Update go modules (main) (patch) by renovate[bot] · Pull Request #1686 · conforma/policy

renovate · 2026-03-03T01:36:42Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/conforma/cli	`v0.9.64` → `v0.9.118`
github.com/conforma/cli	`v0.10.5` → `v0.10.42`
github.com/conforma/go-containerregistry	`v0.20.7-0.20251103083939-3459088e4bae` → `v0.20.7`
github.com/google/go-containerregistry	`v0.21.7` → `v0.21.9`
github.com/sigstore/cosign/v3	`v3.0.4` → `v3.0.6`
github.com/sigstore/rekor	`v1.5.3` → `v1.5.5`
github.com/sigstore/sigstore	`v1.10.8` → `v1.10.11`
github.com/tektoncd/cli	`v0.42.0` → `v0.42.2`
oras.land/oras	`v1.3.3` → `v1.3.6`

Release Notes

conforma/cli (github.com/conforma/cli)

conforma/go-containerregistry (github.com/conforma/go-containerregistry)

`v0.20.7`

Compare Source

google/go-containerregistry (github.com/google/go-containerregistry)

`v0.21.9`

Compare Source

What's Changed

actions: pin slsa generator by version by @Subserial in #2395
fix: prevent data race on scope refreshes within remote.writer by @Subserial in #2396
fix: remove '.' from unsafe path prefixes by @Subserial in #2400
build(deps): bump the actions group with 3 updates by @dependabot[bot] in #2398

Full Changelog: google/go-containerregistry@v0.21.8...v0.21.9

`v0.21.8`

Compare Source

The artifacts attached to this release are missing SLSA provenance, see #2390.

What's Changed

build(deps): bump the go-deps group across 1 directory with 3 updates by @dependabot[bot] in #2353
build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /cmd/krane by @dependabot[bot] in #2367
build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /pkg/authn/k8schain by @dependabot[bot] in #2368
build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in /pkg/authn/kubernetes by @dependabot[bot] in #2363
build(deps): bump the go-deps group across 3 directories with 7 updates by @dependabot[bot] in #2377
build(deps): bump the actions group across 1 directory with 5 updates by @dependabot[bot] in #2375
Reject unsafe Windows archive paths in Extract by @Haihan-Jiang in #2330
feat(goreleaser): add loong64 build support for crane/gcrane/krane by @xuxiaowei-com-cn in #2358
Document tag and digest reference semantics by @Haihan-Jiang in #2325
remote: release pull limiter slot when body is read to EOF by @knQzx in #2373
tarball: bounds-check layer index in uncompressed LayerByDiffID by @arpitjain099 in #2370
authn: read Podman auth from XDG config by @vigneshakaviki in #2379
transport: per-host bearer token exchange on cross-host redirect by @amitzig in #2360
mutate: bounds-check layer index when building rebase addendums by @arpitjain099 in #2371
fix(daemon): copy ExposedPorts from source config in computeImageConfig by @x64vps in #2356
feat(remote): add WithReferrersTagFallback option by @kevinmdavis in #2366
mutate: apply opaque-directory whiteouts (.wh..wh..opq) in Extract by @sadmanf in #2372
tarball: use correct file extension for zstd/uncompressed by @milas in #2382
build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in the go-deps group across 1 directory by @dependabot[bot] in #2380
actions: update actions to be pinned by hash by @Subserial in #2384
Bump go version to 1.26.5 by @Subserial in #2388

New Contributors

@xuxiaowei-com-cn made their first contribution in #2358
@knQzx made their first contribution in #2373
@arpitjain099 made their first contribution in #2370
@vigneshakaviki made their first contribution in #2379
@amitzig made their first contribution in #2360
@x64vps made their first contribution in #2356
@kevinmdavis made their first contribution in #2366
@sadmanf made their first contribution in #2372

Full Changelog: google/go-containerregistry@v0.21.7...v0.21.8

sigstore/cosign (github.com/sigstore/cosign/v3)

`v3.0.6`

Compare Source

Changelog

v3.0.6 resolves GHSA-w6c6-c85g-mmv6. This release also adds support for signing with OpenBao-managed keys.

f1ad3ee Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801)
a09afa9 Handle whitespace-only certificate annotation (#4760)
5a38a6d fix(sign): closing SignerVerifier too early when signing with a security key (#4761)
2290a59 Disallow --new-bundle-format and --rfc3161-timestamp (#4762)
36f4008 support managed keys in conformance testing (#4728)
3274cf9 Add support for GCE metadata server env var (#4732)
2e9754a fix: preserve per-layer annotations in WriteAttestationsReferrer (#4709)
dece275 Fix parsing of in-toto for string predicates
bd4f0fd Mark batch of flags for deprecation (#4698)
9b259ff disallow key and cert identity being used together during verification (#4636)
95eb1c3 support key creation in GitLab group (#4704)

Thanks to all contributors!

`v3.0.5`

Compare Source

Deprecations

Deprecate rekor-entry-type flag (#4691)
Deprecate cosign triangulate (#4676)
Deprecate cosign copy (#4681)

Features

Automatically require signed timestamp with Rekor v2 entries (#4666)
Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)
Add mTLS support for TSA client connections when signing with a signing config (#4620)
Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)

Bug Fixes

Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
fix: avoid panic on malformed attestation payload (#4651)
fix: avoid panic on malformed tlog entries (#4649)
fix: avoid panic on malformed replace payload (#4653)
Gracefully fail if bundle payload body is not a string (#4648)
Verify validity of chain rather than just certificate (#4663)
fix: avoid panic on malformed tlog entry body (#4652)

Documentation

docs(cosign): clarify RFC3161 revocation semantics (#4642)
Fix typo in CLI help (#4701)

sigstore/rekor (github.com/sigstore/rekor)

`v1.5.5`

Compare Source

Features

feat: serve the API over TLS with a configurable TLS policy (#2920)

Bug Fixes

re-implement pgp v3 signature support (#3018)
fix broken PGP sigv3 parsing, add tests (#2959)
ensure invalid treeIDs always return with 400 errors (#2958)
use WithCancel ctx for async tasks (#2947)
Update 413 status code error handling (#2813)

Improvements

Replace cyberphone/json-canonicalization with encoding/json/jsontext (#3028)
Replace hashicorp/go-retryablehttp with std lib retry transport (#2933)
Drop patch version from go directive in go.mod (#3027)
Bump sigstore/sigstore to v1.11, bump min Go version to 1.27, modernize code (#2992)
bump go-openapi and mysql driver (#2985)
remove gocovmerge for go tool cover (#2963)
build releases w/ go 1.27.0 toolchain (#2960)
dsse parsing cpu/memory optimization (#2946)
numerous upgraded dependencies
builds use go 1.27 (including JSON, gc improvements)

Contributors

Anitha Natarajan
Bob Callaway
Hayden
Radoslav Dimitrov
Stef Graces

`v1.5.4`

Compare Source

Features

search: add subject field for SAN-based lookup (#2850)
Change default CLI upload type to hashedrekord (#2885)
separate read/write sql traffic for indexservice into separate pools (#2914)

Bug Fixes

better handle connection issues (#2931)
fix pprof arg (#2932)
fix shadowed err, wrong err label (#2907)
alpine: hash only the bytes read when computing the control.tar.gz digest (#2908)
return a 400 error for invalid TreeID (#2895)
Return the file error instead of the URL error for a missing artifact path (#2872)
Apply proactive hardening against malformed requests (#2945)

Improvements

remove repetitive viper lookups from api endpoints (#2922)
move CI containers to GHCR (#2943)
remove unused semver type version map (#2918)
test against valkey (#2916)
Remove unmaintained scripts/createdb.sh dev helper (#2905)
test mysql with production dsn strings (#2906)
create interface for TrillianClient (#2896)
use more efficient table schema for indexes (#2903)
Migrate off deprecated golang.org/x/crypto/openpgp (#2883)
minimize duplicative JSON parsing while handling entries (#2880)
remove duplicative log entry (#2881)
optimize DSSE memory and cpu while parsing and verifying envs (#2879)
update builder to use go1.26.4 (#2873)
upgrade grpc-ecosystem/go-grpc-middleware to v2 (#2921)
Migrate gopkg.in/yaml.v2 to sigs.k8s.io/yaml (#2919)
numerous upgraded dependencies

Documentation

docs(cli): add usage examples to rekor-cli commands (#2851)

Contributors

ahmagdyfb
Bob Callaway
Carlos Tadeu Panato Junior
Chiman Jain
Hayden
Jason Hall
Nikhil J
Ogulcan Aydogan
Pujitha Paladugu
Sueun Cho

sigstore/sigstore (github.com/sigstore/sigstore)

`v1.10.11`

Compare Source

v1.10.11 rolls back the release to a previous commit where the minimum Go version is 1.25.0. An upcoming v1.11.0 will require 1.27.0.

