chore(deps): update dev tooling

.github/renovate.json

@@ -2,7 +2,7 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "config:recommended",
-    "github>aquaproj/aqua-renovate-config#2.13.0"
+    "github>aquaproj/aqua-renovate-config#2.14.0"
   ],
   "postUpdateOptions": [
     "gomodTidy"

.github/workflows/ci.yaml

@@ -71,7 +71,7 @@ jobs:
       - uses: aquaproj/aqua-installer@v4.0.5
         if: needs.changes.outputs.go == 'true' || needs.changes.outputs.infra == 'true'
         with:
-          aqua_version: v2.62.3
+          aqua_version: v2.66.0
           # Trust the committed aqua-policy.yaml so the local registry providing
           # controller-gen (aqua/registry.yaml) is allowed without interactive prompts.
           policy_allow: "true"
@@ -108,7 +108,7 @@ jobs:
       - uses: aquaproj/aqua-installer@v4.0.5
         if: needs.changes.outputs.go == 'true' || needs.changes.outputs.infra == 'true'
         with:
-          aqua_version: v2.62.3
+          aqua_version: v2.66.0
           # Trust the committed aqua-policy.yaml so the local registry providing
           # controller-gen (aqua/registry.yaml) is allowed without interactive prompts.
           policy_allow: "true"
@@ -133,7 +133,7 @@ jobs:
       - uses: aquaproj/aqua-installer@v4.0.5
         if: needs.changes.outputs.go == 'true' || needs.changes.outputs.docker == 'true' || needs.changes.outputs.infra == 'true'
         with:
-          aqua_version: v2.62.3
+          aqua_version: v2.66.0
           # Trust the committed aqua-policy.yaml so the local registry providing
           # controller-gen (aqua/registry.yaml) is allowed without interactive prompts.
           policy_allow: "true"
@@ -180,7 +180,7 @@ jobs:
       - uses: aquaproj/aqua-installer@v4.0.5
         if: needs.changes.outputs.docs == 'true'
         with:
-          aqua_version: v2.62.3
+          aqua_version: v2.66.0
           policy_allow: "true"
       - name: Cache Go + aqua tools
         if: needs.changes.outputs.docs == 'true'
@@ -215,7 +215,7 @@ jobs:
       - uses: aquaproj/aqua-installer@v4.0.5
         if: needs.changes.outputs.chart == 'true' || needs.changes.outputs.infra == 'true'
         with:
-          aqua_version: v2.62.3
+          aqua_version: v2.66.0
           # Trust the committed aqua-policy.yaml so the local registry providing
           # controller-gen (aqua/registry.yaml) is allowed without interactive prompts.
           policy_allow: "true"

.github/workflows/e2e.yaml

@@ -81,7 +81,7 @@ jobs:
       - uses: aquaproj/aqua-installer@v4.0.5
         if: steps.changes.outputs.run == 'true'
         with:
-          aqua_version: v2.62.3
+          aqua_version: v2.66.0
           # Trust the committed aqua-policy.yaml so the local registry providing
           # controller-gen (aqua/registry.yaml) is allowed without interactive prompts.
           policy_allow: "true"

.github/workflows/pages.yaml

@@ -39,7 +39,7 @@ jobs:
           fetch-depth: 0
       - uses: aquaproj/aqua-installer@v4.0.5
         with:
-          aqua_version: v2.62.3
+          aqua_version: v2.66.0
           policy_allow: "true"
       - name: Cache Go + aqua tools
         uses: actions/cache@v6

.github/workflows/release.yaml

@@ -134,7 +134,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: aquaproj/aqua-installer@v4.0.5
         with:
-          aqua_version: v2.62.3
+          aqua_version: v2.66.0
           policy_allow: "true"
       - name: Package chart
         run: helm package "${CHART_DIR}" --destination dist

aqua.yaml

@@ -15,7 +15,7 @@
 # checksum lock is later enabled) — never reintroduce a free-floating install.
 registries:
   - type: standard
-    ref: v4.558.1 # renovate: depName=aquaproj/aqua-registry
+    ref: v4.581.1 # renovate: depName=aquaproj/aqua-registry
   # Local registry for tools the standard registry does not carry (controller-gen).
   # Trusted via aqua-policy.yaml (allowed by the Makefile aqua-tools target).
   - name: local
@@ -35,7 +35,7 @@ packages:
   - name: kubernetes-sigs/controller-runtime/setup-envtest@v0.25.0
   # gopls is a go_install package: aqua builds it from source with the pinned
   # Go toolchain above.
-  - name: golang.org/x/tools/gopls@v0.23.0
+  - name: golang.org/x/tools/gopls@v0.24.0
   - name: golangci/golangci-lint@v2.13.2
   # controller-gen generates the RotationPolicy CRD manifests and zz_generated
   # deepcopy from the api/ kubebuilder markers (`make manifests` / `make generate`,
@@ -49,11 +49,11 @@ packages:
   - name: ko-build/ko@v0.19.1
   # kustomize releases carry a `kustomize/` tag prefix; pin the full tag (aqua
   # only auto-applies version_prefix when resolving "latest", not an exact pin).
-  - name: kubernetes-sigs/kustomize@kustomize/v5.8.1
+  - name: kubernetes-sigs/kustomize@kustomize/v5.8.3
   # helm is pinned to the v4 line — the version CI already used de-facto
   # (azure/setup-helm installed latest). The chart, values.schema.json, and the
   # helm-unittest v1.1.1 plugin all render/pass under it.
-  - name: helm/helm@v4.3.0
+  - name: helm/helm@v4.3.1
   # kubectl tracks the controller's Kubernetes client minor (k8s.io/api v0.37 ->
   # 1.37), matching the kind node's Kubernetes minor (v1.37) — within skew policy.
   - name: kubernetes/kubernetes/kubectl@v1.37.0
@@ -62,10 +62,10 @@ packages:
   # parses the PromQL the chart's PrometheusRule ships; helm-unittest asserts the
   # rendered YAML's content, never the expressions. yq lifts the manifest's
   # `.spec` out, which is exactly promtool's rule-file schema.
-  - name: prometheus/prometheus@v3.14.0
-  - name: mikefarah/yq@v4.53.6
+  - name: prometheus/prometheus@v3.15.1
+  - name: mikefarah/yq@v4.54.1
   # --- Ephemeral EKS Auto Mode PoC tooling (test/e2e/eks-automode, issue #93) ---
-  - name: hashicorp/terraform@v1.16.2
+  - name: hashicorp/terraform@v1.17.1
   # awscli authenticates to AWS, logs Docker in to ECR, and writes the cluster
   # kubeconfig for the PoC (issue #106). v2 line.
-  - name: aws/aws-cli@2.36.42
+  - name: aws/aws-cli@2.39.3