Update go modules (release-v0.7) (patch) by renovate[bot] · Pull Request #3146 · conforma/cli

renovate · 2026-03-02T02:08:37Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
cuelang.org/go	`v0.16.0` → `v0.16.1`
cuelang.org/go	`v0.15.1` → `v0.15.4`
github.com/enterprise-contract/enterprise-contract-controller/api	`v0.1.257` → `v0.1.281`
github.com/gkampitakis/go-snaps	`v0.5.19` → `v0.5.22`
github.com/go-openapi/strfmt	`v0.26.1` → `v0.26.3`
github.com/google/go-containerregistry	`v0.21.5` → `v0.21.6`
github.com/mattn/go-isatty	`v0.0.20` → `v0.0.22`
github.com/package-url/packageurl-go	`v0.1.3` → `v0.1.6`
github.com/sigstore/cosign/v2	`v2.4.1` → `v2.4.3`
github.com/sigstore/cosign/v2	`v2.6.2` → `v2.6.3`
github.com/sigstore/rekor	`v1.5.0` → `v1.5.2`
github.com/sigstore/sigstore	`v1.10.5` → `v1.10.8`
github.com/tektoncd/chains	`v0.26.2` → `v0.26.4`
github.com/tektoncd/cli	`v0.44.0` → `v0.44.1`
k8s.io/api	`v0.35.4` → `v0.35.5`
k8s.io/apiextensions-apiserver	`v0.35.4` → `v0.35.5`
k8s.io/apimachinery	`v0.35.4` → `v0.35.5`
k8s.io/client-go	`v0.35.4` → `v0.35.5`
k8s.io/kubernetes	`v1.34.3` → `v1.34.8`

Release Notes

cue-lang/cue (cuelang.org/go)

`v0.16.1`

Compare Source

Language

The fallback keyword in the aliasv2 experiment is replaced by otherwise, which is clearer. cue fmt or cue fix can be used to rewrite existing code.

Evaluator

Fix a regression where the compiler could add comments to the input AST value, which could lead to increased memory usage.

Fix a bug where exporting certain schemas could result in "cannot have both alias and field in same scope" errors.

`cmd/cue`

Fix a panic which could occur when using non-label expressions in the --path flag.

Teach cue login to give helpful errors when used with OCI registries which don't support the OAuth2 device flow.

Go API

Fix a regression where cue.Context.Encode could panic on custom marshaler types with pointer receivers.

Full list of changes since v0.16.0

internal/cueversion: bump to v0.16.1 by @mvdan in 6d609d7
internal/ci: build releases with Go 1.26.2 by @mvdan in cedf4c8
update all golang.org/x/... dependencies by @mvdan in b4efeef
all: rename fallback keyword to otherwise by @mpvl in f813811
lsp/cache: improve rename by @cuematthew in 8e47027
integration/workspace: add test showing bad behaviour by @cuematthew in a5e0ef5
cmd/cue: suggest docker/podman login when OAuth2 device flow is unsupported by @mvdan in c169605
cmd/cue: add testscript for cue login when device code endpoint is unsupported by @mvdan in d7c882a
cmd/cue: clarify how to authenticate with standard OCI registries by @mvdan in 2613edf
internal/core/compile: avoid mutating AST by @rogpeppe in e4b0516
internal/core/export: fix alias/field name conflict in pattern constraints by @mvdan in 1e46409
internal/core/export: add regression test for alias/field name conflict by @mvdan in 1654f66
pkg: fix godoc mistakes across several packages by @mvdan in eae9aaf
internal/core/convert: fix panic when encoding pointer-receiver marshalers by @mvdan in 8e39aec
cmd/cue: return an error for non-label --path expressions instead of panicking by @mvdan in 5a55849
encoding: add godoc hints for cue/ast result types by @mvdan in 682c663

gkampitakis/go-snaps (github.com/gkampitakis/go-snaps)

`v0.5.22`

Compare Source

What's Changed

Enhance README with additional Any matcher example by @MoritzHeld in #157
fix: create snapshot files with 0644 instead of os.ModePerm by @gkampitakis in #159

New Contributors

@MoritzHeld made their first contribution in #157

Full Changelog: gkampitakis/go-snaps@v0.5.21...v0.5.22

`v0.5.21`

Compare Source

What's Changed

support nested arrays in json matchers by @gkampitakis in #145

Full Changelog: gkampitakis/go-snaps@v0.5.20...v0.5.21

`v0.5.20`

Compare Source

What's Changed

feat: support setting serializer on config by @gkampitakis in #154

Full Changelog: gkampitakis/go-snaps@v0.5.19...v0.5.20

go-openapi/strfmt (github.com/go-openapi/strfmt)

`v0.26.3`

Compare Source

0.26.3 - 2026-05-31

Full Changelog: go-openapi/strfmt@v0.26.2...v0.26.3

15 commits in this release.

