chore(deps): update go dependencies by red-hat-konflux[bot] · Pull Request #678 · securesign/cosign

red-hat-konflux · 2026-04-21T19:36:28Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go	indirect	patch	`v1.36.11-20260209202127-80ab13bee0bf.1` → `v1.36.11-20260415201107-50325440f8f2.1`
cloud.google.com/go/iam	indirect	minor	`v1.9.0` → `v1.11.0`
cloud.google.com/go/kms	indirect	minor	`v1.29.0` → `v1.31.0`
cloud.google.com/go/longrunning	indirect	major	`v0.11.0` → `v1.0.0`
github.com/AzureAD/microsoft-authentication-library-for-go	indirect	patch	`v1.7.1` → `v1.7.2`
github.com/alibabacloud-go/cr-20160607	indirect	major	`v1.0.1` → `v2.0.0`
github.com/alibabacloud-go/cr-20181201	indirect	major	`v1.0.10` → `v3.1.2`
github.com/alibabacloud-go/darabonba-openapi	indirect	major	`v0.2.1` → `v2.1.16`
github.com/alibabacloud-go/tea-utils	indirect	major	`v1.4.5` → `v2.0.9`
github.com/aws/aws-sdk-go-v2	indirect	patch	`v1.41.6` → `v1.41.7`
github.com/aws/aws-sdk-go-v2/config	indirect	patch	`v1.32.14` → `v1.32.17`
github.com/aws/aws-sdk-go-v2/credentials	indirect	patch	`v1.19.14` → `v1.19.16`
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	indirect	patch	`v1.18.22` → `v1.18.23`
github.com/aws/aws-sdk-go-v2/internal/configsources	indirect	patch	`v1.4.22` → `v1.4.23`
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	indirect	patch	`v2.7.22` → `v2.7.23`
github.com/aws/aws-sdk-go-v2/service/ecrpublic	indirect	patch	`v1.38.13` → `v1.38.15`
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	indirect	patch	`v1.13.8` → `v1.13.9`
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	indirect	patch	`v1.13.22` → `v1.13.23`
github.com/aws/aws-sdk-go-v2/service/kms	indirect	minor	`v1.50.4` → `v1.51.1`
github.com/aws/aws-sdk-go-v2/service/signin	indirect	patch	`v1.0.10` → `v1.0.11`
github.com/aws/aws-sdk-go-v2/service/sso	indirect	patch	`v1.30.15` → `v1.30.17`
github.com/aws/aws-sdk-go-v2/service/ssooidc	indirect	patch	`v1.35.19` → `v1.35.21`
github.com/aws/aws-sdk-go-v2/service/sts	indirect	minor	`v1.41.10` → `v1.42.1`
github.com/aws/smithy-go	indirect	patch	`v1.25.0` → `v1.25.1`
github.com/buildkite/agent/v3	require	minor	`v3.121.0` → `v3.126.0`
github.com/buildkite/go-pipeline	indirect	minor	`v0.16.0` → `v0.17.0`
github.com/cenkalti/backoff/v4	indirect	major	`v4.3.0` → `v5.0.3`
github.com/coreos/go-oidc/v3	indirect	minor	`v3.17.0` → `v3.18.0`
github.com/docker/cli	indirect	patch	`v29.4.0+incompatible` → `v29.4.3+incompatible`
github.com/docker/docker-credential-helpers	indirect	patch	`v0.9.6` → `v0.9.7`
github.com/fsnotify/fsnotify	indirect	minor	`v1.9.0` → `v1.10.1`
github.com/fxamacker/cbor/v2	indirect	patch	`v2.9.1` → `v2.9.2`
github.com/go-chi/chi	indirect	major	`v4.1.2+incompatible` → `v5.2.5`
github.com/go-jose/go-jose/v3	require	major	`v3.0.5` → `v4.1.4`
github.com/go-jose/go-jose/v4	require	minor	`v4.0.5` → `v4.1.4`
github.com/go-openapi/runtime	require	patch	`v0.29.4` → `v0.29.5`
github.com/go-openapi/strfmt	require	patch	`v0.26.1` → `v0.26.2`
