Update go modules (main) (patch) by renovate[bot] · Pull Request #3130 · conforma/cli

renovate · 2026-02-27T01:15:43Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
cuelang.org/go	`v0.16.0` → `v0.16.1`
github.com/conforma/crds/api	`v0.1.7` → `v0.1.11`
github.com/cucumber/godog	`v0.15.0` → `v0.15.1`
github.com/gkampitakis/go-snaps	`v0.5.19` → `v0.5.23`
github.com/go-git/go-billy/v5	`v5.9.0` → `v5.9.1`
github.com/go-logr/logr	`v1.4.3` → `v1.4.4`
github.com/go-openapi/runtime	`v0.32.4` → `v0.32.6`
github.com/google/go-containerregistry	`v0.21.7` → `v0.21.9`
github.com/mattn/go-isatty	`v0.0.20` → `v0.0.24`
github.com/otiai10/copy	`v1.14.0` → `v1.14.1`
github.com/package-url/packageurl-go	`v0.1.3` → `v0.1.6`
github.com/sigstore/cosign/v3	`v3.0.4` → `v3.0.6`
github.com/sigstore/sigstore	`v1.10.8` → `v1.10.9`
github.com/sigstore/sigstore-go	`v1.2.1` → `v1.2.2`
github.com/tektoncd/chains	`v0.26.2` → `v0.26.9`
github.com/tektoncd/cli	`v0.44.1` → `v0.44.2`
github.com/testcontainers/testcontainers-go	`v0.34.0` → `v0.34.1`
gotest.tools/gotestsum	`v1.12.1` → `v1.12.3`
k8s.io/api	`v0.36.0` → `v0.36.3`
k8s.io/apiextensions-apiserver	`v0.36.0` → `v0.36.3`
k8s.io/apimachinery	`v0.36.0` → `v0.36.3`
k8s.io/client-go	`v0.36.0` → `v0.36.3`
k8s.io/kubernetes	`v1.34.2` → `v1.34.10`

Release Notes

cue-lang/cue (cuelang.org/go)

`v0.16.1`

Compare Source

Language

The fallback keyword in the aliasv2 experiment is replaced by otherwise, which is clearer. cue fmt or cue fix can be used to rewrite existing code.

Evaluator

Fix a regression where the compiler could add comments to the input AST value, which could lead to increased memory usage.

Fix a bug where exporting certain schemas could result in "cannot have both alias and field in same scope" errors.

`cmd/cue`

Fix a panic which could occur when using non-label expressions in the --path flag.

Teach cue login to give helpful errors when used with OCI registries which don't support the OAuth2 device flow.

Go API

Fix a regression where cue.Context.Encode could panic on custom marshaler types with pointer receivers.

Full list of changes since v0.16.0

internal/cueversion: bump to v0.16.1 by @mvdan in 6d609d7
internal/ci: build releases with Go 1.26.2 by @mvdan in cedf4c8
update all golang.org/x/... dependencies by @mvdan in b4efeef
all: rename fallback keyword to otherwise by @mpvl in f813811
lsp/cache: improve rename by @cuematthew in 8e47027
integration/workspace: add test showing bad behaviour by @cuematthew in a5e0ef5
cmd/cue: suggest docker/podman login when OAuth2 device flow is unsupported by @mvdan in c169605
cmd/cue: add testscript for cue login when device code endpoint is unsupported by @mvdan in d7c882a
cmd/cue: clarify how to authenticate with standard OCI registries by @mvdan in 2613edf
internal/core/compile: avoid mutating AST by @rogpeppe in e4b0516
internal/core/export: fix alias/field name conflict in pattern constraints by @mvdan in 1e46409
internal/core/export: add regression test for alias/field name conflict by @mvdan in 1654f66
pkg: fix godoc mistakes across several packages by @mvdan in eae9aaf
internal/core/convert: fix panic when encoding pointer-receiver marshalers by @mvdan in 8e39aec
cmd/cue: return an error for non-label --path expressions instead of panicking by @mvdan in 5a55849
encoding: add godoc hints for cue/ast result types by @mvdan in 682c663

cucumber/godog (github.com/cucumber/godog)

`v0.15.1`

Compare Source

Added

Step text is added to "step is undefined" error - (669 - vearutop)
Localisation support by @MegaGrindStone in #665
feat: support uint types by @chengxilo in #695

Changed

Replace deprecated ::set-output - (681 - nodeg)

Fixed

fix(errors): fix(errors): Fix expected Step argument count for steps with context.Context (679 - tigh-latte)
fix(formatter): On concurrent execution, execute formatter at end of Scenario - (645 - tigh-latte)
Pretty printing results now prints the line where the step is declared instead of the line where the handler is declared. (668 - spencerc)
Update honnef.co/go/tools/cmd/staticcheck version in Makefile by @RezaZareiii in #670
fix: verify dogT exists in the context before using it by @cakoolen in #692
fix: change bang to being in README by @nahomEagleLion in #687
Mark junit test cases as skipped if no pickle step results available by @mrsheepuk in #597
Print step declaration line instead of handler declaration line by @SpencerC in #668

gkampitakis/go-snaps (github.com/gkampitakis/go-snaps)

`v0.5.23`

Compare Source

What's Changed

Fix Skipf test format for Go vet by @HNO3Miracle in #160
feat: support labeling snapshots by @G-Rath in #152

New Contributors

@HNO3Miracle made their first contribution in #160

Full Changelog: gkampitakis/go-snaps@v0.5.22...v0.5.23

`v0.5.22`

Compare Source

What's Changed

Enhance README with additional Any matcher example by @MoritzHeld in #157
fix: create snapshot files with 0644 instead of os.ModePerm by @gkampitakis in #159

New Contributors

@MoritzHeld made their first contribution in #157

Full Changelog: gkampitakis/go-snaps@v0.5.21...v0.5.22

`v0.5.21`

Compare Source

What's Changed

support nested arrays in json matchers by @gkampitakis in #145

Full Changelog: gkampitakis/go-snaps@v0.5.20...v0.5.21

`v0.5.20`

Compare Source

What's Changed

feat: support setting serializer on config by @gkampitakis in #154

Full Changelog: gkampitakis/go-snaps@v0.5.19...v0.5.20

go-git/go-billy (github.com/go-git/go-billy/v5)

`v5.9.1`

Compare Source

What's Changed

build: Update module golang.org/x/net to v0.55.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #216
build: Update module golang.org/x/text to v0.39.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #230
build: Update module golang.org/x/net to v0.56.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #229

Full Changelog: go-git/go-billy@v5.9.0...v5.9.1

go-logr/logr (github.com/go-logr/logr)

`v1.4.4`

Compare Source

What's Changed

drop +build tags by @pohly in #401
CI: avoid floating dependencies, fix issues by @pohly in #432
Bump to Go 1.26 by @thockin in #445
funcr: bound slog.Group nesting depth to prevent stack overflow by @martinholovsky in #447
funcr: Handle and test recursive values by @thockin in #446

New Contributors

@martinholovsky made their first contribution in #447

Full Changelog: go-logr/logr@v1.4.3...v1.4.4

go-openapi/runtime (github.com/go-openapi/runtime)

`v0.32.6`

Compare Source

0.32.6 - 2026-07-21

Full Changelog: go-openapi/runtime@v0.32.5...v0.32.6

4 commits in this release.

Miscellaneous tasks

chore: prepare release v0.32.6 by @bot-go-openapi[bot] in #505 ...
chore: updated dependencies (go-openapi updates) by @fredbi in #504 ...

Updates

build(deps): bump the go-openapi-dependencies group across 3 directories with 1 update by @dependabot[bot] in #503 ...
build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 in the development-dependencies group by @dependabot[bot] in #502 ...