Documentation

fix(ci): typo in sha by @fredbi ...
doc: updated contributors file by @bot-go-openapi[bot] in #258 ...
doc: updated contributors file by @bot-go-openapi[bot] in #251 ...

Miscellaneous tasks

chore: prepare release v0.26.3 by @bot-go-openapi[bot] in #260 ...
fix(ci): monitor - work around dependabot identity requirements by @fredbi ...
fix(ci): updated shared ci worflows (fix monitor-bot identity) by @fredbi ...
fix(ci): updated shared ci worflows (fix monitor-bot permissions) by @fredbi ...
fix(ci): updated shared ci worflows (fix monitor-bot filter) by @fredbi in #259 ...
ci: schedule bot PR monitoring by @fredbi in #257 ...

Updates

build(deps): bump the other-dependencies group across 3 directories with 2 updates by @dependabot[bot] in #252 ...
build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 in the golang-org-dependencies group across 1 directory by @dependabot[bot] in #255 ...
build(deps): bump the go-openapi-dependencies group across 2 directories with 1 update by @dependabot[bot] in #256 ...
build(deps): bump the development-dependencies group with 8 updates by @dependabot[bot] in #254 ...
build(deps): bump golang.org/x/net from 0.53.0 to 0.54.0 in the golang-org-dependencies group across 1 directory by @dependabot[bot] in #253 ...
build(deps): bump the go-openapi-dependencies group across 2 directories with 1 update by @dependabot[bot] in #249 ...

People who contributed to this release

@fredbi

strfmt license terms

Per-module changes

enable/mongodb (0.26.3)

Miscellaneous tasks

chore: prepare release v0.26.3 by @bot-go-openapi[bot] in #260 ...

Updates

build(deps): bump the other-dependencies group across 3 directories with 2 updates by @dependabot[bot] in #252 ...

internal/testintegration (0.26.3)

Miscellaneous tasks

chore: prepare release v0.26.3 by @bot-go-openapi[bot] in #260 ...

Updates

build(deps): bump the other-dependencies group across 3 directories with 2 updates by @dependabot[bot] in #252 ...
build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 in the golang-org-dependencies group across 1 directory by @dependabot[bot] in #255 ...
build(deps): bump the go-openapi-dependencies group across 2 directories with 1 update by @dependabot[bot] in #256 ...
build(deps): bump golang.org/x/net from 0.53.0 to 0.54.0 in the golang-org-dependencies group across 1 directory by @dependabot[bot] in #253 ...
build(deps): bump the go-openapi-dependencies group across 2 directories with 1 update by @dependabot[bot] in #249 ...

`v0.26.2`

Compare Source

0.26.2 - 2026-04-29

Full Changelog: go-openapi/strfmt@v0.26.1...v0.26.2

13 commits in this release.

Documentation

doc: aligned docs with org-wide documentation. by @fredbi in #247 ...
doc: updated contributors file by @bot-go-openapi[bot] in #239 ...
doc: add portable agentic instructions by @fredbi in #236 ...
doc: added portable agentic instructions by @fredbi in #235 ...

Performance

perf(duration): faster and stricter ParseDuration. by @fredbi in #246 ...

Miscellaneous tasks

chore: prepare release v0.26.2 by @bot-go-openapi[bot] in #248 ...
chore: bump go directive to 1.25.0 by @fredbi in #237 ...

Updates

build(deps): bump the other-dependencies group across 2 directories with 2 updates by @dependabot[bot] in #245 ...
build(deps): bump the development-dependencies group with 8 updates by @dependabot[bot] in #242 ...
build(deps): bump golang.org/x/net from 0.52.0 to 0.53.0 in the golang-org-dependencies group across 1 directory by @dependabot[bot] in #241 ...
build(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.1 in /internal/testintegration in the other-dependencies group across 1 directory by @dependabot[bot] in #240 ...
build(deps): bump the go-openapi-dependencies group across 2 directories with 1 update by @dependabot[bot] in #238 ...
build(deps): bump golang.org/x/net from 0.50.0 to 0.52.0 in the golang-org-dependencies group across 1 directory by @dependabot[bot] in #228 ...

People who contributed to this release

@fredbi

strfmt license terms

Per-module changes

enable/mongodb (0.26.2)

Miscellaneous tasks

chore: prepare release v0.26.2 by @bot-go-openapi[bot] in #248 ...
chore: bump go directive to 1.25.0 by @fredbi in #237 ...

Updates

build(deps): bump the other-dependencies group across 2 directories with 2 updates by @dependabot[bot] in #245 ...

internal/testintegration (0.26.2)

Miscellaneous tasks

chore: prepare release v0.26.2 by @bot-go-openapi[bot] in #248 ...
chore: bump go directive to 1.25.0 by @fredbi in #237 ...

Updates

build(deps): bump the other-dependencies group across 2 directories with 2 updates by @dependabot[bot] in #245 ...
build(deps): bump golang.org/x/net from 0.52.0 to 0.53.0 in the golang-org-dependencies group across 1 directory by @dependabot[bot] in #241 ...
build(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.1 in /internal/testintegration in the other-dependencies group across 1 directory by @dependabot[bot] in #240 ...
build(deps): bump the go-openapi-dependencies group across 2 directories with 1 update by @dependabot[bot] in #238 ...
build(deps): bump golang.org/x/net from 0.50.0 to 0.52.0 in the golang-org-dependencies group across 1 directory by @dependabot[bot] in #228 ...

google/go-containerregistry (github.com/google/go-containerregistry)

`v0.21.6`

Compare Source

What's Changed

fix: update dependencies to use new azure sdk components by @gaganhr94 in #2262
transport: restore resp.Body in retryError so CheckError can parse it by @alliasgher in #2264
pkg/registry: return 202 Accepted for PATCH chunk uploads by @alliasgher in #2265
Follow OCI distribution spec for artifactType and annotations by @malt3 in #2269
actions: attach Codecov token to coverage tests on main by @Subserial in #2270
remote: use DeleteScope (with "delete" action) for manifest deletion by @alliasgher in #2266
remote: limit concurrent layer pulls by @gnix0 in #2271
pkg/registry: reject corrupt disk blobs by @gnix0 in #2272
mutate: close layer readers during export by @gnix0 in #2277
crane/flatten: preserve image media type when flattening by @alliasgher in #2267
build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 in the actions group across 1 directory by @dependabot[bot] in #2273
build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 by @dependabot[bot] in #2278
build(deps): bump the go-deps group across 3 directories with 6 updates by @dependabot[bot] in #2280
Replace go-homedir with os.UserHomeDir by @jammie-jelly in #2282
pkg/name: only treat .localhost as non-HTTPS, not .local by @blackwell-systems in #2281
transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL by @marwan9696 in #2285
test(mutate): add Extract round-trip test for filesystem object preservation by @blackwell-systems in #2283
experiments: remove deprecated support for estargz by @thaJeztah in #2288
build(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 in the actions group by @dependabot[bot] in #2289
fix: limit HTTP response body reads to prevent OOM by @evilgensec in #2296
build(deps): bump the go-deps group across 3 directories with 6 updates by @dependabot[bot] in #2297
transport: block redirects from token server to private/link-local addresses (SSRF fix) by @evilgensec in #2292
pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract by @anishesg in #2279
validate: skip non-layer layers by @imjasonh in #2298
remote: validate foreign layer URLs to prevent SSRF (fixes #2259) by @evilgensec in #2293
remote: block SSRF via private-IP Location headers in blob uploads by @adilburaksen in #2295
fix(mutate): preserve config blob and layers for non-Docker OCI artifacts by @blackwell-systems in #2286
fix: preserve per-occurrence layer identity in mutate.Image.Layers() by @iahsanGill in #2299
transport: retry HTTP 429 (Too Many Requests) by @iahsanGill in #2301
transport: allow bearer realm at same host:port as registry by @iahsanGill in #2302
Update go version to 1.26.3 by @Subserial in #2300

New Contributors

@gaganhr94 made their first contribution in #2262
@alliasgher made their first contribution in #2264
@malt3 made their first contribution in #2269
@gnix0 made their first contribution in #2271
@blackwell-systems made their first contribution in #2281
@marwan9696 made their first contribution in #2285
@anishesg made their first contribution in #2279
@adilburaksen made their first contribution in #2295
@iahsanGill made their first contribution in #2299

Full Changelog: google/go-containerregistry@v0.21.5...v0.21.6

mattn/go-isatty (github.com/mattn/go-isatty)

`v0.0.22`

Compare Source

`v0.0.21`

Compare Source

package-url/packageurl-go (github.com/package-url/packageurl-go)

`v0.1.6`

Compare Source

`v0.1.5`

Compare Source

What's Changed

Remove version requirement for TypeSwift by @Talgarr in #90
Handle non-canonical input purls a bit more gracefully by @petergardfjall in #89