github.com/go-piv/piv-go/v2	require	minor	`v2.5.0` → `v2.6.0`
github.com/golang-jwt/jwt/v4	indirect	major	`v4.5.2` → `v5.3.1`
github.com/google/go-github/v55	require	major	`v55.0.0` → `v86.0.0`
github.com/googleapis/gax-go/v2	indirect	minor	`v2.21.0` → `v2.22.0`
github.com/grpc-ecosystem/grpc-gateway/v2	indirect	minor	`v2.28.0` → `v2.29.0`
github.com/hashicorp/hcl	indirect	major	`v1.0.1-vault-7` → `v2.24.0`
github.com/in-toto/in-toto-golang	require	minor	`v0.10.0` → `v0.11.0`
github.com/klauspost/compress	indirect	patch	`v1.18.5` → `v1.18.6`
github.com/lestrrat-go/jwx/v3	indirect	major	`v3.0.13` → `v4.0.2`
github.com/letsencrypt/boulder	indirect	minor	`v0.20260420.0` → `v0.20260512.0`
github.com/open-policy-agent/opa	require	minor	`v1.15.2` → `v1.16.2`
github.com/pelletier/go-toml/v2	indirect	patch	`v2.3.0` → `v2.3.1`
github.com/secure-systems-lab/go-securesystemslib	require	minor	`v0.10.0` → `v0.11.0`
github.com/sigstore/timestamp-authority	require	major	`v1.2.9` → `v2.0.6`
github.com/sigstore/timestamp-authority/v2	indirect	patch	`v2.0.5` → `v2.0.6`
github.com/theupdateframework/go-tuf	indirect	major	`v0.7.0` → `v2.4.1`
github.com/tink-crypto/tink-go-awskms/v2	indirect	major	`v2.1.0` → `v3.0.0`
github.com/tjfoc/gmsm	indirect	major	`v1.4.1` → `v2.0.0`
github.com/urfave/negroni	indirect	major	`v1.0.0` → `v3.1.1`
github.com/vbatts/tar-split	indirect	patch	`v0.12.2` → `v0.12.3`
github.com/vektah/gqlparser/v2	indirect	patch	`v2.5.32` → `v2.5.33`
gitlab.com/gitlab-org/api/client-go	require	major	`v1.46.0` → `v2.25.0`
go.step.sm/crypto	indirect	minor	`v0.77.2` → `v0.79.0`
go.uber.org/zap	indirect	minor	`v1.27.1` → `v1.28.0`
go.yaml.in/yaml/v2	indirect	major	`v2.4.4` → `v3.0.4`
golang.org/x/crypto	indirect	minor	`v0.50.0` → `v0.51.0`
golang.org/x/crypto	require	minor	`v0.50.0` → `v0.51.0`
golang.org/x/mod	indirect	minor	`v0.35.0` → `v0.36.0`
golang.org/x/net	indirect	minor	`v0.53.0` → `v0.54.0`
golang.org/x/sys	indirect	minor	`v0.43.0` → `v0.44.0`
golang.org/x/term	require	minor	`v0.42.0` → `v0.43.0`
golang.org/x/text	indirect	minor	`v0.36.0` → `v0.37.0`
golang.org/x/tools	indirect	minor	`v0.44.0` → `v0.45.0`
google.golang.org/api	require	minor	`v0.276.0` → `v0.279.0`
google.golang.org/genproto	indirect	digest	`e10c466` → `3700d41`
google.golang.org/genproto/googleapis/api	indirect	digest	`e10c466` → `3700d41`
google.golang.org/genproto/googleapis/rpc	indirect	digest	`e10c466` → `3700d41`
google.golang.org/grpc	indirect	minor	`v1.80.0` → `v1.81.0`
gopkg.in/evanphx/json-patch.v4	indirect	major	`v4.13.0` → `v5.9.11`
gopkg.in/ini.v1	indirect	patch	`v1.67.1` → `v1.67.2`
k8s.io/api	require	minor	`v0.35.4` → `v0.36.1`
k8s.io/apimachinery	require	minor	`v0.35.4` → `v0.36.1`
k8s.io/client-go	require	minor	`v0.35.4` → `v0.36.1`
k8s.io/kube-openapi	indirect	digest	`ec9c827` → `ef417d0`
k8s.io/utils	require	digest	`28399d8` → `ff6756f`
sigs.k8s.io/structured-merge-diff/v6	indirect	minor	`v6.3.2` → `v6.4.0`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

googleapis/google-cloud-go (cloud.google.com/go/longrunning)

`v0.13.0`

Compare Source

bigquery: UseLegacySQL options for CreateTable and QueryConfig. Use these
options to continue using Legacy SQL after the client switches its default
to Standard SQL.
bigquery: Support for updating dataset labels.
bigquery: Set DatasetIterator.ProjectID to list datasets in a project other
than the client's. DatasetsInProject is no longer needed and is deprecated.
bigtable: Fail ListInstances when any zones fail.
spanner: support decoding of slices of basic types (e.g. []string, []int64,
etc.)
logging/logadmin: UpdateSink no longer creates a sink if it is missing
(actually a change to the underlying service, not the client)
profiler: Service and ServiceVersion replace Target in Config.

`v0.12.0`

Compare Source

pubsub: Subscription.Receive now uses streaming pull.
pubsub: add Client.TopicInProject to access topics in a different project
than the client.
errors: renamed errorreporting. The errors package will be removed shortly.
datastore: improved retry behavior.
bigquery: support updates to dataset metadata, with etags.
bigquery: add etag support to Table.Update (BREAKING: etag argument added).
bigquery: generate all job IDs on the client.
storage: support bucket lifecycle configurations.

AzureAD/microsoft-authentication-library-for-go (github.com/AzureAD/microsoft-authentication-library-for-go)

`v1.7.2`

Compare Source

What's Changed

Adjust constants used in FMI tests by @Avery-Dunn in #608
Update version to 1.7.1 by @Avery-Dunn in #607
Add MSAL client metadata headers to IMDS managed identity requests by @Copilot in #611
Disable gzip compression #613 by @4gust in #616
Update version.go by @4gust in #617

New Contributors

@Copilot made their first contribution in #611

Full Changelog: AzureAD/microsoft-authentication-library-for-go@v1.7.1...v1.7.2

alibabacloud-go/cr-20160607 (github.com/alibabacloud-go/cr-20160607)

`v2.0.0`

Compare Source

Generated 2016-06-07 for cr.

alibabacloud-go/cr-20181201 (github.com/alibabacloud-go/cr-20181201)

`v3.1.2`

Compare Source

Update API CreateRepoSyncRule: add request parameters LinkId.
Update API ListRepoSyncRule: add response parameters Body.SyncRules.$.LinkId.
Update API ListRepoSyncTask: add response parameters Body.SyncTasks.$.LinkId.
Update API ListRepoSyncTask: add response parameters Body.SyncTasks.$.ModifiedTime.

`v3.1.1`

Compare Source

Update API ListRepoBuildRule: add response parameters Body.BuildRules.$.DestArtifactType.

`v3.1.0`

Compare Source

Support API CreateScanRule.
Support API CreateStorageDomainRoutingRule.
Support API DeleteScanRule.
Support API DeleteStorageDomainRoutingRule.
Support API GetScanRule.
Support API GetStorageDomainRoutingRule.
Support API ListScanRule.
Support API UpdateScanRule.
Support API UpdateStorageDomainRoutingRule.

`v3.0.6`

Compare Source

Update API GetArtifactSubscriptionRule: add response parameters Body.SourceDomain.
Update API ListArtifactSubscriptionRule: add response parameters Body.Rules.$.SourceDomain.

`v3.0.5`

Compare Source

Update API GetInstanceVpcEndpoint: add response parameters Body.LinkedVpcs.$.Issue.

`v3.0.4`

Compare Source

Update API GetArtifactLifecycleRule: add response parameters Body.Policies.
Update API ListArtifactLifecycleRule: add response parameters Body.Rules.$.Policies.

`v3.0.3`

Compare Source

Generated 2018-12-01 for cr.

`v3.0.2`

Compare Source

Update API CreateNamespace: add request parameters DefaultRepoConfiguration.
Update API GetNamespace: add response parameters Body.DefaultRepoConfiguration.
Update API ListNamespace: add response parameters Body.Namespaces.$.DefaultRepoConfiguration.
Update API UpdateNamespace: add request parameters DefaultRepoConfiguration.

`v3.0.1`

Compare Source

Update API CreateRepoTagScanTask: add request parameters ScanType.
Update API GetRepoTagScanStatus: add request parameters ScanType.

`v3.0.0`

Compare Source

Support API CancelRepoSyncTask.
Support API CreateArtifactSubscriptionRule.
Support API CreateArtifactSubscriptionTask.
Support API DeleteArtifactSubscriptionRule.
Support API GetArtifactSubscriptionRule.
Support API GetArtifactSubscriptionTask.
Support API GetArtifactSubscriptionTaskResult.
Support API ListArtifactSubscriptionRule.
Support API ListArtifactSubscriptionTask.
Support API UpdateArtifactSubscriptionRule.
Delete API GetRepoTagLayers.
Delete API GetRepoTagManifest.
Update API CreateRepoSyncRule: add request parameters RepoNameFilter.
Update API GetArtifactBuildRule: add response parameters Body.Parameters.PriorityFile.
Update API GetInstanceUsage: add response parameters Body.VpcQuota.
Update API GetInstanceUsage: add response parameters Body.VpcUsage.
Update API GetRepoSyncTask: add response parameters Body.TaskIssue.
Update API ListRepoSyncRule: add response parameters Body.SyncRules.$.RepoNameFilter.
Update API ListRepoSyncTask: add response parameters Body.SyncTasks.$.TaskIssue.