People who contributed to this release

@fredbi

runtime license terms

Per-module changes

client-middleware/opentracing (0.32.6)

Miscellaneous tasks

chore: prepare release v0.32.6 by @bot-go-openapi[bot] in #505 ...
chore: updated dependencies (go-openapi updates) by @fredbi in #504 ...

Updates

build(deps): bump the go-openapi-dependencies group across 3 directories with 1 update by @dependabot[bot] in #503 ...

docs/examples (0.32.6)

Miscellaneous tasks

chore: prepare release v0.32.6 by @bot-go-openapi[bot] in #505 ...

Updates

build(deps): bump the go-openapi-dependencies group across 3 directories with 1 update by @dependabot[bot] in #503 ...

`v0.32.5`

Compare Source

0.32.5 - 2026-07-16

Full Changelog: go-openapi/runtime@v0.32.4...v0.32.5

10 commits in this release.

Documentation

doc: updated contributors file by @bot-go-openapi[bot] in #497 ...
ci: post README announcements to discord + bump ci-workflows to v0.4.0 by @fredbi in #494 ...
doc: updated contributors file by @bot-go-openapi[bot] in #492 ...

Miscellaneous tasks

chore: prepare release v0.32.5 by @bot-go-openapi[bot] in #501 ...
chore(ci): run contributors workflow monthly instead of weekly by @fredbi in #493 ...

Updates

build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 in the golang-org-dependencies group across 1 directory by @dependabot[bot] in #499 ...
build(deps): bump the go-openapi-dependencies group across 3 directories with 7 updates by @dependabot[bot] in #498 ...
build(deps): bump the go-openapi-dependencies group across 4 directories with 2 updates by @dependabot[bot] in #496 ...
build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 in the development-dependencies group by @dependabot[bot] in #495 ...

Other (technical)

middleware: set http.Request.Pattern to the matched route by @delthas in #500 ...

People who contributed to this release

New Contributors

@delthas made their first contribution
in #500

runtime license terms

Per-module changes

client-middleware/opentracing (0.32.5)

Miscellaneous tasks

chore: prepare release v0.32.5 by @bot-go-openapi[bot] in #501 ...

Updates

build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 in the golang-org-dependencies group across 1 directory by @dependabot[bot] in #499 ...
build(deps): bump the go-openapi-dependencies group across 3 directories with 7 updates by @dependabot[bot] in #498 ...
build(deps): bump the go-openapi-dependencies group across 4 directories with 2 updates by @dependabot[bot] in #496 ...

docs/examples (0.32.5)

Updates

build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 in the golang-org-dependencies group across 1 directory by @dependabot[bot] in #499 ...
build(deps): bump the go-openapi-dependencies group across 3 directories with 7 updates by @dependabot[bot] in #498 ...
build(deps): bump the go-openapi-dependencies group across 4 directories with 2 updates by @dependabot[bot] in #496 ...

server-middleware (0.32.5)

Updates

build(deps): bump the go-openapi-dependencies group across 4 directories with 2 updates by @dependabot[bot] in #496 ...

google/go-containerregistry (github.com/google/go-containerregistry)

`v0.21.9`

Compare Source

What's Changed

actions: pin slsa generator by version by @Subserial in #2395
fix: prevent data race on scope refreshes within remote.writer by @Subserial in #2396
fix: remove '.' from unsafe path prefixes by @Subserial in #2400
build(deps): bump the actions group with 3 updates by @dependabot[bot] in #2398

Full Changelog: google/go-containerregistry@v0.21.8...v0.21.9

`v0.21.8`

Compare Source

The artifacts attached to this release are missing SLSA provenance, see #2390.

