Update go modules (release-v0.5) (patch) by renovate[bot] · Pull Request #2983 · conforma/cli

renovate · 2025-10-01T09:21:43Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
cuelang.org/go	`v0.10.0` -> `v0.10.1`
github.com/daixiang0/gci	`v0.13.5` -> `v0.13.7`
github.com/enterprise-contract/enterprise-contract-controller/api	`v0.1.55` -> `v0.1.198`
github.com/enterprise-contract/go-containerregistry	`v0.20.3-0.20240814111759-1368a664d919` -> `v0.20.6`
github.com/evanphx/json-patch	`v5.9.0+incompatible` -> `v5.9.11+incompatible`
github.com/evanphx/json-patch/v5	`v5.9.0` -> `v5.9.11`
github.com/gkampitakis/go-snaps	`v0.5.7` -> `v0.5.15`
github.com/go-logr/logr	`v1.4.2` -> `v1.4.3`
github.com/google/go-containerregistry	`v0.20.2` -> `v0.20.6`
github.com/hashicorp/go-getter	`v1.7.9` -> `v1.7.10`
github.com/otiai10/copy	`v1.14.0` -> `v1.14.1`
github.com/secure-systems-lab/go-securesystemslib	`v0.9.0` -> `v0.9.1`
github.com/sigstore/cosign/v2	`v2.4.0` -> `v2.4.3`
github.com/sigstore/rekor	`v1.3.6` -> `v1.3.10`
github.com/spf13/pflag	`v1.0.5` -> `v1.0.10`
github.com/tektoncd/chains	`v0.22.0` -> `v0.22.3`
github.com/tektoncd/cli	`v0.38.0` -> `v0.38.2`
k8s.io/api	`v0.31.6` -> `v0.31.14`
k8s.io/apiextensions-apiserver	`v0.31.4` -> `v0.31.14`
k8s.io/apimachinery	`v0.31.6` -> `v0.31.14`
k8s.io/client-go	`v0.31.6` -> `v0.31.14`
k8s.io/kubernetes	`v1.31.12` -> `v1.31.14`

Release Notes

cue-lang/cue (cuelang.org/go)

`v0.10.1`

Compare Source

This release includes fixes for two bugs which were uncovered and resolved in the last few weeks.

`cmd/cue`

CL 1202646 fixes a panic for users of the cmd/cue/cmd Go API.

CL 1202738 fixes a bug when using @if attributes in files specified directly as command line arguments.

daixiang0/gci (github.com/daixiang0/gci)

`v0.13.7`

Compare Source

What's Changed

fix: scrape all goos/goarch pair for stdlib by @Zxilly in #208
chore: get module info from pass by @ldez in #221
chore: remove analyzer by @ldez in #222
feat: update standard list to go1.25 by @ldez in #233
bump up version by @daixiang0 in #234

New Contributors

@Zxilly made their first contribution in #208

Full Changelog: daixiang0/gci@v0.13.6...v0.13.7

`v0.13.6`

Compare Source

What's Changed

fix: update standard list to go1.24 by @ldez in #227
bump up version by @daixiang0 in #229

Full Changelog: daixiang0/gci@v0.13.5...v0.13.6

enterprise-contract/go-containerregistry (github.com/enterprise-contract/go-containerregistry)

evanphx/json-patch (github.com/evanphx/json-patch)

`v5.9.11+incompatible`

Compare Source

`v5.9.10+incompatible`

Compare Source

gkampitakis/go-snaps (github.com/gkampitakis/go-snaps)

`v0.5.15`

Compare Source

What's Changed

test: explicitly return named variables by @G-Rath in #137
ci: show diff after running linting by @G-Rath in #136
fix: only update snapshots when actually allowed by @G-Rath in #135

Full Changelog: gkampitakis/go-snaps@v0.5.14...v0.5.15

`v0.5.14`

Compare Source

What's Changed

feat: snaps.Clean now returns if snaps dirty and err by @gkampitakis in #131

Full Changelog: gkampitakis/go-snaps@v0.5.13...v0.5.14

`v0.5.13`

Compare Source

What's Changed

feat: support MatchStandaloneYAML by @gkampitakis in #128
chore: update go-yaml and gh-action deps by @gkampitakis in #129

Full Changelog: gkampitakis/go-snaps@v0.5.12...v0.5.13

`v0.5.12`

Compare Source

What's Changed

feat: add UPDATE_SNAPS=always for updating and creating snaps on CI setup by @gkampitakis in #126

