Skip to content

chore(deps): update tools - #786

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/tools
Open

chore(deps): update tools#786
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/tools

Conversation

@renovate

@renovate renovate Bot commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change Pending Age Adoption Passing Confidence
aquasecurity/trivy patch v0.76.0 → v0.76.1 age adoption passing confidence
github.com/anchore/syft minor v1.54.1 → v1.55.0 age adoption passing confidence
github.com/cli/cli/v2 minor v2.102.0 → v2.103.0 v2.103.2 (+1) age adoption passing confidence
github.com/goreleaser/goreleaser/v2 minor v2.18.3 → v2.19.0 age adoption passing confidence
istio/istio patch 1.31.2 → 1.31.3 age adoption passing confidence
kyverno/kyverno patch v1.19.1 → v1.19.2 age adoption passing confidence
suzuki-shunsuke/pinact patch v5.0.0 → v5.0.1 v5.0.2 age adoption passing confidence
vmware-tanzu/carvel-ytt patch v0.55.3 → v0.55.4 age adoption passing confidence

Release Notes

aquasecurity/trivy

v0.76.1

Compare Source

🔐 Security update: eMudhra CA incident 🛡️

Trivy v0.76.1 includes mitigations for the eMudhra intermediate CA key compromise.

  • Official binaries are built with Go 1.27.3, which includes the certificate distrust mitigation tracked as CVE-2026-111943.
  • Official container images include an updated Alpine CA trust store that rejects the affected certificate chains.

We recommend upgrading to v0.76.1 and redeploying container images to apply these updates. If you build Trivy from source, use Go 1.27.3 or later and keep your runtime CA trust store up to date.

Changelog
  • e713f67 release: v0.76.1 [release/v0.76] (#​11445)
  • 6647bd6 fix(deps): bump the aws group across 1 directory with 6 updates [backport: release/v0.76] (#​11446)
  • e0964c9 fix(deps): bump the docker group with 3 updates [backport: release/v0.76] (#​11443)
  • 992c360 fix(deps): bump the common group with 3 updates [backport: release/v0.76] (#​11442)
anchore/syft (github.com/anchore/syft)

v1.55.0

Compare Source

Added Features
  • Add support for scanning IPK packages using the deb-archive-cataloger [PR #​5111 @​skyhisi]
Bug Fixes
Additional Changes
Dependencies

49 dependency changes (46 updated, 1 added, 2 removed). 5 vulnerabilities remediated.

🟢 Remediated (5)

Updated (46 packages)
  • cloud.google.com/go/auth v0.23.2 → v0.23.3
  • cloud.google.com/go/compute/metadata v0.9.0 → v0.9.1
  • cloud.google.com/go/storage v1.65.1 → v1.68.0
  • github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 → v1.34.0
  • github.com/aws/aws-sdk-go-v2 v1.44.0 → v1.47.1
  • github.com/aws/aws-sdk-go-v2/config v1.32.40 → v1.33.6
  • github.com/aws/aws-sdk-go-v2/credentials v1.19.39 → v1.20.6
  • github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.40 → v1.20.1
  • github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40 → v1.5.4
  • github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40 → v2.8.4
  • github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.41 → v1.5.4
  • github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.10.0 → v1.11.5
  • github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40 → v1.14.4
  • github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.41 → v1.20.4
  • github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0 → v1.114.0
  • github.com/aws/aws-sdk-go-v2/service/signin v1.6.0 → v1.10.1
  • github.com/aws/aws-sdk-go-v2/service/sso v1.34.0 → v1.38.1
  • github.com/aws/aws-sdk-go-v2/service/ssooidc v1.39.0 → v1.43.1
  • github.com/aws/aws-sdk-go-v2/service/sts v1.46.0 → v1.51.1
  • github.com/github/go-spdx/v2 v2.7.0 → v2.7.1
  • github.com/go-git/go-billy/v5 v5.9.1 → v5.9.2
  • github.com/go-git/go-git/v5 v5.19.2 → v5.19.3
  • github.com/google/s2a-go v0.1.9 → v0.1.10
  • github.com/googleapis/enterprise-certificate-proxy v0.3.20 → v0.3.22
  • github.com/googleapis/gax-go/v2 v2.24.0 → v2.24.1
  • github.com/gookit/color v1.6.1 → v1.6.2
  • github.com/gpustack/gguf-parser-go v0.26.3 → v0.26.4
  • github.com/hashicorp/go-getter v1.8.9 → v1.8.10
  • github.com/pb33f/ordered-map/v2 v2.3.1 → v2.3.2
  • github.com/pjbgf/sha1cd v0.6.0 → v0.7.0
  • github.com/spiffe/go-spiffe/v2 v2.7.0 → v2.8.1
  • golang.org/x/crypto v0.57.0 → v0.58.0
  • golang.org/x/net v0.59.0 → v0.61.0 (🟢 remediated GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617)
  • golang.org/x/oauth2 v0.36.0 → v0.37.0
  • golang.org/x/sync v0.23.0 → v0.24.0
  • golang.org/x/sys v0.48.0 → v0.49.0
  • golang.org/x/term v0.46.0 → v0.47.0
  • golang.org/x/text v0.42.0 → v0.43.0
  • golang.org/x/tools v0.50.0 → v0.51.0
  • google.golang.org/api v0.294.0 → v0.299.0
  • google.golang.org/genproto/googleapis/rpc v0.0.0-da73d73 → v0.0.0-b142276
  • google.golang.org/grpc v1.83.2 → v1.84.0
  • modernc.org/cc/v4 v4.29.2 → v4.29.7
  • modernc.org/ccgo/v4 v4.35.0 → v4.36.1
  • modernc.org/libc v1.75.7 → v1.77.1
  • modernc.org/sqlite v1.59.0 → v1.60.1
Added (1 package)
  • github.com/pb33f/go-yaml v0.1.0
Removed (2 packages)
  • github.com/klauspost/cpuid/v2 v2.3.0
  • go.yaml.in/yaml/v4 v4.0.0-rc.2

(Full Changelog)

cli/cli (github.com/cli/cli/v2)

v2.103.0: GitHub CLI 2.103.0

Compare Source

Expiring, auto-refreshing OAuth tokens (preview)

gh can now sign in with expiring OAuth credentials that it refreshes automatically. When you opt in, gh stores a short-lived access token alongside a rotating refresh token and refreshes the access token whenever it is needed, so you stay signed in without having to authenticate again.

To opt in for a single sign-in, run:

gh auth login --expiring

To prefer expiring credentials for every sign-in, run:

gh config set expiring_credentials enabled

gh auth status shows whether a credential is refreshable and when the current access token expires. Both gh auth status and gh auth token automatically refresh the access token when needed. Expiring tokens are available on github.com and GHE.com; on hosts that do not issue them, gh falls back to a regular non-expiring token.

If you use HTTPS as your git protocol, we advise using git 2.46 or newer and letting gh act as your git credential helper by running gh auth setup-git. This way gh serves and refreshes the expiring credential for git, and git does not cache it past its lifetime.

[!IMPORTANT]
Expiring access tokens should not be cached. Scripts and extensions that store the output of gh auth token will eventually hold an expired token, so run gh auth token again each time a token is needed. Tokens supplied through GH_TOKEN or GITHUB_TOKEN are never refreshed.

For more information, see Authenticating with GitHub CLI.

Manage issue artifacts with gh issue artifact (private preview)

gh issue artifact brings issue artifacts to the command line. Users and organizations enrolled in the private preview can use the list, view, create, edit, download, and delete commands to manage issue artifacts.

# Create a Markdown document with an attached image
gh issue artifact create 142 signin-plan.md --attach ./signin-flow.png

# Create an HTML document
gh issue artifact create 142 menu-prototype.html

# List or view artifacts
gh issue artifact list 142
gh issue artifact view 142 2

# Update a document or restore an earlier version
gh issue artifact edit 142 2 --body-file signin-plan-v2.md
gh issue artifact edit 142 2 --restore-version 5

Artifacts can also be addressed by their GitHub URLs, and Markdown documents support image and video attachments with --attach.

[!IMPORTANT]
Issue artifacts are in private preview. These commands only work for repositories enrolled in the preview. See the Issue Artifacts private preview announcement and feedback discussion for access instructions and to share feedback.

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.102.1...v2.103.0

v2.102.1: GitHub CLI 2.102.1

Compare Source

What's Changed

:dependabot: Dependencies

chore(deps): bump Go toolchain from 1.27.1 to 1.27.3 and golang.org/x/net from 0.58.0 to 0.60.0

Full Changelog: cli/cli@v2.102.0...v2.102.1

goreleaser/goreleaser (github.com/goreleaser/goreleaser/v2)

v2.19.0

Compare Source

Announcement

Read the official announcement: Announcing GoReleaser v2.19.

Changelog

New Features
Security updates
Bug fixes
Documentation updates
Other work

Full Changelog: goreleaser/goreleaser@v2.18.3...v2.19.0

Helping out

This release is only possible thanks to all the support of some awesome people!

Want to be one of them?
You can sponsor, get a Pro License or contribute with code.

Where to go next?

GoReleaser logo

istio/istio

v1.31.3: Istio 1.31.3

Compare Source

Release Notes

kyverno/kyverno

v1.19.2

Compare Source

Security

Kyverno v1.19.2 addresses 24 published GitHub Security Advisories: 9 Critical, 14 High, and 1 Moderate. The fixes include:

See the linked advisories for affected-version details. Upgrade to v1.19.2 to receive these fixes.

What's Changed

New Contributors

Full Changelog: kyverno/kyverno@v1.19.1...v1.19.2

suzuki-shunsuke/pinact

v5.0.1

Compare Source

⚠️ Security

#​1792 Update Go to v1.27.3

This release is built with Go 1.27.3, which fixes CVE-2026-111943 in crypto/x509. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. Verify filters out chains containing those intermediates. The Go team highly recommends upgrading immediately.

pinact relies on crypto/x509 to verify the TLS certificate of GitHub when it calls the GitHub API, with your access token if one is set, to resolve the commit SHAs that workflows are pinned to. We recommend upgrading.

ref.

This release also includes Go 1.27.2 (#​1764), which has security fixes to the go command and the crypto/tls, html/template, net/http, net/textproto, and os packages.

Others

#​1766 ci: Update GitHub Actions runner to ubuntu-26.04
#​1767 ci: Use download-go-module-action
#​1768 ci: Share Go modules between integration test and go-test-full-workflow
#​1774 ci: Use the reusable workflow of go-autofix-action
#​1782 ci: Replace go-test-full-workflow with go-test-workflow and test-workflow

Dependency updates

#​1764 #​1792 Update Go to v1.27.3
#​1730 #​1789 Update github.com/google/go-github to v93
#​1739 Update github.com/suzuki-shunsuke/cobra-util to v0.0.5
#​1723 Update github.com/sourcegraph/go-diff to v0.9.0

vmware-tanzu/carvel-ytt

v0.55.4

Compare Source

Installation and signature verification
Installation
By downloading binary from the release

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/carvel-dev/ytt/releases/download/v0.55.4/ytt-linux-amd64

# Move the binary in to your PATH
mv kapp-linux-amd64 /usr/local/bin/ytt

# Make the binary executable
chmod +x /usr/local/bin/ytt
Via Homebrew (macOS or Linux)
$ brew tap carvel-dev/carvel
$ brew install ytt
$ ytt version
Verify checksums file signature

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC(Refer this page for cosign installation). To validate the signature of this file, run the following commands:

# Download the checksums file, certificate and signature
curl -LO https://github.com/carvel-dev/ytt/releases/download/v0.55.4/checksums.txt
curl -LO https://github.com/carvel-dev/ytt/releases/download/v0.55.4/checksums.txt.pem
curl -LO https://github.com/carvel-dev/ytt/releases/download/v0.55.4/checksums.txt.sig

# Verify the checksums file
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp=https://github.com/carvel-dev \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com
Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature.

# Verify the binary using the checksums file
sha256sum -c checksums.txt --ignore-missing

What's Changed

New Contributors

Full Changelog: carvel-dev/ytt@v0.55.3...v0.55.4

📂 Files Checksum

89c529789031cee20fac0802bb7bd083

> [!IMPORTANT]
> ✂ PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/London)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cert-manager/makefile-modules).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJvay10by10ZXN0Il19-->

@renovate renovate Bot added dependencies Pull requests that update a dependency file ok-to-test labels Oct 22, 2026
@cert-manager-prow cert-manager-prow Bot added the dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. label Oct 22, 2026
@cert-manager-prow

cert-manager-prow Bot commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign wallrj for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@cert-manager-prow cert-manager-prow Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Oct 22, 2026
@renovate
renovate Bot force-pushed the renovate/tools branch 3 times, most recently from be781fe to 82092ee Compare October 24, 2026 18:52
@cert-manager-prow cert-manager-prow Bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Oct 24, 2026
@renovate
renovate Bot force-pushed the renovate/tools branch 2 times, most recently from 893ce4e to ce214ea Compare October 25, 2026 14:33
@renovate
chore(deps): update tools
9d57665 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. dependencies Pull requests that update a dependency file ok-to-test size/M Denotes a PR that changes 30-99 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants