chore(deps): update dev tooling by renovate[bot] · Pull Request #348 · AkashiSN/node-rotation-controller

renovate · 2026-09-10T09:56:37Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
aquaproj/aqua	minor	`v2.62.3` → `v2.65.2`
aquaproj/aqua-registry	minor	`v4.558.1` → `v4.578.0`
aquaproj/aqua-renovate-config	minor	`2.13.0` → `2.14.0`
aws/aws-cli	minor	`2.36.42` → `2.39.0`
golang.org/x/tools/gopls	minor	`v0.23.0` → `v0.24.0`
hashicorp/terraform	minor	`v1.16.2` → `v1.17.0`
helm/helm	patch	`v4.3.0` → `v4.3.1`
kubernetes-sigs/kustomize	patch	`v5.8.1` → `v5.8.3`
mikefarah/yq	minor	`v4.53.6` → `v4.54.1`
prometheus/prometheus	minor	`v3.14.0` → `v3.15.1`

Release Notes

aquaproj/aqua

`v2.65.2`

Compare Source

Bug Fixes

#5494 Fix the failure of installing aqua on Windows

`v2.65.1`

Compare Source

🐛 Bug Fixes

#5486 Fix a bug that it fails to install packslip
#5486 Fix a bug that aqua upa fails for v2.65.0 or later
#5493 Publish SLSA Provenance again

Others

#5490 Update aqua-proxy to v1.2.14

`v2.65.0`

Compare Source

[!WARNING]
aqua v2.17.0 - v2.65.0 can't install this version by aqua update-aqua v2.65.0, because this release doesn't have the SLSA Provenance (multiple.intoto.jsonl) which they require.
Please use v2.65.1 or later instead.
aqua-installer v4.1.0 or older also fails to install aqua_version: v2.65.0. aqua-installer v4.1.1 or later can install it.

⚠️ Security

#5485 Update Go to v1.27.3

This release is built with Go 1.27.3, which fixes CVE-2026-111943 in crypto/x509. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. Verify filters out chains containing those intermediates. The Go team highly recommends upgrading immediately.

aqua relies on crypto/x509 to verify the TLS certificates of the servers it downloads registries, packages, checksums, and signatures from. We recommend upgrading.

ref.

This release also includes Go 1.27.2 (#5407), which has security fixes to the go command and the crypto/tls, html/template, net/http, net/textproto, and os packages.

https://go.dev/doc/devel/release#go1.27.2

Features

Install packages from the releases of Forgejo, Gitea, and GitLab

#5387 forgejo_release
#5391 gitea_release
#5399 gitlab_release

Until now, a package hosted on Codeberg, gitea.com, or gitlab.com had to be an http package with a URL template, often with version_constraint: "false". Nothing could list its versions, so aqua g and aqua up couldn't update it.

These package types have the same fields as github_release, plus host:

packages:
  - type: forgejo_release
    host: codeberg.org
    repo_owner: mergiraf
    repo_name: mergiraf
    asset: mergiraf_{{.Arch}}-{{.OS}}.{{.Format}}
    format: tar.gz
    replacements:
      darwin: apple-darwin
      linux: unknown-linux-gnu
      amd64: x86_64
      arm64: aarch64

aqua gr supports them too, e.g. aqua gr gitlab.com/gitlab-org/cli.

#5403 Verify packages with packslip

aqua can now verify packages with packslip, like it already does with cosign, slsa-verifier, minisign, and GitHub Artifact Attestations.
aqua downloads the signed release bundle packslip.sigstore.json from the package's release and runs packslip verify <bundle> --artifact <asset> before unarchiving the asset.

packslip:
  enabled: true # optional, default true
  url: ...             # optional, where the bundle is
  pubkey: ...          # --pubkey
  identity: ...        # --identity
  identity_prefix: ... # --identity-prefix
  issuer: ...          # --issuer
  pin: ...             # --pin
  allow_unlogged: true # --allow-unlogged

#5414 Pass more of the signing certificate to `gh attestation verify`

github_artifact_attestations gains six optional fields:

Field	Flag
`repository`	`--repo`, defaulting to the package's repository as before
`signer_repo`	`--signer-repo`
`cert_oidc_issuer`	`--cert-oidc-issuer`
`deny_self_hosted_runners`	`--deny-self-hosted-runners`
`source_ref`	`--source-ref`
`source_digest`	`--source-digest`

#5425 aqua gr: Infer a libc variant for a musl build beside the Linux one

Bug Fixes

#5362 #5367 Windows: Fix the infinite loop of a shim started with an upper-case extension such as nu.EXE

Tools that build a command name from PATHEXT, such as Python's shutil.which and just, start a shim as nu.EXE. aqua didn't find the package and ran the shim itself again until it failed. Command names are now matched case-insensitively on all OSes, preferring an exact match, and on Windows aqua skips its bin directory in PATH case-insensitively.

#5363 #5375 Windows: Fix the infinite loop of batch files such as npx and npm of nodejs/node

cmd.exe runs the first token of the command line rather than the executable path, so npx.cmd and npm.cmd started the shim again until it ran out of memory. aqua now runs a batch file (.bat / .cmd) by its absolute path.

#5406 Close the temporary file of a downloaded asset

On Windows, the leaked handle could keep the temporary file from being removed.

#5423 aqua gr: Cancel a promoted replacement for an OS that doesn't use it
#5436 aqua gr: Don't take an SBOM for the package's asset
#5444 aqua gr: Exclude 32-bit ARM assets by name

Others

#5368 Remove -ldflags
#5461 ci: Enable split_build of go-release-workflow
#5431 ci: Use go-autofix-action's reusable workflow
#5439 ci: Replace go-test-full-workflow with go-test-workflow and test-workflow

Dependency updates

#5407 #5485 Update Go to v1.27.3
#5477 Update github.com/google/go-github to v93
#5386 Update golang.org/x/sync to v0.24.0
#5396 Update golang.org/x/sys to v0.49.0

`v2.64.0`

Compare Source

Features

#5364 Support installing only specified packages by command or package names

aqua install now accepts command names or package names as positional arguments. Only packages matching them are installed.

aqua i gh                                 # by command name
aqua i cli/cli                            # by package name
aqua i gh suzuki-shunsuke/tfcmt           # multiple names

If any of the given names isn't found in the configuration files, the command fails:

ERR aqua failed not_found="[bar foo]" error="packages or commands aren't found in configuration files"

#5279 Add a settings file

${XDG_CONFIG_HOME:-$HOME/.config}/aquaproj-aqua/config.yaml

checksum:
  enabled: true
  require: true
  enforce: true
  enforce_require: true
lazy_install: true
policy:
  enabled: true
  config: /home/foo/policy.yaml
tracking: true
progress_bar: false
log:
  level: info
  color: auto
max_parallelism: 5
global_config: /home/foo/aqua-global.yaml
root_dir: /home/foo/.local/share/aquaproj-aqua
keyring: false

config.yaml	environment variable
`checksum.enabled`	`AQUA_CHECKSUM`
`checksum.require`	`AQUA_REQUIRE_CHECKSUM`
`checksum.enforce`	`AQUA_ENFORCE_CHECKSUM`
`checksum.enforce_require`	`AQUA_ENFORCE_REQUIRE_CHECKSUM`
`lazy_install`	`AQUA_DISABLE_LAZY_INSTALL` (inverted)
`policy.enabled`	`AQUA_DISABLE_POLICY` (inverted)
`policy.config`	`AQUA_POLICY_CONFIG`
`tracking`	`AQUA_DISABLE_TRACKING` (inverted)
`progress_bar`	`AQUA_PROGRESS_BAR`
`log.level`	`AQUA_LOG_LEVEL`
`log.color`	`AQUA_LOG_COLOR`
`max_parallelism`	`AQUA_MAX_PARALLELISM`
`global_config`	`AQUA_GLOBAL_CONFIG`
`root_dir`	`AQUA_ROOT_DIR`
`keyring`	`AQUA_KEYRING_ENABLED`