Full Changelog: gkampitakis/go-snaps@v0.5.11...v0.5.12

`v0.5.11`

Compare Source

What's Changed

feat: add json format config by @kitimark in #121

New Contributors

@kitimark made their first contribution in #121

Full Changelog: gkampitakis/go-snaps@v0.5.10...v0.5.11

`v0.5.10`

Compare Source

What's Changed

fix: handle builds with trimpath enabled by @gkampitakis in #120

Full Changelog: gkampitakis/go-snaps@v0.5.9...v0.5.10

`v0.5.9`

Compare Source

What's Changed

fix: snaps.Update should apply and on snapshot create by @gkampitakis in #119

Full Changelog: gkampitakis/go-snaps@`v0.5.8...v0.5.9`

Kudos to @orloffv for this issue #116

`v0.5.8`

Compare Source

What's Changed

feat: implement matchYAML by @gkampitakis in #114
feat: implement matchStandaloneJSON by @gkampitakis in #113

Full Changelog: gkampitakis/go-snaps@v0.5.7...v0.5.8

go-logr/logr (github.com/go-logr/logr)

`v1.4.3`

Compare Source

Minor release.

What's Changed

Fix slog tests for 1.25 by @hoeppi-google in #361
Remove one exception from Slog testing by @thockin in #362

New Contributors

@hoeppi-google made their first contribution in #361

Full Changelog: go-logr/logr@v1.4.2...v1.4.3

google/go-containerregistry (github.com/google/go-containerregistry)

`v0.20.6`

Compare Source

What's Changed

Ensure that tag name is not empty if name contains colon by @SaschaSchwarze0 in #2094
Bump some deps by @jonjohnsonjr in #2110

New Contributors

@SaschaSchwarze0 made their first contribution in #2094

Full Changelog: google/go-containerregistry@v0.20.4...v0.20.6

`v0.20.5`

Compare Source

What's Changed

build(deps): bump docker/docker to v28.0.0+incompatible by @luhring in #2071
Migrate linter to v2 by @Subserial in #2096
bump go version + bump deps by @Subserial in #2093
implement TextMarshaler/JSONMarshaler more consistently by @imjasonh in #2097
Update CodeQL permissions by @Subserial in #2103
Update goreleaser permissions by @Subserial in #2104
Update provenance action in release by @Subserial in #2105
Update validator action by @Subserial in #2106

New Contributors

@luhring made their first contribution in #2071
@Subserial made their first contribution in #2096

Full Changelog: google/go-containerregistry@v0.20.3...v0.20.5

`v0.20.4`: - Not usable as a go module

Compare Source

🚨 This release was published to the Go module proxy and then re-tagged with a different commit. This means it's not usable as a Go module (#2107) -- please us v0.20.5 instead.

What's Changed

build(deps): bump docker/docker to v28.0.0+incompatible by @luhring in #2071
Migrate linter to v2 by @Subserial in #2096
bump go version + bump deps by @Subserial in #2093
implement TextMarshaler/JSONMarshaler more consistently by @imjasonh in #2097
Update CodeQL permissions by @Subserial in #2103
Update goreleaser permissions by @Subserial in #2104
Update provenance action in release by @Subserial in #2105
Update validator action by @Subserial in #2106

New Contributors

@luhring made their first contribution in #2071
@Subserial made their first contribution in #2096

Full Changelog: google/go-containerregistry@v0.20.3...v0.20.4

`v0.20.3`

Compare Source

What's Changed

remote/transport: Make bearer transport go-routine-safe by @2opremio in #1806
Expose compare package by @jonjohnsonjr in #2001
fix: redact.URL uses (*URL).Redacted to omit basic-auth password by @bmoylan in #1947
bump actions to latest by @ajayk in #2011
don't pin chainguard-dev/actions by @imjasonh in #2025
Check for 406 status code when handling referrers API endpoint response by @malancas in #2026
mutate: Create a defensive annotations copy by @jonjohnsonjr in #2030
Detect zstd in crane append by @jonjohnsonjr in #2023
bump deps using hack/bump-deps.sh by @imjasonh in #2042

New Contributors

@bmoylan made their first contribution in #1947
@ajayk made their first contribution in #2011
@malancas made their first contribution in #2026

Full Changelog: google/go-containerregistry@v0.20.2...v0.20.3

otiai10/copy (github.com/otiai10/copy)

`v1.14.1`

Compare Source

secure-systems-lab/go-securesystemslib (github.com/secure-systems-lab/go-securesystemslib)

`v0.9.1`

Compare Source

sigstore/cosign (github.com/sigstore/cosign/v2)

