Skip to content

Bump the backend group across 1 directory with 12 updates#4668

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/go_modules/backend-436663ea2b
Open

Bump the backend group across 1 directory with 12 updates#4668
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/go_modules/backend-436663ea2b

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 1, 2026

Bumps the backend group with 5 updates in the / directory:

Package From To
github.com/aquasecurity/trivy 0.67.2 0.68.2
github.com/go-git/go-git/v5 5.16.3 5.16.4
github.com/google/go-containerregistry 0.20.6 0.20.7
github.com/operator-framework/api 0.35.0 0.37.0
github.com/tektoncd/pipeline 1.5.0 1.7.0

Updates github.com/aquasecurity/trivy from 0.67.2 to 0.68.2

Release notes

Sourced from github.com/aquasecurity/trivy's releases.

v0.68.2

Changelog

  • 0c40a8d4b9b943f1b679a20f8ba3cb61c94831de release: v0.68.2 [release/v0.68] (#9950)
  • db2894561daa20301eb144cad467d75d8a3d2647 fix(deps): bump alpine from 3.22.1 to 3.23.0 [backport: release/v0.68] (#9949)

v0.68.1

👉 Trivy v0.68.1 release notes (click here)

[!NOTE]
v0.68.0 was skipped due to issues with the release.

⬇️ Download Trivy

🐳 Docker Install

  • docker pull get.trivy.dev/image/trivy:0.68.1

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0680-2025-12-02

Changelog

Sourced from github.com/aquasecurity/trivy's changelog.

0.68.2 (2025-12-16)

Bug Fixes

  • deps: bump alpine from 3.22.1 to 3.23.0 [backport: release/v0.68] (#9949) (db28945)

0.68.1 (2025-12-03)

Bug Fixes

  • update cosing settings for GoReleaser after bumping cosing to v3 (#9863) (c7accc8)

0.68.0 (2025-12-02)

Features

  • add ArtifactID field to uniquely identify scan targets (#9663) (84a7d9a)
  • add ReportID field to scan reports (#9670) (fc976be)
  • allow ignoring findings by type in Rego (#9578) (c638fc6)
  • aws: Add support for dualstack ECR endpoints (#9862) (e74e2b1)
  • cli: Add trivy cloud suppport (#9637) (8e6a7ff)
  • db: enable concurrent access to vulnerability database (#9750) (d70d994)
  • dotnet: add dependency graph support for .deps.json files (#9726) (18c0ee8)
  • flag: add --cacert flag (#9781) (6048173)
  • fs: change artifact type to repository when git info is detected (#9613) (cff91ac)
  • image: add RepoTags support for Docker archives (#9690) (a9a3031)
  • image: add Sigstore bundle SBOM support (#9516) (e1f3f28)
  • image: pass global context to docker/podman image save func (#9733) (2690ac9)
  • include registry and repository in artifact ID calculation (#9689) (758f271)
  • java: add support remote repositories from settings.xml files (#9708) (eff52eb)
  • license: use separate SPDX ids to ignore SPDX expressions (#9087) (012f3d7)
  • misconf: add agentpools to azure container schema (#9714) (69f400c)
  • misconf: Add RoleAssignments attribute (#9396) (3fb8703)
  • misconf: Add support for configurable Rego error limit (#9657) (445cd2b)
  • misconf: include map key in manifest snippet for diagnostics (#9681) (197c9e1)
  • misconf: support https_traffic_only_enabled in Az storage account (#9784) (c8d5ab7)
  • misconf: Update AppService schema (#9792) (c6d95d7)
  • misconf: Update Azure Compute schema (#9675) (cb58bf6)
  • misconf: Update Azure Container Schema (#9673) (43a7546)
  • misconf: Update Azure network schema for new checks (#9791) (ea2dc58)
  • misconf: Update azure storage schema (#9728) (c3bfecf)
  • misconf: Update SecurityCenter schema (#9674) (58819c5)
  • report: add fingerprint generation for vulnerabilities (#9794) (cbad9ca)
  • report: add image reference to report metadata (#9729) (d020f26)
  • report: switch ReportID from UUIDv4 to UUIDv7 (#9749) (6fb3fde)
  • sbom: add support for SPDX attestations (#9829) (d8eaaeb)
  • sbom: use SPDX license IDs list to validate SPDX IDs (#9569) (35db88c)