`v2.5.0`

Compare Source

Support API CreateArtifactLifecycleRule.
Support API DeleteArtifactLifecycleRule.
Support API GetArtifactLifecycleRule.
Support API ListArtifactLifecycleRule.
Support API UpdateArtifactLifecycleRule.

`v2.4.0`

Compare Source

Support API ListScanBaselineByTask.
Support API ListScanMaliciousFileByTask.
Update API GetArtifactBuildRule: update response param.
Update API ListRepository: update param RepoStatus.

`v2.3.2`

Compare Source

Generated 2018-12-01 for cr.

`v2.3.1`

Compare Source

Generated 2018-12-01 for cr.

`v2.3.0`

Compare Source

Generated 2018-12-01 for cr.

`v2.2.2`

Compare Source

Generated 2018-12-01 for cr.

`v2.2.1`

Compare Source

Generated 2018-12-01 for cr.

`v2.2.0`

Compare Source

Generated 2018-12-01 for cr.

`v2.1.0`

Compare Source

Generated 2018-12-01 for cr.

`v2.0.1`

Compare Source

Chain api.

`v2.0.0`

Compare Source

Generated 2018-12-01 for cr.

alibabacloud-go/darabonba-openapi (github.com/alibabacloud-go/darabonba-openapi)

update tea core

`v2.1.4`

Compare Source

`v2.1.3`

Compare Source

Add ToArray in utils

`v2.1.2`

Compare Source

Solve the Token judge error

`v2.1.1`

Compare Source

add GetRules in utils

`v2.1.0`

Compare Source

Upgrade By Darabonba V2

`v2.0.12`

Compare Source

Full Changelog: alibabacloud-go/darabonba-openapi@v2.0.11...v2.0.12

`v2.0.11`

Compare Source

Full Changelog: alibabacloud-go/darabonba-openapi@v2.0.10...v2.0.11

`v2.0.10`

Compare Source

Full Changelog: alibabacloud-go/darabonba-openapi@v2.0.9...v2.0.10

`v2.0.9`

Compare Source

`v2.0.8`

Compare Source

Support bearer token credentials request.

`v2.0.7`

Compare Source

Support extends parameters.

`v2.0.6`

Compare Source

feat: support extends parameters

`v2.0.5`

Compare Source

`v2.0.4`: Release version v2.0.4

`v2.0.2`

Compare Source

Add gateway client setter.

`v2.0.1`

Compare Source

Return description and accessDeniedDetail in error info.

`v2.0.0`

Compare Source

Update with tea-utils.

alibabacloud-go/tea-utils (github.com/alibabacloud-go/tea-utils)

`v2.0.9`

Compare Source

`v2.0.8`

Compare Source

`v2.0.7`

Compare Source

`v2.0.6`

Compare Source

Support extends query parameters.

`v2.0.5`

Compare Source

feat: support extends parameters

`v2.0.4`

Compare Source

Refactor: improve design of nonce

`v2.0.3`

Compare Source

Support static method AssertAsInteger().

`v2.0.2`

Compare Source

Fix stringify map value.

`v2.0.1`

Compare Source

Support ca params for server and client.

`v2.0.0`

Compare Source

Remove function panic.

aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2)

`v1.41.7`

Compare Source

Module Highlights

github.com/aws/aws-sdk-go-v2/service/ecs: v1.41.7
- Documentation: Documentation only update for Amazon ECS.
github.com/aws/aws-sdk-go-v2/service/glue: v1.78.0
- Feature: Adding View related fields to responses of read-only Table APIs.
github.com/aws/aws-sdk-go-v2/service/ivschat: v1.12.5
- Documentation: Doc-only update. Changed "Resources" to "Key Concepts" in docs and updated text.
github.com/aws/aws-sdk-go-v2/service/rolesanywhere: v1.10.0
- Feature: This release increases the limit on the roleArns request parameter for the *Profile APIs that support it. This parameter can now take up to 250 role ARNs.
github.com/aws/aws-sdk-go-v2/service/securityhub: v1.47.2
- Documentation: Documentation updates for AWS Security Hub

aws/smithy-go (github.com/aws/smithy-go)

`v1.25.1`

Compare Source

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.25.1
- Bug Fix: Fixed a memory leak in the LRU cache implementation used by some AWS services.

buildkite/agent (github.com/buildkite/agent/v3)

`v3.126.0`

Compare Source

v3.126.0 (2026-05-07)

Full Changelog

Added

Add priority and queue labels to the Prometheus job-start/end counters, plus a new jobsRunning gauge with the same labels #3900 (@buildkate)

Changed

Document BUILDKITE_S3_PROFILE in buildkite-agent artifact upload --help #3869 (@mastermanas805)

Internal

Remove omitempty JSON tags from api.Job (the struct is only ever unmarshalled from API responses, so the tags had no effect) #3902 (@buildkate)
Dependabot updates: #3847, #3860, #3879, #3885, #3886, #3888, #3890, #3891, #3895 (@dependabot[bot])

`v3.125.0`

Compare Source

v3.125.0 (2026-05-04)

Full Changelog

Added

Multipart S3 download for faster artifact downloads #3875 (@buildkate)
New --fail-on-missing-tags flag (and BUILDKITE_AGENT_FAIL_ON_MISSING_TAGS env var) to exit the agent on startup if a configured cloud tag source (EC2/ECS/GCP) returns no tags #3801 (@omehegan)
Automatic tracing for CLI subcommands (e.g. artifact upload, pipeline upload) when BUILDKITE_TRACING_BACKEND=opentelemetry and a TRACEPARENT is present #3866 (@ss1909)
Register application/zstd MIME type for .zst artifact uploads #3864 (@ladd)

Fixed

Preserve literal percent sequences in JSON job logs (previously rewritten by Go format-string handling) #3877 (@friel-openai)

Internal

Remove Bazel from the agent build #3873 (@moskyb)
Rename logger.Logger methods to end in f (e.g. Debugf, Infof) #3878 #3881 (@DrJosh9000, @buildkate)
Separate OTel provider provisioning from span generation #3880 (@ss1909)
Only log the first stream connection to reduce log noise #3872 (@moskyb)
Remove and prevent use of assert libraries (testify) #3858 (@DrJosh9000)
Bump go-pipeline to v0.17.0 #3865 (@CerealBoy)

`v3.124.0`

Compare Source

v3.124.0 (2026-04-28)

Full Changelog

Added

feat: build and publish freebsd/arm64 binary #3855 (@buildkate)
feat: add metrics to record histogram of chunk sizes and compressed size #3833 (@wolfeidau)

Changed

fix: Hide detached-HEAD advice #3851 (@DrJosh9000)
Big process refactor, improved Windows signal handling #3814 (@DrJosh9000)

Fixed

fix: use single-quoted shell escaping for --format env output #3856 (@ss1909)
fix: More consistent protected env vars #3838 (@DrJosh9000)
fix: set PTY raw mode before process start #3837 (@lox)

Internal

fix: Flakes in shell_test.go due to missing signal grace period #3854 (@DrJosh9000)
fix: Make TestChunksIntervalSeconds less flaky #3850 (@DrJosh9000)
chore: rename mise config and add tasks #3839 (@lox)
feat: migrate to github.com/klauspost/compress/gzip for optimized deflate #3832 (@wolfeidau)
Removal manual gates from deployment process #3830 (@zhming0)
Normalise HTTP status-based retry policies across the agent #3827 (@moskyb)

`v3.123.1`

Compare Source

v3.123.1 (2026-04-17)

Full Changelog

Fixed

Fix --glob-resolve-follow-symlinks regression #3828 (@zhming0)
Prevent snapshot logic if command phase isn't included #3825 (@DrJosh9000)
Per-agent snapshot clones for git mirrors #3789 (@DrJosh9000)

Internal

E2E test coverage for bulk artifacts upload/download #3824 (@zhming0)
Dependabot updates: #3816, #3817, #3818, #3819 (@dependabot[bot])

`v3.123.0`

Compare Source

v3.123.0 (2026-04-14)

Full Changelog

Added

Add zip archive support for plugins #3713 (@adnowakodbx1)
Support PowerShell 7 #3759 (@markmssd)
Allow K8s container start timeout to be configured #3820 (@zhming0)
Make checkout retry attempt configurable, increasing default retry #3822 (@zhming0)

Fixed

Fix incorrect check in TestAnnotateMaxBodySize, clean up assert #3810 (@DrJosh9000)
Compile badChars regexp once #3811 (@DrJosh9000)
Refactor ArtifactBatchCreator to use iterator #3812 (@zhming0)

Internal

Release script #3806 (@swebb)
Dependabot updates: #3813 (@dependabot[bot])

`v3.122.0`

Compare Source

v3.122.0 (2026-04-09)

Full Changelog

[!TIP]
🎉 ✨ Streaming job dispatch (General Availability): Starting this version, Agent's default endpoint has been changed to https://agent-edge.buildkite.com/v3, we expect this to vastly accelerate job acceptance latency.