Precedence: Environment variable > settings file > default

Performance Improvement

#5283 Detect glibc by its loader instead of by running ldd

Bug Fixes

#5284 gr: Don't take a build for particular hardware as the ordinary one
#5285 gr: shorter isn't the point, the same name with less on it is
#5287 Say what cosign said, and wait long enough for it to matter
#5310 gr: Don't claim a provenance that is another artifact's

`v2.63.0`

Compare Source

Security

Fix a path traversal vulnerability GHSA-286g-rf2x-cv99.
When a package archive contained a GNU sparse file, aqua re-extracted the whole archive with the host tar, applying none of its own path or symlink containment. On hosts whose tar follows symlinks during extraction (e.g. BusyBox tar), a crafted archive could plant a symlink escaping the install directory and write a regular file through it. aqua now keeps the system tar out of the install directory: it validates the sparse member names, extracts them into a staging directory, and moves each to its verified destination itself.

Features

#5117 Create timestamp files as group writable and document read only $AQUA_ROOT_DIR
#5115 Support AQUA_DISABLE_TRACKING to disable the tracking of last used date times

Fixes

#5237 Skip minisign verification if the host platform doesn't support minisign
#5188 Ignore incomplete release assets in aqua gr
#5178 Support files[].src in go_install packages
#5171 Extract 7z archives that use the ARM64 filter
#5161 signer_workflow is a literal path, not a regex

Others

#5239 Fix Dockerfile build failure caused by a stale apt package index

aquaproj/aqua-registry

`v4.578.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.577.0...v4.578.0

🎉 New Packages

#63306 glsec/glsec - Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings @predictor2718

Fixes

#63297 cloudposse/atmos: Update signing identity from v1.233.2 @osterman
#63332 suzuki-shunsuke/cmdx: Fix cosign config from v2.0.3

`v4.577.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.576.0...v4.577.0

🎉 New Packages

#63191 yashikota/tlc-static - Native, JVM-free TLA+ TLC. Fully static on Linux @yashikota

Fixes

#63287 jdx/mise: Support Windows @mkanat

`v4.576.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.575.0...v4.576.0

🎉 New Packages

#63088 Future-Element/pinset - A predictable, local-first runtime version manager for multilingual projects @MorleyZhou
#62981 faberlang/releases/faber - Faber (Faber Romanus), an experimental programming language designed to be written by language models and read by people @ianzepp
#62818 bronto-community/bronto-cli - A community command-line client for the Bronto observability platform @svrnm
#62817 pratyay360/ensor - A fast, interactive CLI for finding and redacting secrets in your codebase @Pratyay360
#62699 muvon/octomind - Open-source AI coding agent and agent runtime: one binary, any model, MCP-native @donk8r
#62511 tailscale/tailcat - like netcat, but over Tailscale's data plane, without Tailscale's control plane

Removed Packages

#62544 Arata1202/ascdir @Arata1202

Security

#62903 grafana/gcx: cosign config @scop
#62902 grafana/mcp-grafana: cosign config @scop
#62576 max-sixty/worktrunk: cosign config @scop

Fixes

#61992 magefile/mage: Use arm64 binary on Apple Silicon macOS @dsychin
#62901 duckdb/duckdb: Support v2.0.0 CLI assets @mushanyoung
#62681 anomalyco/opencode: Support v2 releases distributed via opencode.ai @hayatosc
#62548 oxc-project/oxc/oxfmt: Support the version prefix oxfmt_v
#62546 oxc-project/oxc/oxlint: Follow the version prefix change from v1.85.0 @scop

`v4.575.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.574.1...v4.575.0

🎉 New Packages

#62403 Alice39s/xmtr - Concurrent traceroute built on trippy that publishes routes @Alice39s
#62374 takumin/qemu-bin: Prebuilt binaries of qemu built with zig cc @takumin
#62373 bufbuild/protoschema-plugins/protoc-gen-jsonschema - Protobuf plugin that generate JSON Schema from protobuf files @anuragkumar19

Fixes

#62436 Rename leoafarias/fvm to btwld/fvm
#62470 Re-scaffold k1LoW/tbls
#62372 connectrpc/connect-go/protoc-gen-connect-go: Support v2 @anuragkumar19
#62360 bootandy/dust: Stop forcing rosetta2 on versions with arm64 macOS assets @noahbaculi

`v4.574.1`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.574.0...v4.574.1

Fixes

#62343 sharkdp/hyperfine: Stop forcing rosetta2 on versions with arm64 macOS assets @noahbaculi

`v4.574.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.573.1...v4.574.0

🎉 New Packages

#62242 runxhq/runx - Governed runtime for agent skill workflows @auscaster
#62270 takumin/passt-bin: Prebuilt binaries of passt built with zig cc @takumin

`v4.573.1`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.573.0...v4.573.1

Fixes

#62157 charmbracelet/crush: Use the release workflow identity for cosign from v0.98.0 @jdx
#62053 pvolok/dekit: support v0.10.0 renamed assets and binary @jdx

Security

#62068 charmbracelet/skate: cosign config @scop

`v4.573.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.572.0...v4.573.0

🎉 New Packages

#62034 jdx/jactionlint: Static checker for GitHub Actions workflow files
#61966 tontinton/maki: An efficient AI coding agent extendable by neovim-like Lua plugins @FalkWoldmann

Security

#62025 eksctl-io/eksctl: Cosign config @scop
#62017 regclient/regclient/regsync: Cosign config @scop

`v4.572.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.571.0...v4.572.0

🎉 New Packages

#61965 editorconfig/editorconfig-core-go - EditorConfig Core written in Go @the9ball

Fixes

#61950 anchore/syft: Add support for newer anchore/syft releases using cosign bundles @Hsn723

`v4.571.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.570.0...v4.571.0

🎉 New Packages

#61780 goccy/tobari - Tobari is a scoped coverage measurement tool for Go @yashikota
#61778 ymmt2005/pbschema-lens - HTML site generator for protobuf schema @ymmt2005
#61734 agentgateway/agentgateway/agentgateway: Next Generation Agentic Proxy for AI Agents and MCP servers
#61750 agentgateway/agentgateway/agctl: Next Generation Agentic Proxy for AI Agents and MCP servers

Fixes

#61853 ducaale/xh: Add the command xhs

Security

#61852 regclient/regclient/regctl: Cosign config @scop
#61851 openai/tunnel-client: Cosign config @scop
#61850 cloudposse/atmos: Cosign config @scop
#61849 git-bug/git-bug: Checksum and cosign config @scop

`v4.570.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.569.0...v4.570.0

🎉 New Packages

#61633 kunchenguid/no-mistakes - git push no-mistakes @leonaascimento

Fixes

#61689 Stop verifying slsa provenance on new releases of suzuki-shunsuke's tools

`v4.569.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.568.0...v4.569.0

🎉 New Packages

#61584 mdsakalu/zmx-session-manager: TUI session manager for zmx
#61548 trinodb/trino/trino-cli - Trino, the distributed SQL query engine for big data - Command Line Interface @leonaascimento
#61537 jdx/packslip: A signed release manifest for vendor binaries

`v4.568.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.567.0...v4.568.0

🎉 New Packages

#61505 XTLS/Xray-core: Xray, Penetrates Everything. Also the best v2ray-core
#61496 domcyrus/rustnet: Per-process network monitoring for your terminal with deep packet inspection. Cross-platform, sandboxed
#61495 MitMaro/git-interactive-rebase-tool: Native cross-platform full feature terminal-based sequence editor for git interactive rebase
#61494 lance0/ttl: Fast, modern traceroute with real-time TUI, per-hop stats, ASN/geo lookup, ECMP detection, and MPLS label parsing. A better mtr
#61468 awslabs/aidlc-workflows: AI-Driven Life Cycle (AI-DLC) adaptive workflow steering rules for AI coding agents @leonaascimento
#61398 kunchenguid/treehouse: Manage worktrees without managing worktrees @leonaascimento
#61397 SUPERCILEX/ftzz: File Tree Fuzzer creates a pseudo-random directory hierarchy filled with some number of files @nickajacks1
#61396 atomicdotdev/atomic: A Semantic Change Graph (SCG) to track memory, intent, provenance, and change as a single unit of work @geekgonecrazy

Fixes

#61385 lexfrei/claudeline: Rename the package to lexfrei/ailine @lexfrei

The GitHub Repository of the package "lexfrei/claudeline" was renamed from lexfrei/claudeline to lexfrei/ailine

#61378 openai/codex: Say which assets are the command

`v4.567.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.566.0...v4.567.0

🎉 New Packages

#61157 UsefulSoftwareCo/executor: Connect AI agents to OpenAPI, MCP, and GraphQL services @casparbreloh

Security

#61326 utkuozdemir/pv-migrate: Configure Cosign @scop
#61287 open-policy-agent/conftest: Configure GitHub Artifact Attestations @yumafuu

Pin the source repository and tag in the cosign verification

Fixes

#61277 mgechev/revive: Rename the package to revive-lint/revive

The GitHub Repository of the package "mgechev/revive" was transferred from mgechev/revive to revive-lint/revive

#61273 TomWright/dasel: Use the native darwin/arm64 assets from v1.26.1 @cj81499
#61302 YS-L/csvlens: Support linux/arm64

`v4.566.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.565.0...v4.566.0

🎉 New Packages

#61061 aquaproj/ar2: CLI for aqua registry g2

Fixes

#61055 XcodesOrg/xcodes: Remove a version_override that is never read
#61017 nodejs/node: Don't offer the arm64 musl build where it doesn't exist
#60962 Wilfred/difftastic: support difftastic v0.71.0 or later

Refactoring

#61018 aubepkg/aube: Exclude the shared libraries from the inference

`v4.565.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.564.0...v4.565.0

🎉 New Packages

#60801 robgonnella/releasaurus - A comprehensive release automation tool that streamlines the software release process across multiple programming languages and forge platforms @robgonnella
#60983 nubjs/nub - The fast all-in-one Node.js toolkit

`v4.564.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.563.0...v4.564.0

🎉 New Packages

#60759 floci-io/floci-cli - Official command-line interface for Floci @yuriy-yarosh
#60762 robgonnella/minienv - Effortless remote mini environments generated directly from docker compose config @robgonnella

Security

#60761 regclient/regclient/regbot: cosign config @scop

`v4.563.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.562.0...v4.563.0

🎉 New Packages

#60699 grafana/agento11y - Actually Useful Agent Observability @zeitlinger
#60681 boyter/cs - Code search tool with CLI, TUI, MCP and HTTP support that requires no indexing @Crocmagnon

Fixes

#60720 ImageMagick/ImageMagick: Support windows/arm64 @Marukome0743
#60655 Byron/dua-cli: Install native arm64 assets on macOS and Windows @sassdavid

Security

#60698 dprint/dprint: GitHub artifact attestations config @scop

`v4.562.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.561.0...v4.562.0

🎉 New Packages

#60610 microsoft/tgrep - Trigram-indexed grep with a client/server architecture for fast regex search in large codebases locally @sh1Nome

`v4.561.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.560.0...v4.561.0

🎉 New Packages

#60566 kjanat/actionlint - Find problems in your GitHub Actions workflows @kjanat
#60568 redhat-et/ripwire - A zero-dependency CLI and MCP server for finding context in codebases @s0undt3ch

Fixes

#60555 yadm-dev/yadm: Resolve versions from GitHub tags @Susensio
#60567 minio/mc: Download assets from GitHub Releases as dl.min.io returns 410 @jdx

`v4.560.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.559.0...v4.560.0

🎉 New Packages

#60499 getgaal/gaal - A single CLI to keep your local repositories, AI agent skills, and MCP server configurations in sync @Crocmagnon
#60412 openai/tunnel-client - Customer-run client for Secure MCP Tunnel: connect private or localhost MCP servers to ChatGPT, Codex, the Responses API, and AgentKit without exposing them to the public internet @the9ball
#60401 yarnpkg/zpm - Safe, stable, reproducible projects (Yarn v6) @joealden