What's Changed

build(deps): bump the go-deps group across 1 directory with 3 updates by @dependabot[bot] in #2353
build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /cmd/krane by @dependabot[bot] in #2367
build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /pkg/authn/k8schain by @dependabot[bot] in #2368
build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in /pkg/authn/kubernetes by @dependabot[bot] in #2363
build(deps): bump the go-deps group across 3 directories with 7 updates by @dependabot[bot] in #2377
build(deps): bump the actions group across 1 directory with 5 updates by @dependabot[bot] in #2375
Reject unsafe Windows archive paths in Extract by @Haihan-Jiang in #2330
feat(goreleaser): add loong64 build support for crane/gcrane/krane by @xuxiaowei-com-cn in #2358
Document tag and digest reference semantics by @Haihan-Jiang in #2325
remote: release pull limiter slot when body is read to EOF by @knQzx in #2373
tarball: bounds-check layer index in uncompressed LayerByDiffID by @arpitjain099 in #2370
authn: read Podman auth from XDG config by @vigneshakaviki in #2379
transport: per-host bearer token exchange on cross-host redirect by @amitzig in #2360
mutate: bounds-check layer index when building rebase addendums by @arpitjain099 in #2371
fix(daemon): copy ExposedPorts from source config in computeImageConfig by @x64vps in #2356
feat(remote): add WithReferrersTagFallback option by @kevinmdavis in #2366
mutate: apply opaque-directory whiteouts (.wh..wh..opq) in Extract by @sadmanf in #2372
tarball: use correct file extension for zstd/uncompressed by @milas in #2382
build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in the go-deps group across 1 directory by @dependabot[bot] in #2380
actions: update actions to be pinned by hash by @Subserial in #2384
Bump go version to 1.26.5 by @Subserial in #2388

New Contributors

@xuxiaowei-com-cn made their first contribution in #2358
@knQzx made their first contribution in #2373
@arpitjain099 made their first contribution in #2370
@vigneshakaviki made their first contribution in #2379
@amitzig made their first contribution in #2360
@x64vps made their first contribution in #2356
@kevinmdavis made their first contribution in #2366
@sadmanf made their first contribution in #2372

Full Changelog: google/go-containerregistry@v0.21.7...v0.21.8

mattn/go-isatty (github.com/mattn/go-isatty)

otiai10/copy (github.com/otiai10/copy)

`v1.14.1`

Compare Source

package-url/packageurl-go (github.com/package-url/packageurl-go)

`v0.1.6`

Compare Source

What's Changed

Optimize parsing and serialization performance by @andrew in #86

New Contributors

@andrew made their first contribution in #86

Full Changelog: package-url/packageurl-go@v0.1.5...v0.1.6

`v0.1.5`

Compare Source

What's Changed

Remove version requirement for TypeSwift by @Talgarr in #90
Handle non-canonical input purls a bit more gracefully by @petergardfjall in #89

New Contributors

@Talgarr made their first contribution in #90

Full Changelog: package-url/packageurl-go@v0.1.4...v0.1.5

`v0.1.4`

Compare Source

What's Changed

Fix golangci and update versions by @shibumi in #76
Allow npm names to be case sensitive by @PFCM in #73
add custom validation for pkg:cpan by @petergardfjall in #79
move cpan to known types by @nikpivkin in #71
Run tests using reference data from purl-spec by @keshav-space in #80
update code to honor the canonical purl encoding by @petergardfjall in #83

New Contributors

@PFCM made their first contribution in #73
@nikpivkin made their first contribution in #71
@keshav-space made their first contribution in #80

Full Changelog: package-url/packageurl-go@v0.1.3...v0.1.4

sigstore/cosign (github.com/sigstore/cosign/v3)

`v3.0.6`

Compare Source

Changelog

v3.0.6 resolves GHSA-w6c6-c85g-mmv6. This release also adds support for signing with OpenBao-managed keys.

f1ad3ee Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801)
a09afa9 Handle whitespace-only certificate annotation (#4760)
5a38a6d fix(sign): closing SignerVerifier too early when signing with a security key (#4761)
2290a59 Disallow --new-bundle-format and --rfc3161-timestamp (#4762)
36f4008 support managed keys in conformance testing (#4728)
3274cf9 Add support for GCE metadata server env var (#4732)
2e9754a fix: preserve per-layer annotations in WriteAttestationsReferrer (#4709)
dece275 Fix parsing of in-toto for string predicates
bd4f0fd Mark batch of flags for deprecation (#4698)
9b259ff disallow key and cert identity being used together during verification (#4636)
95eb1c3 support key creation in GitLab group (#4704)

Thanks to all contributors!