... (truncated)

Commits
  • 0c40a8d release: v0.68.2 [release/v0.68] (#9950)
  • db28945 fix(deps): bump alpine from 3.22.1 to 3.23.0 [backport: release/v0.68] (#...
  • dc28f24 ci: enable check-latest for setup-go [backport: release/v0.68] (#9946)
  • 96290ae release: v0.68.1 [main] (#9867)
  • c7accc8 fix: update cosing settings for GoReleaser after bumping cosing to v3 (#9863)
  • b503278 chore(deps): bump the testcontainers group with 2 updates (#9506)
  • e0fa76d release: v0.68.0 [main] (#9549)
  • e74e2b1 feat(aws): Add support for dualstack ECR endpoints (#9862)
  • c274f5b fix(vex): use a separate visited set for each DFS path (#9760)
  • 15a5465 docs: catch some missed docs -> guide (#9850)
  • Additional commits viewable in compare view

Updates github.com/go-git/go-git/v5 from 5.16.3 to 5.16.4

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.16.4

What's Changed

Full Changelog: go-git/go-git@v5.16.3...v5.16.4

Commits
  • de8ecc3 Merge pull request #1743 from go-git/renovate/releases/v5.x-go-github.com-go-...
  • 3e752f0 build: Update module github.com/go-git/go-git/v5 to v5.13.0 [SECURITY]
  • 3a31754 Merge pull request #1741 from go-git/renovate/releases/v5.x-go-github.com-clo...
  • acc28f1 build: Update module github.com/cloudflare/circl to v1.6.1 [SECURITY]
  • 95f3880 Merge pull request #1742 from go-git/renovate/releases/v5.x-go-golang.org-x-n...
  • 329f926 build: Update module golang.org/x/net to v0.38.0 [SECURITY]
  • 399e04b Merge pull request #1734 from pjbgf/fix-ci
  • 2025eae build: test, Fix build on Windows.
  • fb6806f Merge pull request #1732 from swills/find-hash-panic-fix-backport
  • 382530f plumbing: format/idxfile, prevent panic
  • See full diff in compare view

Updates github.com/google/go-containerregistry from 0.20.6 to 0.20.7

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.20.7

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.20.6...v0.20.7

Commits
  • e075f20 go mod tidy on dependabot update (#2171)
  • 45aacf4 Bump the actions group across 1 directory with 3 updates (#2170)
  • 073b936 Update dependencies and deprecate DockerVersion field (#2164)
  • 390dacd Bump golang.org/x/crypto from 0.38.0 to 0.45.0 in /cmd/krane (#2163)
  • ca44d47 Bump golang.org/x/crypto from 0.38.0 to 0.45.0 in /pkg/authn/k8schain (#2162)
  • 999cc1f Bump github.com/docker/docker (#2161)
  • d1809c8 Build artifacts for riscv64 (#2159)
  • 7471efd Bump the auxiliary-deps group across 3 directories with 4 updates (#2156)
  • 2bb5bb0 Bump the actions group with 5 updates (#2155)
  • 16371c1 Remove manual vendor setting for dependabot (#2151)
  • Additional commits viewable in compare view

Updates github.com/open-policy-agent/opa from 1.9.0 to 1.10.1

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.10.1

This is a bugfix release for the split builtin: In v1.10.0, it was looping infinitely when used with an empty-string delimiter.

Reported by @​SignalRichard, authored by @​srenatus

The release is otherwise identical to v1.10.0.

v1.10.0

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • Non-static arm64 executables for linux and darwin, supporting Wasm evaluation
  • Performance improvements to the formatter, compiler, and runtime
  • A new --fail-on-empty flag for opa test
  • Support for IS NOT NULL query statements in the Compile API

Non-static OPA binaries for linux/arm64 and darwin/arm64

Starting with this release, OPA will ship non-static arm64 executables for linux and darwin. These binaries have support for Wasm evaluation. Furthermore, the openpolicyagent/opa:latest docker image is a multi-platform image with arm64 support.

Runtime, Tooling

Compiler, Topdown and Rego

Docs, Website, Ecosystem

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

Decision Logs dropped (introduced in OPA v1.9.0)

When the decision logs buffer was uploaded, the buffer limit inadvertently got reset to the default upload limit (32kb). This causes logs to be dropped that shouldn't have been dropped.

This default is overridden by the configuration value decision_logs.reporting.upload_size_limit_bytes, see the docs on decision logs.

There's a Prometheus metric for dropped events, counter_decision_logs_dropped_buffer_size_limit_bytes_exceeded, and you can check that for unexpectedly high counts.

Reported by @​johanneslarsson #8123, fixed by @​sspaink.

The release is otherwise identical to v1.11.0.

1.11.0

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • More efficient connection management in the http.send built-in function
  • More performant loading of large bundles containing multiple Rego files

Immutable Releases

Starting with this release, OPA releases are immutable for increased security.

Runtime, SDK, Tooling

Compiler, Topdown and Rego

Docs, Website, Ecosystem

... (truncated)

Commits

Updates github.com/operator-framework/api from 0.35.0 to 0.37.0

Release notes

Sourced from github.com/operator-framework/api's releases.

v0.37.0

Significant Features

  • #454 provides a new optional release field allowing bundle authors to express packaging-specific versioning for CSVs which is backwards- and forwards-compatible. Validators are updated to ensure correct use of this field. For more information, please see the brief and rfc.

What's Changed

Full Changelog: operator-framework/api@v0.36.0...v0.37.0

v0.36.0

What's Changed

Full Changelog: operator-framework/api@v0.35.0...v0.36.0

Commits
  • f65ea7e add Release version as an optional field in the CSV (#454)
  • 4efa173 Bump github.com/spf13/cobra from 1.10.1 to 1.10.2 (#460)
  • ebdb4e0 Bump actions/checkout from 5 to 6 (#459)
  • 500bb71 Bump the k8s-dependencies group with 4 updates (#458)
  • 9b9df1e add general agents info (#457)
  • d6a5128 Bump sigs.k8s.io/controller-runtime in the k8s-dependencies group (#456)
  • 28121db bump go version to fix GO-2025-3956 (#455)
  • e9c7bb5 Bump sigs.k8s.io/controller-runtime in the k8s-dependencies group (#453)
  • 67b6d64 Bump sigs.k8s.io/controller-runtime in the k8s-dependencies group (#452)
  • See full diff in compare view

Updates github.com/spf13/cobra from 1.10.1 to 1.10.2

Release notes

Sourced from github.com/spf13/cobra's releases.

v1.10.2

🔧 Dependencies

  • chore: Migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 by @​dims in spf13/cobra#2336 - the gopkg.in/yaml.v3 package has been deprecated for some time: this should significantly cleanup dependency/supply-chains for consumers of spf13/cobra

📈 CI/CD

🔥✍🏼 Docs

🍂 Refactors

🤗 New Contributors

Full Changelog: spf13/cobra@v1.10.1...v1.10.2

Thank you to our amazing contributors!!!!! 🐍 🚀

Commits

Updates github.com/tektoncd/pipeline from 1.5.0 to 1.7.0

Release notes

Sourced from github.com/tektoncd/pipeline's releases.

Tekton Pipeline release v1.7.0 "LaPerm Little Helper"

🎉 Bug fixes, stability improvements and dependency updates 🎉

-Docs @ v1.7.0 -Examples @ v1.7.0

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.7.0/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a0af3ff47db2d68605b227b75af0aa40d87262257e2b9295f35454fe3d050ed38

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a0af3ff47db2d68605b227b75af0aa40d87262257e2b9295f35454fe3d050ed38
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.7.0/release.yaml
REKOR_UUID=108e9186e8c5677a0af3ff47db2d68605b227b75af0aa40d87262257e2b9295f35454fe3d050ed38
Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.7.0@sha256:" + .digest.sha256')
Download the release file
curl -L "$RELEASE_FILE" > release.yaml
For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Fixes

  • 🐛 fix: Populate step statuses before TaskRun timeout handling (#9184)

Fix a race condition on timeout that would result in a TaskRun status without steps statuses.

