[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aqua	uses-with	minor	v2.62.3 → v2.65.2
aquaproj/aqua-installer	action	minor	v4.0.5 → v4.1.1

---

Release Notes

aquaproj/aqua (aqua)

v2.65.2

Compare Source

Bug Fixes

#​5494 Fix the failure of installing aqua on Windows

v2.65.1

Compare Source

🐛 Bug Fixes

#​5486 Fix a bug that it fails to install packslip
#​5486 Fix a bug that aqua upa fails for v2.65.0 or later
#​5493 Publish SLSA Provenance again

Others

#​5490 Update aqua-proxy to v1.2.14

v2.65.0

Compare Source

[!WARNING]
aqua v2.17.0 - v2.65.0 can't install this version by aqua update-aqua v2.65.0, because this release doesn't have the SLSA Provenance (multiple.intoto.jsonl) which they require.
Please use v2.65.1 or later instead.
aqua-installer v4.1.0 or older also fails to install aqua_version: v2.65.0. aqua-installer v4.1.1 or later can install it.

⚠️ Security

#​5485 Update Go to v1.27.3

This release is built with Go 1.27.3, which fixes CVE-2026-111943 in crypto/x509. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. Verify filters out chains containing those intermediates. The Go team highly recommends upgrading immediately.

aqua relies on crypto/x509 to verify the TLS certificates of the servers it downloads registries, packages, checksums, and signatures from. We recommend upgrading.

ref.

• https://go.dev/doc/devel/release#go1.27.3
• https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html

This release also includes Go 1.27.2 (#​5407), which has security fixes to the go command and the crypto/tls, html/template, net/http, net/textproto, and os packages.

• https://go.dev/doc/devel/release#go1.27.2

Features

Install packages from the releases of Forgejo, Gitea, and GitLab

#​5387 forgejo_release
#​5391 gitea_release
#​5399 gitlab_release

Until now, a package hosted on Codeberg, gitea.com, or gitlab.com had to be an http package with a URL template, often with version_constraint: "false". Nothing could list its versions, so aqua g and aqua up couldn't update it.

These package types have the same fields as github_release, plus host:

packages:
  - type: forgejo_release
    host: codeberg.org
    repo_owner: mergiraf
    repo_name: mergiraf
    asset: mergiraf_{{.Arch}}-{{.OS}}.{{.Format}}
    format: tar.gz
    replacements:
      darwin: apple-darwin
      linux: unknown-linux-gnu
      amd64: x86_64
      arm64: aarch64

aqua gr supports them too, e.g. aqua gr gitlab.com/gitlab-org/cli.

#​5403 Verify packages with packslip

aqua can now verify packages with packslip, like it already does with cosign, slsa-verifier, minisign, and GitHub Artifact Attestations.
aqua downloads the signed release bundle packslip.sigstore.json from the package's release and runs packslip verify <bundle> --artifact <asset> before unarchiving the asset.

packslip:
  enabled: true # optional, default true
  url: ...             # optional, where the bundle is
  pubkey: ...          # --pubkey
  identity: ...        # --identity
  identity_prefix: ... # --identity-prefix
  issuer: ...          # --issuer
  pin: ...             # --pin
  allow_unlogged: true # --allow-unlogged

#​5414 Pass more of the signing certificate to gh attestation verify

github_artifact_attestations gains six optional fields:

Field	Flag
repository	--repo, defaulting to the package's repository as before
signer_repo	--signer-repo
cert_oidc_issuer	--cert-oidc-issuer
deny_self_hosted_runners	--deny-self-hosted-runners
source_ref	--source-ref
source_digest	--source-digest

#​5425 aqua gr: Infer a libc variant for a musl build beside the Linux one

Bug Fixes

#​5362 #​5367 Windows: Fix the infinite loop of a shim started with an upper-case extension such as nu.EXE

Tools that build a command name from PATHEXT, such as Python's shutil.which and just, start a shim as nu.EXE. aqua didn't find the package and ran the shim itself again until it failed. Command names are now matched case-insensitively on all OSes, preferring an exact match, and on Windows aqua skips its bin directory in PATH case-insensitively.

#​5363 #​5375 Windows: Fix the infinite loop of batch files such as npx and npm of nodejs/node

cmd.exe runs the first token of the command line rather than the executable path, so npx.cmd and npm.cmd started the shim again until it ran out of memory. aqua now runs a batch file (.bat / .cmd) by its absolute path.

#​5406 Close the temporary file of a downloaded asset

On Windows, the leaked handle could keep the temporary file from being removed.

#​5423 aqua gr: Cancel a promoted replacement for an OS that doesn't use it
#​5436 aqua gr: Don't take an SBOM for the package's asset
#​5444 aqua gr: Exclude 32-bit ARM assets by name

Others

#​5368 Remove -ldflags
#​5461 ci: Enable split_build of go-release-workflow
#​5431 ci: Use go-autofix-action's reusable workflow
#​5439 ci: Replace go-test-full-workflow with go-test-workflow and test-workflow

Dependency updates

#​5407 #​5485 Update Go to v1.27.3
#​5477 Update github.com/google/go-github to v93
#​5386 Update golang.org/x/sync to v0.24.0
#​5396 Update golang.org/x/sys to v0.49.0

v2.64.0

Compare Source

Features

#​5364 Support installing only specified packages by command or package names

aqua install now accepts command names or package names as positional arguments. Only packages matching them are installed.

aqua i gh                                 # by command name
aqua i cli/cli                            # by package name
aqua i gh suzuki-shunsuke/tfcmt           # multiple names

If any of the given names isn't found in the configuration files, the command fails:

ERR aqua failed not_found="[bar foo]" error="packages or commands aren't found in configuration files"

#​5279 Add a settings file

${XDG_CONFIG_HOME:-$HOME/.config}/aquaproj-aqua/config.yaml

checksum:
  enabled: true
  require: true
  enforce: true
  enforce_require: true
lazy_install: true
policy:
  enabled: true
  config: /home/foo/policy.yaml
tracking: true
progress_bar: false
log:
  level: info
  color: auto
max_parallelism: 5
global_config: /home/foo/aqua-global.yaml
root_dir: /home/foo/.local/share/aquaproj-aqua
keyring: false

config.yaml	environment variable
checksum.enabled	AQUA_CHECKSUM
checksum.require	AQUA_REQUIRE_CHECKSUM
checksum.enforce	AQUA_ENFORCE_CHECKSUM
checksum.enforce_require	AQUA_ENFORCE_REQUIRE_CHECKSUM
lazy_install	AQUA_DISABLE_LAZY_INSTALL (inverted)
policy.enabled	AQUA_DISABLE_POLICY (inverted)
policy.config	AQUA_POLICY_CONFIG
tracking	AQUA_DISABLE_TRACKING (inverted)
progress_bar	AQUA_PROGRESS_BAR
log.level	AQUA_LOG_LEVEL
log.color	AQUA_LOG_COLOR
max_parallelism	AQUA_MAX_PARALLELISM
global_config	AQUA_GLOBAL_CONFIG
root_dir	AQUA_ROOT_DIR
keyring	AQUA_KEYRING_ENABLED

Precedence: Environment variable > settings file > default

Performance Improvement

#​5283 Detect glibc by its loader instead of by running ldd

Bug Fixes

#​5284 gr: Don't take a build for particular hardware as the ordinary one
#​5285 gr: shorter isn't the point, the same name with less on it is
#​5287 Say what cosign said, and wait long enough for it to matter
#​5310 gr: Don't claim a provenance that is another artifact's

v2.63.0

Compare Source

Security

Fix a path traversal vulnerability GHSA-286g-rf2x-cv99.
When a package archive contained a GNU sparse file, aqua re-extracted the whole archive with the host tar, applying none of its own path or symlink containment. On hosts whose tar follows symlinks during extraction (e.g. BusyBox tar), a crafted archive could plant a symlink escaping the install directory and write a regular file through it. aqua now keeps the system tar out of the install directory: it validates the sparse member names, extracts them into a staging directory, and moves each to its verified destination itself.

Features

#​5117 Create timestamp files as group writable and document read only $AQUA_ROOT_DIR
#​5115 Support AQUA_DISABLE_TRACKING to disable the tracking of last used date times

Fixes

#​5237 Skip minisign verification if the host platform doesn't support minisign
#​5188 Ignore incomplete release assets in aqua gr
#​5178 Support files[].src in go_install packages
#​5171 Extract 7z archives that use the ARM64 filter
#​5161 signer_workflow is a literal path, not a regex

Others

#​5239 Fix Dockerfile build failure caused by a stale apt package index

aquaproj/aqua-installer

v4.1.1

Compare Source

SHA256 Checksum

c0acde4802a1edd8b8201fd4cc1f0e52700cd4feb875f9c9793381b5b0ca2065  aqua-installer

Fixes

#​958 Support installing aqua v2.65.0 or later

v4.1.0

Compare Source

SHA256 Checksum

4d3e513d42f425609c1ead6ecd40b9c62492011979dfe23d7012428a59efbe82  aqua-installer

Features

#​951 Add the packages input to install only specified packages

aqua >= v2.64.0 is required.

- uses: aquaproj/aqua-installer@82d0e83878a8657c4a6f2ff1755d3bfbfc67f329 # v4.1.0
  with:
    aqua_version: v2.64.0
    packages: |
      ghalint # Command names
      suzuki-shunsuke/tfcmt # Package names
- run: ghalint run

By default, aqua-installer runs aqua i -l, so tools are installed by lazy install when they are first run.
This has some problems:

1. Without a GitHub access token, lazy install can fail because of the GitHub API rate limit
2. Lazy install logs are mixed into the command output and become noise. This is confusing especially when a tool such as github-comment posts the output of a failed command to the pull request
3. If a GitHub access token is passed to avoid the rate limit, the token is also passed to commands that don't need it, which increases the risk of leaking it

A common workaround is to run each command with --version first to trigger lazy install, but the token is still passed to the command, it's hard to understand why the command is run, and you have to add a step for every command.

With the packages input, only the specified packages are installed up front rather than by lazy install, so you don't need to pass a GitHub access token when running them.

• Names are separated by whitespace or newlines
• Empty lines and text after # are ignored
• If packages is set and aqua_opts is the default value -l, -l isn't passed to aqua i, because -l skips installing packages

Others

#​954 Update the bootstrap version to v2.64.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.