Changed

Streaming Job Dispatch is now enabled by default: the default agent API endpoint has been changed from https://agent.buildkite.com/v3 to https://agent-edge.buildkite.com/v3 #3808 (@zhming0)

`v3.121.1`

Compare Source

v3.121.1 (2026-04-08)

Full Changelog

Change

Map executor setup failures to exit_status -1 #3769 (kainanpeace666)

Fix

Don't send commit metadata when BUILDKITE_SKIP_CHECKOUT is set #3790 (swebb)

Security

Go 1.25.9 #3805 (swebb)

Dependency updates

build(deps): bump docker/library/golang from 1.25.8 to 1.25.9 in /.buildkite in the container-images group across 1 directory #3804 (dependabot[bot])
build(deps): bump cloud.google.com/go/kms from 1.26.0 to 1.27.0 #3799 (dependabot[bot])
build(deps): bump the cloud-providers group across 1 directory with 6 updates #3797 (dependabot[bot])
build(deps): bump github.com/buildkite/go-buildkite/v4 from 4.17.0 to 4.18.0 #3798 (dependabot[bot])
build(deps): bump the container-images group across 5 directories with 1 update #3796 (dependabot[bot])
build(deps): bump the otel group with 5 updates #3795 (dependabot[bot])
build(deps): bump github.com/buildkite/go-buildkite/v4 from 4.16.0 to 4.17.0 #3787 (dependabot[bot])
build(deps): bump the cloud-providers group with 8 updates #3786 (dependabot[bot])
build(deps): bump the container-images group across 3 directories with 1 update #3785 (dependabot[bot])

buildkite/go-pipeline (github.com/buildkite/go-pipeline)

`v0.17.0`

Compare Source

What's Changed

Change the CommandStep and Plugins processing to allow control characters by @CerealBoy in #72

Full Changelog: buildkite/go-pipeline@v0.16.0...v0.17.0

cenkalti/backoff (github.com/cenkalti/backoff/v4)

`v5.0.3`

Compare Source

`v5.0.2`

Compare Source

`v5.0.1`

Compare Source

`v5.0.0`

Compare Source

coreos/go-oidc (github.com/coreos/go-oidc/v3)

`v3.18.0`

Compare Source

What's Changed

.github: configure dependabot by @ericchiang in #477
.github: update go versions in CI by @ericchiang in #480
build(deps): bump golang.org/x/oauth2 from 0.28.0 to 0.36.0 by @dependabot[bot] in #478
build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #479

Full Changelog: coreos/go-oidc@v3.17.0...v3.18.0

docker/cli (github.com/docker/cli)

`v29.4.3+incompatible`

Compare Source

`v29.4.2+incompatible`

Compare Source

`v29.4.1+incompatible`

Compare Source

docker/docker-credential-helpers (github.com/docker/docker-credential-helpers)

`v0.9.7`

Compare Source

What's Changed

update to go1.26.3
ci: update zizmore action to v1.7.1

Full Changelog: docker/docker-credential-helpers@v0.9.6...v0.9.7

fsnotify/fsnotify (github.com/fsnotify/fsnotify)

`v1.10.1`

Compare Source

Changes and fixes

inotify: don't remove sibling watches sharing a path prefix (#754)
inotify, windows: don't rename sibling watches sharing a path prefix
(#755)

`v1.10.0`

Compare Source

This version of fsnotify needs Go 1.23.

Changes and fixes

inotify: improve initialization error message (#731)
inotify: send Rename event if recursive watch is renamed (#696)
inotify: avoid copying event buffers when reading names (#741)
kqueue: skip dangling symlinks (ENOENT) in watchDirectoryFiles, so a bad entry no longer aborts Watcher.Add for the whole directory (#748)
kqueue: drop watches directly in Close() to fix a file descriptor leak when recycling watchers (#740)
windows: fix nil pointer dereference in remWatch (#736)
windows: lock watch field updates against concurrent WatchList to fix a race introduced in v1.9.0 (#709, #749)

fxamacker/cbor (github.com/fxamacker/cbor/v2)

`v2.9.2`

Compare Source

This release refactors and hardens the streaming encoder by adding stricter checks for encoding CBOR indefinite-length data. Other changes include minor bugfixes, defensive checks, and more tests.

Projects that don't use CBOR indefinite-length data may also want to upgrade (summary of prior releases).

The stricter checks in the encoder prevent improper use of the library and bad inputs from producing malformed CBOR indefinite-length data that would be rejected by the decoder.

This release passed fuzz tests (billions of execs) and it is production quality.

What's Changed

Reject encoding indefinite-length map with odd item count by @fxamacker in #764
Reject encoding indefinite-length data item as a chunk inside indefinite-length byte string or text string by @fxamacker in #765
Make TagSet.Remove a no-op when contentType is nil by @fxamacker in #766
Refactor indefinite-length encoding and improve chunk validation during encoding by @fxamacker in #767
Add more tests, fix a nit in unreachable panic message, update docs & ci by @fxamacker in #768

CI / GitHub Actions and Docs

🔎 Details...