`v1.10.10`

Compare Source

What's Changed

Validate ed25519 public key length in verifier constructors by @sueun-dev in #2378
build(deps): Bump google.golang.org/api from 0.287.1 to 0.291.0 in /pkg/signature/kms/gcp by @dependabot[bot] in #2389
build(deps): Bump the gomod group across 3 directories with 4 updates by @dependabot[bot] in #2393
build(deps): Bump hashicorp/vault from 2.0.3 to 2.0.4 in /test/e2e in the all group by @dependabot[bot] in #2391
build(deps): Bump github.com/sigstore/sigstore from 1.10.8 to 1.10.9 in /test/fuzz in the tools group across 1 directory by @dependabot[bot] in #2392
build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0 in /pkg/signature/kms/azure by @dependabot[bot] in #2388
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms from 1.54.0 to 1.55.6 in /pkg/signature/kms/aws by @dependabot[bot] in #2387
build(deps): Bump google.golang.org/api from 0.291.0 to 0.293.0 in /pkg/signature/kms/gcp by @dependabot[bot] in #2401
build(deps): Bump github.com/tink-crypto/tink-go/v2 from 2.7.0 to 2.8.0 by @dependabot[bot] in #2399
build(deps): Bump github.com/secure-systems-lab/go-securesystemslib from 0.11.0 to 0.11.1 in /test/fuzz in the tools group across 1 directory by @dependabot[bot] in #2397
build(deps): Bump the gomod group across 2 directories with 7 updates by @dependabot[bot] in #2398
build(deps): Bump google.golang.org/grpc from 1.83.0 to 1.83.1 in /pkg/signature/kms/gcp by @dependabot[bot] in #2411
Add retryable HTTP transport by @crazy-max in #2396
build(deps): Bump google.golang.org/api from 0.293.0 to 0.295.0 in /pkg/signature/kms/gcp by @dependabot[bot] in #2408
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms from 1.55.7 to 1.57.1 in /pkg/signature/kms/aws by @dependabot[bot] in #2404
build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.22.0 to 1.23.1 in /pkg/signature/kms/azure by @dependabot[bot] in #2407
build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.38 to 1.33.2 in /pkg/signature/kms/aws by @dependabot[bot] in #2406
Fix Azure KMS ECDSA signature verification (r||s ordering + padding) by @hugolevino in #2410
build(deps): Bump hashicorp/vault from 2.0.4 to 2.1.0 in /test/e2e in the all group by @dependabot[bot] in #2412
Bump go to 1.27 and fix linter and api issues by @loosebazooka in #2415
Support for ML-DSA keys by @loosebazooka in #2416
adjust mldsa error handling by @loosebazooka in #2417
build(deps): Bump the gomod group across 4 directories with 4 updates by @dependabot[bot] in #2413
build(deps): Bump github.com/google/go-containerregistry from 0.21.9 to 0.22.1 by @dependabot[bot] in #2403

New Contributors

@crazy-max made their first contribution in #2396
@hugolevino made their first contribution in #2410

Full Changelog: sigstore/sigstore@v1.10.9...v1.10.10

`v1.10.9`

Compare Source

What's Changed

Note: #2369 deprecates the TUF client. Use the TUF client from sigstore-go instead: https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf

Deprecate TUF client, ValidatePubKey in #2369
docs: add OVHcloud KMS in available external plugins in #2359
fix(oauthflow): default the device flow poll interval to 5s per RFC 8628 in #2381
Add BrowserOpener field to InteractiveIDTokenGetter in #2383
Fix Azure KMS support for RSA signatures in #2355

Full Changelog: sigstore/sigstore@v1.10.8...v1.10.9

tektoncd/cli (github.com/tektoncd/cli)

`v0.42.2`

Compare Source

v0.42.2 Release 🎉

This patch release addresses the following CVEs: CVE-2026-33186, CVE-2026-33810, CVE-2025-61729 and CVE-2025-61726.

Changelog

1e1782f New version v0.42.2

Full Changelog: tektoncd/cli@v0.42.1...v0.42.2

`v0.42.1`

Compare Source

v0.42.1 Release 🎉

This patch release fixes CVEs CVE-2025-47913, CVE-2025-66564, CVE-2025-66506, CVE-2025-12044 and CVE-2025-11621.

Changelog

e3c8b70 New version v0.42.1

Full Changelog: tektoncd/cli@v0.42.0...v0.42.1

oras-project/oras (oras.land/oras)

`v1.3.6`

Compare Source

Changes since v1.3.5

Dependencies

Update oras.land/oras-go/v2 from v2.6.4 to v2.7.0 (#2284, fixes #2275)
- Behavior change: v2.6.4 rejected bearer token realms on any private address, which broke split-host registries such as self-hosted GitLab (oras-project/oras-go#1631). The default denylist now blocks only loopback, link-local, unspecified, and cloud metadata addresses. RFC 1918, IPv6 unique-local, and CGNAT realms are allowed again.
- Authentication now works after a same-host HTTP-to-HTTPS redirect.
- Copy and verification fixes: FilterArtifactType matching for referrers with an empty config and for image indexes, PreCopy returning SkipNode after a declined cross-repo mount, and a clearer error when a source fails after sending all its declared bytes.

Bug fixes

oras tag now checks that it gets a source reference and at least one tag (#2265, fixes #2264)
--from-resolve and --to-resolve rules no longer overwrite each other when combined with --resolve (#2282, fixes #2277)
Fix a panic when a mount is attempted against a tracked target that does not support mounting, such as an OCI layout (#2283, fixes #2278)

Release and packaging

Release archives and the checksums file now come with GitHub artifact attestations (SLSA build provenance). You can verify them with gh attestation verify in addition to GPG signatures (#2271, fixes #2269)
Stable snap releases now publish to the candidate channel as well as stable. The classic snap no longer bundles its own ca-certificates and uses the host certificate store instead (#2274)

Other

More unit tests for display JSON metadata handlers and contentutil (#2266, #2267)
Bump GitHub Actions dependencies (#2263)