`v3.0.5`

Compare Source

Deprecations

Deprecate rekor-entry-type flag (#4691)
Deprecate cosign triangulate (#4676)
Deprecate cosign copy (#4681)

Features

Automatically require signed timestamp with Rekor v2 entries (#4666)
Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)
Add mTLS support for TSA client connections when signing with a signing config (#4620)
Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)

Bug Fixes

Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
fix: avoid panic on malformed attestation payload (#4651)
fix: avoid panic on malformed tlog entries (#4649)
fix: avoid panic on malformed replace payload (#4653)
Gracefully fail if bundle payload body is not a string (#4648)
Verify validity of chain rather than just certificate (#4663)
fix: avoid panic on malformed tlog entry body (#4652)

Documentation

docs(cosign): clarify RFC3161 revocation semantics (#4642)
Fix typo in CLI help (#4701)

sigstore/sigstore (github.com/sigstore/sigstore)

`v1.10.9`

Compare Source

What's Changed

Note: #2369 deprecates the TUF client. Use the TUF client from sigstore-go instead: https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf

Deprecate TUF client, ValidatePubKey in #2369
docs: add OVHcloud KMS in available external plugins in #2359
fix(oauthflow): default the device flow poll interval to 5s per RFC 8628 in #2381
Add BrowserOpener field to InteractiveIDTokenGetter in #2383
Fix Azure KMS support for RSA signatures in #2355

Full Changelog: sigstore/sigstore@v1.10.8...v1.10.9

sigstore/sigstore-go (github.com/sigstore/sigstore-go)

`v1.2.2`

Compare Source

What's Changed

Reject certificate identity with no SAN or issuer criteria in #645
Support Verification in sigstore/cosign with X.509 Certificate Chain in #581

Full Changelog: sigstore/sigstore-go@v1.2.1...v1.2.2

tektoncd/chains (github.com/tektoncd/chains)

[`v0.26.9`](https://redirect.github.com/tektoncd/chains/releases/ta

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM (* 0-3 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-02-27T01:15:46Z

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

18 additional dependencies were updated

Details:

Package	Change
`github.com/coreos/go-oidc/v3`	`v3.19.0` -> `v3.20.0`
`github.com/gkampitakis/ciinfo`	`v0.3.2` -> `v0.3.4`
`github.com/go-openapi/swag/conv`	`v0.26.1` -> `v0.27.0`
`github.com/go-openapi/swag/typeutils`	`v0.26.1` -> `v0.27.0`
`github.com/goccy/go-yaml`	`v1.18.0` -> `v1.19.2`
`github.com/maruel/natural`	`v1.1.1` -> `v1.3.0`
`github.com/sigstore/rekor-tiles/v2`	`v2.2.2-0.20260601073857-5d098a2b6443` -> `v2.3.0`
`github.com/theupdateframework/go-tuf/v2`	`v2.4.2-0.20260407074541-7e8f69f906ef` -> `v2.4.2`
`github.com/tidwall/gjson`	`v1.18.0` -> `v1.19.0`
`go.opentelemetry.io/otel/exporters/prometheus`	`v0.65.0` -> `v0.66.0`
`golang.org/x/crypto`	`v0.53.0` -> `v0.54.0`
`golang.org/x/mod`	`v0.36.0` -> `v0.37.0`
`golang.org/x/sys`	`v0.46.0` -> `v0.47.0`
`golang.org/x/term`	`v0.44.0` -> `v0.45.0`
`golang.org/x/text`	`v0.38.0` -> `v0.40.0`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260526163538-3dc84a4a5aaa` -> `v0.0.0-20260727163830-6c54dddc4772`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260610212136-7ab31c22f7ad` -> `v0.0.0-20260720155508-bb71a54f79dc`
`sigs.k8s.io/structured-merge-diff/v6`	`v6.3.2` -> `v6.3.3`