  • 🐛 fix: panic in v1beta1 matrix validation for invalid result refs (#9135)

Resolved an issue where Pipelines with invalid result references in matrix parameters would cause a panic during validation (v1beta1 API)

... (truncated)

Changelog

Sourced from github.com/tektoncd/pipeline's changelog.

Tekton Pipeline Releases

Release Frequency

Tekton Pipelines follows the Tekton community [release policy][release-policy] as follows:

  • Versions are numbered according to semantic versioning: vX.Y.Z
  • A new release is produced on a monthly basis
  • Four releases a year are chosen for long term support (LTS). All remaining releases are supported for approximately 1 month (until the next release is produced)
    • LTS releases take place in January, April, July and October every year
    • The first Tekton Pipelines LTS release will be v0.41.0 in October 2022
    • Releases happen towards the middle of the month, between the 13th and the 20th, depending on week-ends and readiness

Tekton Pipelines produces nightly builds, publicly available on gcr.io/tekton-nightly.

Transition Process

Before release v0.41 Tekton Pipelines has worked on the basis of an undocumented support period of four months, which will be maintained for the releases between v0.37 and v0.40.

Release Process

Tekton Pipeline releases are made of YAML manifests and container images. Manifests are published to cloud object-storage as well as [GitHub][tekton-pipeline-releases]. Container images are signed by [Sigstore][sigstore] via [Tekton Chains][tekton-chains]; signatures can be verified through the [public key][chains-public-key] hosted by the Tekton Chains project.

Further documentation available:

  • The Tekton Pipeline [release process][tekton-releases-docs]
  • [Installing Tekton][tekton-installation]
  • Standard for [release notes][release-notes-standards]

Release

v1.7

  • Latest Release: [v1.7.0][v1.7-0] (2025-12-03) ([docs][v1.7-0-docs], [examples][v1.7-0-examples])
  • Initial Release: [v1.7.0][v1.7-0] (2025-12-03)
  • End of Life: 2025-12-31
  • Patch Releases: [v1.7.0][v1.7-0]

v1.6 (LTS)

... (truncated)

Commits
  • 478d30f chore(release-pipeline): update references to oci bucket
  • 81efec1 fix: panic in v1beta1 matrix validation for invalid result refs
  • 87e65a4 build(deps): bump tj-actions/changed-files
  • a3b0033 e2e: give more time for dind-sidecar to start
  • 212e4c2 e2e: try to bump to 15min for the wait function
  • 66cfc36 examples: reduce the size of the matrix to reduce flakiness
  • ad5317e .github/workflows: fix e2e-matrix-extras
  • b03f7e4 Migrate tests images out of dockerhub.
  • da0d703 build(deps): bump the all group in /tekton with 4 updates
  • 3471300 build(deps): bump golangci/golangci-lint-action from 9.0.0 to 9.1.0
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.43.0 to 0.45.0

Commits
  • 4e0068c go.mod: update golang.org/x dependencies
  • e79546e ssh: curb GSSAPI DoS risk by limiting number of specified OIDs
  • f91f7a7 ssh/agent: prevent panic on malformed constraint
  • 2df4153 acme/autocert: let automatic renewal work with short lifetime certs
  • bcf6a84 acme: pass context to request
  • b4f2b62 ssh: fix error message on unsupported cipher
  • 79ec3a5 ssh: allow to bind to a hostname in remote forwarding
  • 122a78f go.mod: update golang.org/x dependencies
  • c0531f9 all: eliminate vet diagnostics
  • 0997000 all: fix some comments
  • Additional commits viewable in compare view

Updates golang.org/x/oauth2 from 0.32.0 to 0.33.0

Commits

Updates golang.org/x/text from 0.30.0 to 0.31.0

Commits
  • e7ff6b3 go.mod: update golang.org/x dependencies
  • fbf012b all: use reflect.TypeFor instead of reflect.TypeOf
  • See full diff in compare view

Updates google.golang.org/api from 0.252.0 to 0.254.0

Release notes

Sourced from google.golang.org/api's releases.

v0.254.0

0.254.0 (2025-10-28)

Features

v0.253.0

0.253.0 (2025-10-22)

Features

  • all: Auto-regenerate discovery clients (#3337) (40f2752)
  • all: Auto-regenerate discovery clients (#3339) (d1ef976)
  • all: Auto-regenerate discovery clients (#3340) (580c65f)
  • all: Auto-regenerate discovery clients (#3341) (9d031c4)
  • all: Auto-regenerate discovery clients (#3342) (ca2b9ad)
  • all: Auto-regenerate discovery clients (#3344) (844753e)
  • all: Auto-regenerate discovery clients (#3345) (3de8a5b)
  • all: Auto-regenerate discovery clients (

@dependabot
Bump the backend group across 1 directory with 12 updates
7e57ae6 
Bumps the backend group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/aquasecurity/trivy](https://github.com/aquasecurity/trivy) | `0.67.2` | `0.68.2` |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.16.3` | `5.16.4` |
| [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.20.6` | `0.20.7` |
| [github.com/operator-framework/api](https://github.com/operator-framework/api) | `0.35.0` | `0.37.0` |
| [github.com/tektoncd/pipeline](https://github.com/tektoncd/pipeline) | `1.5.0` | `1.7.0` |



Updates `github.com/aquasecurity/trivy` from 0.67.2 to 0.68.2
- [Release notes](https://github.com/aquasecurity/trivy/releases)
- [Changelog](https://github.com/aquasecurity/trivy/blob/v0.68.2/CHANGELOG.md)
- [Commits](aquasecurity/trivy@v0.67.2...v0.68.2)

Updates `github.com/go-git/go-git/v5` from 5.16.3 to 5.16.4
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](go-git/go-git@v5.16.3...v5.16.4)

Updates `github.com/google/go-containerregistry` from 0.20.6 to 0.20.7
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](google/go-containerregistry@v0.20.6...v0.20.7)

Updates `github.com/open-policy-agent/opa` from 1.9.0 to 1.10.1
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](open-policy-agent/opa@v1.9.0...v1.10.1)

Updates `github.com/operator-framework/api` from 0.35.0 to 0.37.0
- [Release notes](https://github.com/operator-framework/api/releases)
- [Changelog](https://github.com/operator-framework/api/blob/master/RELEASE.md)
- [Commits](operator-framework/api@v0.35.0...v0.37.0)

Updates `github.com/spf13/cobra` from 1.10.1 to 1.10.2
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](spf13/cobra@v1.10.1...v1.10.2)

Updates `github.com/tektoncd/pipeline` from 1.5.0 to 1.7.0
- [Release notes](https://github.com/tektoncd/pipeline/releases)
- [Changelog](https://github.com/tektoncd/pipeline/blob/main/releases.md)
- [Commits](tektoncd/pipeline@v1.5.0...v1.7.0)

Updates `golang.org/x/crypto` from 0.43.0 to 0.45.0
- [Commits](golang/crypto@v0.43.0...v0.45.0)

Updates `golang.org/x/oauth2` from 0.32.0 to 0.33.0
- [Commits](golang/oauth2@v0.32.0...v0.33.0)

Updates `golang.org/x/text` from 0.30.0 to 0.31.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.30.0...v0.31.0)

Updates `google.golang.org/api` from 0.252.0 to 0.254.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.252.0...v0.254.0)

Updates `helm.sh/helm/v3` from 3.19.0 to 3.19.2
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](helm/helm@v3.19.0...v3.19.2)

---
updated-dependencies:
- dependency-name: github.com/aquasecurity/trivy
  dependency-version: 0.68.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.16.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.20.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: github.com/open-policy-agent/opa
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: github.com/operator-framework/api
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: github.com/spf13/cobra
  dependency-version: 1.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: github.com/tektoncd/pipeline
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: golang.org/x/text
  dependency-version: 0.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: google.golang.org/api
  dependency-version: 0.254.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: helm.sh/helm/v3
  dependency-version: 3.19.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
...

Signed-off-by: dependabot[bot] <support@github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants