Contributors

@andrew made their first contribution in #86

Full Changelog: package-url/packageurl-go@v0.1.5...v0.1.6

`v0.1.5`

Compare Source

What's Changed

Remove version requirement for TypeSwift by @Talgarr in #90
Handle non-canonical input purls a bit more gracefully by @petergardfjall in #89

New Contributors

@Talgarr made their first contribution in #90

Full Changelog: package-url/packageurl-go@v0.1.4...v0.1.5

`v0.1.4`

Compare Source

What's Changed

Fix golangci and update versions by @shibumi in #76
Allow npm names to be case sensitive by @PFCM in #73
add custom validation for pkg:cpan by @petergardfjall in #79
move cpan to known types by @nikpivkin in #71
Run tests using reference data from purl-spec by @keshav-space in #80
update code to honor the canonical purl encoding by @petergardfjall in #83

New Contributors

@PFCM made their first contribution in #73
@nikpivkin made their first contribution in #71
@keshav-space made their first contribution in #80

Full Changelog: package-url/packageurl-go@v0.1.3...v0.1.4

secure-systems-lab/go-securesystemslib (github.com/secure-systems-lab/go-securesystemslib)

`v0.11.1`

Compare Source

sigstore/cosign (github.com/sigstore/cosign/v2)

`v2.4.3`

Compare Source

Features

Bump sigstore/sigstore to support KMS plugins (#4073)
Enable fetching signatures without remote get. (#4047)
Feat/file flag completion improvements (#4028)
Update builder to use go1.23.6 (#4052)

Bug Fixes

fix parsing error in --only for cosign copy (#4049)

Cleanup

Refactor verifyNewBundle into library function (#4013)
fix comment typo and imports order (#4061)
sync comment with parameter name in function signature (#4063)
sort properly Go imports (#4071)

Contributors

Bob Callaway
Carlos Tadeu Panato Junior
Cody Soyland
Dmitry Savintsev
Hayden B
Tomasz Janiszewski
Ville Skyttä

`v2.4.2`

Compare Source

Features

Updated open-policy-agent to 1.1.0 library (#4036)
- Note that only Rego v0 policies are supported at this time
Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
Add support for verifying root checksum in cosign initialize (#3953)
Detect if user supplied a valid protobuf bundle (#3931)
Add a log message if user doesn't provide --trusted-root (#3933)
Support mTLS towards container registry (#3922)
Add bundle create helper command (#3901)
Add trusted-root create helper command (#3876)

Bug Fixes

fix: set tls config while retaining other fields from default http transport (#4007)
policy fuzzer: ignore known panics (#3993)
Fix for multiple WithRemote options (#3982)
Add nightly conformance test workflow (#3979)
Fix copy --only for signatures + update/align docs (#3904)

Documentation

Remove usage.md from spec, point to client spec (#3918)
move reference from gcr to ghcr (#3897)

Contributors

AdamKorcz
Aditya Sirish
Bob Callaway
Carlos Tadeu Panato Junior
Cody Soyland
Colleen Murphy
Hayden B
Jussi Kukkonen
Marco Franssen
Nianyu Shen
Slavek Kabrda
Søren Juul
Warren Hodgkinson
Zach Steindler

sigstore/rekor (github.com/sigstore/rekor)

`v1.5.4`

Compare Source

Features

search: add subject field for SAN-based lookup (#2850)
Change default CLI upload type to hashedrekord (#2885)
separate read/write sql traffic for indexservice into separate pools (#2914)

Bug Fixes

better handle connection issues (#2931)
fix pprof arg (#2932)
fix shadowed err, wrong err label (#2907)
alpine: hash only the bytes read when computing the control.tar.gz digest (#2908)
return a 400 error for invalid TreeID (#2895)
Return the file error instead of the URL error for a missing artifact path (#2872)
Apply proactive hardening against malformed requests (#2945)