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

34 additional dependencies were updated

Details:

Package	Change
`github.com/go-openapi/strfmt`	`v0.26.4` -> `v0.27.0`
`golang.org/x/net`	`v0.56.0` -> `v0.57.0`
`golang.org/x/text`	`v0.38.0` -> `v0.40.0`
`github.com/coreos/go-oidc/v3`	`v3.19.0` -> `v3.20.0`
`github.com/gkampitakis/ciinfo`	`v0.3.2` -> `v0.3.4`
`github.com/go-openapi/analysis`	`v0.25.2` -> `v0.25.5`
`github.com/go-openapi/jsonpointer`	`v0.23.1` -> `v1.0.0`
`github.com/go-openapi/jsonreference`	`v0.21.6` -> `v1.0.0`
`github.com/go-openapi/loads`	`v0.24.0` -> `v0.25.0`
`github.com/go-openapi/spec`	`v0.22.6` -> `v0.22.9`
`github.com/go-openapi/swag/conv`	`v0.26.1` -> `v0.27.3`
`github.com/go-openapi/swag/fileutils`	`v0.26.1` -> `v0.27.3`
`github.com/go-openapi/swag/jsonutils`	`v0.26.1` -> `v0.27.3`
`github.com/go-openapi/swag/loading`	`v0.26.1` -> `v0.27.3`
`github.com/go-openapi/swag/mangling`	`v0.26.1` -> `v0.27.3`
`github.com/go-openapi/swag/stringutils`	`v0.26.1` -> `v0.27.3`
`github.com/go-openapi/swag/typeutils`	`v0.26.1` -> `v0.27.3`
`github.com/go-openapi/swag/yamlutils`	`v0.26.1` -> `v0.27.3`
`github.com/go-openapi/validate`	`v0.26.0` -> `v0.26.1`
`github.com/goccy/go-yaml`	`v1.18.0` -> `v1.19.2`
`github.com/golang/snappy`	`v0.0.4` -> `v1.0.0`
`github.com/maruel/natural`	`v1.1.1` -> `v1.3.0`
`github.com/sigstore/rekor-tiles/v2`	`v2.0.1` -> `v2.2.1`
`github.com/sigstore/timestamp-authority/v2`	`v2.0.4` -> `v2.0.5`
`github.com/tidwall/gjson`	`v1.18.0` -> `v1.19.0`
`gitlab.com/gitlab-org/api/client-go`	`v1.11.0` -> `v1.46.0`
`golang.org/x/crypto`	`v0.53.0` -> `v0.54.0`
`golang.org/x/mod`	`v0.36.0` -> `v0.37.0`
`golang.org/x/sys`	`v0.46.0` -> `v0.47.0`
`golang.org/x/term`	`v0.44.0` -> `v0.45.0`
`golang.org/x/tools`	`v0.45.0` -> `v0.47.0`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260526163538-3dc84a4a5aaa` -> `v0.0.0-20260727163830-6c54dddc4772`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260610212136-7ab31c22f7ad` -> `v0.0.0-20260720155508-bb71a54f79dc`
`sigs.k8s.io/structured-merge-diff/v6`	`v6.3.2` -> `v6.3.3`

File name: tools/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

43 additional dependencies were updated

Details:

Package	Change
`cloud.google.com/go/kms`	`v1.31.0` -> `v1.33.0`
`cloud.google.com/go/longrunning`	`v1.0.0` -> `v1.2.0`
`github.com/Azure/azure-sdk-for-go/sdk/azcore`	`v1.21.1` -> `v1.22.0`
`github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys`	`v1.4.0` -> `v1.5.0`
`github.com/AzureAD/microsoft-authentication-library-for-go`	`v1.6.0` -> `v1.7.0`
`github.com/aws/aws-sdk-go-v2`	`v1.42.0` -> `v1.43.0`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.17` -> `v1.32.31`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.19.16` -> `v1.19.30`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.23` -> `v1.18.31`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.4.23` -> `v1.4.31`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.23` -> `v2.7.31`
`github.com/aws/aws-sdk-go-v2/internal/v4a`	`v1.4.24` -> `v1.4.32`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.13.9` -> `v1.13.13`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.13.23` -> `v1.13.31`
`github.com/aws/aws-sdk-go-v2/service/kms`	`v1.51.1` -> `v1.54.0`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.0.11` -> `v1.5.0`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.30.17` -> `v1.33.0`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.35.21` -> `v1.38.0`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.42.1` -> `v1.45.0`
`github.com/aws/smithy-go`	`v1.27.1` -> `v1.27.3`
`github.com/coreos/go-oidc/v3`	`v3.19.0` -> `v3.20.0`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.16` -> `v0.3.17`
`github.com/googleapis/gax-go/v2`	`v2.22.0` -> `v2.23.0`
`github.com/hashicorp/vault/api`	`v1.22.0` -> `v1.23.0`
`github.com/in-toto/go-witness`	`v0.9.1` -> `v0.9.2`
`github.com/in-toto/in-toto-golang`	`v0.10.0` -> `v0.11.0`
`github.com/jellydator/ttlcache/v3`	`v3.4.0` -> `v3.4.1`
`github.com/sigstore/cosign/v2`	`v2.6.2` -> `v2.6.4`
`github.com/sigstore/sigstore`	`v1.10.8` -> `v1.10.9`
`github.com/sigstore/sigstore/pkg/signature/kms/aws`	`v1.10.8` -> `v1.10.9`
`github.com/sigstore/sigstore/pkg/signature/kms/azure`	`v1.10.8` -> `v1.10.9`
`github.com/sigstore/sigstore/pkg/signature/kms/gcp`	`v1.10.8` -> `v1.10.9`
`github.com/sigstore/sigstore/pkg/signature/kms/hashivault`	`v1.10.8` -> `v1.10.9`
`github.com/sigstore/timestamp-authority/v2`	`v2.0.3` -> `v2.0.6`
`golang.org/x/crypto`	`v0.53.0` -> `v0.54.0`
`golang.org/x/sys`	`v0.46.0` -> `v0.47.0`
`golang.org/x/term`	`v0.44.0` -> `v0.45.0`
`golang.org/x/text`	`v0.38.0` -> `v0.40.0`
`golang.org/x/tools`	`v0.46.0` -> `v0.47.0`
`google.golang.org/api`	`v0.286.0` -> `v0.287.1`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260526163538-3dc84a4a5aaa` -> `v0.0.0-20260727163830-6c54dddc4772`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260610212136-7ab31c22f7ad` -> `v0.0.0-20260720155508-bb71a54f79dc`
`google.golang.org/grpc`	`v1.82.0` -> `v1.82.1`

fullsend-ai-review · 2026-08-03T19:41:46Z

🤖 Finished Review · ✅ Success · Started 7:41 PM UTC · Completed 7:48 PM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-03T20:40:40Z

🤖 Finished Review · ✅ Success · Started 8:40 PM UTC · Completed 8:47 PM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-04T11:39:43Z

🤖 Review · ⚠️ Cancelled · Started 11:39 AM UTC · Ended 11:46 AM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-04T11:46:27Z

/fs-review

fullsend-ai-review · 2026-08-04T11:47:26Z

🤖 Finished Review · ✅ Success · Started 11:47 AM UTC · Completed 11:54 AM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-04T11:56:19Z

