Skip to content

Commit 88d8e5f

Browse files
renovate[bot]renovate[bot]
authored
chore: Update Infrastructure dependencies (#2566)
This PR contains the following updates: | Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) | action | patch | `v4.18.1` → `v4.18.5` | ![age](https://developer.mend.io/api/mc/badges/age/github-tags/CodSpeedHQ%2faction/v4.18.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/CodSpeedHQ%2faction/v4.18.1/v4.18.5?slim=true) | | [chainguard-dev/apko](https://redirect.github.com/chainguard-dev/apko) | | patch | `v1.2.21` → `v1.2.24` | ![age](https://developer.mend.io/api/mc/badges/age/github-releases/chainguard-dev%2fapko/v1.2.24?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/chainguard-dev%2fapko/v1.2.21/v1.2.24?slim=true) | | [chainguard-dev/melange](https://redirect.github.com/chainguard-dev/melange) | | patch | `v0.56.0` → `v0.56.1` | ![age](https://developer.mend.io/api/mc/badges/age/github-releases/chainguard-dev%2fmelange/v0.56.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/chainguard-dev%2fmelange/v0.56.0/v0.56.1?slim=true) | | [charm.land/bubbles/v2](https://redirect.github.com/charmbracelet/bubbles) | require | patch | `v2.1.0` → `v2.1.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/charm.land%2fbubbles%2fv2/v2.1.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/charm.land%2fbubbles%2fv2/v2.1.0/v2.1.1?slim=true) | | [charm.land/lipgloss/v2](https://redirect.github.com/charmbracelet/lipgloss) | require | patch | `v2.0.4` → `v2.0.5` | ![age](https://developer.mend.io/api/mc/badges/age/go/charm.land%2flipgloss%2fv2/v2.0.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/charm.land%2flipgloss%2fv2/v2.0.4/v2.0.5?slim=true) | | [dhi.io/nats](https://dhi.io/catalog/nats) ([source](https://redirect.github.com/docker-hardened-images/definitions)) | | digest | `d42d0f3` → `a142c2d` | | | | [dhi.io/postgres](https://dhi.io/catalog/postgres) ([source](https://redirect.github.com/docker-hardened-images/definitions)) | | digest | `50a57c1` → `2ff0d4a` | | | | [ghcr.io/astral-sh/uv](https://redirect.github.com/astral-sh/uv) | stage | patch | `0.11.26` → `0.11.28` | ![age](https://developer.mend.io/api/mc/badges/age/docker/ghcr.io%2fastral-sh%2fuv/0.11.28?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/ghcr.io%2fastral-sh%2fuv/0.11.26/0.11.28?slim=true) | | [github.com/sigstore/sigstore-go](https://redirect.github.com/sigstore/sigstore-go) | require | patch | `v1.2.1` → `v1.2.2` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fsigstore%2fsigstore-go/v1.2.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fsigstore%2fsigstore-go/v1.2.1/v1.2.2?slim=true) | | [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | minor | `v4.36.3` → `v4.37.0` | ![age](https://developer.mend.io/api/mc/badges/age/github-tags/github%2fcodeql-action/v4.37.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/github%2fcodeql-action/v4.36.3/v4.37.0?slim=true) | | golang | stage | digest | `3ad5730` → `0178a64` | | | | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | require | minor | [`v0.44.0` → `v0.45.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.44.0...refs/tags/v0.45.0) | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fterm/v0.45.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fterm/v0.44.0/v0.45.0?slim=true) | | [goreleaser/goreleaser](https://redirect.github.com/goreleaser/goreleaser) | | minor | `v2.16.0` → `v2.17.0` | ![age](https://developer.mend.io/api/mc/badges/age/github-releases/goreleaser%2fgoreleaser/v2.17.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/goreleaser%2fgoreleaser/v2.16.0/v2.17.0?slim=true) | --- ### Release Notes <details> <summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary> ### [`v4.18.5`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v4.18.5) [Compare Source](https://redirect.github.com/CodSpeedHQ/action/compare/v4.18.4...v4.18.5) #### Release Notes ##### <!-- 10 -->💼 Other - Bump pinned valgrind-codspeed to [3.26.0-0codspeed6](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/releases/tag/3.26.0-0codspeed6) ([#&#8203;448](https://redirect.github.com/CodSpeedHQ/action/issues/448)) by [@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) in [#&#8203;448](https://redirect.github.com/CodSpeedHQ/runner/pull/448) - fix: hangs on ARM64 due to atomics by [@&#8203;not-matthias](https://redirect.github.com/not-matthias) in [CodSpeedHQ/valgrind-codspeed#23](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/23) - fix(aspacem): raise amd64 managed address ceiling to 1 TiB by [@&#8203;not-matthias](https://redirect.github.com/not-matthias) in [CodSpeedHQ/valgrind-codspeed#22](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/22) #### Install codspeed-runner 4.18.4 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-installer.sh | sh ``` #### Download codspeed-runner 4.18.4 | File | Platform | Checksum | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | [codspeed-runner-aarch64-apple-darwin.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-aarch64-apple-darwin.tar.gz.sha256) | | [codspeed-runner-aarch64-unknown-linux-musl.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-aarch64-unknown-linux-musl.tar.gz.sha256) | | [codspeed-runner-x86\_64-unknown-linux-musl.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.4/codspeed-runner-x86_64-unknown-linux-musl.tar.gz.sha256) | **Full Runner Changelog**: <https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md> **Full Changelog**: <CodSpeedHQ/action@v4.18.4...v4.18.5> ### [`v4.18.4`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v4.18.4) [Compare Source](https://redirect.github.com/CodSpeedHQ/action/compare/v4.18.2...v4.18.4) #### What's Changed - fix 4.18.3 runner hash – [`bf19f56`](https://redirect.github.com/CodSpeedHQ/action/commit/bf19f56fe8857e83e4343138c1a927e56f666e3b) by [@&#8203;adriencaccia](https://redirect.github.com/adriencaccia) **Full Changelog**: <CodSpeedHQ/action@v4.18.3...v4.18.4> ### [`v4.18.2`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v4.18.2) [Compare Source](https://redirect.github.com/CodSpeedHQ/action/compare/v4.18.1...v4.18.2) #### Release Notes ##### <!-- 1 -->🐛 Bug Fixes - Source forwarded env below memtrack's capability boundary by [@&#8203;not-matthias](https://redirect.github.com/not-matthias) in [#&#8203;439](https://redirect.github.com/CodSpeedHQ/runner/pull/439) ##### <!-- 7 -->⚙️ Internals - chore: bump runner version to 4.18.2 by [@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot] in [#&#8203;219](https://redirect.github.com/CodSpeedHQ/action/pull/219) #### Install codspeed-runner 4.18.2 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-installer.sh | sh ``` #### Download codspeed-runner 4.18.2 | File | Platform | Checksum | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | [codspeed-runner-aarch64-apple-darwin.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-aarch64-apple-darwin.tar.gz.sha256) | | [codspeed-runner-aarch64-unknown-linux-musl.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-aarch64-unknown-linux-musl.tar.gz.sha256) | | [codspeed-runner-x86\_64-unknown-linux-musl.tar.gz](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://redirect.github.com/CodSpeedHQ/codspeed/releases/download/v4.18.2/codspeed-runner-x86_64-unknown-linux-musl.tar.gz.sha256) | **Full Runner Changelog**: <https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md> **Full Changelog**: <CodSpeedHQ/action@v4.18.1...v4.18.2> </details> <details> <summary>chainguard-dev/apko (chainguard-dev/apko)</summary> ### [`v1.2.24`](https://redirect.github.com/chainguard-dev/apko/releases/tag/v1.2.24) [Compare Source](https://redirect.github.com/chainguard-dev/apko/compare/v1.2.23...v1.2.24) ##### Changelog - [`f2ad955`](https://redirect.github.com/chainguard-dev/apko/commit/f2ad95570365329f3063fc617162455f32c1afda) lock: embed keyring content in the lock file ([#&#8203;2322](https://redirect.github.com/chainguard-dev/apko/issues/2322)) ### [`v1.2.23`](https://redirect.github.com/chainguard-dev/apko/releases/tag/v1.2.23) [Compare Source](https://redirect.github.com/chainguard-dev/apko/compare/v1.2.22...v1.2.23) ##### Changelog - [`9d4b52d`](https://redirect.github.com/chainguard-dev/apko/commit/9d4b52d913063421165620da75b7926bbe211321) Add contents.runtime\_keyring for runtime APK trust ([#&#8203;2297](https://redirect.github.com/chainguard-dev/apko/issues/2297)) - [`ebe71ff`](https://redirect.github.com/chainguard-dev/apko/commit/ebe71ff2908910610421e5817298838f1e865400) Use flightCache for index cache implementation ([#&#8203;2175](https://redirect.github.com/chainguard-dev/apko/issues/2175)) ### [`v1.2.22`](https://redirect.github.com/chainguard-dev/apko/releases/tag/v1.2.22) [Compare Source](https://redirect.github.com/chainguard-dev/apko/compare/v1.2.21...v1.2.22) ##### Changelog - [`463cab4`](https://redirect.github.com/chainguard-dev/apko/commit/463cab44ae3454c02406d55c259e36f4ebfcc1f7) build(deps): bump chainguard-dev/actions/setup-registry from 1.6.24 to 1.6.26 ([#&#8203;2313](https://redirect.github.com/chainguard-dev/apko/issues/2313)) - [`59d7f49`](https://redirect.github.com/chainguard-dev/apko/commit/59d7f49ccdf5b333cd3be875a3563fae1b14d354) build(deps): bump chainguard.dev/sdk from 0.1.74 to 0.1.94 ([#&#8203;2309](https://redirect.github.com/chainguard-dev/apko/issues/2309)) - [`74c4920`](https://redirect.github.com/chainguard-dev/apko/commit/74c49209db70fe6b488ffc17c2be95a529cfbb79) build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.19.0 ([#&#8203;2314](https://redirect.github.com/chainguard-dev/apko/issues/2314)) - [`8165fd4`](https://redirect.github.com/chainguard-dev/apko/commit/8165fd40c5dfad902122385ae6a78beb257ba3aa) build(deps): bump go.step.sm/crypto from 0.83.0 to 0.84.1 ([#&#8203;2301](https://redirect.github.com/chainguard-dev/apko/issues/2301)) - [`6fb33c4`](https://redirect.github.com/chainguard-dev/apko/commit/6fb33c44faab2f3b6155b5190ae389ceaf60a298) build(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 ([#&#8203;2312](https://redirect.github.com/chainguard-dev/apko/issues/2312)) - [`d7dc9ca`](https://redirect.github.com/chainguard-dev/apko/commit/d7dc9ca44ed085c9a2ae59cc23af8b06b5d6254a) build(deps): bump google.golang.org/api from 0.285.0 to 0.286.0 ([#&#8203;2298](https://redirect.github.com/chainguard-dev/apko/issues/2298)) - [`891d275`](https://redirect.github.com/chainguard-dev/apko/commit/891d27560c80f61cca2fd27e20408ca7e921b67d) build(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 ([#&#8203;2308](https://redirect.github.com/chainguard-dev/apko/issues/2308)) - [`f9189c2`](https://redirect.github.com/chainguard-dev/apko/commit/f9189c2afb477dd0f7ecab00f3751f0888553c4b) build(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 ([#&#8203;2295](https://redirect.github.com/chainguard-dev/apko/issues/2295)) </details> <details> <summary>chainguard-dev/melange (chainguard-dev/melange)</summary> ### [`v0.56.1`](https://redirect.github.com/chainguard-dev/melange/releases/tag/v0.56.1) [Compare Source](https://redirect.github.com/chainguard-dev/melange/compare/v0.56.0...v0.56.1) #### What's Changed - build(deps): bump the actions group across 1 directory with 4 updates by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;2583](https://redirect.github.com/chainguard-dev/melange/pull/2583) - build(deps): bump the gomod group across 1 directory with 6 updates by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;2585](https://redirect.github.com/chainguard-dev/melange/pull/2585) **Full Changelog**: <chainguard-dev/melange@v0.56.0...v0.56.1> </details> <details> <summary>charmbracelet/bubbles (charm.land/bubbles/v2)</summary> ### [`v2.1.1`](https://redirect.github.com/charmbracelet/bubbles/releases/tag/v2.1.1) [Compare Source](https://redirect.github.com/charmbracelet/bubbles/compare/v2.1.0...v2.1.1) ### Lil’ Textarea Fix This is a tiny patch to fix a bug in `textarea` where the prompt character could be missing styling on empty lines. That’s all for now! Thanks for using Bubbles, Charm 🌞 #### Changelog ##### Fixed - [`d2b2217`](https://redirect.github.com/charmbracelet/bubbles/commit/d2b2217d6352ce04183623d66d4266115419733c): fix(textarea): apply prompt style on all lines, including fillers ([@&#8203;meowgorithm](https://redirect.github.com/meowgorithm)) ##### Docs - [`a13f110`](https://redirect.github.com/charmbracelet/bubbles/commit/a13f110fba4f13ce5fe9bc7fd51619f5782077b9): docs: fix typo in README ([#&#8203;921](https://redirect.github.com/charmbracelet/bubbles/issues/921)) ([@&#8203;Rohan5commit](https://redirect.github.com/Rohan5commit)) *** <a href="https://charm.land/"><img alt="The Charm logo" src="https://stuff.charm.sh/charm-banner-next.jpg" width="400"></a> Thoughts? Questions? We love hearing from you. Feel free to reach out on [X](https://x.com/charmcli), [Discord](https://charm.land/discord), [Slack](https://charm.land/slack), [The Fediverse](https://mastodon.social/@&#8203;charmcli), [Bluesky](https://bsky.app/profile/charm.land). </details> <details> <summary>charmbracelet/lipgloss (charm.land/lipgloss/v2)</summary> ### [`v2.0.5`](https://redirect.github.com/charmbracelet/lipgloss/releases/tag/v2.0.5) [Compare Source](https://redirect.github.com/charmbracelet/lipgloss/compare/v2.0.4...v2.0.5) #### Changelog *** <a href="https://charm.land/"><img alt="The Charm logo" src="https://stuff.charm.sh/charm-banner-next.jpg" width="400"></a> Thoughts? Questions? We love hearing from you. Feel free to reach out on [X](https://x.com/charmcli), [Discord](https://charm.land/discord), [Slack](https://charm.land/slack), [The Fediverse](https://mastodon.social/@&#8203;charmcli), [Bluesky](https://bsky.app/profile/charm.land). </details> <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.11.28`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01128) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.11.27...0.11.28) Released on 2026-07-07. ##### Security This release updates our ZIP library, [astral-async-zip](https://redirect.github.com/astral-sh/rs-async-zip), to v0.0.20, which includes 15 changes that harden our ZIP handling against [parser differentials](https://www.brainonfire.net/blog/2022/04/11/what-is-parser-mismatch/). uv may reject ZIP archives with malformed or ambiguous content that were previously accepted. See the [upstream commits](https://redirect.github.com/astral-sh/rs-async-zip/compare/v0.0.18...v0.0.20) for a full list of changes. ##### Python - Upgrade GraalPy to 25.1.3 ([#&#8203;20069](https://redirect.github.com/astral-sh/uv/pull/20069)) ##### Enhancements - Improve trace logs for unexpected error chains ([#&#8203;20220](https://redirect.github.com/astral-sh/uv/pull/20220)) - Move lockfile update guidance to a hint ([#&#8203;20219](https://redirect.github.com/astral-sh/uv/pull/20219)) - Preserve indentation for multiline error causes ([#&#8203;20156](https://redirect.github.com/astral-sh/uv/pull/20156)) - Render user errors with their cause chains ([#&#8203;20217](https://redirect.github.com/astral-sh/uv/pull/20217)) - Route final command errors through the printer to respect `-q` and `-qq` ([#&#8203;20163](https://redirect.github.com/astral-sh/uv/pull/20163)) - Use standard rendering for `uv build` errors ([#&#8203;20159](https://redirect.github.com/astral-sh/uv/pull/20159)) - Use standard rendering for tool requirement errors ([#&#8203;20160](https://redirect.github.com/astral-sh/uv/pull/20160)) ##### Performance - Only compile bytecode for installed distributions in `uv pip install` ([#&#8203;19914](https://redirect.github.com/astral-sh/uv/pull/19914)) - Avoid allocating URL-safe Git revisions ([#&#8203;20194](https://redirect.github.com/astral-sh/uv/pull/20194)) - Avoid allocating canonical Python request strings ([#&#8203;20193](https://redirect.github.com/astral-sh/uv/pull/20193)) - Avoid allocating custom Astral mirror URLs ([#&#8203;20204](https://redirect.github.com/astral-sh/uv/pull/20204)) - Avoid allocating expanded compatibility tags ([#&#8203;20190](https://redirect.github.com/astral-sh/uv/pull/20190)) - Avoid allocating shell strings that need no escaping ([#&#8203;20196](https://redirect.github.com/astral-sh/uv/pull/20196)) - Avoid allocating static ABI descriptions ([#&#8203;20201](https://redirect.github.com/astral-sh/uv/pull/20201)) - Avoid allocating static Windows executable names ([#&#8203;20200](https://redirect.github.com/astral-sh/uv/pull/20200)) - Avoid allocating static dependency table names ([#&#8203;20199](https://redirect.github.com/astral-sh/uv/pull/20199)) - Avoid allocating static platform triple components ([#&#8203;20195](https://redirect.github.com/astral-sh/uv/pull/20195)) - Avoid allocating static resolver report labels ([#&#8203;20198](https://redirect.github.com/astral-sh/uv/pull/20198)) - Avoid allocating static unavailable-version messages ([#&#8203;20197](https://redirect.github.com/astral-sh/uv/pull/20197)) - Avoid allocating unchanged Python download architectures ([#&#8203;20202](https://redirect.github.com/astral-sh/uv/pull/20202)) - Avoid allocating unchanged paths during case normalization ([#&#8203;20203](https://redirect.github.com/astral-sh/uv/pull/20203)) - Avoid allocations when expanding group conflicts ([#&#8203;20211](https://redirect.github.com/astral-sh/uv/pull/20211)) - Avoid allocations when formatting requirements ([#&#8203;20206](https://redirect.github.com/astral-sh/uv/pull/20206)) - Avoid cloning credential lookup services ([#&#8203;20210](https://redirect.github.com/astral-sh/uv/pull/20210)) - Avoid cloning dry-run distributions ([#&#8203;20209](https://redirect.github.com/astral-sh/uv/pull/20209)) - Avoid cloning owned dependency metadata ([#&#8203;20212](https://redirect.github.com/astral-sh/uv/pull/20212)) - Avoid redundant direct URL clones ([#&#8203;20207](https://redirect.github.com/astral-sh/uv/pull/20207)) - Create metadata version errors lazily ([#&#8203;20205](https://redirect.github.com/astral-sh/uv/pull/20205)) - Optimize expanded tag compatibility checks ([#&#8203;20171](https://redirect.github.com/astral-sh/uv/pull/20171)) - Optimize parsing of single-digit three-part versions ([#&#8203;20118](https://redirect.github.com/astral-sh/uv/pull/20118)) ##### Bug fixes - Avoid overflow when computing HTTP cache age ([#&#8203;20178](https://redirect.github.com/astral-sh/uv/pull/20178)) - Respect `--upgrade` when `upgrade-package` is configured ([#&#8203;19955](https://redirect.github.com/astral-sh/uv/pull/19955)) - Support `uv tree` in dependency-group-only projects ([#&#8203;20167](https://redirect.github.com/astral-sh/uv/pull/20167)) - Treat cache entries as stale at exact expiration ([#&#8203;20183](https://redirect.github.com/astral-sh/uv/pull/20183)) ### [`v0.11.27`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01127) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.11.26...0.11.27) Released on 2026-07-06. ##### Enhancements - Continue on ignored errors when fetching wheel metadata ([#&#8203;12255](https://redirect.github.com/astral-sh/uv/pull/12255)) - Use caching for `--python-downloads-json-url` ([#&#8203;16749](https://redirect.github.com/astral-sh/uv/pull/16749)) ##### Preview features - Discover extensionless shebang scripts in `uv workspace list --scripts` ([#&#8203;20099](https://redirect.github.com/astral-sh/uv/pull/20099)) ##### Performance - Avoid full site-packages scans for direct reinstalls ([#&#8203;20119](https://redirect.github.com/astral-sh/uv/pull/20119)) - Avoid redundant pyproject parsing ([#&#8203;20076](https://redirect.github.com/astral-sh/uv/pull/20076)) - Cache default dependency markers when reading locks ([#&#8203;20125](https://redirect.github.com/astral-sh/uv/pull/20125)) - Enable SIMD-accelerated TOML parsing ([#&#8203;20079](https://redirect.github.com/astral-sh/uv/pull/20079)) - Intern `requires-python` specifiers in Simple API parsing ([#&#8203;20104](https://redirect.github.com/astral-sh/uv/pull/20104)) - Read cache entries into exact-sized buffers ([#&#8203;20120](https://redirect.github.com/astral-sh/uv/pull/20120)) - Reduce VersionSpecifiers parsing allocations ([#&#8203;20105](https://redirect.github.com/astral-sh/uv/pull/20105)) - Reduce site-packages scan allocation overhead ([#&#8203;20087](https://redirect.github.com/astral-sh/uv/pull/20087)) - Reuse package names when parsing wheel filenames ([#&#8203;20110](https://redirect.github.com/astral-sh/uv/pull/20110)) - Sort Simple API files after grouping ([#&#8203;20112](https://redirect.github.com/astral-sh/uv/pull/20112)) ##### Bug fixes - Always emit `packages` table for pylock.toml ([#&#8203;20145](https://redirect.github.com/astral-sh/uv/pull/20145)) - Avoid blank line for empty `uv pip tree` ([#&#8203;20062](https://redirect.github.com/astral-sh/uv/pull/20062)) - Encode hashes in file paths ([#&#8203;19807](https://redirect.github.com/astral-sh/uv/pull/19807)) - Error on a registry uv.lock package without a version instead of panicking ([#&#8203;19855](https://redirect.github.com/astral-sh/uv/pull/19855)) - Preserve conditional extra markers in exports ([#&#8203;20148](https://redirect.github.com/astral-sh/uv/pull/20148)) - Skip the ambiguous authority check for file transport VCS URLs ([#&#8203;20086](https://redirect.github.com/astral-sh/uv/pull/20086)) - Sync index format when `uv add --index` updates an existing index URL ([#&#8203;19818](https://redirect.github.com/astral-sh/uv/pull/19818)) ##### Other changes - Re-add `pub` APIs used in Pixi ([#&#8203;20074](https://redirect.github.com/astral-sh/uv/pull/20074)) - Update Rust toolchain to 1.96.1 ([#&#8203;20103](https://redirect.github.com/astral-sh/uv/pull/20103)) </details> <details> <summary>sigstore/sigstore-go (github.com/sigstore/sigstore-go)</summary> ### [`v1.2.2`](https://redirect.github.com/sigstore/sigstore-go/releases/tag/v1.2.2) [Compare Source](https://redirect.github.com/sigstore/sigstore-go/compare/v1.2.1...v1.2.2) ##### What's Changed - Reject certificate identity with no SAN or issuer criteria in [#&#8203;645](https://redirect.github.com/sigstore/sigstore-go/pull/645) - Support Verification in sigstore/cosign with X.509 Certificate Chain in [#&#8203;581](https://redirect.github.com/sigstore/sigstore-go/pull/581) **Full Changelog**: <sigstore/sigstore-go@v1.2.1...v1.2.2> </details> <details> <summary>github/codeql-action (github/codeql-action)</summary> ### [`v4.37.0`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.0) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.36.3...v4.37.0) - Update default CodeQL bundle version to [2.26.0](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#&#8203;3995](https://redirect.github.com/github/codeql-action/pull/3995) - In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@&#8203;ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#&#8203;3973](https://redirect.github.com/github/codeql-action/pull/3973) </details> <details> <summary>goreleaser/goreleaser (goreleaser/goreleaser)</summary> ### [`v2.17.0`](https://redirect.github.com/goreleaser/goreleaser/releases/tag/v2.17.0) [Compare Source](https://redirect.github.com/goreleaser/goreleaser/compare/v2.16.0...v2.17.0) #### Announcement Read the official announcement: [Announcing GoReleaser v2.17](https://goreleaser.com/blog/goreleaser-v2.17/). #### Changelog ##### New Features - [`31d4279`](https://redirect.github.com/goreleaser/goreleaser/commit/31d427926bf91dede0f208d4b034c4b35dfb5507): feat(brew,cask,krew,nix,scoop,winget): default pull request branch name ([#&#8203;6685](https://redirect.github.com/goreleaser/goreleaser/issues/6685)) ([@&#8203;caarlos0](https://redirect.github.com/caarlos0)) - [`e5f075b`](https://redirect.github.com/goreleaser/goreleaser/commit/e5f075b7a372541a1db505f3dc4015d1495714c5): feat(dockers/v2): retry build ([@&#8203;caarlos0](https://redirect.github.com/caarlos0)) - [`cd5f16b`](https://redirect.github.com/goreleaser/goreleaser/commit/cd5f16b42e09c8b8994e7722e034fb79770d9273): feat(nfpm): support msix packages ([#&#8203;6647](https://redirect.github.com/goreleaser/goreleaser/issues/6647)) ([@&#8203;umaidshahid](https://redirect.github.com/umaidshahid) and [@&#8203;caarlos0](https://redirect.github.com/caarlos0)) - [`43be34a`](https://redirect.github.com/goreleaser/goreleaser/commit/43be34a1cd33dc36fad9a2626251f29fa81eed61): feat(scm): allow a custom token on the release repository ([#&#8203;6689](https://redirect.github.com/goreleaser/goreleaser/issues/6689)) ([@&#8203;caarlos0](https://redirect.github.com/caarlos0)) - [`5ed70f2`](https://redirect.github.com/goreleaser/goreleaser/commit/5ed70f2d19c85eb9589f0316073ef42930a78c3b): feat(winget): allow configuring the manifest locale ([#&#8203;6680](https://redirect.github.com/goreleaser/goreleaser/issues/6680)) ([@&#8203;caarlos0](https://redirect.github.com/caarlos0)) - [`6f7175a`](https://redirect.github.com/goreleaser/goreleaser/commit/6f7175a0ec98ecae6b00548922648da27c330716): feat: Allow GOARM softfloat and hardfloat ([#&#8203;6198](https://redirect.github.com/goreleaser/goreleaser/issues/6198)) ([@&#8203;MDr164](https://redirect.github.com/MDr164) and [@&#8203;caarlos0](https://redirect.github.com/caarlos0)) ##### Security updates - [`b985ca8`](https://redirect.github.com/goreleaser/goreleaser/commit/b985ca8dc6b231440d98ff5e018c7c40678f0baa): sec(deps): bump go-pkcs12 to v0.7.2 (GO-2026-5052) ([#&#8203;6683](https://redirect.github.com/goreleaser/goreleaser/issues/6683)) ([@&#8203;caarlos0](https://redirect.github.com/caarlos0)) - [`7c73b82`](https://redirect.github.com/goreleaser/goreleaser/commit/7c73b82e0822ebaded3b193e045ffb173befa58a): sec(deps): update golang.org/x/net ([@&#8203;caarlos0](https://redirect.github.com/caarlos0)) ##### Bug fixes - [`7d602ff`](https://redirect.github.com/goreleaser/goreleaser/commit/7d602ff39b52b7edbdf3340dd548f1238ccd656b): fix(builders): reject empty target string ([#&#8203;6679](https://redirect.github.com/goreleaser/goreleaser/issues/6679)) ([@&#8203;sueun-dev](https://redirect.github.com/sueun-dev)) - [`355d706`](https://redirect.github.com/goreleaser/goreleaser/commit/355d706ba6ee76a8dcabbc55902840376548d774): fix(client): skip merge-upstream when target repo is not a fork ([#&#8203;6646](https://redirect.github.com/goreleaser/goreleaser/issues/6646)) ([@&#8203;jamessawle](https://redirect.github.com/jamessawle) and [@&#8203;caarlos0](https://redirect.github.com/caarlos0)) - [`944bbb2`](https://redirect.github.com/goreleaser/goreleaser/commit/944bbb2de2c80e04e03f3509a781c82a2bb312d1): fix(deps): drop dep on docker/docker ([#&#8203;6682](https://redirect.github.com/goreleaser/goreleaser/issues/6682)) ([@&#8203;caarlos0](https://redirect.github.com/caarlos0)) - [`a85ce26`](https://redirect.github.com/goreleaser/goreleaser/commit/a85ce26032280f8cb4ba2f32cd5223176ecd86fb): fix(mcp): clean subfolder path ([#&#8203;6649](https://redirect.github.com/goreleaser/goreleaser/issues/6649)) ([@&#8203;caarlos0](https://redirect.github.com/caarlos0)) - [`99a7173`](https://redirect.github.com/goreleaser/goreleaser/commit/99a71731d269c1f036b0caea92032ac0a1fdce8a): fix(nfpm): produce valid arch for Termux packages ([#&#8203;6668](https://redirect.github.com/goreleaser/goreleaser/issues/6668)) ([@&#8203;bltavares](https://redirect.github.com/bltavares) and [@&#8203;caarlos0](https://redirect.github.com/caarlos0)) - [`7200ec7`](https://redirect.github.com/goreleaser/goreleaser/commit/7200ec73ecf09b4266d4e7ae21464e51dade7ec0): fix(winget): default head branch to a versioned template ([#&#8203;6684](https://redirect.github.com/goreleaser/goreleaser/issues/6684)) ([@&#8203;Sanjays2402](https://redirect.github.com/Sanjays2402)) - [`6645820`](https://redirect.github.com/goreleaser/goreleaser/commit/6645820ffb384318c8486802cd7770f4f1646b4b): fix: return error when go.mod is unreadable in CheckGoModPipe ([#&#8203;6644](https://redirect.github.com/goreleaser/goreleaser/issues/6644)) ([@&#8203;SebTardif](https://redirect.github.com/SebTardif)) ##### Documentation updates - [`da7ce30`](https://redirect.github.com/goreleaser/goreleaser/commit/da7ce304ee4e0dd4b7b7f42231727becd4d99278): docs(casks): fix private-repo example broken by Homebrew 5.1.14 ([#&#8203;6639](https://redirect.github.com/goreleaser/goreleaser/issues/6639)) ([@&#8203;caarlos0](https://redirect.github.com/caarlos0)) - [`09ebd03`](https://redirect.github.com/goreleaser/goreleaser/commit/09ebd035a7737f67816369cbdd6aff93656d93a7): docs(nfpm): note tilde ConventionalFileName ([@&#8203;caarlos0](https://redirect.github.com/caarlos0)) - [`ab7481e`](https://redirect.github.com/goreleaser/goreleaser/commit/ab7481ed082cbad81805823b9ffd911776e8bbc7): docs: doc authoring skill ([@&#8203;caarlos0](https://redirect.github.com/caarlos0)) - [`b945ca3`](https://redirect.github.com/goreleaser/goreleaser/commit/b945ca35c5515cfbb99f3162a738897334ac0c7c): docs: fix ([@&#8203;caarlos0](https://redirect.github.com/caarlos0)) - [`7e87fd3`](https://redirect.github.com/goreleaser/goreleaser/commit/7e87fd39b283119906598461860dcec6e51f99f4): docs: fix "lets" -> "let's" in quick-start guide ([#&#8203;6661](https://redirect.github.com/goreleaser/goreleaser/issues/6661)) ([@&#8203;s3onghyun](https://redirect.github.com/s3onghyun)) - [`698dae5`](https://redirect.github.com/goreleaser/goreleaser/commit/698dae55da5585136be0417502f2467edb213719): docs: fix typo in notarize.md ([#&#8203;6655](https://redirect.github.com/goreleaser/goreleaser/issues/6655)) ([@&#8203;albertchae](https://redirect.github.com/albertchae)) - [`f09c887`](https://redirect.github.com/goreleaser/goreleaser/commit/f09c88738c004e4a1df8858064f368e1f1878b98): docs: good bye discord ([@&#8203;caarlos0](https://redirect.github.com/caarlos0)) - [`2642319`](https://redirect.github.com/goreleaser/goreleaser/commit/2642319f753cde16df470c9da5c5f6124a50a681): docs: improve home ([@&#8203;caarlos0](https://redirect.github.com/caarlos0)) - [`6b7710e`](https://redirect.github.com/goreleaser/goreleaser/commit/6b7710eb4a6b4fc181c21994e694130bc57a1a9b): docs: updates ([@&#8203;caarlos0](https://redirect.github.com/caarlos0)) ##### Other work - [`2e6f200`](https://redirect.github.com/goreleaser/goreleaser/commit/2e6f200efaaf702d1008f37bc75fc28cdf3cdd0d): chore: auto-update generated files ([#&#8203;6662](https://redirect.github.com/goreleaser/goreleaser/issues/6662)) ([@&#8203;goreleaserbot](https://redirect.github.com/goreleaserbot)) - [`4bd4e38`](https://redirect.github.com/goreleaser/goreleaser/commit/4bd4e386d2d260e5efb9cb962a727a3f28c718c7): chore: auto-update generated files ([#&#8203;6671](https://redirect.github.com/goreleaser/goreleaser/issues/6671)) ([@&#8203;goreleaserbot](https://redirect.github.com/goreleaserbot)) - [`dcf5a6b`](https://redirect.github.com/goreleaser/goreleaser/commit/dcf5a6b3b48314ea07b14098bf55372b2d1fa984): chore: auto-update generated files ([#&#8203;6675](https://redirect.github.com/goreleaser/goreleaser/issues/6675)) ([@&#8203;goreleaserbot](https://redirect.github.com/goreleaserbot)) - [`baf110d`](https://redirect.github.com/goreleaser/goreleaser/commit/baf110d41e81f273070e2a092ae1bbac1c22bc6a): chore: auto-update generated files ([#&#8203;6688](https://redirect.github.com/goreleaser/goreleaser/issues/6688)) ([@&#8203;goreleaserbot](https://redirect.github.com/goreleaserbot)) - [`3fa8a94`](https://redirect.github.com/goreleaser/goreleaser/commit/3fa8a94c5b57e0ae3bc7ea0b7f0a89d63afa666a): chore: godoc ([@&#8203;caarlos0](https://redirect.github.com/caarlos0)) **Full Changelog**: <goreleaser/goreleaser@v2.16.0...v2.17.0> #### Helping out This release is only possible thanks to **all** the support of some **awesome people**! Want to be one of them? You can [sponsor](https://goreleaser.com/sponsors/), get a [Pro License](https://goreleaser.com/pro) or [contribute with code](https://goreleaser.com/contributing). #### Where to go next? - Find examples and commented usage of all options in our [website](https://goreleaser.com/intro/). - Reach out on [Discord](https://discord.gg/RGEBtg8vQ6), [Twitter](https://twitter.com/goreleaser), and [Telegram](https://t.me/goreleasernews)! <a href="https://goreleaser.com"><img src="https://raw.githubusercontent.com/goreleaser/artwork/master/opencollective-header.png" with="100%" alt="GoReleaser logo"></a> </details> --- ### Configuration 📅 **Schedule**: (in timezone Etc/UTC) - Branch creation - Between 12:00 AM and 06:59 AM, only on Saturday (`* 0-6 * * 6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Aureliolo/synthorg). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI0Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJ0eXBlOmluZnJhIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
1 parent 8c5bcac commit 88d8e5f

15 files changed

Lines changed: 110 additions & 52 deletions

File tree

‎.github/actions/build-apko-base/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ runs:
132132
133133
- name: Upload SARIF to GitHub Security
134134
if: always()
135-
uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
135+
uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
136136
with: # zizmor: ignore[template-injection]
137137
sarif_file: trivy-${{ inputs.image-name }}-base.sarif
138138
category: trivy-${{ inputs.image-name }}-base

‎.github/actions/build-scan-image/action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -412,7 +412,7 @@ runs:
412412
# above (which stays loud). A transient code-scanning API 401/5xx must
413413
# not fail the image build/publish; the SARIF re-uploads next run.
414414
continue-on-error: true
415-
uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
415+
uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
416416
with:
417417
sarif_file: trivy-${{ inputs.image-name }}-amd64.sarif
418418
category: trivy-${{ inputs.image-name }}-amd64
@@ -433,7 +433,7 @@ runs:
433433
if: always() && github.event_name != 'pull_request' && inputs.enable-arm64 == 'true'
434434
# See the amd64 upload above: cosmetic, non-gating, re-uploads next run.
435435
continue-on-error: true
436-
uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
436+
uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
437437
with:
438438
sarif_file: trivy-${{ inputs.image-name }}-arm64.sarif
439439
category: trivy-${{ inputs.image-name }}-arm64

‎.github/workflows/apko-lock.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ concurrency:
2121

2222
env:
2323
# renovate: datasource=github-releases depName=chainguard-dev/apko
24-
APKO_VERSION: "v1.2.21"
24+
APKO_VERSION: "v1.2.24"
2525

2626
jobs:
2727
update-lockfiles:

‎.github/workflows/cli.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -578,7 +578,7 @@ jobs:
578578
uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
579579
with:
580580
# renovate: datasource=github-releases depName=goreleaser/goreleaser
581-
version: v2.16.0
581+
version: v2.17.0
582582
args: release --clean
583583
workdir: cli
584584
env:

‎.github/workflows/codspeed.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,7 @@ jobs:
139139
- name: Run CodSpeed Python benchmarks (attempt 1/3)
140140
id: codspeed-py-1
141141
continue-on-error: true
142-
uses: CodSpeedHQ/action@a4a36bb07c0638b0b4ca52bf1f3dad1b4289e52f # v4.18.1
142+
uses: CodSpeedHQ/action@f99becdce5e5d51fd556489ebef684f4ecfd6286 # v4.18.5
143143
env:
144144
# Measure the real production code path, not test-harness overhead:
145145
# typeguard is a test-only instrument (never runs in production). This
@@ -163,7 +163,7 @@ jobs:
163163
id: codspeed-py-2
164164
if: ${{ !cancelled() && steps.codspeed-py-1.outcome == 'failure' }}
165165
continue-on-error: true
166-
uses: CodSpeedHQ/action@a4a36bb07c0638b0b4ca52bf1f3dad1b4289e52f # v4.18.1
166+
uses: CodSpeedHQ/action@f99becdce5e5d51fd556489ebef684f4ecfd6286 # v4.18.5
167167
env:
168168
SYNTHORG_BENCH_NO_TYPEGUARD: "1"
169169
with:
@@ -176,7 +176,7 @@ jobs:
176176
sleep 60
177177
- name: Run CodSpeed Python benchmarks (attempt 3/3)
178178
if: ${{ !cancelled() && steps.codspeed-py-1.outcome == 'failure' && steps.codspeed-py-2.outcome == 'failure' }}
179-
uses: CodSpeedHQ/action@a4a36bb07c0638b0b4ca52bf1f3dad1b4289e52f # v4.18.1
179+
uses: CodSpeedHQ/action@f99becdce5e5d51fd556489ebef684f4ecfd6286 # v4.18.5
180180
env:
181181
SYNTHORG_BENCH_NO_TYPEGUARD: "1"
182182
with:
@@ -223,7 +223,7 @@ jobs:
223223
- name: Run CodSpeed Web benchmarks (attempt 1/3)
224224
id: codspeed-web-1
225225
continue-on-error: true
226-
uses: CodSpeedHQ/action@a4a36bb07c0638b0b4ca52bf1f3dad1b4289e52f # v4.18.1
226+
uses: CodSpeedHQ/action@f99becdce5e5d51fd556489ebef684f4ecfd6286 # v4.18.5
227227
with:
228228
mode: simulation,memory
229229
run: npm --prefix web run bench
@@ -236,7 +236,7 @@ jobs:
236236
id: codspeed-web-2
237237
if: ${{ !cancelled() && steps.codspeed-web-1.outcome == 'failure' }}
238238
continue-on-error: true
239-
uses: CodSpeedHQ/action@a4a36bb07c0638b0b4ca52bf1f3dad1b4289e52f # v4.18.1
239+
uses: CodSpeedHQ/action@f99becdce5e5d51fd556489ebef684f4ecfd6286 # v4.18.5
240240
with:
241241
mode: simulation,memory
242242
run: npm --prefix web run bench
@@ -247,7 +247,7 @@ jobs:
247247
sleep 60
248248
- name: Run CodSpeed Web benchmarks (attempt 3/3)
249249
if: ${{ !cancelled() && steps.codspeed-web-1.outcome == 'failure' && steps.codspeed-web-2.outcome == 'failure' }}
250-
uses: CodSpeedHQ/action@a4a36bb07c0638b0b4ca52bf1f3dad1b4289e52f # v4.18.1
250+
uses: CodSpeedHQ/action@f99becdce5e5d51fd556489ebef684f4ecfd6286 # v4.18.5
251251
with:
252252
mode: simulation,memory
253253
run: npm --prefix web run bench

‎.github/workflows/dast.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ env:
1515
# renovate: datasource=github-releases depName=aquasecurity/trivy
1616
TRIVY_VERSION: "0.72.0"
1717
# renovate: datasource=github-releases depName=chainguard-dev/apko
18-
APKO_VERSION: "v1.2.21"
18+
APKO_VERSION: "v1.2.24"
1919
# COMPOSE_FILE makes every `docker compose` invocation in this job pick
2020
# up both the base + DAST overlay automatically (colon separator on
2121
# Linux runners), so we don't repeat `-f docker/compose.yml -f

‎.github/workflows/docker.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ env:
4646
# renovate: datasource=github-releases depName=aquasecurity/trivy
4747
TRIVY_VERSION: "0.72.0"
4848
# renovate: datasource=github-releases depName=chainguard-dev/apko
49-
APKO_VERSION: "v1.2.21"
49+
APKO_VERSION: "v1.2.24"
5050

5151
jobs:
5252
# Detect which domains changed so docs-only PRs skip backend/sandbox builds
@@ -705,7 +705,7 @@ jobs:
705705
uses: chainguard-dev/actions/setup-melange@f0be69916b439d0fcced2451b23d0f27cd46d545 # v1.6.26
706706
with:
707707
# renovate: datasource=github-releases depName=chainguard-dev/melange
708-
version: v0.56.0
708+
version: v0.56.1
709709

710710
- name: Generate melange signing key
711711
run: melange keygen
@@ -860,7 +860,7 @@ jobs:
860860
861861
- name: Upload SARIF to GitHub Security (web)
862862
if: always()
863-
uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
863+
uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
864864
with:
865865
sarif_file: trivy-web.sarif
866866
category: trivy-web

‎.github/workflows/scorecard.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ jobs:
4141

4242
- name: Upload SARIF
4343
if: ${{ !cancelled() }}
44-
uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
44+
uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
4545
with:
4646
sarif_file: results.sarif
4747

‎cli/go.mod‎

Lines changed: 29 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,22 @@ module github.com/Aureliolo/synthorg/cli
33
go 1.26.5
44

55
require (
6-
charm.land/bubbles/v2 v2.1.0
6+
charm.land/bubbles/v2 v2.1.1
77
charm.land/bubbletea/v2 v2.0.8
88
charm.land/huh/v2 v2.0.3
9-
charm.land/lipgloss/v2 v2.0.4
9+
charm.land/lipgloss/v2 v2.0.5
1010
github.com/charmbracelet/x/ansi v0.11.7
1111
github.com/gofrs/flock v0.13.0
1212
github.com/google/go-containerregistry v0.21.7
1313
github.com/mattn/go-isatty v0.0.22
1414
github.com/mattn/go-runewidth v0.0.24
1515
github.com/sigstore/protobuf-specs v0.5.1
16-
github.com/sigstore/sigstore-go v1.2.1
16+
github.com/sigstore/sigstore-go v1.2.2
1717
github.com/spf13/cobra v1.10.2
1818
github.com/spf13/pflag v1.0.10
1919
github.com/theupdateframework/go-tuf/v2 v2.4.2
2020
go.yaml.in/yaml/v3 v3.0.4
21-
golang.org/x/term v0.44.0
21+
golang.org/x/term v0.45.0
2222
)
2323

2424
require (
@@ -46,27 +46,27 @@ require (
4646
github.com/go-logr/logr v1.4.3 // indirect
4747
github.com/go-logr/stdr v1.2.2 // indirect
4848
github.com/go-openapi/analysis v0.25.2 // indirect
49-
github.com/go-openapi/errors v0.22.7 // indirect
49+
github.com/go-openapi/errors v0.22.8 // indirect
5050
github.com/go-openapi/jsonpointer v0.23.1 // indirect
5151
github.com/go-openapi/jsonreference v0.21.6 // indirect
52-
github.com/go-openapi/loads v0.23.3 // indirect
53-
github.com/go-openapi/runtime v0.32.3 // indirect
52+
github.com/go-openapi/loads v0.24.0 // indirect
53+
github.com/go-openapi/runtime v0.32.4 // indirect
5454
github.com/go-openapi/runtime/server-middleware v0.30.0 // indirect
55-
github.com/go-openapi/spec v0.22.5 // indirect
56-
github.com/go-openapi/strfmt v0.26.3 // indirect
57-
github.com/go-openapi/swag v0.26.0 // indirect
58-
github.com/go-openapi/swag/cmdutils v0.26.0 // indirect
59-
github.com/go-openapi/swag/conv v0.26.0 // indirect
60-
github.com/go-openapi/swag/fileutils v0.26.0 // indirect
61-
github.com/go-openapi/swag/jsonname v0.26.0 // indirect
62-
github.com/go-openapi/swag/jsonutils v0.26.0 // indirect
63-
github.com/go-openapi/swag/loading v0.26.0 // indirect
64-
github.com/go-openapi/swag/mangling v0.26.0 // indirect
65-
github.com/go-openapi/swag/netutils v0.26.0 // indirect
66-
github.com/go-openapi/swag/stringutils v0.26.0 // indirect
67-
github.com/go-openapi/swag/typeutils v0.26.0 // indirect
68-
github.com/go-openapi/swag/yamlutils v0.26.0 // indirect
69-
github.com/go-openapi/validate v0.25.3 // indirect
55+
github.com/go-openapi/spec v0.22.6 // indirect
56+
github.com/go-openapi/strfmt v0.26.4 // indirect
57+
github.com/go-openapi/swag v0.26.1 // indirect
58+
github.com/go-openapi/swag/cmdutils v0.26.1 // indirect
59+
github.com/go-openapi/swag/conv v0.27.0 // indirect
60+
github.com/go-openapi/swag/fileutils v0.26.1 // indirect
61+
github.com/go-openapi/swag/jsonname v0.26.1 // indirect
62+
github.com/go-openapi/swag/jsonutils v0.26.1 // indirect
63+
github.com/go-openapi/swag/loading v0.26.1 // indirect
64+
github.com/go-openapi/swag/mangling v0.26.1 // indirect
65+
github.com/go-openapi/swag/netutils v0.26.1 // indirect
66+
github.com/go-openapi/swag/stringutils v0.26.1 // indirect
67+
github.com/go-openapi/swag/typeutils v0.27.0 // indirect
68+
github.com/go-openapi/swag/yamlutils v0.26.1 // indirect
69+
github.com/go-openapi/validate v0.26.0 // indirect
7070
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
7171
github.com/google/certificate-transparency-go v1.3.3 // indirect
7272
github.com/google/uuid v1.6.0 // indirect
@@ -85,8 +85,8 @@ require (
8585
github.com/rivo/uniseg v0.4.7 // indirect
8686
github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect
8787
github.com/shibumi/go-pathspec v1.3.0 // indirect
88-
github.com/sigstore/rekor v1.5.2 // indirect
89-
github.com/sigstore/rekor-tiles/v2 v2.2.2-0.20260601073857-5d098a2b6443 // indirect
88+
github.com/sigstore/rekor v1.5.3 // indirect
89+
github.com/sigstore/rekor-tiles/v2 v2.3.0 // indirect
9090
github.com/sigstore/sigstore v1.10.8 // indirect
9191
github.com/sigstore/timestamp-authority/v2 v2.1.2 // indirect
9292
github.com/sirupsen/logrus v1.9.4 // indirect
@@ -98,15 +98,15 @@ require (
9898
go.opentelemetry.io/otel v1.44.0 // indirect
9999
go.opentelemetry.io/otel/metric v1.44.0 // indirect
100100
go.opentelemetry.io/otel/trace v1.44.0 // indirect
101-
golang.org/x/crypto v0.52.0 // indirect
101+
golang.org/x/crypto v0.53.0 // indirect
102102
golang.org/x/mod v0.37.0 // indirect
103-
golang.org/x/net v0.55.0 // indirect
103+
golang.org/x/net v0.56.0 // indirect
104104
golang.org/x/sync v0.21.0 // indirect
105-
golang.org/x/sys v0.46.0 // indirect
106-
golang.org/x/text v0.37.0 // indirect
105+
golang.org/x/sys v0.47.0 // indirect
106+
golang.org/x/text v0.38.0 // indirect
107107
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
108108
google.golang.org/genproto/googleapis/rpc v0.0.0-20260523011958-0a33c5d7ca68 // indirect
109-
google.golang.org/grpc v1.81.1 // indirect
109+
google.golang.org/grpc v1.82.0 // indirect
110110
google.golang.org/protobuf v1.36.11 // indirect
111111
gotest.tools/v3 v3.5.2 // indirect
112112
k8s.io/klog/v2 v2.140.0 // indirect

0 commit comments

Comments
 (0)