Bump actions/setup-go from 6.3.0 to 6.4.0 by @dependabot[bot] in #760
Bump github/codeql-action from 4.34.1 to 4.35.1 by @dependabot[bot] in #761
Bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in #763
Update README for v2.9.2 release by @fxamacker in #769

Full Changelog: fxamacker/cbor@v2.9.1...v2.9.2

go-chi/chi (github.com/go-chi/chi)

`v5.2.5`

Compare Source

What's Changed

Bump minimum Go to 1.22 and use new features by @JRaspass in [#&Cosign source image #82

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

red-hat-konflux · 2026-04-21T19:36:30Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

14 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.25.6` -> `1.26.0`
`github.com/go-piv/piv-go/v2`	`v2.5.0` -> `v2.6.0`
`google.golang.org/protobuf`	`v1.36.11` -> `v1.36.12-0.20260120151049-f2248ac996af`
`cloud.google.com/go/kms`	`v1.29.0` -> `v1.31.0`
`github.com/aws/aws-sdk-go-v2`	`v1.41.6` -> `v1.41.7`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.14` -> `v1.32.17`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.22` -> `v2.7.23`
`github.com/aws/aws-sdk-go-v2/service/kms`	`v1.50.4` -> `v1.51.1`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.30.15` -> `v1.30.17`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.35.19` -> `v1.35.21`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.41.10` -> `v1.42.1`
`github.com/aws/smithy-go`	`v1.25.0` -> `v1.25.1`
`github.com/googleapis/gax-go/v2`	`v2.21.0` -> `v2.22.0`
`github.com/lestrrat-go/jwx/v3`	`v3.0.13` -> `v3.1.0`
`google.golang.org/grpc`	`v1.80.0` -> `v1.81.0`

red-hat-konflux · 2026-05-12T17:06:12Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go mod tidy
go: downloading github.com/google/go-github/v86 v86.0.0
go: downloading gitlab.com/gitlab-org/api/client-go/v2 v2.25.0
go: downloading github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb
go: downloading github.com/go-rod/rod v0.116.2
go: downloading go.uber.org/goleak v1.3.0
go: downloading github.com/creack/pty v1.1.24
go: downloading github.com/go-openapi/testify/v2 v2.5.0
go: downloading github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d
go: downloading github.com/go-quicktest/qt v1.101.0
go: downloading github.com/fortytw2/leaktest v1.3.0
go: downloading github.com/graph-gophers/graphql-go v1.9.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2
go: downloading github.com/go-test/deep v1.1.1
go: downloading github.com/hashicorp/go-hclog v1.6.3
go: downloading gotest.tools/v3 v3.5.2
go: downloading github.com/frankban/quicktest v1.14.6
go: downloading go.opentelemetry.io/otel/sdk v1.43.0
go: downloading github.com/ysmood/goob v0.4.0
go: downloading github.com/ysmood/got v0.40.0
go: downloading github.com/ysmood/gson v0.7.3
go: downloading github.com/ysmood/fetchup v0.2.3
go: downloading github.com/ysmood/leakless v0.9.0
go: downloading gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
go: downloading github.com/chzyer/test v1.0.0
go: downloading github.com/go-sql-driver/mysql v1.9.3
go: downloading github.com/google/trillian v1.7.2
go: downloading github.com/jackc/pgx/v5 v5.8.0
go: downloading github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.0
go: downloading github.com/go-openapi/testify/enable/yaml/v2 v2.5.0
go: downloading github.com/sassoftware/relic/v7 v7.6.2
go: downloading github.com/stretchr/objx v0.5.2
go: downloading github.com/foxcpp/go-mockdns v1.2.0
go: downloading github.com/kr/pretty v0.3.1
go: downloading github.com/dgraph-io/badger/v4 v4.9.1
go: downloading github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1
go: downloading go.opentelemetry.io/otel/sdk/metric v1.43.0
go: downloading github.com/fatih/color v1.18.0
go: downloading github.com/mattn/go-colorable v0.1.14
go: downloading github.com/mattn/go-isatty v0.0.20
go: downloading github.com/google/gofuzz v1.2.0
go: downloading github.com/onsi/ginkgo v1.16.5
go: downloading github.com/onsi/gomega v1.19.0
go: downloading github.com/Azure/go-autorest/autorest/mocks v0.4.2
go: downloading github.com/chzyer/logex v1.2.1
go: downloading github.com/sergi/go-diff v1.4.0
go: downloading github.com/jackc/pgpassfile v1.0.0
go: downloading github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761
go: downloading software.sslmate.com/src/go-pkcs12 v0.4.0
go: downloading github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
go: downloading github.com/lib/pq v1.10.9
go: downloading github.com/jmhodges/clock v1.2.0
go: downloading github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883
go: downloading github.com/miekg/dns v1.1.62
go: downloading github.com/kr/text v0.2.0
go: downloading github.com/golang/protobuf v1.5.4
go: downloading github.com/keybase/go-keychain v0.0.1
go: downloading github.com/dgraph-io/ristretto/v2 v2.2.0
go: downloading github.com/hashicorp/golang-lru/v2 v2.0.7
go: downloading github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef
go: downloading github.com/zalando/go-keyring v0.2.8
go: downloading github.com/bytecodealliance/wasmtime-go/v43 v43.0.2
go: downloading gonum.org/v1/gonum v0.17.0
go: downloading github.com/envoyproxy/go-control-plane/envoy v1.37.0
go: downloading github.com/envoyproxy/go-control-plane v0.14.0
go: downloading github.com/google/flatbuffers v25.2.10+incompatible
go: downloading gopkg.in/yaml.v2 v2.4.0
go: downloading github.com/nxadm/tail v1.4.11
go: downloading github.com/jmespath/go-jmespath/internal/testify v1.5.1
go: downloading github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0
go: downloading github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54
go: downloading github.com/danieljoos/wincred v1.2.3
go: downloading github.com/godbus/dbus/v5 v5.2.2
go: downloading github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2
go: downloading github.com/envoyproxy/protoc-gen-validate v1.3.3
go: downloading github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10
go: downloading gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7
go: downloading github.com/jackc/puddle/v2 v2.2.2
go: finding module for package github.com/theupdateframework/go-tuf/v2/v2/metadata
go: github.com/sigstore/cosign/v2/test tested by
	github.com/sigstore/cosign/v2/test.test imports
	github.com/theupdateframework/go-tuf/v2/v2/metadata: module github.com/theupdateframework/go-tuf/v2@latest found (v2.4.1), but does not contain package github.com/theupdateframework/go-tuf/v2/v2/metadata

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot added the dependencies label Apr 21, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.3/go-deps branch from b76f64c to 0e365e9 Compare April 22, 2026 22:19

red-hat-konflux Bot changed the title ~~chore(deps): update module github.com/aws/aws-sdk-go-v2/credentials to v1.19.15~~ chore(deps): update go dependencies Apr 22, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.3/go-deps branch 26 times, most recently from 23e4d4a to 242db37 Compare May 1, 2026 06:27

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.3/go-deps branch 15 times, most recently from 08a79ff to 7552776 Compare May 8, 2026 06:40

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.3/go-deps branch 9 times, most recently from 2cc0e4f to e0f703e Compare May 12, 2026 16:52

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.3/go-deps branch from e0f703e to 6b4d3f3 Compare May 12, 2026 23:32

chore(deps): update go dependencies

0236066

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.3/go-deps branch from 6b4d3f3 to 0236066 Compare May 13, 2026 03:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update go dependencies#678

chore(deps): update go dependencies#678
red-hat-konflux[bot] wants to merge 1 commit into
release-1.3from
konflux/mintmaker/release-1.3/go-deps

red-hat-konflux Bot commented Apr 21, 2026 •

edited

Loading

Uh oh!

red-hat-konflux Bot commented Apr 21, 2026 •

edited

Loading

Uh oh!

red-hat-konflux Bot commented May 12, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

red-hat-konflux Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

New Contributors

v2.1.12: Realase v2.1.12

v2.0.4: Release version v2.0.4

Module Highlights

General Highlights

Module Highlights

v3.126.0 (2026-05-07)

Added

Changed

Internal

v3.125.0 (2026-05-04)

Added

Fixed

Internal

v3.124.0 (2026-04-28)

Added

Changed

Fixed

Internal

v3.123.1 (2026-04-17)

Fixed

Internal

v3.123.0 (2026-04-14)

Added

Fixed

Internal

v3.122.0 (2026-04-09)

Changed

v3.121.1 (2026-04-08)

Change

Fix

Security

Dependency updates

What's Changed

What's Changed

What's Changed

Changes and fixes

Changes and fixes

What's Changed

CI / GitHub Actions and Docs

What's Changed

Configuration

Documentation

Uh oh!

red-hat-konflux Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

red-hat-konflux Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: go.sum

red-hat-konflux Bot commented Apr 21, 2026 •

edited

Loading

`v2.1.12`: Realase v2.1.12

`v2.0.4`: Release version v2.0.4

red-hat-konflux Bot commented Apr 21, 2026 •

edited

Loading

red-hat-konflux Bot commented May 12, 2026 •

edited

Loading