🤖 Finished Review · ✅ Success · Started 11:56 AM UTC · Completed 12:02 PM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-04T12:32:17Z

🤖 Finished Review · ✅ Success · Started 12:32 PM UTC · Completed 12:39 PM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-05T23:50:40Z

🤖 Finished Review · ✅ Success · Started 11:50 PM UTC · Completed 11:57 PM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-07T05:56:43Z

🤖 Finished Review · ✅ Success · Started 5:56 AM UTC · Completed 6:03 AM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-07T06:08:26Z

🤖 Finished Review · ✅ Success · Started 6:08 AM UTC · Completed 6:14 AM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-07T09:18:21Z

🤖 Finished Review · ✅ Success · Started 9:18 AM UTC · Completed 9:27 AM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-07T14:05:20Z

🤖 Finished Review · ✅ Success · Started 2:05 PM UTC · Completed 2:12 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-07T15:50:01Z

🤖 Finished Review · ✅ Success · Started 3:50 PM UTC · Completed 3:57 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-07T17:28:50Z

🤖 Finished Review · ✅ Success · Started 5:28 PM UTC · Completed 5:35 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-07T20:24:20Z

🤖 Finished Review · ✅ Success · Started 8:24 PM UTC · Completed 8:35 PM UTC

Commit: 87c4a29 · View workflow run →

renovate Bot added main renovate labels Feb 27, 2026

renovate Bot enabled auto-merge February 27, 2026 01:15

github-actions Bot added the size: XL label Feb 27, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch 14 times, most recently from 2a265d3 to a650df7 Compare March 6, 2026 00:43

renovate Bot force-pushed the renovate/main-patch-go-modules branch 4 times, most recently from 5fde2e2 to 0d4d965 Compare March 9, 2026 23:05

github-actions Bot added size: XXL and removed size: XL labels Mar 9, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch 5 times, most recently from afe86d8 to 9a0b95c Compare March 15, 2026 01:16

This comment was marked as outdated.

Sign in to view

fullsend-ai-retro Bot mentioned this pull request Aug 4, 2026

Update module github.com/in-toto/in-toto-golang to v0.11.0 [SECURITY] (release-v0.8) #3296

Merged

1 task

This comment was marked as outdated.

Sign in to view

Update go modules

ca607cc

fullsend-ai-review Bot approved these changes Aug 7, 2026

View reviewed changes

Uh oh!

Conversation

renovate Bot commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Language

Evaluator

cmd/cue

Go API

Added

Changed

Fixed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

0.32.6 - 2026-07-21

Miscellaneous tasks

Updates

People who contributed to this release

Per-module changes

client-middleware/opentracing (0.32.6)

Miscellaneous tasks

Updates

docs/examples (0.32.6)

Miscellaneous tasks

Updates

0.32.5 - 2026-07-16

Documentation

Miscellaneous tasks

Updates

Other (technical)

People who contributed to this release

New Contributors

Per-module changes

client-middleware/opentracing (0.32.5)

Miscellaneous tasks

Updates

docs/examples (0.32.5)

Updates

server-middleware (0.32.5)

Updates

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

Changelog

Thanks to all contributors!

Deprecations

Features

Bug Fixes

Documentation

What's Changed

What's Changed

[v0.26.9](https://redirect.github.com/tektoncd/chains/releases/ta

Configuration

Uh oh!

renovate Bot commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: acceptance/go.mod

File name: go.mod

File name: tools/go.mod

Uh oh!

fullsend-ai-review Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

renovate Bot commented Feb 27, 2026 •

edited

Loading

`cmd/cue`

[`v0.26.9`](https://redirect.github.com/tektoncd/chains/releases/ta

renovate Bot commented Feb 27, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 3, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 3, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 4, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 4, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 4, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 4, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 5, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 7, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 7, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 7, 2026 •

edited

Loading