`v4.559.0`

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.558.0...v4.559.0

🎉 New Packages

#60259 yadm-dev/yadm - Yet Another Dotfiles Manager @Susensio
#60216 nklmilojevic/sofka - A Kubernetes TUI, reimagined in Rust - built on kube-rs and ratatui, async-first from the ground up @tomvoet
#60119 unikraft-cloud/cli - Command-line interface for Unikraft Cloud @garysassano
#60118 unikraft/kraftkit - Build and use highly customized and ultra-lightweight unikernel VMs @garysassano
#60117 esengine/DeepSeek-Reasonix - DeepSeek-native AI coding agent for the terminal @garysassano

Renamed Packages

#59966 Rename rancher/rke to rancher-archives/rke
#60258 Rename jdx/aube to aubepkg/aube, and follow the signer workflow change @jdx
#60374 Rename jamf/Notifier to Jamf-Concepts/Notifier

Security

#59984 charmbracelet/gum: cosign config @scop
#60039 gopasspw/gopass: cosign config @scop
#60046 masasuzu/clrnd: cosign config @scop

Fixes

#60003 sharkdp/fd: macOS Intel is supported again from v10.5.0
#60104 pnpm/pnpm: macOS Intel is supported from v12.0.0 @arianrhodsandlot
#60131 editorconfig-checker/editorconfig-checker: Follow the binary rename and the universal macOS build in 4.0.0 @sarahhodne
#60283 Byron/dua-cli: Exclude dua-core tags from versions @jdx

aquaproj/aqua-renovate-config

`v2.14.0`

Compare Source

Features

#1326 installer-script: Support aqua-installer URLs pinned by a commit SHA

The installer-script preset now updates aqua-installer URLs pinned by a commit SHA with the version as a comment.
The comment can start with # or //.

curl -sSfL -O https://raw.githubusercontent.com/aquaproj/aqua-installer/611554c6f0137ba41c8dd15aca8bee82504ea461/aqua-installer # v4.1.1

const url = "https://raw.githubusercontent.com/aquaproj/aqua-installer/611554c6f0137ba41c8dd15aca8bee82504ea461/aqua-installer"; // v4.1.1

Renovate updates both the commit SHA and the version.
The content at a commit is immutable, so you no longer need to verify the downloaded script with a hard-coded checksum, which Renovate couldn't update.

Bug Fixes

#1241 Detect github-tags packages in the file and base presets @MxShun

Packages updated by the github-tags datasource, such as anthropics/claude-code, aws/aws-cli, catenacyber/perfsprint, golang/vuln/govulncheck, golang/tools, and twistedpair/google-cloud-sdk, weren't updated with the file and base presets.

Others

#1327 Test presets by Renovate's dry-run
#1329 ci: Use suzuki-shunsuke/test-workflow
#1308 ci: Update GitHub Actions runner to ubuntu-26.04
#1307 ci: Replace renovate-config-validator-workflow with github-action-renovate-config-validator

aws/aws-cli

`v2.39.0`

Compare Source

======

feature:cloudfront: Add aws cloudfront sign-cookies command to generate CloudFront signed cookies.
api-change:license-manager: AWS License Manager now supports delegate grants for read-only visibility into license distributions. CreateGrant accepts a new GrantType (BuyerGrant or DelegateGrant) and a desired status at distribution time.
api-change:inspector2: Adding support for Machine Image scan
api-change:ec2: EC2 AMIs can now show vulnerability data and be targeted directly for scanning.
api-change:lightsail: Added the attributeUpdates parameter to the Lightsail StartInstance API, which allows customers to update the attributes of a stopped instance when starting it.
enhancement:cloudfront: aws cloudfront sign now supports ECDSA (P-256) private keys, SHA-256 signing with --hash-algorithm, and wildcard policies with --policy-resource, and rejects input that would produce a URL CloudFront rejects.
api-change:bedrock-agentcore-control: Adds the ResetTokenVaultKeyMaterial API, which restores a token vault whose customer managed key was deleted by moving it to an AWS owned key. The reset permanently deletes the stored OAuth 2.0 tokens, users must consent again. Adds on-behalf-of token exchange client authentication override option.
enhancement:login: Record the sign-in region in the cached login token and send refresh requests to that region, so a refresh is redeemed in the region the session was created in.
enhancement:logging: Redact PEM private keys from --debug output and the CLI history database when passed as a single argument value or as a fileb:// blob parameter.
bugfix:cloudfront: Fix aws cloudfront sign to support fileb:// private keys and PEM files that contain other blocks, such as a certificate.
api-change:ecs: ECS now supports GPU sharing via NVIDIA Multi-Process Service (MPS) on ECS Managed Instances and ECS EC2, allowing multiple ECS tasks to share a single Nvidia GPU for improved utilization.