Improvements

remove repetitive viper lookups from api endpoints (#2922)
move CI containers to GHCR (#2943)
remove unused semver type version map (#2918)
test against valkey (#2916)
Remove unmaintained scripts/createdb.sh dev helper (#2905)
test mysql with production dsn strings (#2906)
create interface for TrillianClient (#2896)
use more efficient table schema for indexes (#2903)
Migrate off deprecated golang.org/x/crypto/openpgp (#2883)
minimize duplicative JSON parsing while handling entries (#2880)
remove duplicative log entry (#2881)
optimize DSSE memory and cpu while parsing and verifying envs (#2879)
update builder to use go1.26.4 (#2873)
upgrade grpc-ecosystem/go-grpc-middleware to v2 (#2921)
Migrate gopkg.in/yaml.v2 to sigs.k8s.io/yaml (#2919)
numerous upgraded dependencies

Documentation

docs(cli): add usage examples to rekor-cli commands (#2851)

Contributors

ahmagdyfb
Bob Callaway
Carlos Tadeu Panato Junior
Chiman Jain
Hayden
Jason Hall
Nikhil J
Ogulcan Aydogan
Pujitha Paladugu
Sueun Cho

sigstore/sigstore (github.com/sigstore/sigstore)

`v1.10.9`

Compare Source

What's Changed

Note: #2369 deprecates the TUF client. Use the TUF client from sigstore-go instead: https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf

Deprecate TUF client, ValidatePubKey in #2369
docs: add OVHcloud KMS in available external plugins in #2359
fix(oauthflow): default the device flow poll interval to 5s per RFC 8628 in #2381
Add BrowserOpener field to InteractiveIDTokenGetter in #2383
Fix Azure KMS support for RSA signatures in #2355

Full Changelog: sigstore/sigstore@v1.10.8...v1.10.9

tektoncd/chains (github.com/tektoncd/chains)

`v0.26.9`: Tekton Chains release v0.26.9

Compare Source

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/chains/previous/v0.26.9/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a9be065f521117233096593bc64a7419eea1647e468ad275d48d8f7592282ff69

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a9be065f521117233096593bc64a7419eea1647e468ad275d48d8f7592282ff69
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/chains/previous/v0.26.9/release.yaml
REKOR_UUID=108e9186e8c5677a9be065f521117233096593bc64a7419eea1647e468ad275d48d8f7592282ff69

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.26.9@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

Fixes

Misc

🔨 chore(deps): bump the all group with 7 updates (#1858)
🔨 chore(deps): bump chainguard-dev/actions/kind-diag from 1.6.27 to 1.6.28 in the all group (#1846)

Docs

Thanks

Thanks to these contributors who contributed to v0.26.9!

❤️ @app/dependabot

Extra shout-out for awesome release notes:

`v0.26.8`: Tekton Chains release v0.26.8

Compare Source

Tekton Chains release v0.26.8 "Release v0.26.8"

-Docs @ v0.26.8
-Examples @ v0.26.8

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/chains/previous/v0.26.8/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a9395f9f057d95f07be1c614f3e459d16f00ad07648f4e78de6c4aa62ff0bf98d

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a9395f9f057d95f07be1c614f3e459d16f00ad07648f4e78de6c4aa62ff0bf98d
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/chains/previous/v0.26.8/release.yaml
REKOR_UUID=108e9186e8c5677a9395f9f057d95f07be1c614f3e459d16f00ad07648f4e78de6c4aa62ff0bf98d

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.26.8@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

Fixes

Misc

🔨 chore(deps): bump the all group across 1 directory with 3 updates (#1836)

Docs

Thanks

Thanks to these contributors who contributed to v0.26.8!

❤️ @app/dependabot

Extra shout-out for awesome release notes:

`v0.26.7`: Tekton Chains release v0.26.7

Compare Source

Tekton Chains "Release v0.26.7"

-Docs @ v0.26.7
-Examples @ v0.26.7

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/chains/previous/v0.26.7/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a40d0a42a05fb5a94465d14cfd90ef06403eb7ed300ba6402c4f38d8b70978d33

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a40d0a42a05fb5a94465d14cfd90ef06403eb7ed300ba6402c4f38d8b70978d33
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/chains/previous/v0.26.7/release.yaml
REKOR_UUID=108e9186e8c5677a40d0a42a05fb5a94465d14cfd90ef06403eb7ed300ba6402c4f38d8b70978d33

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.26.7@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

Fixes

Misc

🔨 chore(deps): bump chainguard-dev/actions/kind-diag from 1.6.26 to 1.6.27 in the all group (#1818)
🔨 chore(deps): bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 in the all group (#1812)
🔨 chore(deps): bump sigstore/scaffolding/actions/setup from 0.7.33 to 0.7.37 in the all group (#1805)

Docs

Thanks

Thanks to these contributors who contributed to v0.26.7!