Full changelog: oras-project/oras@v1.3.5...v1.3.6

Changelog

9b1fc81 bump: tag and release ORAS CLI v1.3.6 (#2285)
5f03555 docs: make oras-www release updates explicit (#2286)
81f1656 fix: serialize progress console frames (#2292)
27c1796 fix: share auth caches only between clients with the same credentials (#2288)
ecc3e87 fix: take the write lock in status.Render (#2290)
3d087a2 fix: make the TTY progress manager safe against concurrent and repeated Close (#2287)
9218890 fix: expose mount only for capable tracked targets (#2283)
fdf2ba3 fix: keep --from-resolve and --to-resolve rules separate (#2282)
cb601f5 chore: update oras-go to v2.7.0 (#2284)
a325603 build: keep snap candidate channel current (#2274)
5236ba2 ci: publish build provenance attestations for release artifacts (#2271)
ed26899 test(display): cover the remaining JSON metadata handlers (#2266)
bd0668e test(contentutil): cover MultiReadOnlyTarget and IsDigest (#2267)
38812fe fix: validate minimum arguments for tag command (#2265)
17d5269 build(deps): bump the github-actions group with 3 updates (#2263)

Verification

Release artifacts are signed with the ORAS project release key C6FC42F0DE84A345FAADB742F44418110791EF37. Signatures (.asc files) are attached to this release.

Public keys are available in the KEYS file.

Release archives and the checksums file also have GitHub build provenance attestations. Verify an archive with:

gh attestation verify oras_1.3.6_linux_amd64.tar.gz --repo oras-project/oras

The attestations are Sigstore bundles, so they can also be downloaded with gh attestation download and checked with cosign verify-blob-attestation.

`v1.3.5`

Compare Source

Changelog

d6e7b58 bump: tag and release ORAS CLI v1.3.5 (#2244)
4431829 docs: require cve fixes to land before preparing a release (#2258)
8ee66ac docs: add ORAS CLI release process (#2248)
e09a8bb chore: bump oras-go to v2.6.4 in e2e tests (#2247)
8270f5f chore: update oras-go to v2.6.4 (#2242)
ba3a3dc fix: validate extra destination tags before pushing (#2237)
6ca02d0 build(deps): bump the github-actions group across 1 directory with 3 updates (#2240)
c9ccd95 build(deps): bump library/golang from 1.27.1-alpine to 1.27.2-alpine (#2239)
b2dc645 build(deps): bump github.com/onsi/ginkgo/v2 from 2.33.0 to 2.33.1 in /test/e2e (#2238)
bae5056 Preserve the index media type when the index body omits it (#2235)
227fc74 chore: update oras-go to v2.6.3 (#2234)
4d6c6e8 build(deps): bump golang.org/x/term from 0.46.0 to 0.47.0 (#2232)
21193d8 build(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0 (#2231)
8b3b8bd Fall back to config media type for old-style artifact types (#2114)
e58fee3 fix: validate format before special handling (#2205)
4e9a756 fix: validate empty OCI layout path with digest (#2230)
b0a7bda fix: restore pretty output for manifest fetch-config (#2228)
ab0ff3d fix: limit manifest config fetch size (#2222)
80f72e1 build(deps): bump anchore/sbom-action/download-syft from 0.24.2 to 0.24.3 in the github-actions group (#2223)
d608889 docs(e2e): correct test/e2e/README.md references (#2219)
8d737cd chore: drop dead .gitignore entries for the Docker e2e registry mounts (#2220)
02c5c20 ci: remove Docker-based e2e test run (#2208)
d41f4eb fix: detect credentials in multiple JSON values (#2218)
5c33ab2 ci: pin e2e-k8s.yml action refs to commit SHAs (#2216)
1033ebb fix: generate coverage report in covhtml (#2214)
ccf3e26 chore: update golang.org/x/crypto (#2207)
715917d feat(cp): support multiple platforms (#2191)
488b3fa fix: correct manifest fetch format error (#2203)
a826d9a fix: clarify absolute path validation warning (#2201)
7327064 ci: replace action-publish with snapcraft CLI (#2199)
1dd0de8 build(deps): bump the github-actions group with 4 updates (#2200)
7c53cbf fix: clean up partial pull output on failure (#2194)
bdf7835 test(errors): cover the CLI error type and its constructors (#2196)
88f46a4 build(deps): bump github.com/onsi/gomega from 1.43.1 to 1.44.0 in /test/e2e (#2195)
8c979f1 test(display): cover the pulled-file model (#2189)
a0cd4de feat: add Kubernetes-based e2e testing infrastructure (#1913)
be79214 fix: fix concurrency in Tagged (#2183)
44e831a ci: publish stable rolling image tags (#2184)
[bc28b9c](https://redirect.github.com

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM (* 0-3 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-03-03T01:36:45Z

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

112 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.25.3` -> `1.25.8`
`cloud.google.com/go`	`v0.121.6` -> `v0.123.0`
`cloud.google.com/go/auth`	`v0.18.0` -> `v0.18.2`
`cloud.google.com/go/storage`	`v1.57.1` -> `v1.61.3`
`cuelang.org/go`	`v0.15.3` -> `v0.16.0`
`github.com/CycloneDX/cyclonedx-go`	`v0.9.3` -> `v0.10.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric`	`v0.54.0` -> `v0.55.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping`	`v0.54.0` -> `v0.55.0`
`github.com/anchore/go-struct-converter`	`v0.0.0-20230627203149-c72ef8859ca9` -> `v0.1.0`
`github.com/aws/aws-sdk-go-v2`	`v1.41.0` -> `v1.41.4`
`github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream`	`v1.7.1` -> `v1.7.7`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.5` -> `v1.32.12`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.19.5` -> `v1.19.12`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.16` -> `v1.18.20`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.4.16` -> `v1.4.20`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.16` -> `v2.7.20`
`github.com/aws/aws-sdk-go-v2/internal/ini`	`v1.8.4` -> `v1.8.6`
`github.com/aws/aws-sdk-go-v2/internal/v4a`	`v1.4.9` -> `v1.4.21`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.13.4` -> `v1.13.7`
`github.com/aws/aws-sdk-go-v2/service/internal/checksum`	`v1.8.9` -> `v1.9.12`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.13.16` -> `v1.13.20`
`github.com/aws/aws-sdk-go-v2/service/internal/s3shared`	`v1.19.9` -> `v1.19.20`
`github.com/aws/aws-sdk-go-v2/service/s3`	`v1.88.3` -> `v1.97.1`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.0.4` -> `v1.0.8`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.30.7` -> `v1.30.13`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.35.12` -> `v1.35.17`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.41.5` -> `v1.41.9`
`github.com/aws/smithy-go`	`v1.24.0` -> `v1.24.2`
`github.com/cloudflare/circl`	`v1.6.1` -> `v1.6.3`
`github.com/cncf/xds/go`	`v0.0.0-20251022180443-0feb69152e9f` -> `v0.0.0-20251210132809-ee656c7534f5`
`github.com/conforma/go-gather`	`v1.0.2` -> `v1.1.0`
`github.com/containerd/containerd/v2`	`v2.2.0` -> `v2.2.2`
`github.com/containerd/stargz-snapshotter/estargz`	`v0.18.1` -> `v0.18.2`
`github.com/cyphar/filepath-securejoin`	`v0.4.1` -> `v0.6.0`
`github.com/dgraph-io/badger/v4`	`v4.8.0` -> `v4.9.1`
`github.com/docker/cli`	`v29.2.0+incompatible` -> `v29.3.1+incompatible`
`github.com/docker/docker-credential-helpers`	`v0.9.4` -> `v0.9.5`
`github.com/emicklei/proto`	`v1.14.2` -> `v1.14.3`
`github.com/envoyproxy/go-control-plane/envoy`	`v1.35.0` -> `v1.36.0`
`github.com/envoyproxy/protoc-gen-validate`	`v1.2.1` -> `v1.3.0`
`github.com/evanphx/json-patch/v5`	`v5.9.0` -> `v5.9.11`
`github.com/go-git/go-billy/v5`	`v5.6.2` -> `v5.8.0`
`github.com/go-git/go-git/v5`	`v5.16.5` -> `v5.17.1`
`github.com/go-jose/go-jose/v4`	`v4.1.3` -> `v4.1.4`
`github.com/go-openapi/analysis`	`v0.24.1` -> `v0.24.3`
`github.com/go-openapi/errors`	`v0.22.6` -> `v0.22.7`
`github.com/go-openapi/jsonpointer`	`v0.22.4` -> `v0.22.5`
`github.com/go-openapi/jsonreference`	`v0.21.4` -> `v0.21.5`
`github.com/go-openapi/loads`	`v0.23.2` -> `v0.23.3`
`github.com/go-openapi/spec`	`v0.22.3` -> `v0.22.4`
`github.com/go-openapi/strfmt`	`v0.25.0` -> `v0.26.1`
`github.com/go-openapi/swag/conv`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/fileutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/jsonname`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/jsonutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/loading`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/mangling`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/stringutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/typeutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/yamlutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/validate`	`v0.25.1` -> `v0.25.2`
`github.com/go-viper/mapstructure/v2`	`v2.4.0` -> `v2.5.0`
`github.com/google/cel-go`	`v0.26.1` -> `v0.27.0`
`github.com/google/go-containerregistry`	`v0.20.7` -> `v0.21.0`
`github.com/google/go-jsonnet`	`v0.21.0` -> `v0.22.0`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.9` -> `v0.3.14`
`github.com/googleapis/gax-go/v2`	`v2.16.0` -> `v2.17.0`
`github.com/grpc-ecosystem/grpc-gateway/v2`	`v2.27.3` -> `v2.27.7`
`github.com/hashicorp/aws-sdk-go-base/v2`	`v2.0.0-beta.65` -> `v2.0.0-beta.72`
`github.com/hashicorp/go-getter`	`v1.8.3` -> `v1.8.6`
`github.com/hashicorp/go-version`	`v1.7.0` -> `v1.8.0`
`github.com/huandu/go-sqlbuilder`	`v1.38.1` -> `v1.39.1`
`github.com/klauspost/compress`	`v1.18.2` -> `v1.18.5`
`github.com/lestrrat-go/httprc/v3`	`v3.0.1` -> `v3.0.2`
`github.com/lestrrat-go/jwx/v3`	`v3.0.12` -> `v3.0.13`
`github.com/moby/buildkit`	`v0.26.3` -> `v0.29.0`
`github.com/open-policy-agent/conftest`	`v0.66.0` -> `v0.68.2`
`github.com/open-policy-agent/opa`	`v1.12.1` -> `v1.15.2`
`github.com/protocolbuffers/txtpbfmt`	`v0.0.0-20251016062345-16587c79cd91` -> `v0.0.0-20260217160748-a481f6a22f94`
`github.com/spdx/tools-golang`	`v0.5.5` -> `v0.5.7`
`github.com/tektoncd/pipeline`	`v0.70.0` -> `v1.9.2`
`github.com/theupdateframework/go-tuf/v2`	`v2.3.0` -> `v2.4.1`
`github.com/valyala/fastjson`	`v1.6.4` -> `v1.6.7`
`github.com/vektah/gqlparser/v2`	`v2.5.31` -> `v2.5.32`
`go.opentelemetry.io/contrib/detectors/gcp`	`v1.38.0` -> `v1.39.0`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.63.0` -> `v0.65.0`
`go.opentelemetry.io/otel`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace`	`v1.38.0` -> `v1.40.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`	`v1.38.0` -> `v1.40.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`	`v1.38.0` -> `v1.40.0`
`go.opentelemetry.io/otel/metric`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/otel/sdk`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/otel/sdk/metric`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/otel/trace`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/proto/otlp`	`v1.7.1` -> `v1.9.0`
`golang.org/x/crypto`	`v0.47.0` -> `v0.49.0`
`golang.org/x/mod`	`v0.31.0` -> `v0.33.0`
`golang.org/x/net`	`v0.49.0` -> `v0.52.0`
`golang.org/x/oauth2`	`v0.34.0` -> `v0.36.0`
`golang.org/x/sync`	`v0.19.0` -> `v0.20.0`
`golang.org/x/sys`	`v0.40.0` -> `v0.42.0`
`golang.org/x/term`	`v0.39.0` -> `v0.41.0`
`golang.org/x/text`	`v0.33.0` -> `v0.35.0`
`golang.org/x/time`	`v0.14.0` -> `v0.15.0`
`golang.org/x/tools`	`v0.40.0` -> `v0.42.0`
`gomodules.xyz/jsonpatch/v2`	`v2.4.0` -> `v2.5.0`
`google.golang.org/api`	`v0.260.0` -> `v0.271.0`
`google.golang.org/genproto`	`v0.0.0-20251202230838-ff82c1b0f217` -> `v0.0.0-20260128011058-8636f8732409`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20251202230838-ff82c1b0f217` -> `v0.0.0-20260203192932-546029d2fa20`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260203192932-546029d2fa20` -> `v0.0.0-20260226221140-a57be14db171`
`google.golang.org/grpc`	`v1.78.0` -> `v1.79.3`
`k8s.io/apiextensions-apiserver`	`v0.34.2` -> `v0.34.3`
`knative.dev/pkg`	`v0.0.0-20250117084104-c43477f0052b` -> `v0.0.0-20250415155312-ed3e2158b883`

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

113 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.25.5` -> `1.26.2`
`github.com/open-policy-agent/conftest`	`v0.66.0` -> `v0.68.2`
`cloud.google.com/go`	`v0.121.6` -> `v0.123.0`
`cloud.google.com/go/auth`	`v0.18.0` -> `v0.18.2`
`cloud.google.com/go/firestore`	`v1.20.0` -> `v1.21.0`
`cloud.google.com/go/kms`	`v1.23.2` -> `v1.25.0`
`cloud.google.com/go/longrunning`	`v0.7.0` -> `v0.8.0`
`cloud.google.com/go/storage`	`v1.57.1` -> `v1.61.3`
`cuelang.org/go`	`v0.15.3` -> `v0.16.0`
`github.com/CycloneDX/cyclonedx-go`	`v0.9.3` -> `v0.10.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.30.0` -> `v1.31.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric`	`v0.54.0` -> `v0.55.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping`	`v0.54.0` -> `v0.55.0`
`github.com/anchore/go-struct-converter`	`v0.0.0-20230627203149-c72ef8859ca9` -> `v0.1.0`
`github.com/aws/aws-sdk-go-v2`	`v1.41.0` -> `v1.41.4`
`github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream`	`v1.7.2` -> `v1.7.7`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.5` -> `v1.32.12`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.19.5` -> `v1.19.12`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.16` -> `v1.18.20`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.4.16` -> `v1.4.20`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.16` -> `v2.7.20`
`github.com/aws/aws-sdk-go-v2/internal/ini`	`v1.8.4` -> `v1.8.6`
`github.com/aws/aws-sdk-go-v2/internal/v4a`	`v1.4.12` -> `v1.4.21`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.13.4` -> `v1.13.7`
`github.com/aws/aws-sdk-go-v2/service/internal/checksum`	`v1.9.3` -> `v1.9.12`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.13.16` -> `v1.13.20`
`github.com/aws/aws-sdk-go-v2/service/internal/s3shared`	`v1.19.12` -> `v1.19.20`
`github.com/aws/aws-sdk-go-v2/service/s3`	`v1.89.1` -> `v1.97.1`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.0.4` -> `v1.0.8`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.30.7` -> `v1.30.13`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.35.12` -> `v1.35.17`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.41.5` -> `v1.41.9`
`github.com/aws/smithy-go`	`v1.24.0` -> `v1.24.2`
`github.com/cloudflare/circl`	`v1.6.1` -> `v1.6.3`
`github.com/cncf/xds/go`	`v0.0.0-20251022180443-0feb69152e9f` -> `v0.0.0-20251210132809-ee656c7534f5`
`github.com/conforma/go-gather`	`v1.0.2` -> `v1.1.0`
`github.com/containerd/containerd/v2`	`v2.2.0` -> `v2.2.2`
`github.com/containerd/stargz-snapshotter/estargz`	`v0.18.1` -> `v0.18.2`
`github.com/cyphar/filepath-securejoin`	`v0.5.0` -> `v0.6.0`
`github.com/dgraph-io/badger/v4`	`v4.8.0` -> `v4.9.1`
`github.com/docker/cli`	`v29.0.3+incompatible` -> `v29.3.1+incompatible`
`github.com/docker/docker-credential-helpers`	`v0.9.4` -> `v0.9.5`
`github.com/emicklei/proto`	`v1.14.2` -> `v1.14.3`
`github.com/envoyproxy/go-control-plane/envoy`	`v1.35.0` -> `v1.36.0`
`github.com/envoyproxy/protoc-gen-validate`	`v1.2.1` -> `v1.3.0`
`github.com/evanphx/json-patch`	`v5.9.0+incompatible` -> `v5.9.11+incompatible`
`github.com/go-git/go-billy/v5`	`v5.6.2` -> `v5.8.0`
`github.com/go-git/go-git/v5`	`v5.16.5` -> `v5.17.1`
`github.com/go-jose/go-jose/v4`	`v4.1.3` -> `v4.1.4`
`github.com/go-openapi/analysis`	`v0.24.1` -> `v0.24.3`
`github.com/go-openapi/errors`	`v0.22.6` -> `v0.22.7`
`github.com/go-openapi/jsonpointer`	`v0.22.4` -> `v0.22.5`
`github.com/go-openapi/jsonreference`	`v0.21.4` -> `v0.21.5`
`github.com/go-openapi/loads`	`v0.23.2` -> `v0.23.3`
`github.com/go-openapi/spec`	`v0.22.3` -> `v0.22.4`
`github.com/go-openapi/strfmt`	`v0.25.0` -> `v0.26.1`
`github.com/go-openapi/swag/conv`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/fileutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/jsonname`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/jsonutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/loading`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/mangling`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/stringutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/typeutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/yamlutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/validate`	`v0.25.1` -> `v0.25.2`
`github.com/go-viper/mapstructure/v2`	`v2.4.0` -> `v2.5.0`
`github.com/google/cel-go`	`v0.26.1` -> `v0.27.0`
`github.com/google/go-containerregistry`	`v0.20.7` -> `v0.21.0`
`github.com/google/go-jsonnet`	`v0.21.0` -> `v0.22.0`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.9` -> `v0.3.14`
`github.com/googleapis/gax-go/v2`	`v2.16.0` -> `v2.17.0`
`github.com/grpc-ecosystem/grpc-gateway/v2`	`v2.27.3` -> `v2.27.7`
`github.com/hashicorp/aws-sdk-go-base/v2`	`v2.0.0-beta.65` -> `v2.0.0-beta.72`
`github.com/hashicorp/go-getter`	`v1.8.3` -> `v1.8.6`
`github.com/hashicorp/go-version`	`v1.7.0` -> `v1.8.0`
`github.com/huandu/go-sqlbuilder`	`v1.38.1` -> `v1.39.1`
`github.com/klauspost/compress`	`v1.18.2` -> `v1.18.5`
`github.com/lestrrat-go/httprc/v3`	`v3.0.1` -> `v3.0.2`
`github.com/lestrrat-go/jwx/v3`	`v3.0.12` -> `v3.0.13`
`github.com/moby/buildkit`	`v0.26.3` -> `v0.29.0`
`github.com/morikuni/aec`	`v1.0.0` -> `v1.1.0`
`github.com/open-policy-agent/opa`	`v1.12.1` -> `v1.15.2`
`github.com/protocolbuffers/txtpbfmt`	`v0.0.0-20251016062345-16587c79cd91` -> `v0.0.0-20260217160748-a481f6a22f94`
`github.com/spdx/tools-golang`	`v0.5.5` -> `v0.5.7`
`github.com/tektoncd/pipeline`	`v1.3.1` -> `v1.9.2`
`github.com/valyala/fastjson`	`v1.6.4` -> `v1.6.7`
`github.com/vektah/gqlparser/v2`	`v2.5.31` -> `v2.5.32`
`go.opentelemetry.io/contrib/detectors/gcp`	`v1.38.0` -> `v1.39.0`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.63.0` -> `v0.65.0`
`go.opentelemetry.io/otel`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace`	`v1.38.0` -> `v1.40.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`	`v1.38.0` -> `v1.40.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`	`v1.38.0` -> `v1.40.0`
`go.opentelemetry.io/otel/metric`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/otel/sdk`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/otel/sdk/metric`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/otel/trace`	`v1.39.0` -> `v1.43.0`
`golang.org/x/crypto`	`v0.47.0` -> `v0.49.0`
`golang.org/x/mod`	`v0.31.0` -> `v0.33.0`
`golang.org/x/net`	`v0.49.0` -> `v0.52.0`
`golang.org/x/oauth2`	`v0.34.0` -> `v0.36.0`
`golang.org/x/sync`	`v0.19.0` -> `v0.20.0`
`golang.org/x/sys`	`v0.40.0` -> `v0.42.0`
`golang.org/x/term`	`v0.39.0` -> `v0.41.0`
`golang.org/x/text`	`v0.33.0` -> `v0.35.0`
`golang.org/x/time`	`v0.14.0` -> `v0.15.0`
`golang.org/x/tools`	`v0.40.0` -> `v0.42.0`
`google.golang.org/api`	`v0.260.0` -> `v0.271.0`
`google.golang.org/genproto`	`v0.0.0-20251202230838-ff82c1b0f217` -> `v0.0.0-20260128011058-8636f8732409`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20251202230838-ff82c1b0f217` -> `v0.0.0-20260203192932-546029d2fa20`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260203192932-546029d2fa20` -> `v0.0.0-20260226221140-a57be14db171`
`google.golang.org/grpc`	`v1.78.0` -> `v1.80.0`
`k8s.io/apiextensions-apiserver`	`v0.34.2` -> `v0.34.3`

codecov · 2026-03-03T01:42:44Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

fullsend-ai-review · 2026-10-22T09:20:29Z

🤖 Review · ⚠️ Cancelled · Ended 9:20 AM UTC

Commit: 314c99a · View workflow run →

fullsend-ai-review · 2026-10-22T09:28:24Z

🤖 Review · ⚠️ Cancelled · Ended 9:28 AM UTC

Commit: a8eba18 · View workflow run →

renovate Bot added main renovate labels Mar 3, 2026

renovate Bot enabled auto-merge (squash) March 3, 2026 01:36

github-actions Bot added the size: L label Mar 3, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch from cca90ca to 4a2c267 Compare March 4, 2026 21:54

renovate Bot changed the title ~~Update module github.com/conforma/cli to v0.8.120 (main)~~ Update module github.com/conforma/cli to v0.8.122 (main) Mar 4, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch from 4a2c267 to d09fee6 Compare March 5, 2026 02:17

renovate Bot changed the title ~~Update module github.com/conforma/cli to v0.8.122 (main)~~ Update module github.com/conforma/cli to v0.8.123 (main) Mar 5, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch from d09fee6 to 201288b Compare March 12, 2026 01:28

renovate Bot changed the title ~~Update module github.com/conforma/cli to v0.8.123 (main)~~ Update module github.com/conforma/cli to v0.8.129 (main) Mar 12, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch from 201288b to 7067591 Compare March 12, 2026 05:09

renovate Bot changed the title ~~Update module github.com/conforma/cli to v0.8.129 (main)~~ Update go modules (main) (patch) Mar 12, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch 5 times, most recently from 8a6ccc5 to a132df5 Compare March 20, 2026 18:16

renovate Bot force-pushed the renovate/main-patch-go-modules branch from a132df5 to 23a5b44 Compare March 25, 2026 12:31

renovate Bot changed the title ~~Update go modules (main) (patch)~~ Update module oras.land/oras to v1.3.1 (main) Mar 25, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch from 23a5b44 to 9a8f12b Compare March 25, 2026 14:50

github-actions Bot added size: XS and removed size: L labels Mar 25, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch from 9a8f12b to 46eef9b Compare April 1, 2026 01:43

renovate Bot changed the title ~~Update module oras.land/oras to v1.3.1 (main)~~ Update go modules (main) (patch) Apr 1, 2026

github-actions Bot added size: L and removed size: XS labels Apr 1, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch from 46eef9b to 321f66d Compare April 4, 2026 01:26

This comment was marked as outdated.

Sign in to view

Update go modules

828f683

fullsend-ai-review Bot approved these changes Oct 30, 2026

View reviewed changes

Conversation

renovate Bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed

New Contributors

Changelog

Thanks to all contributors!

Deprecations

Features

Bug Fixes

Documentation

Features

Bug Fixes

Improvements

Contributors

Features

Bug Fixes

Improvements

Documentation

Contributors

What's Changed

New Contributors

What's Changed

v0.42.2 Release 🎉

Changelog

v0.42.1 Release 🎉

Changelog

Changes since v1.3.5

Dependencies

Bug fixes

Release and packaging

Other

Changelog

Verification

Changelog

Configuration

Uh oh!

renovate Bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: acceptance/go.mod

File name: go.mod

Uh oh!

codecov Bot commented Mar 3, 2026

Codecov Report

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Oct 22, 2026

Uh oh!

fullsend-ai-review Bot commented Oct 22, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

renovate Bot commented Mar 3, 2026 •

edited

Loading

renovate Bot commented Mar 3, 2026 •

edited

Loading