Update go modules (release-v0.7) (patch) by renovate[bot] · Pull Request #3146 · conforma/cli

renovate · 2026-03-02T02:08:37Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
cuelang.org/go	`v0.16.0` → `v0.16.1`
cuelang.org/go	`v0.15.1` → `v0.15.4`
github.com/enterprise-contract/enterprise-contract-controller/api	`v0.1.257` → `v0.1.281`
github.com/gkampitakis/go-snaps	`v0.5.19` → `v0.5.21`
github.com/go-git/go-git/v5	`v5.17.1` → `v5.17.2`
github.com/google/go-containerregistry	`v0.20.7` → `v0.20.8`
github.com/google/go-containerregistry	`v0.21.0` → `v0.21.5`
github.com/mattn/go-isatty	`v0.0.20` → `v0.0.21`
github.com/package-url/packageurl-go	`v0.1.3` → `v0.1.5`
github.com/sigstore/cosign/v2	`v2.6.2` → `v2.6.3`
github.com/sigstore/rekor	`v1.5.0` → `v1.5.1`
github.com/sigstore/sigstore	`v1.10.4` → `v1.10.5`
github.com/tektoncd/cli	`v0.44.0` → `v0.44.1`
k8s.io/api	`v0.34.4` → `v0.34.7`
k8s.io/apiextensions-apiserver	`v0.34.3` → `v0.34.7`
k8s.io/apimachinery	`v0.34.3` → `v0.34.7`
k8s.io/apimachinery	`v0.34.4` → `v0.34.7`
k8s.io/client-go	`v0.34.3` → `v0.34.7`
k8s.io/client-go	`v0.34.4` → `v0.34.7`
k8s.io/kubernetes	`v1.34.3` → `v1.34.7`

Release Notes

cue-lang/cue (cuelang.org/go)

`v0.16.1`

Compare Source

Language

The fallback keyword in the aliasv2 experiment is replaced by otherwise, which is clearer. cue fmt or cue fix can be used to rewrite existing code.

Evaluator

Fix a regression where the compiler could add comments to the input AST value, which could lead to increased memory usage.

Fix a bug where exporting certain schemas could result in "cannot have both alias and field in same scope" errors.

`cmd/cue`

Fix a panic which could occur when using non-label expressions in the --path flag.

Teach cue login to give helpful errors when used with OCI registries which don't support the OAuth2 device flow.

Go API

Fix a regression where cue.Context.Encode could panic on custom marshaler types with pointer receivers.

Full list of changes since v0.16.0

internal/cueversion: bump to v0.16.1 by @mvdan in 6d609d7
internal/ci: build releases with Go 1.26.2 by @mvdan in cedf4c8
update all golang.org/x/... dependencies by @mvdan in b4efeef
all: rename fallback keyword to otherwise by @mpvl in f813811
lsp/cache: improve rename by @cuematthew in 8e47027
integration/workspace: add test showing bad behaviour by @cuematthew in a5e0ef5
cmd/cue: suggest docker/podman login when OAuth2 device flow is unsupported by @mvdan in c169605
cmd/cue: add testscript for cue login when device code endpoint is unsupported by @mvdan in d7c882a
cmd/cue: clarify how to authenticate with standard OCI registries by @mvdan in 2613edf
internal/core/compile: avoid mutating AST by @rogpeppe in e4b0516
internal/core/export: fix alias/field name conflict in pattern constraints by @mvdan in 1e46409
internal/core/export: add regression test for alias/field name conflict by @mvdan in 1654f66
pkg: fix godoc mistakes across several packages by @mvdan in eae9aaf
internal/core/convert: fix panic when encoding pointer-receiver marshalers by @mvdan in 8e39aec
cmd/cue: return an error for non-label --path expressions instead of panicking by @mvdan in 5a55849
encoding: add godoc hints for cue/ast result types by @mvdan in 682c663

gkampitakis/go-snaps (github.com/gkampitakis/go-snaps)

`v0.5.21`

Compare Source

What's Changed

support nested arrays in json matchers by @gkampitakis in #145

Full Changelog: gkampitakis/go-snaps@v0.5.20...v0.5.21

`v0.5.20`

Compare Source

What's Changed

feat: support setting serializer on config by @gkampitakis in #154

Full Changelog: gkampitakis/go-snaps@v0.5.19...v0.5.20

go-git/go-git (github.com/go-git/go-git/v5)

`v5.17.2`

Compare Source

What's Changed

build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in #1941
dotgit: skip writing pack files that already exist on disk by @pjbgf in #1944

⚠️ This release fixes a bug (#1942) that blocked some users from upgrading to v5.17.1. Thanks @pskrbasu for reporting it. 🙇

Full Changelog: go-git/go-git@v5.17.1...v5.17.2

google/go-containerregistry (github.com/google/go-containerregistry)

`v0.20.8`

Compare Source

mattn/go-isatty (github.com/mattn/go-isatty)

`v0.0.21`

Compare Source

package-url/packageurl-go (github.com/package-url/packageurl-go)

`v0.1.5`

Compare Source

What's Changed

Remove version requirement for TypeSwift by @Talgarr in #90
Handle non-canonical input purls a bit more gracefully by @petergardfjall in #89

New Contributors

@Talgarr made their first contribution in #90

Full Changelog: package-url/packageurl-go@v0.1.4...v0.1.5

`v0.1.4`

Compare Source

What's Changed

Fix golangci and update versions by @shibumi in #76
Allow npm names to be case sensitive by @PFCM in #73
add custom validation for pkg:cpan by @petergardfjall in #79
move cpan to known types by @nikpivkin in #71
Run tests using reference data from purl-spec by @keshav-space in #80
update code to honor the canonical purl encoding by @petergardfjall in #83

New Contributors

@PFCM made their first contribution in #73
@nikpivkin made their first contribution in #71
@keshav-space made their first contribution in #80

Full Changelog: package-url/packageurl-go@v0.1.3...v0.1.4

sigstore/cosign (github.com/sigstore/cosign/v2)

`v2.6.3`

Compare Source

Changelog

v2.6.3 resolves GHSA-w6c6-c85g-mmv6.

fecddd3 Fix DSSE predicate check (#4802)
564c5b1 Backport bundle detection to sign and attest (#4727)

Thanks to all contributors!

sigstore/rekor (github.com/sigstore/rekor)

`v1.5.1`

Compare Source

Features

optimize memory for DSSE v0.0.1 processing (#2766)

Bug Fixes

Type assert the entry bundle when verifying inclusion proof (#2755)
return correct errors in rare failure situations (#2753)
raise error if decoding hash fails during inclusion proof (#2754)

sigstore/sigstore (github.com/sigstore/sigstore)

`v1.10.5`

Compare Source

What's Changed

(kms/hashivault): add openbao support in #2303
Fix typo in RSA PSS 4096 signature identifier in #2270
fix: eliminate usage of text/template in #2288
chore: mention openbao being supported as well (#2303) in #2313

Full Changelog: sigstore/sigstore@v1.10.4...v1.10.5

tektoncd/cli (github.com/tektoncd/cli)

`v0.44.1`

Compare Source

v0.44.1 Release 🎉

This patch release addresses the following CVEs: CVE-2026-34986, CVE-2026-33211, and CVE-2026-33186.

Changelog

feb2d5a New version v0.44.1

Full Changelog: tektoncd/cli@v0.44.0...v0.44.1

kubernetes/api (k8s.io/api)

kubernetes/apiextensions-apiserver (k8s.io/apiextensions-apiserver)

`v0.34.7`

Compare Source

`v0.34.6`

Compare Source

`v0.34.5`

Compare Source

`v0.34.4`

Compare Source

kubernetes/apimachinery (k8s.io/apimachinery)

`v0.34.7`

Compare Source

`v0.34.6`

Compare Source

`v0.34.5`

Compare Source

`v0.34.4`

Compare Source

kubernetes/client-go (k8s.io/client-go)

`v0.34.7`

Compare Source

`v0.34.6`

Compare Source

`v0.34.5`

Compare Source

`v0.34.4`

Compare Source

kubernetes/kubernetes (k8s.io/kubernetes)

`v1.34.7`

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

`v1.34.6`

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

`v1.34.5`

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

`v1.34.4`

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM (* 0-3 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-03-02T02:08:40Z

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

27 additional dependencies were updated

Details:

Package	Change
`github.com/go-openapi/strfmt`	`v0.25.0` -> `v0.26.0`
`github.com/go-chi/chi/v5`	`v5.2.4` -> `v5.2.5`
`github.com/go-openapi/analysis`	`v0.24.1` -> `v0.24.3`
`github.com/go-openapi/errors`	`v0.22.6` -> `v0.22.7`
`github.com/go-openapi/jsonpointer`	`v0.22.4` -> `v0.22.5`
`github.com/go-openapi/jsonreference`	`v0.21.4` -> `v0.21.5`
`github.com/go-openapi/loads`	`v0.23.2` -> `v0.23.3`
`github.com/go-openapi/runtime`	`v0.29.2` -> `v0.29.3`
`github.com/go-openapi/spec`	`v0.22.3` -> `v0.22.4`
`github.com/go-openapi/swag`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/cmdutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/conv`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/fileutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/jsonname`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/jsonutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/loading`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/mangling`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/netutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/stringutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/typeutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/yamlutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/validate`	`v0.25.1` -> `v0.25.2`
`github.com/go-viper/mapstructure/v2`	`v2.4.0` -> `v2.5.0`
`github.com/letsencrypt/boulder`	`v0.20251110.0` -> `v0.20260223.0`
`google.golang.org/api`	`v0.260.0` -> `v0.269.0`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20251222181119-0a764e51fe1b` -> `v0.0.0-20260128011058-8636f8732409`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20251222181119-0a764e51fe1b` -> `v0.0.0-20260217215200-42d3e9bedb6d`

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

12 additional dependencies were updated

Details:

Package	Change
`cloud.google.com/go/auth`	`v0.18.1` -> `v0.18.2`
`filippo.io/edwards25519`	`v1.1.0` -> `v1.1.1`
`github.com/go-chi/chi/v5`	`v5.2.4` -> `v5.2.5`
`github.com/go-openapi/runtime`	`v0.29.2` -> `v0.29.3`
`github.com/go-openapi/swag`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/cmdutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/netutils`	`v0.25.4` -> `v0.25.5`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.11` -> `v0.3.12`
`go.step.sm/crypto`	`v0.74.0` -> `v0.76.2`
`google.golang.org/api`	`v0.267.0` -> `v0.269.0`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260203192932-546029d2fa20` -> `v0.0.0-20260217215200-42d3e9bedb6d`
`k8s.io/api`	`v0.34.3` -> `v0.34.7`

File name: tools/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

1 additional dependency was updated

Details:

Package	Change
`github.com/moby/spdystream`	`v0.5.0` -> `v0.5.1`

File name: tools/kubectl/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

3 additional dependencies were updated

Details:

Package	Change
`github.com/moby/spdystream`	`v0.5.0` -> `v0.5.1`
`go.opentelemetry.io/otel`	`v1.35.0` -> `v1.41.0`
`go.opentelemetry.io/otel/trace`	`v1.35.0` -> `v1.41.0`

codecov · 2026-04-15T10:48:06Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
generative	`69.55% <ø> (ø)`
integration	`69.55% <ø> (ø)`
unit	`69.55% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

renovate bot added release-v0.7 renovate labels Mar 2, 2026

renovate bot enabled auto-merge March 2, 2026 02:08

github-actions bot added the size: L label Mar 2, 2026

renovate bot force-pushed the renovate/release-v0.7-patch-go-modules branch 5 times, most recently from bb1e687 to 608b025 Compare March 10, 2026 03:21

renovate bot force-pushed the renovate/release-v0.7-patch-go-modules branch 4 times, most recently from cb09e7b to 2bdf2b5 Compare March 19, 2026 11:20

renovate bot force-pushed the renovate/release-v0.7-patch-go-modules branch 4 times, most recently from d17ae93 to 9539d46 Compare April 2, 2026 01:41

renovate bot force-pushed the renovate/release-v0.7-patch-go-modules branch 9 times, most recently from e56c120 to 31ef858 Compare April 14, 2026 09:15

renovate bot force-pushed the renovate/release-v0.7-patch-go-modules branch from 31ef858 to a411eb7 Compare April 15, 2026 10:40

github-actions bot added size: M and removed size: L labels Apr 15, 2026

renovate bot force-pushed the renovate/release-v0.7-patch-go-modules branch from a411eb7 to 83d7ee6 Compare April 15, 2026 15:54

github-actions bot added size: XL and removed size: M labels Apr 15, 2026

Update go modules

7caa2b8

renovate bot force-pushed the renovate/release-v0.7-patch-go-modules branch from 83d7ee6 to 7caa2b8 Compare April 16, 2026 02:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update go modules (release-v0.7) (patch)#3146

Update go modules (release-v0.7) (patch)#3146
renovate[bot] wants to merge 1 commit intorelease-v0.7from
renovate/release-v0.7-patch-go-modules

renovate bot commented Mar 2, 2026 •

edited

Loading

Uh oh!

renovate bot commented Mar 2, 2026 •

edited

Loading

Uh oh!

codecov bot commented Apr 15, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Language

Evaluator

cmd/cue

Go API

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

Changelog

Thanks to all contributors!

Features

Bug Fixes

What's Changed

v0.44.1 Release 🎉

Changelog

Configuration

Uh oh!

renovate bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: acceptance/go.mod

File name: go.mod

File name: tools/go.mod

File name: tools/kubectl/go.mod

Uh oh!

codecov bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Mar 2, 2026 •

edited

Loading

`cmd/cue`

renovate bot commented Mar 2, 2026 •

edited

Loading

codecov bot commented Apr 15, 2026 •

edited

Loading