❤️ @app/dependabot

Extra shout-out for awesome release notes:

`v0.26.6`: Tekton Chains Release v0.26.6

Compare Source

Tekton Chains Release v0.26.6

-Docs @ v0.26.6
-Examples @ v0.26.6

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/chains/previous/v0.26.6/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a9cc2851aeabc5d55eb1dce87413ca45c2e7196726dd0e84ea1255a41f3d43ca2

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a9cc2851aeabc5d55eb1dce87413ca45c2e7196726dd0e84ea1255a41f3d43ca2
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/chains/previous/v0.26.6/release.yaml
REKOR_UUID=108e9186e8c5677a9cc2851aeabc5d55eb1dce87413ca45c2e7196726dd0e84ea1255a41f3d43ca2

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.26.6@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

Fixes

Misc

🔨 chore(deps): bump github.com/tektoncd/pipeline from 1.9.5 to 1.9.6 in the all group (#1774)
🔨 chore(deps): bump chainguard-dev/actions/kind-diag from 1.6.25 to 1.6.26 in the all group across 1 directory (#1760)
🔨 chore(deps): bump chainguard-dev/actions/kind-diag from 1.6.14 to 1.6.25 (#1750)
🔨 chore(deps): bump github/codeql-action/autobui

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM (* 0-3 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-03-02T02:08:40Z

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

37 additional dependencies were updated

Details:

Package	Change
`github.com/go-openapi/strfmt`	`v0.26.4` -> `v0.27.0`
`github.com/in-toto/in-toto-golang`	`v0.10.0` -> `v0.11.0`
`github.com/stretchr/testify`	`v1.11.1` -> `v1.12.0`
`github.com/ProtonMail/go-crypto`	`v1.3.0` -> `v1.4.1`
`github.com/coreos/go-oidc/v3`	`v3.19.0` -> `v3.20.0`
`github.com/gkampitakis/ciinfo`	`v0.3.2` -> `v0.3.4`
`github.com/go-chi/chi/v5`	`v5.3.0` -> `v5.3.1`
`github.com/go-openapi/analysis`	`v0.25.2` -> `v0.26.0`
`github.com/go-openapi/jsonpointer`	`v0.23.1` -> `v1.0.0`
`github.com/go-openapi/jsonreference`	`v0.21.6` -> `v1.0.0`
`github.com/go-openapi/loads`	`v0.24.0` -> `v0.25.1`
`github.com/go-openapi/runtime`	`v0.32.4` -> `v0.32.5`
`github.com/go-openapi/spec`	`v0.22.6` -> `v0.22.9`
`github.com/go-openapi/swag/conv`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/swag/fileutils`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/swag/jsonutils`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/swag/loading`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/swag/mangling`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/swag/stringutils`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/swag/typeutils`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/swag/yamlutils`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/validate`	`v0.26.0` -> `v0.26.3`
`github.com/goccy/go-yaml`	`v1.18.0` -> `v1.19.2`
`github.com/klauspost/compress`	`v1.18.5` -> `v1.19.1`
`github.com/maruel/natural`	`v1.1.1` -> `v1.3.0`
`github.com/prometheus/client_golang`	`v1.23.2` -> `v1.24.1`
`github.com/prometheus/common`	`v0.68.0` -> `v0.70.1`
`github.com/prometheus/procfs`	`v0.20.1` -> `v0.21.1`
`github.com/stretchr/objx`	`v0.5.2` -> `v0.5.3`
`github.com/tidwall/gjson`	`v1.18.0` -> `v1.19.0`
`go.yaml.in/yaml/v3`	`v3.0.4` -> `v3.0.5`
`golang.org/x/crypto`	`v0.54.0` -> `v0.55.0`
`golang.org/x/mod`	`v0.37.0` -> `v0.38.0`
`golang.org/x/text`	`v0.40.0` -> `v0.41.0`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260526163538-3dc84a4a5aaa` -> `v0.0.0-20260727163830-6c54dddc4772`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260610212136-7ab31c22f7ad` -> `v0.0.0-20260720155508-bb71a54f79dc`
`sigs.k8s.io/structured-merge-diff/v6`	`v6.3.2` -> `v6.3.3`

