Skip to content

Update go modules (release-v0.7) (minor)#3157

Open
renovate[bot] wants to merge 1 commit into
release-v0.7from
renovate/release-v0.7-go-modules
Open

Update go modules (release-v0.7) (minor)#3157
renovate[bot] wants to merge 1 commit into
release-v0.7from
renovate/release-v0.7-go-modules

Conversation

@renovate

@renovate renovate Bot commented Mar 4, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence Type Update
cuelang.org/go v0.16.0v0.17.0 age adoption passing confidence require minor
cuelang.org/go v0.15.1v0.17.0 age adoption passing confidence require minor
github.com/CycloneDX/cyclonedx-go v0.10.0v0.11.0 age adoption passing confidence require minor
github.com/conforma/go-containerregistry v0.20.7-0.20250703195040-6f40a3734728v0.21.7 age adoption passing confidence replace minor
github.com/conforma/go-gather v1.0.2v1.2.0 age adoption passing confidence require minor
github.com/daixiang0/gci v0.13.7v0.14.0 age adoption passing confidence require minor
github.com/go-git/go-billy/v5 v5.8.0v5.9.0 age adoption passing confidence require minor
github.com/go-git/go-git/v5 v5.17.1v5.19.1 age adoption passing confidence require minor
github.com/go-openapi/strfmt v0.25.0v0.26.3 age adoption passing confidence require minor
github.com/konflux-ci/application-api e7eb2ecdd8c9b1 age adoption passing confidence require digest
github.com/moby/go-archive v0.1.0v0.2.0 age adoption passing confidence replace minor
github.com/open-policy-agent/conftest v0.66.0v0.68.2 age adoption passing confidence require minor
github.com/open-policy-agent/opa v1.15.2v1.18.1 age adoption passing confidence require minor
github.com/pkg/diff 20ebb0f4e6772a age adoption passing confidence require digest
github.com/secure-systems-lab/go-securesystemslib v0.10.0v0.11.0 age adoption passing confidence require minor
github.com/sigstore/cosign/v2 v2.4.1v2.6.3 age adoption passing confidence require minor
github.com/tektoncd/chains v0.26.2v0.27.1 age adoption passing confidence require minor
github.com/tektoncd/cli v0.44.1v0.45.0 age adoption passing confidence require minor
github.com/tektoncd/cli v0.44.0v0.45.0 age adoption passing confidence require minor
github.com/testcontainers/testcontainers-go v0.34.1v0.43.0 age adoption passing confidence require minor
github.com/testcontainers/testcontainers-go/modules/registry v0.34.0v0.43.0 age adoption passing confidence require minor
github.com/wiremock/go-wiremock v1.11.0v1.16.0 age adoption passing confidence require minor
golang.org/x/benchmarks a2b48b63558132 age adoption passing confidence require digest
golang.org/x/exp 7ab1446c48552f age adoption passing confidence require digest
golang.org/x/net v0.53.0v0.56.0 age adoption passing confidence require minor
golang.org/x/sync v0.20.0v0.21.0 age adoption passing confidence require minor
gotest.tools/gotestsum v1.12.3v1.13.0 age adoption passing confidence require minor
helm.sh/helm/v3 v3.20.2v3.21.2 age adoption passing confidence require minor
k8s.io/api v0.35.4v0.36.2 age adoption passing confidence require minor
k8s.io/apiextensions-apiserver v0.35.4v0.36.2 age adoption passing confidence require minor
k8s.io/apimachinery v0.35.4v0.36.2 age adoption passing confidence require minor
k8s.io/client-go v0.35.4v0.36.2 age adoption passing confidence require minor
k8s.io/klog/v2 v2.130.1v2.140.0 age adoption passing confidence require minor
k8s.io/kube-openapi 589584f8f3fa49 age adoption passing confidence require digest
k8s.io/kubernetes v1.34.3v1.36.2 age adoption passing confidence require minor
sigs.k8s.io/kind v0.26.0v0.32.0 age adoption passing confidence require minor
sigs.k8s.io/kustomize/api v0.20.1v0.21.1 age adoption passing confidence require minor
sigs.k8s.io/kustomize/kustomize/v5 v5.7.1v5.8.1 age adoption passing confidence require minor
sigs.k8s.io/kustomize/kyaml v0.20.1v0.21.1 age adoption passing confidence require minor

Release Notes

cue-lang/cue (cuelang.org/go)

v0.17.0

Compare Source

Changes which may break some users are marked below with: ⚠️

Language

The active try experiment renames the new fallback keyword, used with for comprehensions, to otherwise. fallback continues to be accepted for now, but is rewritten to the new form.

The active aliasv2 experiment now allows ~(X) as an alternative to ~X for the single postfix alias form. ~X is also rewritten as ~(X) for the sake of consistency and clarity.

Language versions v0.17.0 and later allow omitting commas in multi-line lists. Just like a newline after a struct field implies a comma, a newline after a list element now implies a comma as well.

Language versions v0.17.0 and later allow a newline or a comma before the closing bracket of an index expression, matching how lists and func arguments allow omitting trailing commas.

The language spec is tweaked to make $ a valid identifier, which was already allowed by the parser and evaluator.

⚠️ Support for the infix div, mod, quo, and rem operators has been removed. Since late 2020, these infix forms have been undocumented and rewritten by cue fix to the new function calls.

The new shortcircuit experiment

This release introduces the shortcircuit experiment, which changes the && and || operators to not evaluate the right operand if the left operand alone determines the result.

This matches the behavior already documented in the CUE spec and is consistent with most mainstream languages, but for the sake of a smooth transition for end users, we are rolling out this change via an experiment.

You can try this experiment via the @experiment(shortcircuit) file attribute. To mimic the old behavior with the experiment, you can use a hidden field:

_y: Y
if X && _y {}

Evaluator

Comprehensions

The comprehension algorithm now waits to run a comprehension's body until the fields it reads have a concrete value, rather than trying to produce its fields up front. This resolves a number of long-standing bugs, most notably the last known regressions from evalv2, where a comprehension that should have resolved instead failed as an incomplete value or a cycle.

This design also greatly simplifies upcoming evaluator work, such as introducing new builtins to replace comparing values to bottom, as well as the design of evalv4.

Other changes

The evaluator no longer deduplicates errors just by position, which was causing some useful errors from disjunctions or standard library calls to be dropped incorrectly.

Several long-standing cycle-detection bugs have been fixed, such as self-referential uses of matchN and matchIf, self-feeding disjunctions, and comprehensions that read a let binding which refers back to the comprehension's own fields.

Fixed a bug where the same package imported via different qualified import paths (e.g. foo.com/bar@v0 or foo.com/bar:baz) did not share the same hidden field namespace.

Resolving an unversioned import from a dependency module now respects that module's own default major version, instead of always using the main module's default.

Fix a number of issues where cue def could produce invalid CUE output, such as due to name conflicts.

Fix an evaluator regression where embedded disjunctions across packages may not correctly apply closedness.

Fix an evaluator bug where cue.Context.BuildExpr of close({}) did not actually result in a closed struct.

Fix a bug where some calls to standard library functions or validators did not include the "error in call to pkg.Func" error context, or included it twice.

A few changes to the evaluator should reduce allocated objects by up to 16%, reducing GC overhead and memory usage.

To ease the transition into the new formatter we plan to release with v0.18, CUE_EXPERIMENT=formatv2=0 is now allowed as a no-op.

A number of other bugs, panics, and hangs have been resolved as well.

cmd/cue

Module replaces

CUE now supports substituting a module dependency with a local directory or a different remote module during development - for example while testing a fix to a dependency before it is published, or to replace a dependency with a fork including improvements.

This configuration lives in cue.mod/local-module.cue, which is excluded when publishing to registries. cue mod edit and cue mod tidy gain support for maintaining this file.

We have also published a how-to guide on replacing a dependency with a local module.

Read the full design doc in the proposal, or read the cue.mod/local-module.cue reference docs.

Other changes

The new global -C or --chdir flag runs cue from the given working directory.

Command input parsing is improved so that CUE packages can come after data files, such as cue vet -c data.yaml ./schema.

cue import --with-context now ensures that data represents the original raw input data, and not its interpretation like JSON Schema.
cue import --path now skips over null values in an input stream, such as empty documents in a YAML file.

Fix a bug where the flag cue export --path was ignored when the inputs were pure CUE.

The new cue exp gengotypes --outfile flag controls the output file path when generating a single package.

cue vet -d/--schema now supports hidden fields, and correctly reports an error when the command inputs are CUE only.

cue fix and cue trim no longer change file modification times when no changes are necessary.

A $CUE_CACHE_DIR directory is no longer required when loading CUE without external dependencies.

The "filetypes" lookup tables now use a more compact encoding, saving about 150KiB in binary size for cmd/cue as well as Go API users.

LSP server

Add an initial version of organize-imports, which sorts the existing imports and removes unneeded imports. It is not yet capable of suggesting missing imports.

Wait for a short period of inactivity before sending diagnostics to the editor. This "debounce" means that a user typing incomplete CUE syntax will not be distracted with syntax errors as much.

The aliasv2 experiment is now fully supported.

The rename function is fixed to distinguish between field names and aliases.

Improve field name analysis in general so that fields with multiple aliases (e.g. v=[k=string]: _) are properly supported.

Improve attribute handling for file-level embedded attributes, and to attach attributes within expressions to the correct struct.

Treat conjunctions (&) and disjunctions (|) the same way for goto-definition. With the cursor on a path, it returns all results that the path MAY resolve to. With the cursor on a field declaration name, it returns all results that the path constructed from the field's name, and its field's name (and so on) MAY resolve to.

Special-case close function calls so that paths can resolve through fields within the argument to close.

Encodings

⚠️ The experimental JSON Schema encoder now emits most definitions without the leading # character, shortening names and ensuring compatibility with the wider JSON Schema ecosystem. This required deprecating encoding/jsonschema.GenerateConfig.NameFunc in favor of NamesFunc.

The JSON Schema encoder is improved to support list.UniqueItems and standalone validators, to use maxItems and minItems instead of maxLength and minLength for lists with prefix elements, and to generate description keywords for doc comments.

Several closedness bugs in the JSON Schema encoder have been fixed, ensuring that the generated JSON Schema behaves the same way as the original CUE definition.

The JSON Schema decoder is improved to better handle the prefixItems keyword.

The ProtoBuf decoder now resolves relative references following the usual scoping rules, instead of always resolving them against the top-level scope.

Standard library

Add time.ToUnix and time.ToUnixNano, which convert an RFC3339Nano time value into seconds or nanoseconds since the Unix epoch, complementing the existing Unix builtin.

strconv.FormatFloat now accepts a string format parameter, like FormatFloat(3.14, "e", 4, 64).

list.MatchN now shows what expected value it's matching against when it fails.

The net IP APIs now consistently return an error on invalid input types.

Go API

Using cue.Values concurrently is now fully supported, which required deprecating cue.Value.Context. If you encounter any races or bugs, please report them via the issue tracker.

cue/load now supports loading from an io/fs.FS, as outlined in proposal #​4285. Loading file embeds through Config.Overlay and Config.FS is supported now as well.

cue/ast/astutil deprecates Sanitize in favor of the new SanitizeFiles API, given that Sanitize on a single file cannot know if another file in the same package shadows builtin names like self.

Add Path.Compare and Selector.Compare, providing allocation-free total ordering suitable for slices.SortFunc.

Clarify that cue/format indents with a tab width of 4 by default.

A new fuzzer has been introduced in the cue package, checking that the parser doesn't crash and that its results are consistent with the rest of the Go APIs like cue/literal. So far, it has already resulted in seventeen bug fixes.

The cue.Interpreter option API has been deprecated in favor of cue.WithInjection, which is a better name going forward.

⚠️ cue/ast.File.Imports, deprecated in mid 2025 in favor of cue/ast.File.ImportSpecs, is now removed.

⚠️ The long-deprecated and hidden cue.Instance methods Lookup, LookupDef, LookupField, and Fill are now removed.

⚠️ The modconfig.Registry interface is changed to report default major versions, which is required for resolving unversioned imports against each dependency module's own defaults. Clients that implement or wrap the interface will need to update. The new interface is future-proofed for upcoming modules changes.

Full list of changes since v0.16.0
  • [release-branch.v0.17] internal/mod: resolve module replacements via minimum-version selection by @​rogpeppe in 0fc639b
  • cue/format: revert #​4296 regression test by @​mvdan in e73658d
  • cue/format: revert manual-AST field alignment fix by @​mvdan in c3f08a1
  • cue/format: revert issue #​1006 test cases by @​mvdan in 60e1bb7
  • cue/format: revert list and call argument column alignment fix by @​mvdan in 3f7aafe
  • cue/format: revert spurious empty line fix by @​mvdan in e2eb7f5
  • cue/format: revert Option-behavior test by @​mvdan in 0fa6c09
  • cue/format: revert default tab width change from 8 to 4 by @​mvdan in 1e07f16
  • cue/format: revert multiline string interpolation indentation fix by @​mvdan in 7190842
  • internal/cueexperiment: teach v0.17 about the formatv2 experiment by @​mvdan in 8d2db9d
  • cmd/cue: test sharing CUE_EXPERIMENT=formatv2 across v0.17 and v0.18 by @​mvdan in ac083b5
  • Revert "internal/core/compile: return Disjunction directly from or() builtin" by @​mvdan in bc31ef8
  • all: hide the "ini" decoder for v0.17 by @​mvdan in 0f15eed
  • internal/core/compile: re-run with CUE_UPDATE=1 by @​mvdan in 4bec06b
  • all: stop using "directive" terminology for module replaces by @​mvdan in 9916719
  • cmd/cue: test that mod publish rejects an invalid module path by @​mvdan in 376a328
  • mod/modfile: rename the local-module.cue replace field to replaceWith by @​mvdan in b32aca7
  • internal/ci: stop running trybot jobs with pull_request_target by @​mvdan in 61bcbc9
  • internal/filetypes: shrink embedded toFile lookup tables by @​mvdan in 01907a9
  • internal/core/adt: do not freeze fieldSetKnown while an own field task is pending by @​mvdan in 906c3e9
  • cue/testdata/eval: add test for issue 4392 list-in-let freeze regression by @​mvdan in 7d77fe7
  • mod/modzip: reject a downloaded module containing local-module.cue by @​rogpeppe in 4d73286
  • cue/cmd: more replacement test cases by @​rogpeppe in a4372d3
  • cmd/cue: reject non-string label values for --path by @​mvdan in 5a0f4f7
  • cmd/cue: add test for --path with a non-string label value by @​mvdan in 772d1d3
  • update dependencies ahead of v0.17.0-alpha.3 by @​mvdan in b7d1625
  • cmd/cue: drop github.com/google/shlex test dependency by @​mvdan in 69bf7d7
  • cue/load: accept package arguments after file arguments by @​mvdan in dd80111
  • cmd/cue: add test for package arguments listed after files by @​mvdan in ed3622b
  • internal/cuetxtar: port old stats framework by @​mpvl in 489b249
  • encoding/ini: pass token.Pos through the decoder directly by @​mvdan in 91a3f18
  • encoding/ini: minor decoder cleanups by @​mvdan in 5b8ba6e
  • encoding/ini: reject section and property name collisions by @​mvdan in eb8ac73
  • cue/testdata: add missing error output for issue2627 by @​mpvl in 092c281
  • Revert "cue/errors: augment paths of wrapped errors" by @​mvdan in a361a5b
  • cmd/cue: add replace directive support to mod edit by @​rogpeppe in 9984dae
  • internal/mod/modload,mod/modzip,cmd/cue: tidy and publish two-file modules by @​rogpeppe in 5adf7f5
  • mod/modfile,cue/load: read replace directives from local-module.cue by @​rogpeppe in 12ecd27
  • all: add core plumbing for module replace directives by @​rogpeppe in 74d78c1
  • cue/build,cue/load: fix hidden-field namespace for versioned imports by @​rogpeppe in b159ed1
  • cue/testdata: add regression test for issue #​2937 by @​mvdan in 39d5c4e
  • cue/errors: augment paths of wrapped errors by @​mvdan in 71c13d2
  • pkg/encoding/json: add test for Validate hiding the failing field by @​mvdan in 8507be6
  • pkg/time: add ToUnix and ToUnixNano builtins by @​mvdan in d5a3fb7
  • cmd/cue: honor -l/--path when exporting CUE values by @​mvdan in 0abb86e
  • cmd/cue: add test for export -l with CUE output by @​mvdan in 14d7d4d
  • all: make more use of string cut/trim/contains APIs by @​mvdan in 40ad26f
  • internal/mod/modpkgload,cue/load: resolve major version defaults per module by @​rogpeppe in b24b39c
  • cue: format builtin call's function operand as a bare reference by @​mvdan in 7392c8e
  • cue: add test for builtin call function operand formatting by @​mvdan in 72ff12b
  • cue/parser: support try clauses in list literals by @​mvdan in b0a4125
  • cmd/cue: point to 'cue help flags' from the --with-context flag by @​mvdan in 8b9f8be
  • cmd/cue: evaluate --with-context labels against the source data by @​mvdan in 9bb021f
  • mod/modconfig: lazily initialize registry clients by @​mvdan in 44f24f1
  • cmd/cue: test various command scenarios without cache/config dirs by @​mvdan in 445c76d
  • cmd/cue: add test for label references with jsonschema import by @​mvdan in f33b9de
  • internal: only wrap over-long generated comment lines by @​mvdan in b682521
  • encoding/jsonschema: add test for doc comment reflow by @​mvdan in fa683ed
  • internal/core/adt: handle cycle placeholder for composite builtins by @​mpvl in 32244d1
  • internal/core/adt: guard nodeContext free on refCount by @​mpvl in 03748aa
  • internal/cuetxtar: fix inline runner writeStruct cycle and BasicType embed by @​mpvl in afa5272
  • cue/testdata: add test case demonstrating #​2627 reopen by @​mpvl in 684e354
  • internal/core/adt: resolve imports to a per-evaluation instance by @​mvdan in 86eb4f1
  • cmd/cue: add test cases for issues 4370 and 4371 by @​rogpeppe in 230bbbb
  • internal/mod: minor module-related code improvements by @​rogpeppe in 964c012
  • internal/core/adt: test optional field referencing pushed-down comprehension by @​mvdan in 32e6da5
  • encoding/jsonschema: compile CRD schema only once by @​mvdan in 139794b
  • internal/core/adt: attribute failed try references to the owning body by @​mvdan in 8c8c47c
  • cue/testdata: add regression tests for nested try clauses by @​mvdan in f7a59da
  • internal/core/adt: fire comprehensions on let-bound self references by @​mvdan in f6d7894
  • internal/core/adt: add test for comprehensions on let-bound self references by @​mvdan in c60ba81
  • internal/core/adt: bound self-feeding disjunction recursion in cycle detection by @​mvdan in 43d216f
  • cue/testdata: add a test for the cycle-detection blowup of issue #​4377 by @​mvdan in e7d5121
  • cue: add regression test for FillPath exporting fields as optional by @​mvdan in 00df6eb
  • internal/core/compile: detect structural cycles in self-referential matchIf by @​mvdan in ec1313c
  • internal/core/compile: detect structural cycles in self-referential matchN by @​mvdan in d1a6540
  • cue: accept a leading index in ParsePath by @​mvdan in 0b61fdf
  • cue: add TestPaths cases for a leading index in a path by @​mvdan in a035333
  • cue: give each TestPaths case its own CUE input by @​mvdan in 5cf0e58
  • pkg/list: add regression test for list.Contains with defaults by @​mvdan in 7c6d8ae
  • .claude: add a skill to draft release notes from a commit log by @​mvdan in 7935fe8
  • internal/ci: bump Go and goreleaser for the upcoming alpha by @​mvdan in c2a8155
  • encoding/jsonschema: mark generation as experimental by @​rogpeppe in 223cfa7
  • encoding/protobuf: translate google.protobuf.Struct to an open struct by @​mvdan in ef3e0ee
  • internal/core/adt: report true element count for list length mismatch by @​mvdan in d474938
  • cue/testdata: add test for list-length error with comprehensions by @​mvdan in 40961bb
  • cue: fix Value.ReferencePath after Eval when sharing is disabled by @​mvdan in 9a6d76d
  • cue: clarify Value.ReferencePath path semantics by @​mvdan in 0adb8dd
  • pkg/list: report a missing less field as a fatal error by @​mvdan in 6aa4a11
  • cmd/cue: fix vet -d resolving a hidden constraint by @​mvdan in 5651def
  • cmd/cue: add test for vet -d with a hidden constraint by @​mvdan in 1a0c02c
  • pkg/encoding: report every Validate conflict by @​mvdan in 81f9d1b
  • pkg/encoding: add tests for Validate reporting a single conflict by @​mvdan in 5310062
  • mod/modconfig: delete the dummy $DOCKER_CONFIG dir when the tests are done by @​mvdan in ffb2fbd
  • cue/errors: deduplicate without rendering errors unnecessarily by @​mvdan in e9f02ca
  • cue/errors: report all distinct errors at the same position by @​mvdan in 774942d
  • cue/errors: add a test recording how often removeMultiples renders errors by [@​mvdan](h

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Mar 4, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 68 additional dependencies were updated

Details:

Package Change
github.com/sigstore/cosign/v2 v2.4.1 -> v2.6.2
github.com/sigstore/rekor v1.3.10 -> v1.5.0
github.com/sigstore/sigstore v1.9.1 -> v1.10.4
github.com/tektoncd/pipeline v0.70.0 -> v1.9.2
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 -> v0.0.0-20250102033503-faa5f7b0171c
github.com/containerd/stargz-snapshotter/estargz v0.16.3 -> v0.18.2
github.com/docker/docker v28.3.3+incompatible -> v28.5.2+incompatible
github.com/docker/go-connections v0.5.0 -> v0.6.0
github.com/fatih/color v1.17.0 -> v1.18.0
github.com/go-jose/go-jose/v4 v4.1.3 -> v4.1.4
github.com/go-openapi/analysis v0.23.0 -> v0.24.1
github.com/go-openapi/errors v0.22.1 -> v0.22.7
github.com/go-openapi/jsonpointer v0.21.0 -> v0.22.4
github.com/go-openapi/jsonreference v0.21.0 -> v0.21.4
github.com/go-openapi/loads v0.22.0 -> v0.23.2
github.com/go-openapi/runtime v0.28.0 -> v0.29.2
github.com/go-openapi/spec v0.21.0 -> v0.22.3
github.com/go-openapi/swag v0.23.1 -> v0.25.4
github.com/golang/snappy v0.0.4 -> v1.0.0
github.com/google/cel-go v0.26.0 -> v0.27.0
github.com/google/certificate-transparency-go v1.2.1 -> v1.3.2
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 -> v2.27.4
github.com/in-toto/attestation v1.1.0 -> v1.1.2
github.com/klauspost/compress v1.18.2 -> v1.18.5
github.com/letsencrypt/boulder v0.0.0-20240830194243-1fcf0ee08180 -> v0.20251110.0
github.com/lufia/plan9stats v0.0.0-20240819163618-b1d8f4d146e7 -> v0.0.0-20251013123823-9fd1530e3ec3
github.com/magiconair/properties v1.8.7 -> v1.8.10
github.com/mattn/go-colorable v0.1.13 -> v0.1.14
github.com/mitchellh/mapstructure v1.5.0 -> v1.5.1-0.20231216201459-8508981c8b6c
github.com/moby/go-archive v0.1.0 -> v0.2.0
github.com/moby/term v0.5.0 -> v0.5.2
github.com/open-policy-agent/opa v1.6.0 -> v1.8.0
github.com/prometheus/common v0.66.1 -> v0.67.5
github.com/prometheus/procfs v0.16.1 -> v0.17.0
github.com/sagikazarmark/locafero v0.7.0 -> v0.11.0
github.com/sigstore/protobuf-specs v0.4.1 -> v0.5.0
github.com/sourcegraph/conc v0.3.0 -> v0.3.1-0.20240121214520-5f936abd7ae8
github.com/spf13/afero v1.12.0 -> v1.15.0
github.com/spf13/cast v1.7.1 -> v1.10.0
github.com/spf13/cobra v1.9.1 -> v1.10.2
github.com/spf13/pflag v1.0.7 -> v1.0.10
github.com/spf13/viper v1.20.1 -> v1.21.0
github.com/stretchr/objx v0.5.2 -> v0.5.3
github.com/tklauser/go-sysconf v0.3.14 -> v0.3.16
github.com/tklauser/numcpus v0.8.0 -> v0.11.0
github.com/vbatts/tar-split v0.12.1 -> v0.12.2
go.mongodb.org/mongo-driver v1.16.1 -> v1.17.6
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 -> v0.64.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.36.0 -> v1.37.0
go.uber.org/zap v1.27.0 -> v1.27.1
go.yaml.in/yaml/v2 v2.4.2 -> v2.4.3
golang.org/x/crypto v0.46.0 -> v0.49.0
golang.org/x/mod v0.34.0 -> v0.35.0
golang.org/x/net v0.48.0 -> v0.52.0
golang.org/x/oauth2 v0.34.0 -> v0.36.0
golang.org/x/sys v0.41.0 -> v0.42.0
golang.org/x/term v0.38.0 -> v0.41.0
golang.org/x/text v0.32.0 -> v0.35.0
gomodules.xyz/jsonpatch/v2 v2.4.0 -> v2.5.0
google.golang.org/api v0.228.0 -> v0.260.0
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 -> v0.0.0-20251222181119-0a764e51fe1b
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 -> v0.0.0-20251222181119-0a764e51fe1b
google.golang.org/protobuf v1.36.10 -> v1.36.11
gopkg.in/evanphx/json-patch.v4 v4.12.0 -> v4.13.0
k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b -> v0.0.0-20250910181357-589584f1c912
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 -> v0.0.0-20251002143259-bc988d571ff4
knative.dev/pkg v0.0.0-20250117084104-c43477f0052b -> v0.0.0-20250415155312-ed3e2158b883
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 -> v0.0.0-20250730193827-2d320260d730
File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 95 additional dependencies were updated

Details:

Package Change
github.com/go-git/go-git/v5 v5.17.1 -> v5.17.2
github.com/sigstore/rekor v1.3.10 -> v1.5.0
github.com/sigstore/sigstore v1.9.1 -> v1.10.4
cloud.google.com/go v0.118.3 -> v0.123.0
cloud.google.com/go/auth v0.15.0 -> v0.18.2
cloud.google.com/go/iam v1.4.1 -> v1.5.3
cloud.google.com/go/monitoring v1.24.0 -> v1.24.3
cloud.google.com/go/storage v1.50.0 -> v1.61.3
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 -> v0.0.0-20250102033503-faa5f7b0171c
github.com/BurntSushi/toml v1.5.0 -> v1.6.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.49.0 -> v0.55.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.49.0 -> v0.55.0
github.com/ProtonMail/go-crypto v1.1.6 -> v1.3.0
github.com/aws/aws-sdk-go v1.55.6 -> v1.55.7
github.com/aws/aws-sdk-go-v2 v1.36.3 -> v1.41.4
github.com/aws/aws-sdk-go-v2/config v1.29.10 -> v1.32.12
github.com/aws/aws-sdk-go-v2/credentials v1.17.63 -> v1.19.12
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 -> v1.18.20
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 -> v1.4.20
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 -> v2.7.20
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 -> v1.13.7
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 -> v1.13.20
github.com/cenkalti/backoff/v5 v5.0.2 -> v5.0.3
github.com/containerd/containerd/v2 v2.2.0 -> v2.2.2
github.com/containerd/stargz-snapshotter/estargz v0.16.3 -> v0.18.2
github.com/coreos/go-oidc/v3 v3.12.0 -> v3.17.0
github.com/cyberphone/json-canonicalization v0.0.0-20231217050601-ba74d44ecf5f -> v0.0.0-20241213102144-19d51d7fe467
github.com/cyphar/filepath-securejoin v0.4.1 -> v0.6.0
github.com/dgraph-io/badger/v4 v4.7.0 -> v4.9.1
github.com/docker/docker-credential-helpers v0.9.3 -> v0.9.5
github.com/docker/go-connections v0.5.0 -> v0.6.0
github.com/go-openapi/analysis v0.23.0 -> v0.24.3
github.com/go-openapi/errors v0.22.1 -> v0.22.7
github.com/go-openapi/jsonpointer v0.21.0 -> v0.22.5
github.com/go-openapi/jsonreference v0.21.0 -> v0.21.5
github.com/go-openapi/loads v0.22.0 -> v0.23.3
github.com/go-openapi/runtime v0.28.0 -> v0.29.2
github.com/go-openapi/spec v0.21.0 -> v0.22.4
github.com/go-openapi/swag v0.23.1 -> v0.25.4
github.com/google/certificate-transparency-go v1.2.1 -> v1.3.2
github.com/google/go-jsonnet v0.21.0 -> v0.22.0
github.com/googleapis/enterprise-certificate-proxy v0.3.6 -> v0.3.14
github.com/googleapis/gax-go/v2 v2.14.1 -> v2.17.0
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 -> v2.27.7
github.com/hashicorp/go-getter v1.7.9 -> v1.8.6
github.com/hashicorp/go-retryablehttp v0.7.7 -> v0.7.8
github.com/hashicorp/go-version v1.7.0 -> v1.8.0
github.com/hashicorp/hcl v1.0.1-vault-5 -> v1.0.1-vault-7
github.com/klauspost/compress v1.18.2 -> v1.18.5
github.com/mattn/go-runewidth v0.0.16 -> v0.0.19
github.com/moby/buildkit v0.23.2 -> v0.29.0
github.com/moby/go-archive v0.1.0 -> v0.2.0
github.com/moby/term v0.5.0 -> v0.5.2
github.com/morikuni/aec v1.0.0 -> v1.1.0
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c -> v0.0.0-20240221224432-82ca36839d55
github.com/prometheus/procfs v0.16.1 -> v0.17.0
github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 -> v0.0.0-20250401214520-65e299d6c5c9
github.com/sagikazarmark/locafero v0.7.0 -> v0.11.0
github.com/sigstore/protobuf-specs v0.4.1 -> v0.5.0
github.com/sourcegraph/conc v0.3.0 -> v0.3.1-0.20240121214520-5f936abd7ae8
github.com/spf13/cast v1.7.1 -> v1.10.0
github.com/stretchr/objx v0.5.2 -> v0.5.3
github.com/tklauser/go-sysconf v0.3.12 -> v0.3.16
github.com/tklauser/numcpus v0.6.1 -> v0.11.0
github.com/ulikunitz/xz v0.5.12 -> v0.5.15
github.com/yusufpapurcu/wmi v1.2.3 -> v1.2.4
go.mongodb.org/mongo-driver v1.16.1 -> v1.17.6
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 -> v0.63.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 -> v0.65.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0 -> v1.40.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.36.0 -> v1.40.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.36.0 -> v1.40.0
go.opentelemetry.io/proto/otlp v1.7.1 -> v1.9.0
go.step.sm/crypto v0.60.0 -> v0.74.0
go.uber.org/zap v1.27.0 -> v1.27.1
go.yaml.in/yaml/v2 v2.4.2 -> v2.4.3
golang.org/x/crypto v0.49.0 -> v0.50.0
golang.org/x/mod v0.34.0 -> v0.35.0
golang.org/x/oauth2 v0.34.0 -> v0.36.0
golang.org/x/sys v0.42.0 -> v0.43.0
golang.org/x/term v0.41.0 -> v0.42.0
golang.org/x/text v0.35.0 -> v0.36.0
golang.org/x/time v0.14.0 -> v0.15.0
golang.org/x/tools v0.43.0 -> v0.44.0
google.golang.org/api v0.228.0 -> v0.271.0
google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb -> v0.0.0-20260128011058-8636f8732409
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 -> v0.0.0-20260203192932-546029d2fa20
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 -> v0.0.0-20260226221140-a57be14db171
google.golang.org/protobuf v1.36.10 -> v1.36.11
gopkg.in/evanphx/json-patch.v4 v4.12.0 -> v4.13.0
gopkg.in/ini.v1 v1.67.0 -> v1.67.1
k8s.io/api v0.34.3 -> v0.35.3
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 -> v0.0.0-20251002143259-bc988d571ff4
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 -> v0.0.0-20250730193827-2d320260d730
sigs.k8s.io/release-utils v0.8.4 -> v0.12.3
File name: tools/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 180 additional dependencies were updated

Details:

Package Change
4d63.com/gocheckcompilerdirectives v1.2.1 -> v1.3.0
4d63.com/gochecknoglobals v0.2.1 -> v0.2.2
cloud.google.com/go v0.116.0 -> v0.123.0
cloud.google.com/go/auth v0.13.0 -> v0.18.2
cloud.google.com/go/auth/oauth2adapt v0.2.6 -> v0.2.8
cloud.google.com/go/firestore v1.17.0 -> v1.21.0
cloud.google.com/go/iam v1.2.2 -> v1.5.3
cloud.google.com/go/kms v1.20.1 -> v1.25.0
cloud.google.com/go/longrunning v0.6.2 -> v0.8.0
cloud.google.com/go/monitoring v1.21.2 -> v1.24.3
cloud.google.com/go/storage v1.49.0 -> v1.61.3
cuelang.org/go v0.13.2 -> v0.16.0
filippo.io/edwards25519 v1.1.0 -> v1.1.1
github.com/4meepo/tagalign v1.4.1 -> v1.4.2
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0 -> v1.20.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0 -> v1.13.1
github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 -> v1.11.2
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.1.0 -> v1.4.0
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.0.1 -> v1.2.0
github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2 -> v1.6.0
github.com/BurntSushi/toml v1.5.0 -> v1.6.0
github.com/Crocmagnon/fatcontext v0.5.3 -> v0.7.1
github.com/CycloneDX/cyclonedx-go v0.9.2 -> v0.10.0
github.com/GaijinEntertainment/go-exhaustruct/v3 v3.3.0 -> v3.3.1
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.48.1 -> v0.55.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.48.1 -> v0.55.0
github.com/IBM/sarama v1.43.3 -> v1.45.2
github.com/Masterminds/semver/v3 v3.3.0 -> v3.4.0
github.com/OpenPeeDeeP/depguard/v2 v2.2.0 -> v2.2.1
github.com/ProtonMail/go-crypto v1.0.0 -> v1.3.0
github.com/alingse/nilnesserr v0.1.1 -> v0.1.2
github.com/anchore/go-struct-converter v0.0.0-20230627203149-c72ef8859ca9 -> v0.1.0
github.com/aws/aws-sdk-go v1.55.5 -> v1.55.8
github.com/aws/aws-sdk-go-v2 v1.30.4 -> v1.41.4
github.com/aws/aws-sdk-go-v2/config v1.27.31 -> v1.32.12
github.com/aws/aws-sdk-go-v2/credentials v1.17.30 -> v1.19.12
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.12 -> v1.18.20
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.16 -> v1.4.20
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.16 -> v2.7.20
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 -> v1.8.6
github.com/aws/aws-sdk-go-v2/service/ecr v1.32.2 -> v1.45.1
github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.25.4 -> v1.33.2
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.4 -> v1.13.7
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.18 -> v1.13.20
github.com/aws/aws-sdk-go-v2/service/kms v1.35.5 -> v1.49.1
github.com/catenacyber/perfsprint v0.7.1 -> v0.8.2
github.com/containerd/stargz-snapshotter/estargz v0.16.3 -> v0.18.2
github.com/coreos/go-oidc/v3 v3.11.0 -> v3.17.0
github.com/coreos/go-systemd/v22 v22.6.0 -> v22.7.0
github.com/cyberphone/json-canonicalization v0.0.0-20231217050601-ba74d44ecf5f -> v0.0.0-20241213102144-19d51d7fe467
github.com/cyphar/filepath-securejoin v0.4.1 -> v0.6.0
github.com/docker/docker v28.2.2+incompatible -> v28.5.2+incompatible
github.com/docker/docker-credential-helpers v0.9.3 -> v0.9.5
github.com/evanphx/json-patch/v5 v5.9.0 -> v5.9.11
github.com/gdamore/tcell/v2 v2.7.4 -> v2.9.0
github.com/ghostiam/protogetter v0.3.8 -> v0.3.9
github.com/go-chi/chi/v5 v5.1.0 -> v5.2.4
github.com/go-critic/go-critic v0.11.5 -> v0.12.0
github.com/go-jose/go-jose/v4 v4.1.3 -> v4.1.4
github.com/go-openapi/analysis v0.23.0 -> v0.24.3
github.com/go-openapi/errors v0.22.0 -> v0.22.7
github.com/go-openapi/jsonpointer v0.21.0 -> v0.22.5
github.com/go-openapi/jsonreference v0.21.0 -> v0.21.5
github.com/go-openapi/loads v0.22.0 -> v0.23.3
github.com/go-openapi/runtime v0.28.0 -> v0.29.2
github.com/go-openapi/spec v0.21.0 -> v0.22.4
github.com/go-openapi/strfmt v0.23.0 -> v0.26.1
github.com/go-openapi/swag v0.23.0 -> v0.25.4
github.com/go-viper/mapstructure/v2 v2.3.0 -> v2.5.0
github.com/gofrs/flock v0.12.1 -> v0.13.0
github.com/golang-jwt/jwt/v5 v5.2.2 -> v5.3.0
github.com/golang/snappy v0.0.4 -> v1.0.0
github.com/golangci/dupl v0.0.0-20180902072040-3e9179ac440a -> v0.0.0-20250308024227-f665c8d69b32
github.com/golangci/gofmt v0.0.0-20241223200906-057b0627d9b9 -> v0.0.0-20250106114630-d62b90e6713d
github.com/golangci/revgrep v0.5.3 -> v0.8.0
github.com/google/cel-go v0.26.0 -> v0.27.0
github.com/google/certificate-transparency-go v1.2.1 -> v1.3.2
github.com/google/go-containerregistry v0.20.2 -> v0.21.0
github.com/google/go-jsonnet v0.21.0 -> v0.22.0
github.com/google/s2a-go v0.1.8 -> v0.1.9
github.com/googleapis/enterprise-certificate-proxy v0.3.4 -> v0.3.14
github.com/googleapis/gax-go/v2 v2.14.1 -> v2.17.0
github.com/gostaticanalysis/comment v1.4.2 -> v1.5.0
github.com/gostaticanalysis/forcetypeassert v0.1.0 -> v0.2.0
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 -> v2.27.7
github.com/hashicorp/go-getter v1.7.9 -> v1.8.6
github.com/hashicorp/go-retryablehttp v0.7.7 -> v0.7.8
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 -> v0.2.0
github.com/hashicorp/go-sockaddr v1.0.6 -> v1.0.7
github.com/hashicorp/go-version v1.7.0 -> v1.8.0
github.com/hashicorp/hcl v1.0.1-vault-5 -> v1.0.1-vault-7
github.com/hashicorp/vault/api v1.14.0 -> v1.22.0
github.com/in-toto/attestation v1.1.0 -> v1.1.2
github.com/jellydator/ttlcache/v3 v3.3.0 -> v3.4.0
github.com/jmespath/go-jmespath v0.4.0 -> v0.4.1-0.20220621161143-b0104c826a24
github.com/karamaru-alpha/copyloopvar v1.1.0 -> v1.2.1
github.com/kisielk/errcheck v1.8.0 -> v1.9.0
github.com/kkHAIKE/contextcheck v1.1.5 -> v1.1.6
github.com/klauspost/compress v1.18.2 -> v1.18.5
github.com/ktr0731/go-fuzzyfinder v0.8.0 -> v0.9.0
github.com/ldez/exptostd v0.3.1 -> v0.4.2
github.com/ldez/gomoddirectives v0.6.0 -> v0.6.1
github.com/ldez/grignotin v0.7.0 -> v0.9.0
github.com/lucasb-eyer/go-colorful v1.2.0 -> v1.3.0
github.com/mailru/easyjson v0.7.7 -> v0.9.0
github.com/matoous/godox v0.0.0-20240105082147-c5b5e0e7c0c0 -> v1.1.0
github.com/mattn/go-colorable v0.1.13 -> v0.1.14
github.com/mattn/go-runewidth v0.0.16 -> v0.0.19
github.com/mgechev/revive v1.5.1 -> v1.7.0
github.com/mitchellh/mapstructure v1.5.0 -> v1.5.1-0.20231216201459-8508981c8b6c
github.com/moby/buildkit v0.23.2 -> v0.29.0
github.com/nunnatsa/ginkgolinter v0.18.4 -> v0.19.1
github.com/pierrec/lz4/v4 v4.1.21 -> v4.1.22
github.com/polyfloyd/go-errorlint v1.7.0 -> v1.7.1
github.com/prometheus/common v0.66.1 -> v0.67.5
github.com/prometheus/procfs v0.16.1 -> v0.17.0
github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 -> v0.0.0-20250401214520-65e299d6c5c9
github.com/sagikazarmark/locafero v0.7.0 -> v0.11.0
github.com/secure-systems-lab/go-securesystemslib v0.8.0 -> v0.10.0
github.com/securego/gosec/v2 v2.21.4 -> v2.22.2
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 -> v1.4.0
github.com/sigstore/cosign/v2 v2.4.0 -> v2.6.2
github.com/sigstore/fulcio v1.6.3 -> v1.8.5
github.com/sigstore/protobuf-specs v0.3.2 -> v0.5.0
github.com/sigstore/rekor v1.3.6 -> v1.5.0
github.com/sigstore/sigstore v1.8.8 -> v1.10.4
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.8 -> v1.10.3
github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.8 -> v1.10.3
github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.8 -> v1.10.3
github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.8 -> v1.10.3
github.com/sourcegraph/conc v0.3.0 -> v0.3.1-0.20240121214520-5f936abd7ae8
github.com/spdx/tools-golang v0.5.5 -> v0.5.7
github.com/spf13/afero v1.12.0 -> v1.15.0
github.com/spf13/cast v1.7.1 -> v1.10.0
github.com/spf13/cobra v1.9.1 -> v1.10.2
github.com/spf13/pflag v1.0.7 -> v1.0.10
github.com/spf13/viper v1.20.1 -> v1.21.0
github.com/stoewer/go-strcase v1.3.0 -> v1.3.1
github.com/tdakkota/asciicheck v0.3.0 -> v0.4.1
github.com/tektoncd/hub v1.18.0 -> v1.23.6
github.com/tektoncd/pipeline v0.66.0 -> v1.9.2
github.com/tektoncd/triggers v0.29.1 -> v0.35.0
github.com/tetafro/godot v1.4.20 -> v1.5.0
github.com/uudashr/iface v1.3.0 -> v1.3.1
github.com/vbatts/tar-split v0.12.1 -> v0.12.2
github.com/vektah/gqlparser/v2 v2.5.28 -> v2.5.32
go-simpler.org/sloglint v0.7.2 -> v0.9.0
go.mongodb.org/mongo-driver v1.16.1 -> v1.17.6
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 -> v0.63.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 -> v0.65.0
go.step.sm/crypto v0.51.2 -> v0.75.0
go.uber.org/zap v1.27.0 -> v1.27.1
go.yaml.in/yaml/v2 v2.4.2 -> v2.4.3
goa.design/goa/v3 v3.18.2 -> v3.23.4
gocloud.dev v0.39.0 -> v0.43.0
gocloud.dev/docstore/mongodocstore v0.39.0 -> v0.43.0
gocloud.dev/pubsub/kafkapubsub v0.39.0 -> v0.43.0
golang.org/x/exp/typeparams v0.0.0-20241108190413-2d47ceb2692f -> v0.0.0-20250210185358-939b2ce775ac
golang.org/x/oauth2 v0.34.0 -> v0.36.0
golang.org/x/time v0.14.0 -> v0.15.0
gomodules.xyz/jsonpatch/v2 v2.4.0 -> v2.5.0
google.golang.org/api v0.215.0 -> v0.271.0
google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 -> v0.0.0-20260128011058-8636f8732409
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 -> v0.0.0-20260203192932-546029d2fa20
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 -> v0.0.0-20260226221140-a57be14db171
google.golang.org/protobuf v1.36.10 -> v1.36.11
gopkg.in/evanphx/json-patch.v4 v4.12.0 -> v4.13.0
gopkg.in/ini.v1 v1.67.0 -> v1.67.1
honnef.co/go/tools v0.5.1 -> v0.6.1
k8s.io/api v0.34.2 -> v0.34.4
k8s.io/apimachinery v0.34.2 -> v0.34.4
k8s.io/client-go v0.34.2 -> v0.34.4
k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b -> v0.0.0-20250910181357-589584f1c912
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 -> v0.0.0-20251002143259-bc988d571ff4
knative.dev/pkg v0.0.0-20240815051656-89743d9bbf7c -> v0.0.0-20250415155312-ed3e2158b883
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 -> v0.0.0-20250730193827-2d320260d730
sigs.k8s.io/kustomize/api v0.20.1 -> v0.21.1
sigs.k8s.io/kustomize/cmd/config v0.20.1 -> v0.21.1
sigs.k8s.io/kustomize/kyaml v0.20.1 -> v0.21.1
sigs.k8s.io/release-utils v0.8.4 -> v0.12.3
File name: tools/kubectl/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 14 additional dependencies were updated

Details:

Package Change
github.com/spf13/cobra v1.9.1 -> v1.10.0
github.com/spf13/pflag v1.0.6 -> v1.0.9
go.opentelemetry.io/otel v1.35.0 -> v1.36.0
go.opentelemetry.io/otel/trace v1.35.0 -> v1.36.0
go.yaml.in/yaml/v2 v2.4.2 -> v2.4.3
golang.org/x/net v0.43.0 -> v0.47.0
golang.org/x/sync v0.17.0 -> v0.18.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/term v0.34.0 -> v0.37.0
golang.org/x/text v0.28.0 -> v0.31.0
gopkg.in/evanphx/json-patch.v4 v4.12.0 -> v4.13.0
k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b -> v0.0.0-20250910181357-589584f1c912
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 -> v0.0.0-20251002143259-bc988d571ff4
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 -> v0.0.0-20250730193827-2d320260d730

@renovate renovate Bot force-pushed the renovate/release-v0.7-go-modules branch 13 times, most recently from f2bee15 to c044cf2 Compare March 11, 2026 14:10
@renovate renovate Bot force-pushed the renovate/release-v0.7-go-modules branch 10 times, most recently from d0b5daa to d7e1ae6 Compare March 19, 2026 01:57
@renovate renovate Bot force-pushed the renovate/release-v0.7-go-modules branch 2 times, most recently from edc3061 to 0e0416e Compare March 19, 2026 09:50
@fullsend-ai-review

fullsend-ai-review Bot commented Jun 19, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 2:44 AM UTC · Completed 2:53 AM UTC
Commit: 47d3320 · View workflow run →

Comment thread go.mod Outdated
k8s.io/client-go v0.35.4
k8s.io/klog/v2 v2.130.1
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
github.com/testcontainers/testcontainers-go v0.42.0 // using unreleased version that contains the fix in https://github.com/testcontainers/testcontainers-go/pull/2899

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] stale-comment

The PR bumps testcontainers-go from a pseudo-version to v0.42.0 and aligns modules/registry to v0.42.0, but retains the comment about using unreleased version which is now misleading since v0.42.0 is a released version.

Suggested fix: Remove the stale comment from the testcontainers-go dependency line.

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 19, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 12:56 PM UTC · Completed 1:07 PM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 19, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 5:17 PM UTC · Completed 5:28 PM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

Comment thread go.mod
// Force moby/go-archive to v0.1.0 for compatibility with docker/docker v28.5.2
// v0.2.0 removed archive.Compression type which docker still uses
replace github.com/moby/go-archive => github.com/moby/go-archive v0.1.0
replace github.com/moby/go-archive => github.com/moby/go-archive v0.2.0

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] api-contract

The moby/go-archive replace directive was changed from pinning to v0.1.0 to pinning to v0.2.0, directly contradicting the comment on lines 65-66 which states that v0.2.0 removed archive.Compression type which docker/docker v28.5.2 still uses. docker/docker v28.5.2+incompatible remains a direct dependency. Additionally, acceptance/go.mod still correctly pins to v0.1.0, creating an inconsistency between modules.

Suggested fix: Either revert the replace to point to v0.1.0, or verify that docker/docker v28.5.2 no longer needs archive.Compression and update/remove the stale comment.

Comment thread tools/go.mod
@@ -3,17 +3,17 @@ module github.com/conforma/cli/tools
go 1.25.9

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] version-inconsistency

tools/go.mod Go version stays at 1.25.9 while go.mod, acceptance/go.mod, and tools/kubectl/go.mod are all bumped to 1.26.0. A Go version mismatch across modules in a monorepo can cause subtle build issues.

Suggested fix: Bump tools/go.mod to go 1.26.0 consistently with the other modules, or document why it must remain on an older version.

Comment thread go.mod
k8s.io/client-go v0.35.4
k8s.io/klog/v2 v2.130.1
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
github.com/testcontainers/testcontainers-go v0.43.0 // using unreleased version that contains the fix in https://github.com/testcontainers/testcontainers-go/pull/2899

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] stale-reference

The comment on testcontainers-go says using unreleased version but the version is now v0.43.0, which is a released version. The comment is stale and misleading.

Suggested fix: Remove the trailing comment or update it to note which released version first included the fix.

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 20, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 6:19 AM UTC · Completed 6:28 AM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

Comment thread tools/go.mod
@@ -3,17 +3,17 @@ module github.com/conforma/cli/tools
go 1.25.9

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] version inconsistency

The PR bumps the Go directive to 1.26.0 in go.mod, acceptance/go.mod, and tools/kubectl/go.mod, but tools/go.mod stays at 1.25.9. The inconsistency suggests Renovate did not process all go.mod files uniformly, though tools/go.mod is an independent module and may function correctly at the older version.

Suggested fix: Verify whether tools/go.mod should also be bumped to go 1.26.0 for consistency. If it must stay at an older version, document why.

Comment thread go.mod
k8s.io/client-go v0.35.4
k8s.io/klog/v2 v2.130.1
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
github.com/testcontainers/testcontainers-go v0.43.0 // using unreleased version that contains the fix in https://github.com/testcontainers/testcontainers-go/pull/2899

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] stale comment

The PR updates testcontainers-go from the pre-release pseudo-version v0.34.1-0.20241204123437-72be13940122 to the released version v0.43.0, but the inline comment still reads using unreleased version that contains the fix in testcontainers/testcontainers-go#2899. Since v0.43.0 is an official release well past v0.34, this comment is now misleading.

Suggested fix: Remove or update the comment to reflect that v0.43.0 is a released version.

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 21, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 9:01 AM UTC · Completed 9:09 AM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 21, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 2:18 PM UTC · Completed 2:28 PM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 22, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 3:37 PM UTC · Completed 3:47 PM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 22, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 8:10 PM UTC · Completed 8:21 PM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 23, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 5:52 AM UTC · Completed 6:09 AM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

Comment thread go.mod
github.com/conforma/go-gather v1.0.2
github.com/conforma/go-gather v1.2.0
github.com/docker/docker v28.5.2+incompatible
github.com/enterprise-contract/enterprise-contract-controller/api v0.1.257

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] api-contract

Inconsistency between root go.mod and acceptance/go.mod: acceptance removes docker/docker in favor of moby/moby packages, but the root module retains docker/docker alongside the new moby packages. This partial migration is fragile for future updates.

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 24, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 6:22 AM UTC · Completed 6:32 AM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

Comment thread go.mod Outdated
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/ini.v1 v1.67.1 // indirect
gopkg.in/ini.v1 v1.67.2 // indirect

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] pre-release-dependency

google.golang.org/protobuf changes from stable v1.36.11 to pre-release pseudo-version v1.36.12-0.20260120151049-f2248ac996af. Pseudo-versions reduce build reproducibility for this foundational library.

Suggested fix: Pin to the latest stable release of google.golang.org/protobuf. If a specific unreleased fix is needed, document the reason.

Comment thread go.mod
k8s.io/client-go v0.35.4
k8s.io/klog/v2 v2.130.1
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
github.com/testcontainers/testcontainers-go v0.43.0 // using unreleased version that contains the fix in https://github.com/testcontainers/testcontainers-go/pull/2899

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] stale-reference

The testcontainers-go comment says using unreleased version but v0.43.0 is a released version. The comment becomes misleading.

Suggested fix: Remove or update the comment to reflect that v0.43.0 is released.

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 25, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:15 PM UTC · Completed 1:35 PM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

Comment thread go.mod
k8s.io/client-go v0.35.4
k8s.io/klog/v2 v2.130.1
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
github.com/testcontainers/testcontainers-go v0.43.0 // using unreleased version that contains the fix in https://github.com/testcontainers/testcontainers-go/pull/2899

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] API contract violation

The PR updates testcontainers-go from a pseudo-version based on v0.34.1 to v0.43.0, a jump of ~9 minor versions. The codebase uses testcontainers.GenericContainer in three files (acceptance/git/git.go:183, acceptance/registry/registry.go:112, acceptance/wiremock/wiremock.go:220) and testcontainers.GenericContainerRequest. Between v0.34 and v0.43, testcontainers-go deprecated and may have removed GenericContainer. If the code is not updated, it may fail to compile.

Suggested fix: Either confirm the testcontainers-go v0.43.0 API is still compatible (GenericContainer was not yet removed), or include Go source code changes to adapt to the new testcontainers-go API.

Comment thread go.mod
// Force moby/go-archive to v0.1.0 for compatibility with docker/docker v28.5.2
// v0.2.0 removed archive.Compression type which docker still uses
replace github.com/moby/go-archive => github.com/moby/go-archive v0.1.0
replace github.com/moby/go-archive => github.com/moby/go-archive v0.2.0

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] stale-reference

The moby/go-archive replace directive is being changed from v0.1.0 to v0.2.0, but the comments explicitly state: Force moby/go-archive to v0.1.0 for compatibility with docker/docker v28.5.2 and v0.2.0 removed archive.Compression type which docker still uses. docker/docker v28.5.2 remains a direct dependency. The replace directive now points to the exact version the comment warns against.

Suggested fix: Either revert the replace directive to keep v0.1.0, or verify that docker/docker v28.5.2 no longer uses archive.Compression in the code paths exercised by this project, and update the comment accordingly.

Comment thread go.mod
k8s.io/client-go v0.35.4
k8s.io/klog/v2 v2.130.1
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
github.com/testcontainers/testcontainers-go v0.43.0 // using unreleased version that contains the fix in https://github.com/testcontainers/testcontainers-go/pull/2899

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] Edge case

The root go.mod updates testcontainers-go to v0.43.0 (a released version) but retains the stale comment: using unreleased version that contains the fix. v0.43.0 is a released version.

Suggested fix: Remove or update the stale comment.

Comment thread acceptance/go.mod
sigs.k8s.io/kind v0.32.0
sigs.k8s.io/kustomize/api v0.21.1
sigs.k8s.io/kustomize/kyaml v0.21.1
sigs.k8s.io/yaml v1.6.0

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] API contract violation

sigs.k8s.io/kind is being updated from v0.26.0 to v0.32.0, a jump of 6 minor versions. The acceptance tests use kind programmatically (acceptance/kubernetes/kind/kind.go). This is a significant version jump that warrants verification.

Suggested fix: Verify that the kind Go API usage in acceptance tests is compatible with v0.32.0.

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 25, 2026

Copy link
Copy Markdown

🤖 Finished Review · ❌ Failure · Started 9:16 PM UTC · Completed 9:27 PM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 26, 2026

Copy link
Copy Markdown

🤖 Review · ⚠️ Cancelled · Started 1:46 AM UTC · Ended 1:49 AM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 26, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:52 AM UTC · Completed 2:02 AM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 26, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 5:29 PM UTC · Completed 5:40 PM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

Comment thread go.mod

// use forked version until we can get the fixes merged see https://github.com/conforma/go-containerregistry/blob/main/hack/ec-patches.sh for a list of patches we carry
replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.20.7-0.20250703195040-6f40a3734728
replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.21.7

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] API contract violation

The conforma go-containerregistry fork changes from a v0.20.x pseudo-version to v0.21.7. 49 Go files import go-containerregistry packages. While the team controls the fork, the major version change should be verified.

Suggested fix: Verify the PR compiles and passes tests with the updated fork version.

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 29, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 11:06 AM UTC · Completed 11:15 AM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 29, 2026

Copy link
Copy Markdown

🤖 Finished Review · ❌ Failure · Started 11:20 AM UTC · Completed 11:31 AM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 29, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 3:44 PM UTC · Completed 3:54 PM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

Comment thread go.mod
// v0.2.0 removed archive.Compression type which docker still uses
replace github.com/moby/go-archive => github.com/moby/go-archive v0.1.0
replace github.com/moby/go-archive => github.com/moby/go-archive v0.2.0

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] logic-error

The replace directive for moby/go-archive changed from pinning to v0.1.0 to pointing at v0.2.0. The comment directly above explicitly warns that v0.2.0 removed archive.Compression type which docker/docker v28.5.2 still uses. docker/docker remains at v28.5.2+incompatible. acceptance/go.mod still correctly pins to v0.1.0, making the two modules inconsistent. This is likely a Renovate bot oversight.

Suggested fix: Revert the right-hand side of the replace directive back to v0.1.0: replace github.com/moby/go-archive => github.com/moby/go-archive v0.1.0. If docker/docker no longer needs archive.Compression, update or remove the comment and the acceptance/go.mod pin as well.

Comment thread go.mod
k8s.io/klog/v2 v2.130.1
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
oras.land/oras-go/v2 v2.6.0
github.com/testcontainers/testcontainers-go v0.43.0 // using unreleased version that contains the fix in https://github.com/testcontainers/testcontainers-go/pull/2899

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] stale-reference

The inline comment on testcontainers-go says 'using unreleased version' but v0.43.0 is a released version (previously it was a pre-release pseudo-version). The comment is now factually incorrect.

Suggested fix: Remove or update the inline comment to reflect that the fix is included in the released v0.43.0.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code release-v0.7 renovate size: XXL

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants