Update go modules (release-v0.6) (patch) by renovate[bot] · Pull Request #3137 · conforma/cli

renovate · 2026-02-28T02:35:28Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
cuelang.org/go	`v0.11.1` → `v0.11.2`
github.com/cucumber/godog	`v0.15.0` → `v0.15.1`
github.com/daixiang0/gci	`v0.13.5` → `v0.13.7`
github.com/enterprise-contract/enterprise-contract-controller/api	`v0.1.79` → `v0.1.281`
github.com/enterprise-contract/go-containerregistry	`v0.20.3-0.20250120083621-7be5271048b1` → `v0.20.6`
github.com/evanphx/json-patch	`v5.9.0+incompatible` → `v5.9.11+incompatible`
github.com/evanphx/json-patch/v5	`v5.9.0` → `v5.9.11`
github.com/google/go-containerregistry	`v0.20.2` → `v0.20.8`
github.com/mattn/go-isatty	`v0.0.20` → `v0.0.21`
github.com/otiai10/copy	`v1.14.0` → `v1.14.1`
github.com/package-url/packageurl-go	`v0.1.3` → `v0.1.5`
github.com/secure-systems-lab/go-securesystemslib	`v0.9.0` → `v0.9.1`
github.com/sigstore/cosign/v2	`v2.4.1` → `v2.4.3`
github.com/sigstore/rekor	`v1.3.6` → `v1.3.10`
github.com/sirupsen/logrus	`v1.9.3` → `v1.9.4`
github.com/spf13/pflag	`v1.0.6` → `v1.0.10`
github.com/tektoncd/chains	`v0.22.2` → `v0.22.3`
github.com/tektoncd/cli	`v0.38.0` → `v0.38.2`
github.com/testcontainers/testcontainers-go	`v0.34.0` → `v0.34.1`
k8s.io/api	`v0.34.2` → `v0.34.7`
k8s.io/apiextensions-apiserver	`v0.34.2` → `v0.34.7`
k8s.io/apimachinery	`v0.34.2` → `v0.34.7`
k8s.io/client-go	`v0.34.2` → `v0.34.7`
k8s.io/kubernetes	`v1.34.2` → `v1.34.7`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

cue-lang/cue (cuelang.org/go)

`v0.11.2`

Compare Source

This release includes fixes for bugs which were uncovered and resolved in the last few weeks.

Evaluator

CL 1206279 fixes a regression in the old evaluator which could lead to "conflicting value" errors.

`cmd/cue`

CL 1207330 fixes a regression where cue get go stopped copying some CUE files from Go package directories.

CL 1207402 fixes a regression where cue def --inline-imports could result in invalid CUE which failed to evaluate.

Full list of changes since v0.11.1

internal/cueversion: bump LanguageVersion for the next release by @mvdan in 079dc4a
internal/ci: update pinned Go for the next release by @mvdan in b1a57a5
internal/core/dep: fix handling sharing in non-rooted nodes by @mpvl in 8d97e7a
cmd/cue: add test for 3646 by @mpvl in 815cb30
cmd/cue: fix a regression with cue get go dropping CUE files by @mvdan in 5b0e411
cmd/cue: add a test case to reproduce #3644 by @mvdan in 801f976
internal/core/adt: fix let issue for eval v2 by @mpvl in a1fbeaa
internal/core/adt: add tests for 3590 and 3591 by @mpvl in 0ae498f

cucumber/godog (github.com/cucumber/godog)

`v0.15.1`

Compare Source

Added

Step text is added to "step is undefined" error - (669 - vearutop)
Localisation support by @MegaGrindStone in #665
feat: support uint types by @chengxilo in #695

Changed

Replace deprecated ::set-output - (681 - nodeg)