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

66 additional dependencies were updated

Details:

Package	Change
`github.com/go-openapi/strfmt`	`v0.26.4` -> `v0.27.0`
`github.com/in-toto/in-toto-golang`	`v0.10.0` -> `v0.11.0`
`github.com/stretchr/testify`	`v1.11.1` -> `v1.12.0`
`cloud.google.com/go/iam`	`v1.11.0` -> `v1.13.0`
`cloud.google.com/go/monitoring`	`v1.25.0` -> `v1.29.0`
`github.com/ProtonMail/go-crypto`	`v1.3.0` -> `v1.4.1`
`github.com/aws/aws-sdk-go-v2`	`v1.42.0` -> `v1.43.0`
`github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream`	`v1.7.8` -> `v1.7.11`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.17` -> `v1.32.31`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.19.16` -> `v1.19.30`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.23` -> `v1.18.31`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.4.23` -> `v1.4.31`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.23` -> `v2.7.31`
`github.com/aws/aws-sdk-go-v2/internal/v4a`	`v1.4.24` -> `v1.4.32`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.13.9` -> `v1.13.13`
`github.com/aws/aws-sdk-go-v2/service/internal/checksum`	`v1.9.13` -> `v1.9.18`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.13.23` -> `v1.13.31`
`github.com/aws/aws-sdk-go-v2/service/internal/s3shared`	`v1.19.21` -> `v1.19.25`
`github.com/aws/aws-sdk-go-v2/service/s3`	`v1.97.3` -> `v1.102.2`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.0.11` -> `v1.5.0`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.30.17` -> `v1.33.0`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.35.21` -> `v1.38.0`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.42.1` -> `v1.45.0`
`github.com/aws/smithy-go`	`v1.27.1` -> `v1.27.3`
`github.com/coreos/go-oidc/v3`	`v3.19.0` -> `v3.20.0`
`github.com/gkampitakis/ciinfo`	`v0.3.2` -> `v0.3.4`
`github.com/go-chi/chi/v5`	`v5.3.0` -> `v5.3.1`
`github.com/go-openapi/analysis`	`v0.25.2` -> `v0.26.0`
`github.com/go-openapi/jsonpointer`	`v0.23.1` -> `v1.0.0`
`github.com/go-openapi/jsonreference`	`v0.21.6` -> `v1.0.0`
`github.com/go-openapi/loads`	`v0.24.0` -> `v0.25.1`
`github.com/go-openapi/runtime`	`v0.32.4` -> `v0.32.5`
`github.com/go-openapi/spec`	`v0.22.6` -> `v0.22.9`
`github.com/go-openapi/swag/conv`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/swag/fileutils`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/swag/jsonutils`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/swag/loading`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/swag/mangling`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/swag/stringutils`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/swag/typeutils`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/swag/yamlutils`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/validate`	`v0.26.0` -> `v0.26.3`
`github.com/goccy/go-yaml`	`v1.18.0` -> `v1.19.2`
`github.com/golang/snappy`	`v0.0.4` -> `v1.0.0`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.16` -> `v0.3.18`
`github.com/googleapis/gax-go/v2`	`v2.22.0` -> `v2.23.0`
`github.com/klauspost/compress`	`v1.18.5` -> `v1.19.1`
`github.com/maruel/natural`	`v1.1.1` -> `v1.3.0`
`github.com/prometheus/client_golang`	`v1.23.2` -> `v1.24.1`
`github.com/prometheus/common`	`v0.68.0` -> `v0.70.1`
`github.com/prometheus/procfs`	`v0.20.1` -> `v0.21.1`
`github.com/stretchr/objx`	`v0.5.2` -> `v0.5.3`
`github.com/tidwall/gjson`	`v1.18.0` -> `v1.19.0`
`go.yaml.in/yaml/v3`	`v3.0.4` -> `v3.0.5`
`golang.org/x/crypto`	`v0.54.0` -> `v0.55.0`
`golang.org/x/mod`	`v0.37.0` -> `v0.38.0`
`golang.org/x/text`	`v0.40.0` -> `v0.41.0`
`golang.org/x/tools`	`v0.47.0` -> `v0.48.0`
`google.golang.org/api`	`v0.286.0` -> `v0.290.0`
`google.golang.org/genproto`	`v0.0.0-20260406210006-6f92a3bedf2d` -> `v0.0.0-20260622175928-b703f567277d`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260526163538-3dc84a4a5aaa` -> `v0.0.0-20260727163830-6c54dddc4772`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260610212136-7ab31c22f7ad` -> `v0.0.0-20260720155508-bb71a54f79dc`
`google.golang.org/grpc`	`v1.82.0` -> `v1.82.1`
`google.golang.org/protobuf`	`v1.36.12-0.20260120151049-f2248ac996af` -> `v1.36.12`
`k8s.io/api`	`v0.36.0` -> `v0.36.4`
`sigs.k8s.io/structured-merge-diff/v6`	`v6.3.2` -> `v6.3.3`

File name: tools/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

38 additional dependencies were updated

Details:

Package	Change
`cloud.google.com/go/kms`	`v1.31.0` -> `v1.33.0`
`cloud.google.com/go/longrunning`	`v1.0.0` -> `v1.2.0`
`github.com/Azure/azure-sdk-for-go/sdk/azcore`	`v1.21.1` -> `v1.22.0`
`github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys`	`v1.4.0` -> `v1.5.0`
`github.com/AzureAD/microsoft-authentication-library-for-go`	`v1.6.0` -> `v1.7.0`
`github.com/aws/aws-sdk-go-v2`	`v1.42.0` -> `v1.43.0`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.17` -> `v1.32.31`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.19.16` -> `v1.19.30`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.23` -> `v1.18.31`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.4.23` -> `v1.4.31`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.23` -> `v2.7.31`
`github.com/aws/aws-sdk-go-v2/internal/v4a`	`v1.4.24` -> `v1.4.32`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.13.9` -> `v1.13.13`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.13.23` -> `v1.13.31`
`github.com/aws/aws-sdk-go-v2/service/kms`	`v1.51.1` -> `v1.54.0`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.0.11` -> `v1.5.0`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.30.17` -> `v1.33.0`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.35.21` -> `v1.38.0`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.42.1` -> `v1.45.0`
`github.com/aws/smithy-go`	`v1.27.1` -> `v1.27.3`
`github.com/coreos/go-oidc/v3`	`v3.19.0` -> `v3.20.0`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.16` -> `v0.3.17`
`github.com/googleapis/gax-go/v2`	`v2.22.0` -> `v2.23.0`
`github.com/hashicorp/vault/api`	`v1.22.0` -> `v1.23.0`
`github.com/in-toto/go-witness`	`v0.9.1` -> `v0.9.2`
`github.com/in-toto/in-toto-golang`	`v0.10.0` -> `v0.11.0`
`github.com/jellydator/ttlcache/v3`	`v3.4.0` -> `v3.4.1`
`github.com/sigstore/cosign/v2`	`v2.6.2` -> `v2.6.4`
`github.com/sigstore/sigstore`	`v1.10.8` -> `v1.10.9`
`github.com/sigstore/sigstore/pkg/signature/kms/aws`	`v1.10.8` -> `v1.10.9`
`github.com/sigstore/sigstore/pkg/signature/kms/azure`	`v1.10.8` -> `v1.10.9`
`github.com/sigstore/sigstore/pkg/signature/kms/gcp`	`v1.10.8` -> `v1.10.9`
`github.com/sigstore/sigstore/pkg/signature/kms/hashivault`	`v1.10.8` -> `v1.10.9`
`github.com/sigstore/timestamp-authority/v2`	`v2.0.3` -> `v2.0.6`
`google.golang.org/api`	`v0.286.0` -> `v0.287.1`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260526163538-3dc84a4a5aaa` -> `v0.0.0-20260727163830-6c54dddc4772`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260610212136-7ab31c22f7ad` -> `v0.0.0-20260720155508-bb71a54f79dc`
`google.golang.org/grpc`	`v1.82.0` -> `v1.82.1`

fullsend-ai-review · 2026-08-09T18:03:59Z

🤖 Finished Review · ✅ Success · Started 6:03 PM UTC · Completed 6:09 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-09T21:40:26Z

🤖 Finished Review · ✅ Success · Started 9:40 PM UTC · Completed 9:47 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-10T15:23:12Z

🤖 Finished Review · ✅ Success · Started 3:23 PM UTC · Completed 3:30 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-10T17:05:24Z

🤖 Finished Review · ✅ Success · Started 5:05 PM UTC · Completed 5:13 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-11T01:00:25Z

🤖 Finished Review · ✅ Success · Started 1:00 AM UTC · Completed 1:07 AM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-11T04:03:21Z

🤖 Finished Review · ✅ Success · Started 4:03 AM UTC · Completed 4:10 AM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-12T12:48:16Z

🤖 Finished Review · ✅ Success · Started 12:48 PM UTC · Completed 12:54 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-12T13:02:02Z

🤖 Finished Review · ✅ Success · Started 1:02 PM UTC · Completed 1:08 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-14T16:33:09Z

🤖 Finished Review · ✅ Success · Started 4:33 PM UTC · Completed 4:42 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-17T21:06:23Z

🤖 Finished Review · ✅ Success · Started 9:06 PM UTC · Completed 9:13 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-18T01:40:31Z

🤖 Finished Review · ✅ Success · Started 1:40 AM UTC · Completed 1:47 AM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-18T18:38:47Z

🤖 Finished Review · ✅ Success · Started 6:38 PM UTC · Completed 6:46 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-19T22:03:44Z

🤖 Finished Review · ✅ Success · Started 10:03 PM UTC · Completed 10:10 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-20T19:32:03Z

🤖 Finished Review · ✅ Success · Started 7:32 PM UTC · Completed 7:44 PM UTC

Commit: 87c4a29 · View workflow run →

renovate Bot added release-v0.7 renovate labels Mar 2, 2026

renovate Bot enabled auto-merge March 2, 2026 02:08

github-actions Bot added the size: L label Mar 2, 2026

renovate Bot force-pushed the renovate/release-v0.7-patch-go-modules branch 5 times, most recently from bb1e687 to 608b025 Compare March 10, 2026 03:21

renovate Bot force-pushed the renovate/release-v0.7-patch-go-modules branch 4 times, most recently from cb09e7b to 2bdf2b5 Compare March 19, 2026 11:20

renovate Bot force-pushed the renovate/release-v0.7-patch-go-modules branch 4 times, most recently from d17ae93 to 9539d46 Compare April 2, 2026 01:41

renovate Bot force-pushed the renovate/release-v0.7-patch-go-modules branch 9 times, most recently from e56c120 to 31ef858 Compare April 14, 2026 09:15

renovate Bot force-pushed the renovate/release-v0.7-patch-go-modules branch from 31ef858 to a411eb7 Compare April 15, 2026 10:40

github-actions Bot added size: M and removed size: L labels Apr 15, 2026

This comment was marked as outdated.

Sign in to view

Update go modules

0618be5

fullsend-ai-review Bot approved these changes Aug 20, 2026

View reviewed changes

Uh oh!

Conversation

renovate Bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Language

Evaluator

cmd/cue

Go API

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

Features

Bug Fixes

Cleanup

Contributors

Features

Bug Fixes

Documentation

Contributors

Features

Bug Fixes

Improvements

Documentation

Contributors

What's Changed

v0.26.9: Tekton Chains release v0.26.9

Installation one-liner

Attestation

Changes

Features

Fixes

Misc

Docs

Thanks

v0.26.8: Tekton Chains release v0.26.8

Installation one-liner

Attestation

Changes

Features

Fixes

Misc

Docs

Thanks

v0.26.7: Tekton Chains release v0.26.7

Installation one-liner

Attestation

Changes

Features

Fixes

Misc

Docs

Thanks

v0.26.6: Tekton Chains Release v0.26.6

Installation one-liner

Attestation

Changes

Features

Fixes

Misc

Configuration

Uh oh!

renovate Bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

renovate Bot commented Mar 2, 2026 •

edited

Loading

`cmd/cue`

`v0.26.9`: Tekton Chains release v0.26.9

`v0.26.8`: Tekton Chains release v0.26.8

`v0.26.7`: Tekton Chains release v0.26.7

`v0.26.6`: Tekton Chains Release v0.26.6

renovate Bot commented Mar 2, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 9, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 9, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 10, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 10, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 11, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 11, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 12, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 12, 2026 •

edited

Loading