New Contributors

@Talgarr made their first contribution in #90

Full Changelog: package-url/packageurl-go@v0.1.4...v0.1.5

`v0.1.4`

Compare Source

What's Changed

Fix golangci and update versions by @shibumi in #76
Allow npm names to be case sensitive by @PFCM in #73
add custom validation for pkg:cpan by @petergardfjall in #79
move cpan to known types by @nikpivkin in #71
Run tests using reference data from purl-spec by @keshav-space in #80
update code to honor the canonical purl encoding by @petergardfjall in #83

New Contributors

@PFCM made their first contribution in #73
@nikpivkin made their first contribution in #71
@keshav-space made their first contribution in #80

Full Changelog: package-url/packageurl-go@v0.1.3...v0.1.4

sigstore/cosign (github.com/sigstore/cosign/v2)

`v2.4.3`

Compare Source

Features

Bump sigstore/sigstore to support KMS plugins (#4073)
Enable fetching signatures without remote get. (#4047)
Feat/file flag completion improvements (#4028)
Update builder to use go1.23.6 (#4052)

Bug Fixes

fix parsing error in --only for cosign copy (#4049)

Cleanup

Refactor verifyNewBundle into library function (#4013)
fix comment typo and imports order (#4061)
sync comment with parameter name in function signature (#4063)
sort properly Go imports (#4071)

Contributors

Bob Callaway
Carlos Tadeu Panato Junior
Cody Soyland
Dmitry Savintsev
Hayden B
Tomasz Janiszewski
Ville Skyttä

`v2.4.2`

Compare Source

Features

Updated open-policy-agent to 1.1.0 library (#4036)
- Note that only Rego v0 policies are supported at this time
Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
Add support for verifying root checksum in cosign initialize (#3953)
Detect if user supplied a valid protobuf bundle (#3931)
Add a log message if user doesn't provide --trusted-root (#3933)
Support mTLS towards container registry (#3922)
Add bundle create helper command (#3901)
Add trusted-root create helper command (#3876)

Bug Fixes

fix: set tls config while retaining other fields from default http transport (#4007)
policy fuzzer: ignore known panics (#3993)
Fix for multiple WithRemote options (#3982)
Add nightly conformance test workflow (#3979)
Fix copy --only for signatures + update/align docs (#3904)

Documentation

Remove usage.md from spec, point to client spec (#3918)
move reference from gcr to ghcr (#3897)

Contributors

AdamKorcz
Aditya Sirish
Bob Callaway
Carlos Tadeu Panato Junior
Cody Soyland
Colleen Murphy
Hayden B
Jussi Kukkonen
Marco Franssen
Nianyu Shen
Slavek Kabrda
Søren Juul
Warren Hodgkinson
Zach Steindler

sigstore/rekor (github.com/sigstore/rekor)

`v1.5.2`

Compare Source

Changelog

759b98e alpine: Enforce max size limit on decompression (#2831)
c7e77ee Support restricting kinds on insertion (#2814)
a10818a fix(trillianclient): strip dns:/// scheme from TLS ServerName in gRPC dial (#2812)
8a2f3a2 add checks to ensure returned entries match client inputs to rekor-cli (#2799)
0e88bac add nil pointer check to resolve fuzzing crash (#2807)
93da954 client: surface last-response details after retries are exhausted (#2796)
4d67ecd Fix internal error detail leakage in 500 responses (#2801)
b34ca94 add defensive check to ensure tid is in config ahead of getting client (#2795)
656c832 restapi: include inactiveShards in the homepage total count (#2797)

Thanks for all contributors!

`v1.5.1`

Compare Source

Features

optimize memory for DSSE v0.0.1 processing (#2766)

Bug Fixes

Type assert the entry bundle when verifying inclusion proof (#2755)
return correct errors in rare failure situations (#2753)
raise error if decoding hash fails during inclusion proof (#2754)

sigstore/sigstore (github.com/sigstore/sigstore)

`v1.10.8`

Compare Source

What's Changed

Support standard PKCS#8 encrypted private key decryption in #2333

Full Changelog: sigstore/sigstore@v1.10.7...v1.10.8

`v1.10.7`

Compare Source

What's Changed

add functional options to DSSE to improve memory usage, validation in #2326
Extend PEM private key unmarshalling to support legacy format in #2332

Full Changelog: sigstore/sigstore@v1.10.6...v1.10.7

`v1.10.6`

Compare Source

What's Changed

fix: remove leftover Go template syntax from success page by @imjasonh in #2324

Full Changelog: sigstore/sigstore@v1.10.5...v1.10.6

tektoncd/chains (github.com/tektoncd/chains)

`v0.26.4`: Tekton Chains "Release v0.26.4"

Compare Source

Tekton Chains "Release v0.26.4"

-Docs @ v0.26.4
-Examples @ v0.26.4

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/chains/previous/v0.26.4/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a530b574bc14f60d678f287e5f81e8707750ea0808ede65f1f7a4add3183e74a1

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a530b574bc14f60d678f287e5f81e8707750ea0808ede65f1f7a4add3183e74a1
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/chains/previous/v0.26.4/release.yaml
REKOR_UUID=108e9186e8c5677a530b574bc14f60d678f287e5f81e8707750ea0808ede65f1f7a4add3183e74

> ✂ **Note**
> 
> PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/conforma/cli).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My40My4yIiwidXBkYXRlZEluVmVyIjoiNDMuMjAyLjEiLCJ0YXJnZXRCcmFuY2giOiJyZWxlYXNlLXYwLjciLCJsYWJlbHMiOlsicmVsZWFzZS12MC43IiwicmVub3ZhdGUiXX0=-->

renovate · 2026-03-02T02:08:40Z

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

45 additional dependencies were updated

Details:

Package	Change
`github.com/go-openapi/strfmt`	`v0.25.0` -> `v0.26.2`
`github.com/secure-systems-lab/go-securesystemslib`	`v0.10.0` -> `v0.11.0`
`github.com/gkampitakis/ciinfo`	`v0.3.2` -> `v0.3.4`
`github.com/go-chi/chi/v5`	`v5.2.4` -> `v5.2.5`
`github.com/go-openapi/analysis`	`v0.24.1` -> `v0.25.0`
`github.com/go-openapi/errors`	`v0.22.6` -> `v0.22.7`
`github.com/go-openapi/jsonpointer`	`v0.22.4` -> `v0.22.5`
`github.com/go-openapi/jsonreference`	`v0.21.4` -> `v0.21.5`
`github.com/go-openapi/loads`	`v0.23.2` -> `v0.23.3`
`github.com/go-openapi/runtime`	`v0.29.2` -> `v0.29.4`
`github.com/go-openapi/spec`	`v0.22.3` -> `v0.22.4`
`github.com/go-openapi/swag`	`v0.25.4` -> `v0.26.0`
`github.com/go-openapi/swag/cmdutils`	`v0.25.4` -> `v0.26.0`
`github.com/go-openapi/swag/conv`	`v0.25.4` -> `v0.26.0`
`github.com/go-openapi/swag/fileutils`	`v0.25.4` -> `v0.26.0`
`github.com/go-openapi/swag/jsonname`	`v0.25.4` -> `v0.26.0`
`github.com/go-openapi/swag/jsonutils`	`v0.25.4` -> `v0.26.0`
`github.com/go-openapi/swag/loading`	`v0.25.4` -> `v0.26.0`
`github.com/go-openapi/swag/mangling`	`v0.25.4` -> `v0.26.0`
`github.com/go-openapi/swag/netutils`	`v0.25.4` -> `v0.26.0`
`github.com/go-openapi/swag/stringutils`	`v0.25.4` -> `v0.26.0`
`github.com/go-openapi/swag/typeutils`	`v0.25.4` -> `v0.26.0`
`github.com/go-openapi/swag/yamlutils`	`v0.25.4` -> `v0.26.0`
`github.com/go-openapi/validate`	`v0.25.1` -> `v0.25.2`
`github.com/go-viper/mapstructure/v2`	`v2.4.0` -> `v2.5.0`
`github.com/goccy/go-yaml`	`v1.18.0` -> `v1.19.2`
`github.com/letsencrypt/boulder`	`v0.20251110.0` -> `v0.20260223.0`
`github.com/maruel/natural`	`v1.1.1` -> `v1.3.0`
`github.com/sigstore/protobuf-specs`	`v0.5.0` -> `v0.5.1`
`github.com/tidwall/gjson`	`v1.18.0` -> `v1.19.0`
`go.opentelemetry.io/otel`	`v1.42.0` -> `v1.43.0`
`go.opentelemetry.io/otel/metric`	`v1.42.0` -> `v1.43.0`
`go.uber.org/zap`	`v1.27.1` -> `v1.28.0`
`golang.org/x/crypto`	`v0.49.0` -> `v0.50.0`
`golang.org/x/net`	`v0.52.0` -> `v0.53.0`
`golang.org/x/oauth2`	`v0.35.0` -> `v0.36.0`
`golang.org/x/sys`	`v0.42.0` -> `v0.43.0`
`golang.org/x/term`	`v0.41.0` -> `v0.42.0`
`golang.org/x/text`	`v0.35.0` -> `v0.36.0`
`golang.org/x/time`	`v0.14.0` -> `v0.15.0`
`google.golang.org/api`	`v0.260.0` -> `v0.274.0`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20251222181119-0a764e51fe1b` -> `v0.0.0-20260401024825-9d38bb4040a9`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20251222181119-0a764e51fe1b` -> `v0.0.0-20260401024825-9d38bb4040a9`
`google.golang.org/grpc`	`v1.79.3` -> `v1.80.0`
`k8s.io/klog/v2`	`v2.130.1` -> `v2.140.0`

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

67 additional dependencies were updated

Details:

Package	Change
`github.com/secure-systems-lab/go-securesystemslib`	`v0.10.0` -> `v0.11.0`
`golang.org/x/net`	`v0.52.0` -> `v0.53.0`
`k8s.io/klog/v2`	`v2.130.1` -> `v2.140.0`
`cloud.google.com/go/auth`	`v0.18.2` -> `v0.19.0`
`cloud.google.com/go/iam`	`v1.5.3` -> `v1.7.0`
`cloud.google.com/go/storage`	`v1.61.3` -> `v1.62.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.30.0` -> `v1.31.0`
`github.com/aws/aws-sdk-go-v2`	`v1.41.4` -> `v1.41.6`
`github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream`	`v1.7.7` -> `v1.7.8`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.12` -> `v1.32.14`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.19.12` -> `v1.19.14`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.20` -> `v1.18.21`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.4.20` -> `v1.4.22`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.20` -> `v2.7.22`
`github.com/aws/aws-sdk-go-v2/internal/v4a`	`v1.4.21` -> `v1.4.22`
`github.com/aws/aws-sdk-go-v2/service/ecr`	`v1.32.2` -> `v1.40.3`
`github.com/aws/aws-sdk-go-v2/service/ecrpublic`	`v1.25.4` -> `v1.31.2`
`github.com/aws/aws-sdk-go-v2/service/internal/checksum`	`v1.9.12` -> `v1.9.13`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.13.20` -> `v1.13.21`
`github.com/aws/aws-sdk-go-v2/service/internal/s3shared`	`v1.19.20` -> `v1.19.21`
`github.com/aws/aws-sdk-go-v2/service/s3`	`v1.97.1` -> `v1.97.3`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.0.8` -> `v1.0.9`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.30.13` -> `v1.30.15`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.35.17` -> `v1.35.19`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.41.9` -> `v1.41.10`
`github.com/aws/smithy-go`	`v1.24.2` -> `v1.25.0`
`github.com/awslabs/amazon-ecr-credential-helper/ecr-login`	`v0.0.0-20240826150212-5dc58b6e29f8` -> `v0.9.1`
`github.com/clipperhouse/displaywidth`	`v0.6.0` -> `v0.10.0`
`github.com/clipperhouse/uax29/v2`	`v2.3.0` -> `v2.6.0`
`github.com/gkampitakis/ciinfo`	`v0.3.2` -> `v0.3.4`
`github.com/go-chi/chi/v5`	`v5.2.4` -> `v5.2.5`
`github.com/go-openapi/analysis`	`v0.24.3` -> `v0.25.0`
`github.com/go-openapi/runtime`	`v0.29.2` -> `v0.29.4`
`github.com/go-openapi/swag`	`v0.25.4` -> `v0.26.0`
`github.com/go-openapi/swag/cmdutils`	`v0.25.4` -> `v0.26.0`
`github.com/go-openapi/swag/conv`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/fileutils`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/jsonname`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/jsonutils`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/loading`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/mangling`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/netutils`	`v0.25.4` -> `v0.26.0`
`github.com/go-openapi/swag/stringutils`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/typeutils`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/yamlutils`	`v0.25.5` -> `v0.26.0`
`github.com/goccy/go-yaml`	`v1.18.0` -> `v1.19.2`
`github.com/googleapis/gax-go/v2`	`v2.17.0` -> `v2.22.0`
`github.com/maruel/natural`	`v1.1.1` -> `v1.3.0`
`github.com/olekukonko/errors`	`v1.1.0` -> `v1.2.0`
`github.com/olekukonko/ll`	`v0.1.3` -> `v0.1.6`
`github.com/olekukonko/tablewriter`	`v1.1.2` -> `v1.1.4`
`github.com/sigstore/fulcio`	`v1.6.3` -> `v1.6.6`
`github.com/sigstore/protobuf-specs`	`v0.5.0` -> `v0.5.1`
`github.com/tidwall/gjson`	`v1.18.0` -> `v1.19.0`
`go.uber.org/zap`	`v1.27.1` -> `v1.28.0`
`golang.org/x/crypto`	`v0.49.0` -> `v0.50.0`
`golang.org/x/sys`	`v0.42.0` -> `v0.43.0`
`golang.org/x/term`	`v0.41.0` -> `v0.42.0`
`golang.org/x/text`	`v0.35.0` -> `v0.36.0`
`google.golang.org/api`	`v0.271.0` -> `v0.274.0`
`google.golang.org/genproto`	`v0.0.0-20260128011058-8636f8732409` -> `v0.0.0-20260319201613-d00831a3d3e7`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260203192932-546029d2fa20` -> `v0.0.0-20260401024825-9d38bb4040a9`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260226221140-a57be14db171` -> `v0.0.0-20260401024825-9d38bb4040a9`
`google.golang.org/grpc`	`v1.79.3` -> `v1.80.0`
`gopkg.in/ini.v1`	`v1.67.1` -> `v1.67.2`
`k8s.io/api`	`v0.34.3` -> `v0.34.8`
`sigs.k8s.io/release-utils`	`v0.12.3` -> `v0.12.4`

File name: tools/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated

Details:

Package	Change
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.30.0` -> `v1.31.0`
`google.golang.org/grpc`	`v1.79.3` -> `v1.80.0`

File name: tools/kubectl/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated

Details:

Package	Change
`go.opentelemetry.io/otel`	`v1.35.0` -> `v1.41.0`
`go.opentelemetry.io/otel/trace`	`v1.35.0` -> `v1.41.0`

renovate · 2026-05-27T08:27:42Z

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: acceptance/go.sum

Command failed: go mod tidy
go: downloading github.com/go-openapi/testify/v2 v2.4.2
go: downloading go.etcd.io/etcd/client/pkg/v3 v3.6.5
go: downloading go.etcd.io/etcd/client/v3 v3.6.5
go: downloading github.com/evanphx/json-patch v5.9.0+incompatible
go: downloading go.etcd.io/etcd/api/v3 v3.6.5
go: downloading cuelabs.dev/go/oci/ociregistry v0.0.0-20250722084951-074d06050084
go: downloading github.com/emicklei/proto v1.14.2
go: downloading github.com/protocolbuffers/txtpbfmt v0.0.0-20251016062345-16587c79cd91
go: finding module for package knative.dev/pkg/metrics
go: finding module for package knative.dev/pkg/tracing/config
go: github.com/conforma/cli/acceptance/kubernetes/kind imports
	github.com/tektoncd/cli/pkg/formatted tested by
	github.com/tektoncd/cli/pkg/formatted.test imports
	github.com/tektoncd/cli/pkg/test imports
	github.com/tektoncd/triggers/test imports
	github.com/tektoncd/triggers/pkg/reconciler/eventlistener/resources imports
	knative.dev/eventing/pkg/reconciler/source imports
	knative.dev/pkg/metrics: module knative.dev/pkg@latest found (v0.0.0-20260529191007-91499a17111f), but does not contain package knative.dev/pkg/metrics
go: github.com/conforma/cli/acceptance/kubernetes/kind imports
	github.com/tektoncd/cli/pkg/formatted tested by
	github.com/tektoncd/cli/pkg/formatted.test imports
	github.com/tektoncd/cli/pkg/test imports
	github.com/tektoncd/triggers/test imports
	github.com/tektoncd/triggers/pkg/reconciler/eventlistener/resources imports
	knative.dev/eventing/pkg/reconciler/source imports
	knative.dev/pkg/tracing/config: module knative.dev/pkg@latest found (v0.0.0-20260529191007-91499a17111f), but does not contain package knative.dev/pkg/tracing/config

File name: tools/go.sum

Command failed: go mod tidy
go: downloading github.com/dlclark/regexp2 v1.11.0
go: downloading go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.39.0
go: downloading github.com/tidwall/gjson v1.14.2
go: downloading github.com/alecthomas/repr v0.4.0
go: downloading github.com/tidwall/pretty v1.2.0
go: downloading github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6
go: finding module for package knative.dev/pkg/metrics
go: finding module for package knative.dev/pkg/tracing/config
go: github.com/conforma/cli/tools imports
	github.com/tektoncd/cli/cmd/tkn imports
	github.com/tektoncd/cli/pkg/cmd imports
	github.com/tektoncd/cli/pkg/cmd/clustertriggerbinding tested by
	github.com/tektoncd/cli/pkg/cmd/clustertriggerbinding.test imports
	github.com/tektoncd/triggers/test imports
	github.com/tektoncd/triggers/pkg/reconciler/eventlistener/resources imports
	knative.dev/eventing/pkg/reconciler/source imports
	knative.dev/pkg/metrics: module knative.dev/pkg@latest found (v0.0.0-20260529191007-91499a17111f), but does not contain package knative.dev/pkg/metrics
go: github.com/conforma/cli/tools imports
	github.com/tektoncd/cli/cmd/tkn imports
	github.com/tektoncd/cli/pkg/cmd imports
	github.com/tektoncd/cli/pkg/cmd/clustertriggerbinding tested by
	github.com/tektoncd/cli/pkg/cmd/clustertriggerbinding.test imports
	github.com/tektoncd/triggers/test imports
	github.com/tektoncd/triggers/pkg/reconciler/eventlistener/resources imports
	knative.dev/eventing/pkg/reconciler/source imports
	knative.dev/pkg/tracing/config: module knative.dev/pkg@latest found (v0.0.0-20260529191007-91499a17111f), but does not contain package knative.dev/pkg/tracing/config

renovate Bot added release-v0.7 renovate labels Mar 2, 2026

renovate Bot enabled auto-merge March 2, 2026 02:08

github-actions Bot added the size: L label Mar 2, 2026

renovate Bot force-pushed the renovate/release-v0.7-patch-go-modules branch 5 times, most recently from bb1e687 to 608b025 Compare March 10, 2026 03:21

renovate Bot force-pushed the renovate/release-v0.7-patch-go-modules branch 4 times, most recently from cb09e7b to 2bdf2b5 Compare March 19, 2026 11:20

renovate Bot force-pushed the renovate/release-v0.7-patch-go-modules branch 4 times, most recently from d17ae93 to 9539d46 Compare April 2, 2026 01:41

renovate Bot force-pushed the renovate/release-v0.7-patch-go-modules branch 9 times, most recently from e56c120 to 31ef858 Compare April 14, 2026 09:15

renovate Bot force-pushed the renovate/release-v0.7-patch-go-modules branch from 31ef858 to a411eb7 Compare April 15, 2026 10:40

github-actions Bot added size: M and removed size: L labels Apr 15, 2026

renovate Bot force-pushed the renovate/release-v0.7-patch-go-modules branch 14 times, most recently from 89a7b2c to 6d3b435 Compare April 27, 2026 22:44

renovate Bot force-pushed the renovate/release-v0.7-patch-go-modules branch 6 times, most recently from 46956c6 to dedcec3 Compare May 5, 2026 20:46

renovate Bot force-pushed the renovate/release-v0.7-patch-go-modules branch 7 times, most recently from 565c5de to 89371f7 Compare May 15, 2026 14:43

renovate Bot force-pushed the renovate/release-v0.7-patch-go-modules branch from 89371f7 to 2729ee7 Compare May 15, 2026 21:47

Update go modules

9cafc7f

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update go modules (release-v0.7) (patch)#3146

Update go modules (release-v0.7) (patch)#3146
renovate[bot] wants to merge 1 commit into
release-v0.7from
renovate/release-v0.7-patch-go-modules

renovate Bot commented Mar 2, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Mar 2, 2026 •

edited

Loading

Uh oh!

renovate Bot commented May 27, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Language

Evaluator

cmd/cue

Go API

What's Changed

New Contributors

What's Changed

What's Changed

0.26.3 - 2026-05-31

Documentation

Miscellaneous tasks

Updates

People who contributed to this release

Per-module changes

enable/mongodb (0.26.3)

Miscellaneous tasks

Updates

internal/testintegration (0.26.3)

Miscellaneous tasks

Updates

0.26.2 - 2026-04-29

Documentation

Performance

Miscellaneous tasks

Updates

People who contributed to this release

Per-module changes

enable/mongodb (0.26.2)

Miscellaneous tasks

Updates

internal/testintegration (0.26.2)

Miscellaneous tasks

Updates

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

Features

Bug Fixes

Cleanup

Contributors

Features

Bug Fixes

Documentation

Contributors

Changelog

Thanks for all contributors!

Features

Bug Fixes

What's Changed

What's Changed

What's Changed

v0.26.4: Tekton Chains "Release v0.26.4"

Installation one-liner

Attestation

Uh oh!

renovate Bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: acceptance/go.mod

File name: go.mod

File name: tools/go.mod

File name: tools/kubectl/go.mod

Uh oh!

renovate Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: acceptance/go.sum

File name: tools/go.sum

Uh oh!

Reviewers

Assignees

Labels

Projects

renovate Bot commented Mar 2, 2026 •

edited

Loading

`cmd/cue`

`v0.26.4`: Tekton Chains "Release v0.26.4"

renovate Bot commented Mar 2, 2026 •

edited

Loading

renovate Bot commented May 27, 2026 •

edited

Loading