Fixed

fix(errors): fix(errors): Fix expected Step argument count for steps with context.Context (679 - tigh-latte)
fix(formatter): On concurrent execution, execute formatter at end of Scenario - (645 - tigh-latte)
Pretty printing results now prints the line where the step is declared instead of the line where the handler is declared. (668 - spencerc)
Update honnef.co/go/tools/cmd/staticcheck version in Makefile by @RezaZareiii in #670
fix: verify dogT exists in the context before using it by @cakoolen in #692
fix: change bang to being in README by @nahomEagleLion in #687
Mark junit test cases as skipped if no pickle step results available by @mrsheepuk in #597
Print step declaration line instead of handler declaration line by @SpencerC in #668

daixiang0/gci (github.com/daixiang0/gci)

`v0.13.7`

Compare Source

What's Changed

fix: scrape all goos/goarch pair for stdlib by @Zxilly in #208
chore: get module info from pass by @ldez in #221
chore: remove analyzer by @ldez in #222
feat: update standard list to go1.25 by @ldez in #233
bump up version by @daixiang0 in #234

New Contributors

@Zxilly made their first contribution in #208

Full Changelog: daixiang0/gci@v0.13.6...v0.13.7

`v0.13.6`

Compare Source

What's Changed

fix: update standard list to go1.24 by @ldez in #227
bump up version by @daixiang0 in #229

Full Changelog: daixiang0/gci@v0.13.5...v0.13.6

enterprise-contract/go-containerregistry (github.com/enterprise-contract/go-containerregistry)

evanphx/json-patch (github.com/evanphx/json-patch)

`v5.9.11+incompatible`

Compare Source

`v5.9.10+incompatible`

Compare Source

google/go-containerregistry (github.com/google/go-containerregistry)

`v0.20.8`

Compare Source

`v0.20.7`

Compare Source

What's Changed

Fix ArgsEscaped lint directive by @Subserial in #2137
transport: Fix broken links to distribution docs by @guzalv in #2136
fix(remote): using customized retry predicate func if provided by @derekhjray in #2135
Adding docker file by @HassanJasim in #2138
crane: Add timestamp to flatten layer by @Stephanie0829 in #2117
feat(remote): pass retryBackoff option to transport by @aslafy-z in #1628
Expose clobber refusal error by @pjbgf in #2146
Build artifacts for riscv64 by @ffgan in #2159
Update dependencies and deprecate DockerVersion field by @Subserial in #2164

New Contributors

@guzalv made their first contribution in #2136
@derekhjray made their first contribution in #2135
@HassanJasim made their first contribution in #2138
@Stephanie0829 made their first contribution in #2117
@pjbgf made their first contribution in #2146
@ffgan made their first contribution in #2159

Full Changelog: google/go-containerregistry@v0.20.6...v0.20.7

`v0.20.6`

Compare Source

What's Changed

Ensure that tag name is not empty if name contains colon by @SaschaSchwarze0 in #2094
Bump some deps by @jonjohnsonjr in #2110

New Contributors

@SaschaSchwarze0 made their first contribution in #2094

Full Changelog: google/go-containerregistry@v0.20.4...v0.20.6

`v0.20.5`

Compare Source

What's Changed

build(deps): bump docker/docker to v28.0.0+incompatible by @luhring in #2071
Migrate linter to v2 by @Subserial in #2096
bump go version + bump deps by @Subserial in #2093
implement TextMarshaler/JSONMarshaler more consistently by @imjasonh in #2097
Update CodeQL permissions by @Subserial in #2103
Update goreleaser permissions by @Subserial in #2104
Update provenance action in release by @Subserial in #2105
Update validator action by @Subserial in #2106

New Contributors

@luhring made their first contribution in #2071
@Subserial made their first contribution in #2096

Full Changelog: google/go-containerregistry@v0.20.3...v0.20.5

`v0.20.4`: - Not usable as a go module

Compare Source

🚨 This release was published to the Go module proxy and then re-tagged with a different commit. This means it's not usable as a Go module (#2107) -- please us v0.20.5 instead.

What's Changed

build(deps): bump docker/docker to v28.0.0+incompatible by @luhring in #2071
Migrate linter to v2 by @Subserial in #2096
bump go version + bump deps by @Subserial in #2093
implement TextMarshaler/JSONMarshaler more consistently by @imjasonh in #2097
Update CodeQL permissions by @Subserial in #2103
Update goreleaser permissions by @Subserial in #2104
Update provenance action in release by @Subserial in #2105
Update validator action by @Subserial in #2106

New Contributors

@luhring made their first contribution in #2071
@Subserial made their first contribution in #2096

Full Changelog: google/go-containerregistry@v0.20.3...v0.20.4

`v0.20.3`

Compare Source

What's Changed

remote/transport: Make bearer transport go-routine-safe by @2opremio in #1806
Expose compare package by @jonjohnsonjr in #2001
fix: redact.URL uses (*URL).Redacted to omit basic-auth password by @bmoylan in #1947
bump actions to latest by @ajayk in #2011
don't pin chainguard-dev/actions by @imjasonh in #2025
Check for 406 status code when handling referrers API endpoint response by @malancas in #2026
mutate: Create a defensive annotations copy by @jonjohnsonjr in #2030
Detect zstd in crane append by @jonjohnsonjr in #2023
bump deps using hack/bump-deps.sh by @imjasonh in #2042

New Contributors

@bmoylan made their first contribution in #1947
@ajayk made their first contribution in #2011
@malancas made their first contribution in #2026

Full Changelog: google/go-containerregistry@v0.20.2...v0.20.3

mattn/go-isatty (github.com/mattn/go-isatty)

`v0.0.21`

Compare Source

otiai10/copy (github.com/otiai10/copy)

`v1.14.1`

Compare Source

package-url/packageurl-go (github.com/package-url/packageurl-go)

`v0.1.5`

Compare Source

What's Changed

Remove version requirement for TypeSwift by @Talgarr in #90
Handle non-canonical input purls a bit more gracefully by @petergardfjall in #89

New Contributors

@Talgarr made their first contribution in #90

Full Changelog: package-url/packageurl-go@v0.1.4...v0.1.5

`v0.1.4`

Compare Source

What's Changed

Fix golangci and update versions by @shibumi in #76
Allow npm names to be case sensitive by @PFCM in #73
add custom validation for pkg:cpan by @petergardfjall in #79
move cpan to known types by @nikpivkin in #71
Run tests using reference data from purl-spec by @keshav-space in #80
update code to honor the canonical purl encoding by @petergardfjall in #83

New Contributors

@PFCM made their first contribution in #73
@nikpivkin made their first contribution in #71
@keshav-space made their first contribution in #80

Full Changelog: package-url/packageurl-go@v0.1.3...v0.1.4

secure-systems-lab/go-securesystemslib (github.com/secure-systems-lab/go-securesystemslib)

`v0.9.1`

Compare Source

sigstore/cosign (github.com/sigstore/cosign/v2)

`v2.4.3`

Compare Source

Features

Bump sigstore/sigstore to support KMS plugins (#4073)
Enable fetching signatures without remote get. (#4047)
Feat/file flag completion improvements (#4028)
Update builder to use go1.23.6 (#4052)

Bug Fixes

fix parsing error in --only for cosign copy (#4049)

Cleanup

Refactor verifyNewBundle into library function (#4013)
fix comment typo and imports order (#4061)
sync comment with parameter name in function signature (#4063)
sort properly Go imports (#4071)

Contributors

Bob Callaway
Carlos Tadeu Panato Junior
Cody Soyland
Dmitry Savintsev
Hayden B
Tomasz Janiszewski
Ville Skyttä

`v2.4.2`

Compare Source

Features

Updated open-policy-agent to 1.1.0 library (#4036)
- Note that only Rego v0 policies are supported at this time
Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
Add support for verifying root checksum in cosign initialize (#3953)
Detect if user supplied a valid protobuf bundle (#3931)
Add a log message if user doesn't provide --trusted-root (#3933)
Support mTLS towards container registry (#3922)
Add bundle create helper command (#3901)
Add trusted-root create helper command (#3876)

Bug Fixes

fix: set tls config while retaining other fields from default http transport (#4007)
policy fuzzer: ignore known panics (#3993)
Fix for multiple WithRemote options (#3982)
Add nightly conformance test workflow (#3979)
Fix copy --only for signatures + update/align docs (#3904)

Documentation

Remove usage.md from spec, point to client spec (#3918)
move reference from gcr to ghcr (#3897)

Contributors

AdamKorcz
Aditya Sirish
Bob Callaway
Carlos Tadeu Panato Junior
Cody Soyland
Colleen Murphy
Hayden B
Jussi Kukkonen
Marco Franssen
Nianyu Shen
Slavek Kabrda
Søren Juul
Warren Hodgkinson
Zach Steindler

sigstore/rekor (github.com/sigstore/rekor)

`v1.3.10`

Compare Source

Note that Rekor v1 is in maintenance mode as we are actively developing
its successor, Rekor v2, designed to be easy to maintain and cheaper to operate.. See the
README
for more information.

Features

Added --client-signing-algorithms flag (#1974)

Fixes / Misc

emit unpopulated values when marshalling (#2438)
pkg/api: better logs when algorithm registry rejects a key (#2429)
chore: improve mysql readiness checks (#2397)

Contributors

Bob Callaway
cangqiaoyuzhuo
Carlos Tadeu Panato Junior
cpanato
Hayden B
Praful Khanduri
Ramon Petgrave
Riccardo Schirone
rubyisrust
Sascha Grunert

`v1.3.9`

Compare Source

Features

Cache checkpoint for inactive shards (#2332)
Support per-shard signing keys (#2330)

Contributors

Hayden B

`v1.3.8`

Compare Source

Bug Fixes

fix zizmor issues (#2298)
remove unneeded value in log message (#2282)

Quality Enhancements

chore: relax go directive to permit 1.22.x
fetch minisign from homebrew instead of custom ppa (#2329)
fix(ci): simplify GOVERSION extraction
chore(deps): bump actions pins to latest
Updates go and golangci-lint (#2302)
update builder to use go1.23.4 (#2301)
clean up spaces
log request body on 500 error to aid debugging (#2283)

Contributors

Appu Goundan
Bob Callaway
Carlos Tadeu Panato Junior
Dominic Evans
sgpinkus

`v1.3.7`

Compare Source

New Features

log request body on 500 error to aid debugging (#2283)
Add support for signing with Tink keyset (#2228)
Add public key hash check in Signed Note verification (#2214)
update Trillian TLS configuration (#2202)
Add TLS support for Trillian server (#2164)
Replace docker-compose with plugin if available (#2153)
Add flags to backfill script (#2146)
Unset DisableKeepalive for backfill HTTP client (#2137)
Add script to delete indexes from Redis (#2120)
Run CREATE statement in backfill script (#2109)
Add MySQL support to backfill script (#2081)
Run e2e tests on mysql and redis index backends (#2079)

Bug Fixes

remove unneeded value in log message (#2282)
Add error message when computing consistency proof (#2278)
fix validation error handling on API (#2217)
fix error in pretty-printed inclusion proof from verify subcommand (#2210)
Fix index scripts (#2203)
fix failing sharding test
Better error handling in backfill script (#2148)
Batch entries in cleanup script (#2158)
Add missing workflow for index cleanup test (#2121)
hashedrekord: fix schema $id (#2092)

Contributors

Aditya Sirish
Bob Callaway
Colleen Murphy
cpanato
Firas Ghanmi
Hayden B
Hojoung (Brian) Jang
William Woodruff

sirupsen/logrus (github.com/sirupsen/logrus)

`v1.9.4`

Compare Source

Notable changes

go.mod: update minimum supported go version to v1.17 #1460
go.mod: bump up dependencies #1460
Touch-up godoc and add "doc" links.
README: fix links, grammar, and update examples.
Add GNU/Hurd support #1364
Add WASI wasip1 support #1388
Remove uses of deprecated ioutil package #1472
CI: update actions and golangci-lint #1459
CI: remove appveyor, add macOS #1460

Full Changelog: sirupsen/logrus@v1.9.3...v1.9.4

spf13/pflag (github.com/spf13/pflag)

`v1.0.10`

Compare Source

What's Changed

fix deprecation comment for (FlagSet.)ParseErrorsWhitelist by @thaJeztah in #447
remove uses of errors.Is, which requires go1.13, move go1.16/go1.21 tests to separate file by @thaJeztah in #448

New Contributors

@thaJeztah made their first contribution in #447

Full Changelog: spf13/pflag@v1.0.9...v1.0.10

`v1.0.9`

Compare Source

What's Changed

fix: Restore ParseErrorsWhitelist name for now by @tomasaschan in #446

Full Changelog: spf13/pflag@v1.0.8...v1.0.9

`v1.0.8`

Compare Source

⚠️ Breaking Change

This version, while only a patch bump, includes a (very minor) breaking change: the flag.ParseErrorsWhitelist struct and corresponding FlagSet.parseErrorsWhitelist field have been renamed to ParseErrorsAllowlist.

This should result in compilation errors in any code that uses these fields, which can be fixed by adjusting the names at call sites. There is no change in semantics or behavior of the struct or field referred to by these names. If your code compiles without errors after bumping to/past v1.0.8, you are not affected by this change.

The breaking change was reverted in v1.0.9, by means of re-introducing the old names with deprecation warnings. The plan is still to remove them in a future release, so if your code does depend on the old names, please change them to use the new names at your earliest convenience.

What's Changed

Remove Redundant "Unknown-Flag" Error by @vaguecoder in #364
Switching from whitelist to Allowlist terminology by @dubrie in #261
Omit zero time.Time default from usage line by @mologie in #438
implement CopyToGoFlagSet by @pohly in #330
flag: Emulate stdlib behavior and do not print ErrHelp by @tmc in #407
Print Default Values of String-to-String in Sorted Order by @vaguecoder in #365
fix: Don't print ErrHelp in ParseAll by @tomasaschan in #443
Reset args on re-parse even if empty by @tomasaschan in #444

New Contributors

@vaguecoder made their first contribution in #364
@dubrie made their first contribution in #261
@mologie made their first contribution in #438
@pohly made their first contribution in #330
@tmc made their first contribution in #407
@tomasaschan made their first contribution in #443

Full Changelog: spf13/pflag@v1.0.7...v1.0.8

`v1.0.7`

Compare Source

What's Changed

Fix defaultIsZeroValue check for generic Value types by @MidnightRocket in #422
feat: Use structs for errors returned by pflag. by @eth-p in #425
Fix typos by @co63oc in #428
fix #423 : Add helper function and some documentation to parse shorthand go test flags. by @valdar in #424
add support equivalent to golang flag.TextVar(), also fixes the test failure as described in #368 by @hujun-open in #418
add support for Func() and BoolFunc() #426 by @LeGEC in #429
fix: correct argument length check in FlagSet.Parse by @ShawnJeffersonWang in #409
fix usage message for func flags, fix arguments order by @LeGEC in #431
Add support for time.Time flags by @max-frank in #348

New Contributors

@MidnightRocket made their first contribution in #422
@eth-p made their first contribution in #425
@co63oc made their first contribution in #428
@valdar made their first contribution in #424
@hujun-open made their first contribution in #418
[@LeGEC](https://redirect.g

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM (* 0-3 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-02-28T02:35:31Z

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

22 additional dependencies were updated

Details:

Package	Change
`github.com/sigstore/sigstore`	`v1.8.15` -> `v1.9.1`
`github.com/Azure/go-ansiterm`	`v0.0.0-20230124172434-306776ec8161` -> `v0.0.0-20250102033503-faa5f7b0171c`
`github.com/containerd/stargz-snapshotter/estargz`	`v0.15.1` -> `v0.18.2`
`github.com/docker/cli`	`v27.2.0+incompatible` -> `v29.2.1+incompatible`
`github.com/docker/docker`	`v27.2.0+incompatible` -> `v28.5.2+incompatible`
`github.com/docker/docker-credential-helpers`	`v0.8.2` -> `v0.9.3`
`github.com/go-openapi/errors`	`v0.22.0` -> `v0.22.1`
`github.com/go-openapi/swag`	`v0.23.0` -> `v0.23.1`
`github.com/google/certificate-transparency-go`	`v1.2.1` -> `v1.3.1`
`github.com/klauspost/compress`	`v1.18.2` -> `v1.18.4`
`github.com/magiconair/properties`	`v1.8.7` -> `v1.8.9`
`github.com/mailru/easyjson`	`v0.7.7` -> `v0.9.0`
`github.com/mitchellh/mapstructure`	`v1.5.0` -> `v1.5.1-0.20231216201459-8508981c8b6c`
`github.com/moby/term`	`v0.5.0` -> `v0.5.2`
`github.com/sigstore/protobuf-specs`	`v0.4.0` -> `v0.4.1`
`github.com/sigstore/timestamp-authority`	`v1.2.2` -> `v1.2.4`
`github.com/spf13/cobra`	`v1.9.1` -> `v1.10.2`
`github.com/spf13/pflag`	`v1.0.6` -> `v1.0.9`
`github.com/vbatts/tar-split`	`v0.11.5` -> `v0.12.2`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.60.0` -> `v0.61.0`
`golang.org/x/oauth2`	`v0.34.0` -> `v0.35.0`
`google.golang.org/api`	`v0.217.0` -> `v0.228.0`

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

35 additional dependencies were updated

Details:

Package	Change
`github.com/open-policy-agent/opa`	`v0.70.0` -> `v1.1.0`
`cloud.google.com/go/auth`	`v0.14.0` -> `v0.14.1`
`cloud.google.com/go/storage`	`v1.43.0` -> `v1.45.0`
`github.com/aws/aws-sdk-go`	`v1.55.5` -> `v1.55.6`
`github.com/aws/aws-sdk-go-v2/config`	`v1.29.1` -> `v1.29.6`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.17.54` -> `v1.17.59`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.16.24` -> `v1.16.28`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.3.28` -> `v1.3.32`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.6.28` -> `v2.6.32`
`github.com/aws/aws-sdk-go-v2/internal/ini`	`v1.8.1` -> `v1.8.2`
`github.com/aws/aws-sdk-go-v2/service/ecr`	`v1.32.2` -> `v1.40.3`
`github.com/aws/aws-sdk-go-v2/service/ecrpublic`	`v1.25.4` -> `v1.31.2`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.12.1` -> `v1.12.2`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.12.9` -> `v1.12.13`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.24.11` -> `v1.24.15`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.28.10` -> `v1.28.14`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.33.9` -> `v1.33.14`
`github.com/awslabs/amazon-ecr-credential-helper/ecr-login`	`v0.0.0-20240826150212-5dc58b6e29f8` -> `v0.9.1`
`github.com/docker/cli`	`v27.5.0+incompatible` -> `v28.2.2+incompatible`
`github.com/docker/docker-credential-helpers`	`v0.8.2` -> `v0.9.3`
`github.com/google/certificate-transparency-go`	`v1.2.1` -> `v1.3.1`
`github.com/google/flatbuffers`	`v24.3.25+incompatible` -> `v24.12.23+incompatible`
`github.com/grpc-ecosystem/grpc-gateway/v2`	`v2.26.3` -> `v2.27.1`
`github.com/jmespath/go-jmespath`	`v0.4.0` -> `v0.4.1-0.20220621161143-b0104c826a24`
`github.com/magiconair/properties`	`v1.8.7` -> `v1.8.9`
`github.com/mitchellh/mapstructure`	`v1.5.0` -> `v1.5.1-0.20231216201459-8508981c8b6c`
`github.com/sigstore/fulcio`	`v1.6.3` -> `v1.6.6`
`github.com/sigstore/rekor`	`v1.3.6` -> `v1.3.9`
`github.com/sigstore/timestamp-authority`	`v1.2.2` -> `v1.2.4`
`github.com/vbatts/tar-split`	`v0.11.6` -> `v0.12.1`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.60.0` -> `v0.61.0`
`go.opentelemetry.io/proto/otlp`	`v1.5.0` -> `v1.7.1`
`google.golang.org/api`	`v0.217.0` -> `v0.221.0`
`k8s.io/api`	`v0.34.2` -> `v0.34.7`
`sigs.k8s.io/release-utils`	`v0.8.4` -> `v0.11.0`

File name: tools/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated

Details:

Package	Change
`github.com/moby/spdystream`	`v0.5.0` -> `v0.5.1`
`github.com/tektoncd/triggers`	`v0.29.0` -> `v0.29.1`

File name: tools/kubectl/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

3 additional dependencies were updated

Details:

Package	Change
`github.com/moby/spdystream`	`v0.5.0` -> `v0.5.1`
`go.opentelemetry.io/otel`	`v1.35.0` -> `v1.41.0`
`go.opentelemetry.io/otel/trace`	`v1.35.0` -> `v1.41.0`

renovate Bot added release-v0.6 renovate labels Feb 28, 2026

renovate Bot enabled auto-merge February 28, 2026 02:35

github-actions Bot added the size: XL label Feb 28, 2026

renovate Bot force-pushed the renovate/release-v0.6-patch-go-modules branch 6 times, most recently from ab92641 to e1c481b Compare March 12, 2026 22:12

renovate Bot force-pushed the renovate/release-v0.6-patch-go-modules branch 5 times, most recently from f4c542f to b63aa6e Compare March 19, 2026 11:20

renovate Bot force-pushed the renovate/release-v0.6-patch-go-modules branch 7 times, most recently from 2fadb7a to 69402d9 Compare March 31, 2026 14:22

renovate Bot force-pushed the renovate/release-v0.6-patch-go-modules branch 7 times, most recently from c00adfc to f066b3a Compare April 8, 2026 20:23

renovate Bot force-pushed the renovate/release-v0.6-patch-go-modules branch 6 times, most recently from 71568b4 to 212d55d Compare April 15, 2026 10:36

renovate Bot force-pushed the renovate/release-v0.6-patch-go-modules branch 2 times, most recently from 12c961d to 6aa7d00 Compare April 16, 2026 22:20

github-actions Bot added size: XXL and removed size: XL labels Apr 16, 2026

renovate Bot force-pushed the renovate/release-v0.6-patch-go-modules branch 11 times, most recently from 0df885d to 9122a72 Compare April 23, 2026 21:19

Update go modules

a83e547

renovate Bot force-pushed the renovate/release-v0.6-patch-go-modules branch from 9122a72 to a83e547 Compare April 23, 2026 21:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update go modules (release-v0.6) (patch)#3137

Update go modules (release-v0.6) (patch)#3137
renovate[bot] wants to merge 1 commit intorelease-v0.6from
renovate/release-v0.6-patch-go-modules

renovate Bot commented Feb 28, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Feb 28, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Feb 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Evaluator

cmd/cue

Added

Changed

Fixed

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

v0.20.4: - Not usable as a go module

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

Features

Bug Fixes

Cleanup

Contributors

Features

Bug Fixes

Documentation

Contributors

Features

Fixes / Misc

Contributors

Features

Contributors

Bug Fixes

Quality Enhancements

Contributors

New Features

Bug Fixes

Contributors

Notable changes

What's Changed

New Contributors

What's Changed

⚠️ Breaking Change

What's Changed

New Contributors

What's Changed

New Contributors

Configuration

Uh oh!

renovate Bot commented Feb 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: acceptance/go.mod

File name: go.mod

File name: tools/go.mod

File name: tools/kubectl/go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Feb 28, 2026 •

edited

Loading

`cmd/cue`

`v0.20.4`: - Not usable as a go module

renovate Bot commented Feb 28, 2026 •

edited

Loading