`v2.4.3`

Compare Source

Features

Bump sigstore/sigstore to support KMS plugins (#4073)
Enable fetching signatures without remote get. (#4047)
Feat/file flag completion improvements (#4028)
Update builder to use go1.23.6 (#4052)

Bug Fixes

fix parsing error in --only for cosign copy (#4049)

Cleanup

Refactor verifyNewBundle into library function (#4013)
fix comment typo and imports order (#4061)
sync comment with parameter name in function signature (#4063)
sort properly Go imports (#4071)

Contributors

Bob Callaway
Carlos Tadeu Panato Junior
Cody Soyland
Dmitry Savintsev
Hayden B
Tomasz Janiszewski
Ville Skyttä

`v2.4.2`

Compare Source

Features

Updated open-policy-agent to 1.1.0 library (#4036)
- Note that only Rego v0 policies are supported at this time
Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
Add support for verifying root checksum in cosign initialize (#3953)
Detect if user supplied a valid protobuf bundle (#3931)
Add a log message if user doesn't provide --trusted-root (#3933)
Support mTLS towards container registry (#3922)
Add bundle create helper command (#3901)
Add trusted-root create helper command (#3876)

Bug Fixes

fix: set tls config while retaining other fields from default http transport (#4007)
policy fuzzer: ignore known panics (#3993)
Fix for multiple WithRemote options (#3982)
Add nightly conformance test workflow (#3979)
Fix copy --only for signatures + update/align docs (#3904)

Documentation

Remove usage.md from spec, point to client spec (#3918)
move reference from gcr to ghcr (#3897)

Contributors

AdamKorcz
Aditya Sirish
Bob Callaway
Carlos Tadeu Panato Junior
Cody Soyland
Colleen Murphy
Hayden B
Jussi Kukkonen
Marco Franssen
Nianyu Shen
Slavek Kabrda
Søren Juul
Warren Hodgkinson
Zach Steindler

`v2.4.1`

Compare Source

v2.4.1 largely contains bug fixes and updates dependencies.

Features

Added fuzzing coverage to multiple packages

Bug Fixes

Fix bug in attest-blob when using a timestamp authority with new bundles (#3877)
fix: documentation link for installation guide (#3884)

Contributors

AdamKorcz
Bob Callaway
Carlos Tadeu Panato Junior
Hayden B
Hemil K
Sota Sugiura
Zach Steindler

sigstore/rekor (github.com/sigstore/rekor)

`v1.3.10`

Compare Source

Note that Rekor v1 is in maintenance mode as we are actively developing
its successor, Rekor v2, designed to be easy to maintain and cheaper to operate.. See the
README
for more information.

Features

Added --client-signing-algorithms flag (#1974)

Fixes / Misc

emit unpopulated values when marshalling (#2438)
pkg/api: better logs when algorithm registry rejects a key (#2429)
chore: improve mysql readiness checks (#2397)

Contributors

Bob Callaway
cangqiaoyuzhuo
Carlos Tadeu Panato Junior
cpanato
Hayden B
Praful Khanduri
Ramon Petgrave
Riccardo Schirone
rubyisrust
Sascha Grunert

`v1.3.9`

Compare Source

Features

Cache checkpoint for inactive shards (#2332)
Support per-shard signing keys (#2330)

Contributors

Hayden B

`v1.3.8`

Compare Source

Bug Fixes

fix zizmor issues (#2298)
remove unneeded value in log message (#2282)

Quality Enhancements

chore: relax go directive to permit 1.22.x
fetch minisign from homebrew instead of custom ppa (#2329)
fix(ci): simplify GOVERSION extraction
chore(deps): bump actions pins to latest
Updates go and golangci-lint (#2302)
update builder to use go1.23.4 (#2301)
clean up spaces
log request body on 500 error to aid debugging (#2283)

Contributors

Appu Goundan
Bob Callaway
Carlos Tadeu Panato Junior
Dominic Evans
sgpinkus

`v1.3.7`

Compare Source

New Features

log request body on 500 error to aid debugging (#2283)
Add support for signing with Tink keyset (#2228)
Add public key hash check in Signed Note verification (#2214)
update Trillian TLS configuration (#2202)
Add TLS support for Trillian server (#2164)
Replace docker-compose with plugin if available (#2153)
Add flags to backfill script (#2146)
Unset DisableKeepalive for backfill HTTP client (#2137)
Add script to delete indexes from Redis (#2120)
Run CREATE statement in backfill script (#2109)
Add MySQL support to backfill script (#2081)
Run e2e tests on mysql and redis index backends (#2079)

Bug Fixes

remove unneeded value in log message (#2282)
Add error message when computing consistency proof (#2278)
fix validation error handling on API (#2217)
fix error in pretty-printed inclusion proof from verify subcommand (#2210)
Fix index scripts (#2203)
fix failing sharding test
Better error handling in backfill script (#2148)
Batch entries in cleanup script (#2158)
Add missing workflow for index cleanup test (#2121)
hashedrekord: fix schema $id (#2092)

Contributors

Aditya Sirish
Bob Callaway
Colleen Murphy
cpanato
Firas Ghanmi
Hayden B
Hojoung (Brian) Jang
William Woodruff

spf13/pflag (github.com/spf13/pflag)

`v1.0.10`

Compare Source

What's Changed

fix deprecation comment for (FlagSet.)ParseErrorsWhitelist by @thaJeztah in #447
remove uses of errors.Is, which requires go1.13, move go1.16/go1.21 tests to separate file by @thaJeztah in #448

New Contributors

@thaJeztah made their first contribution in #447

Full Changelog: spf13/pflag@v1.0.9...v1.0.10

`v1.0.9`

Compare Source

What's Changed

fix: Restore ParseErrorsWhitelist name for now by @tomasaschan in #446

Full Changelog: spf13/pflag@v1.0.8...v1.0.9

`v1.0.8`

Compare Source

⚠️ Breaking Change

This version, while only a patch bump, includes a (very minor) breaking change: the flag.ParseErrorsWhitelist struct and corresponding FlagSet.parseErrorsWhitelist field have been renamed to ParseErrorsAllowlist.

This should result in compilation errors in any code that uses these fields, which can be fixed by adjusting the names at call sites. There is no change in semantics or behavior of the struct or field referred to by these names. If your code compiles without errors after bumping to/past v1.0.8, you are not affected by this change.

The breaking change was reverted in v1.0.9, by means of re-introducing the old names with deprecation warnings. The plan is still to remove them in a future release, so if your code does depend on the old names, please change them to use the new names at your earliest convenience.

What's Changed

Remove Redundant "Unknown-Flag" Error by @vaguecoder in #364
Switching from whitelist to Allowlist terminology by @dubrie in #261
Omit zero time.Time default from usage line by @mologie in #438
implement CopyToGoFlagSet by @pohly in #330
flag: Emulate stdlib behavior and do not print ErrHelp by @tmc in #407
Print Default Values of String-to-String in Sorted Order by @vaguecoder in #365
fix: Don't print ErrHelp in ParseAll by @tomasaschan in #443
Reset args on re-parse even if empty by @tomasaschan in #444

New Contributors

@vaguecoder made their first contribution in #364
@dubrie made their first contribution in #261
@mologie made their first contribution in #438
@pohly made their first contribution in #330
@tmc made their first contribution in #407
@tomasaschan made their first contribution in #443

Full Changelog: spf13/pflag@v1.0.7...v1.0.8

`v1.0.7`

Compare Source

What's Changed

Fix defaultIsZeroValue check for generic Value types by @MidnightRocket in #422
feat: Use structs for errors returned by pflag. by @eth-p in #425
Fix typos by @co63oc in #428
fix #423 : Add helper function and some documentation to parse shorthand go test flags. by @valdar in #424
add support equivalent to golang flag.TextVar(), also fixes the test failure as described in #368 by @hujun-open in #418
add support for Func() and BoolFunc() #426 by @LeGEC in #429
fix: correct argument length check in FlagSet.Parse by @ShawnJeffersonWang in #409
fix usage message for func flags, fix arguments order by @LeGEC in #431
Add support for time.Time flags by @max-frank in #348

New Contributors

@MidnightRocket made their first contribution in #422
@eth-p made their first contribution in #425
@co63oc made their first contribution in #428
@valdar made their first contribution in #424
@hujun-open made their first contribution in #418
@LeGEC made their first contribution in #429
@ShawnJeffersonWang made their first contribution in #409
@max-frank made their first contribution in #348

Full Changelog: spf13/pflag@v1.0.6...v1.0.7

`v1.0.6`

Compare Source

What's Changed

Add exported functions to preserve pkg/flag compatibility by @mckern in #220
remove dead code for checking error nil by @yashbhutwala in #282
Add IPNetSlice and unit tests by @rpothier in #170
allow for blank ip addresses by @duhruh in #316
add github actions by @sagikazarmark in #419

New Contributors

@mckern made their first contribution in #220
@yashbhutwala made their first contribution in #282
@rpothier made their first contribution in #170
@duhruh made their first contribution in #316
@sagikazarmark made their first contribution in #419

Full Changelog: spf13/pflag@v1.0.5...v1.0.6

tektoncd/chains (github.com/tektoncd/chains)

`v0.22.3`: Tekton Chains release v0.22.3 "v0.22.3"

Compare Source

-[Docs @ v0.22.3](https://redirect.gi

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2025-10-01T09:21:50Z

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: acceptance/go.sum

Command failed: go get -t ./...
go: module github.com/google/go-containerregistry@v0.20.6 requires go >= 1.24; switching to go1.24.10
go: downloading go1.24.10 (linux/amd64)
go: download go1.24.10: golang.org/toolchain@v0.0.1-go1.24.10.linux-amd64: verifying module: checksum database disabled by GOSUMDB=off

File name: go.sum

Command failed: go get -t ./...
go: module github.com/enterprise-contract/go-containerregistry@v0.20.6 requires go >= 1.24; switching to go1.24.10
go: downloading go1.24.10 (linux/amd64)
go: download go1.24.10: golang.org/toolchain@v0.0.1-go1.24.10.linux-amd64: verifying module: checksum database disabled by GOSUMDB=off

simonbaird · 2025-11-12T21:44:24Z

The release-v0.5 is branch is no longer being maintained, see EC-1553.

renovate bot added release-v0.5 renovate labels Oct 1, 2025

renovate bot enabled auto-merge October 1, 2025 09:21

renovate bot force-pushed the renovate/release-v0.5-patch-go-modules branch 12 times, most recently from a3fb242 to ddf49f5 Compare October 8, 2025 12:54

renovate bot force-pushed the renovate/release-v0.5-patch-go-modules branch 10 times, most recently from a2dd040 to 33742e5 Compare October 16, 2025 04:52

renovate bot force-pushed the renovate/release-v0.5-patch-go-modules branch 4 times, most recently from 15b9df6 to 7e1cc06 Compare October 19, 2025 05:03

renovate bot force-pushed the renovate/release-v0.5-patch-go-modules branch 10 times, most recently from 3eae83c to 13850ae Compare October 31, 2025 17:15

renovate bot force-pushed the renovate/release-v0.5-patch-go-modules branch 10 times, most recently from 8cb23de to b945e09 Compare November 8, 2025 04:48

renovate bot force-pushed the renovate/release-v0.5-patch-go-modules branch 5 times, most recently from 1543c60 to 0439158 Compare November 12, 2025 20:16

Update go modules

80b0f80

renovate bot force-pushed the renovate/release-v0.5-patch-go-modules branch from 0439158 to 80b0f80 Compare November 12, 2025 21:41

simonbaird closed this Nov 12, 2025

auto-merge was automatically disabled November 12, 2025 21:44
Pull request was closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update go modules (release-v0.5) (patch)#2983

Update go modules (release-v0.5) (patch)#2983
renovate[bot] wants to merge 1 commit intorelease-v0.5from
renovate/release-v0.5-patch-go-modules

renovate bot commented Oct 1, 2025 •

edited

Loading

Uh oh!

renovate bot commented Oct 1, 2025 •

edited

Loading

Uh oh!

simonbaird commented Nov 12, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate bot commented Oct 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

cmd/cue

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

Full Changelog: gkampitakis/go-snaps@v0.5.8...v0.5.9

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

v0.20.4: - Not usable as a go module

What's Changed

New Contributors

What's Changed

New Contributors

Features

Bug Fixes

Cleanup

Contributors

Features

Bug Fixes

Documentation

Contributors

Features

Bug Fixes

Contributors

Features

Fixes / Misc

Contributors

Features

Contributors

Bug Fixes

Quality Enhancements

Contributors

New Features

Bug Fixes

Contributors

What's Changed

New Contributors

What's Changed

⚠️ Breaking Change

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

v0.22.3: Tekton Chains release v0.22.3 "v0.22.3"

Configuration

Uh oh!

renovate bot commented Oct 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: acceptance/go.sum

File name: go.sum

Uh oh!

simonbaird commented Nov 12, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Oct 1, 2025 •

edited

Loading

`cmd/cue`

Full Changelog: gkampitakis/go-snaps@`v0.5.8...v0.5.9`

`v0.20.4`: - Not usable as a go module

`v0.22.3`: Tekton Chains release v0.22.3 "v0.22.3"

renovate bot commented Oct 1, 2025 •

edited

Loading