`v2.38.6`

Compare Source

======

api-change:

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions Bot added the chore Build, CI, deps, or tooling (Conventional Commit: chore) label Sep 10, 2026

renovate Bot force-pushed the renovate/dev-tooling branch from 8115af1 to e5d7479 Compare September 10, 2026 20:27

renovate Bot changed the title ~~chore(deps): update dependency aquaproj/aqua-registry to v4.559.0~~ chore(deps): update dev tooling Sep 10, 2026

renovate Bot force-pushed the renovate/dev-tooling branch 12 times, most recently from 9917143 to c574637 Compare September 17, 2026 22:15

renovate Bot force-pushed the renovate/dev-tooling branch 8 times, most recently from f57a35d to 92bce56 Compare September 25, 2026 20:08

renovate Bot force-pushed the renovate/dev-tooling branch 7 times, most recently from bac99be to 15bb5ac Compare October 1, 2026 21:00

renovate Bot force-pushed the renovate/dev-tooling branch 10 times, most recently from 2bbb361 to 0738b11 Compare October 9, 2026 19:42

renovate Bot force-pushed the renovate/dev-tooling branch 8 times, most recently from 1ee4743 to d0963d1 Compare October 15, 2026 15:53

renovate Bot force-pushed the renovate/dev-tooling branch 10 times, most recently from cc01d6e to d50cd3e Compare October 27, 2026 00:47

chore(deps): update dev tooling

245929f

renovate Bot force-pushed the renovate/dev-tooling branch from d50cd3e to 245929f Compare October 27, 2026 20:24

Navigation Menu

Repository navigation

chore(deps): update dev tooling - #348

chore(deps): update dev tooling#348
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/dev-tooling

renovate Bot commented Sep 10, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Bug Fixes

🐛 Bug Fixes

Others

⚠️ Security

Features

Install packages from the releases of Forgejo, Gitea, and GitLab

#​5403 Verify packages with packslip

#​5414 Pass more of the signing certificate to gh attestation verify

#​5425 aqua gr: Infer a libc variant for a musl build beside the Linux one

Bug Fixes

Others

Dependency updates

Features

Performance Improvement

Bug Fixes

Security

Features

Fixes

Others

🎉 New Packages

Fixes

🎉 New Packages

Fixes

🎉 New Packages

Removed Packages

Security

Fixes

🎉 New Packages

Fixes

Fixes

🎉 New Packages

Fixes

Security

🎉 New Packages

Security

🎉 New Packages

Fixes

🎉 New Packages

Fixes

Security

🎉 New Packages

Fixes

🎉 New Packages

🎉 New Packages

Fixes

🎉 New Packages

Security

Fixes

🎉 New Packages

Fixes

Refactoring

🎉 New Packages

🎉 New Packages

Security

🎉 New Packages

Fixes

Security

🎉 New Packages

🎉 New Packages

Fixes

🎉 New Packages

🎉 New Packages

Renamed Packages

Security

Fixes

Features

Bug Fixes

Others

Configuration

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

renovate Bot commented Sep 10, 2026 •

edited

Loading

#5403 Verify packages with packslip

#5414 Pass more of the signing certificate to `gh attestation verify`

#5425 aqua gr: Infer a libc variant for a musl build beside the Linux one