Update go modules (release-v0.7) (minor) by renovate[bot] · Pull Request #3157 · conforma/cli

renovate · 2026-03-04T02:21:22Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
cuelang.org/go	`v0.13.2` → `v0.16.0`	require	minor
cuelang.org/go	`v0.11.2` → `v0.16.0`	require	minor
github.com/CycloneDX/cyclonedx-go	`v0.9.3` → `v0.10.0`	require	minor
github.com/conforma/go-containerregistry	`6f40a37` → `3459088`	replace	digest
github.com/cyberphone/json-canonicalization	`ba74d44` → `19d51d7`	require	digest
github.com/daixiang0/gci	`v0.13.7` → `v0.14.0`	require	minor
github.com/docker/docker	`v28.3.3+incompatible` → `v28.5.2+incompatible`	require	minor
github.com/go-git/go-billy/v5	`v5.6.2` → `v5.8.0`	require	minor
github.com/go-git/go-git/v5	`v5.16.5` → `v5.17.0`	require	minor
github.com/go-openapi/strfmt	`v0.23.0` → `v0.25.0`	require	minor
github.com/golangci/golangci-lint	`v1.63.4` → `v1.64.8`	require	minor
github.com/google/addlicense	`v1.1.1` → `v1.2.0`	require	minor
github.com/google/go-containerregistry	`v0.20.7` → `v0.21.2`	require	minor
github.com/in-toto/in-toto-golang	`v0.9.0` → `v0.10.0`	require	minor
github.com/in-toto/in-toto-golang	`v0.9.1-0.20240317085821-8e2966059a09` → `v0.10.0`	require	minor
github.com/konflux-ci/application-api	`e7eb2ec` → `5400350`	require	digest
github.com/open-policy-agent/conftest	`v0.62.0` → `v0.66.0`	require	minor
github.com/open-policy-agent/opa	`v1.6.0` → `v1.14.0`	require	minor
github.com/pkg/diff	`20ebb0f` → `4e6772a`	require	digest
github.com/secure-systems-lab/go-securesystemslib	`v0.9.1` → `v0.10.0`	require	minor
github.com/sigstore/cosign/v2	`v2.4.1` → `v2.6.2`	require	minor
github.com/sigstore/rekor	`v1.3.10` → `v1.5.0`	require	minor
github.com/sigstore/sigstore	`v1.9.1` → `v1.10.4`	require	minor
github.com/spf13/afero	`v1.14.0` → `v1.15.0`	require	minor
github.com/spf13/cobra	`v1.9.1` → `v1.10.2`	require	minor
github.com/spf13/viper	`v1.20.1` → `v1.21.0`	require	minor
github.com/tektoncd/chains	`v0.22.3` → `v0.26.2`	require	minor
github.com/tektoncd/cli	`v0.38.2` → `v0.44.0`	require	minor
github.com/testcontainers/testcontainers-go	`v0.34.1` → `v0.40.0`	require	minor
github.com/testcontainers/testcontainers-go/modules/registry	`v0.34.0` → `v0.40.0`	require	minor
github.com/wiremock/go-wiremock	`v1.11.0` → `v1.15.0`	require	minor
golang.org/x/benchmarks	`a2b48b6` → `cb323f9`	require	digest
golang.org/x/exp	`7e4ce0a` → `3dfff04`	require	digest
golang.org/x/exp	`2d47ceb` → `3dfff04`	require	digest
golang.org/x/net	`v0.47.0` → `v0.51.0`	require	minor
golang.org/x/sync	`v0.18.0` → `v0.19.0`	require	minor
gotest.tools/gotestsum	`v1.12.3` → `v1.13.0`	require	minor
helm.sh/helm/v3	`v3.18.6` → `v3.20.0`	require	minor
k8s.io/api	`v0.34.3` → `v0.35.2`	require	minor
k8s.io/apiextensions-apiserver	`v0.34.3` → `v0.35.2`	require	minor
k8s.io/apimachinery	`v0.34.3` → `v0.35.2`	require	minor
k8s.io/client-go	`v0.34.3` → `v0.35.2`	require	minor
k8s.io/kube-openapi	`f3f2b99` → `a19766b`	require	digest
k8s.io/kubernetes	`v1.34.3` → `v1.35.2`	require	minor
sigs.k8s.io/kind	`v0.26.0` → `v0.31.0`	require	minor
sigs.k8s.io/kustomize/api	`v0.20.1` → `v0.21.1`	require	minor
sigs.k8s.io/kustomize/kustomize/v5	`v5.7.1` → `v5.8.1`	require	minor
sigs.k8s.io/kustomize/kyaml	`v0.20.1` → `v0.21.1`	require	minor

Release Notes

cue-lang/cue (cuelang.org/go)

`v0.16.0`

Compare Source

Changes which may break some users are marked below with: ⚠️

Language

As a reminder, we have two ongoing language experiments since v0.15; a replacement for struct embedding and a rework of aliases. Please give these a try and report any issues or feedback!

⚠️ The cmdreferencepkg global experiment is now stable, meaning that CUE_EXPERIMENT=cmdreferencepkg is always enabled.

#"""# is now accepted as a string literal quoting a double quote, ".

Multiline string literals now require a trailing newline, matching the language spec.

The new `try` experiment

This release introduces the try experiment, which adds a try clause in comprehensions as well as the use of ? in field selectors. This addition to the language is intended to provide a more concise syntax for handling optional fields without the risk of unintentionally swallowing errors.

This experiment also introduces the else clause for if and try comprehensions, and the fallback clause for for comprehensions, which trigger when a comprehension produces zero values.

You can try this experiment by following our how-to guides on the try clause and the else clause. For more information, see the proposal on GitHub and the spec change patch.

Evaluator

Performance

Further improve the use of caching in the typochecker algorithm; this provides speed-ups of up to 80% on some large projects.

Very large structs (tested with 20,000 fields) are up to 80% faster now, as we were repeating some work unnecessarily.

A great deal of effort has gone into reducing the allocations and memory usage across a number of projects. For some of these, memory usage is down by as much as 60%.

These improvements were possible thanks to our Unity service, letting us analyze CUE's performance and test for regressions on third party projects. Contact @mvdan on Discord, Slack, or via the Unity page to ensure that your project is included or you are running into slowness.

A number of changes were made to improve support for using cue.Values concurrently; see Issue #2733 for more details and ongoing progress.

Other changes

Fix a regression introduced in v0.13 where the or built-in with literal arguments could stop behaving like a disjunction.

A number of panics and other bugs in the evaluator which were reported since v0.15.0 have been fixed; thank you to all who reported these.

`cmd/cue`

Add support for $DOCKER_AUTH_CONFIG to directly provide the contents of $DOCKER_CONFIG/config.json to authenticate with module registries, matching Docker's current behavior.

The --outfile flag now works when given non-regular files such as named pipes or sockets.

⚠️ cue mod publish no longer ignores sub-directories containing a go.mod file.

⚠️ Using cue inside the cue.mod directory now fails consistently with a clear error message to not place CUE code there. Previously, some commands worked while others failed with confusing errors.

⚠️ The global --verbose and --trace flags have been moved to the cue get go and cue trim commands respectively, as they were the only ones actually using those flags, and this could be confusing to users.

Fix a bug where loading ./...:pkgname could lead to loading directories without CUE files as instances, which could cause poor performance for CUE packages with multiple parent directories.

cue exp writefs gains an encoding optional field for regular files, to specify an encoding rather than infer it from the filename extension.

LSP server

Initial LSP support for editing embedded JSON and YAML files. This feature provides completions and hover-docs when editing JSON or YAML files which are embedded into CUE via the @embed attribute. A teaser video is available on YouTube.

Code Actions: two code actions are now provided, Add surrounding struct braces and Remove surrounding struct braces, which convert between

a: b: c

and

a: {
	b: c
}

with the cursor on b.

A complete overhaul of how the LSP server suggests code completions. This solves the previous naïve implementation which would only make suggestions after a field name or path had been started. Now completions are available from within whitespace.

Embedded paths with mutual dependencies: embedded paths with multiple components (e.g. a.b.c) can in some cases only be fully resolved after the resolution of other embedded paths. The LSP server can now correctly handle these dependencies.

The LSP server now implements LSP Document Symbols functionality. This is often used by editors to provide light-weight breadcrumb navigation within a file.

Some preliminary diagnostics are now sent from the LSP server back to the editor. Initially this mainly indicates syntax errors in CUE files, but this can be extended in the future.

Many bug fixes, including better behaviour for files and directories with spaces; improvements for value aliases (foo: L=x); LSP rename now provides placeholder text; improved jump-to-definition behaviour for package-level fields; fixed issues around imports; path resolution; formatting of standalone CUE files; and others.

See our Getting Started wiki page for instructions on how to set it up with your editor.

Please report any bugs or missing features you encounter via the Issue tracker or via the #lsp channels on Discord or Slack.

Encodings

Add support for encoding YAML tags like key: !Custom value by using CUE attributes like key: "value" @yaml(,tag="!Custom").

cue get go now detects which Go packages use Kubernetes type semantics via // +k8s:openapi-gen=true and obeys the field annotations // +optional and // +nullable.

cue get go gains a --codec flag to configure the use and priority of Go struct field tags like json or yaml.

Fix a bug where cue get go could skip over fields whose type implements one of the supported marshaling interfaces.

Fix a few bugs where cue get go could result in invalid or failing CUE code.

JSON Schema's Config.OpenOnlyWhenExplicit option is now exposed for the CLI via the filetype tag jsonschema+openOnlyWhenExplicit.

JSON Schema now properly encodes hash references for better compatibility with other tools.

Standard library

The strconv package adds ParseNumber, like ParseInt or ParseFloat but allowing other CUE number strings such as 1Ki.

The net package adds InCIDR to test whether an IP is contained by a CIDR string.

The net package adds ParseCIDR to extract useful information from a CIDR string.

The net package adds CompareIP to compare two IP addresses, which can be useful for computing with IP ranges.

The net/http package adds Serve as an experimental API to listen on a port and serve HTTP requests.

The tool/file package adds Symlink to create symbolic links.

Go API

cue.Value.Decode now supports the new cue.Unmarshaler interface, allowing Go types to implement their own CUE value decoding logic via an UnmarshalCUE(cue.Value) error method.

The new cue.IsIncomplete function reports whether the given value is a CUE incomplete error.

cue/ast gains the NewPredeclared and Ident.IsPredeclared to mark and detect identifiers referencing predeclared names like error or int rather than fields which may shadow those names in the current scope.

⚠️ cue.Value.Decode now uses cue.IsIncomplete to not treat incomplete errors as fatal, allowing the decoding to continue.

Fix a bug where cue.Value.Decode could behave incorrectly when decoding a CUE null or incomplete value.

⚠️ cue/token.Compare now sorts absolute paths before relative ones, to ensure consistent behavior between Unix-like systems and Windows.

⚠️ The long-deprecated cue/ast.Node.Comments and cue/ast.Node.AddComment interface methods are now removed; use cue/ast.Comments and cue/ast.AddComment respectively.

⚠️ The long-deprecated and unused cue/parser.FromVersion and cue/parser.DeprecationError APIs are now removed.

⚠️ The long-deprecated and hidden cue.Instance.Eval method is now removed.

Full list of changes since v0.15.0

internal/ci: use OIDC with the Central Registry for the e2e tests by @mvdan in de47a5e
re-enable staticcheck's SA4000 and SA4003 checks by @mvdan in 771e253
internal: bump staticcheck to v0.7.0 for Go 1.26 support by @mvdan in e1de78e
lsp/eval: correct resolution of package-level fields by @cuematthew in e3306a9
lsp/eval: add test showing bad behaviour by @cuematthew in da5d43a
lsp/server: make "Remove surrounding struct braces" preferred by @cuematthew in 5f20a71
doc/ref: clarify who maintains this document by @mvdan in 3ee970f
allow more commands in Claude by @mvdan in 6d50284
lspaux/protocol: initial implementation for protocol by @cuematthew in 3ee106b
cue/load: check some errors that were ignored by @rogpeppe in 13fdcdb
doc/ref: fix three mistakes in the matchIf examples by @mvdan in 000506e
cue/load: do not panic when load.Instances(args, nil) fails very early by @mvdan in cd6a481
cmd/cue: add a test case for issue 4286 by @mvdan in edc89df
lsp/eval: add support for comprehension else/fallback by @cuematthew in e2d8f7b
cmd/cue: support explicit encodings in exp writefs by @mvdan in d0eca3f
cmd/cue: rewrite exp writefs with internal/filetypes and internal/encoding by @mvdan in 766668d
cmd/cue: add first exp writefs testscript by @mvdan in 00eddbf
internal/core/adt: missed missing missing by @mpvl in 8732213
cue/parser: simplify else/fallback clause rules by @mpvl in 0cbc9a1
cue/parser: restrict else to single clause only by @mpvl in 28f0246
cue: add fallback keyword for for comprehensions by @mpvl in fe9f503
cue/testdata: rename out/eval to out/evalalpha when appropriate by @rogpeppe in c76dc5a
cue/build: fix stale identifier resolution across instances by @mvdan in dd7361a
cmd/cue: add regression test for issue 4275 by @mvdan in 791e697
encoding/yaml: improve ast.StructLit and ListLit positions by @cuematthew in cde471e
cmd/cue: be more helpful when publishing a module without source by @mvdan in 3dfa50a
encoding/jsonschema: remove net/url.Parse workaround for Go 1.26 by @mvdan in 6cce9bc
internal/core/export: fix self-referential lets for recursive definitions by @mvdan in c257634
internal/core/compile: avoid double error for invalid optional references by @mpvl in c1be2bb
update all dependencies by @mvdan in 9fb0173
internal/core/adt: add regression test for error() in pattern constraint keys by @mvdan in 50a0a5e
internal/core/adt: fix structural cycle hang with braced selectors by @mvdan in 36702fd
cmd/cue: add and unskip tests for invalid task type errors by @mvdan in db4afc1
internal/core/dep: fix stack overflow on recursive definitions in dep analysis by @mvdan in 0b49a54
internal/core/dep,internal/core/export: fix stack overflow on recursive definitions by @mvdan in d0e2ab6
tools/flow: skip phantom tasks from eliminated conditional branches by @mvdan in 7fb912e
encoding/gocode: fix test by @rogpeppe in 98ca6e3
internal/core: remove import path to instance mapping by @rogpeppe in b3d9ffc
doc/spec: use "custom errors" instead of "user errors" by @myitcv in baf8302
internal/ci: explicitly set contents permission by @myitcv in 7cde504
lsp/eval: Add support for try-clauses and optional path components by @cuematthew in 62de631
cue/testdata: update stats for comprehensions/try.txtar by @mvdan in 20c1149
internal/core/adt: implement try expressions by @mpvl in f2e8299
cue/build: integrate identifier resolution into Complete by @mpvl in 1aeb33e
lsp/fscache: ignore ASTs which have no absolute positions by @cuematthew in 2585b3b
cue/ast,cue/ast/astutil: add NewPredeclared and IsPredeclared for builtin references by @mpvl in 8405422
internal/core/adt: fix else clause duplication in comprehension field splitting by @mvdan in 40356ab
cue/load: improve error for major-only version packages outside a module by @mvdan in 7675369
cmd/cue/cmd: add test coverage for absolute packages with cue cmd by @mvdan in f5e266a
encoding/yaml: add support for YAML tags via @yaml(,tag) attribute by @jonas-meyer in b1a58bd
internal/astinternal: omit ILLEGAL tokens in debug print by @mpvl in 23736eb
cue: clarify that Schema is only useful for Value.Subsume by @mvdan in bb18d7b
lsp/cache: expand completion range of fields in json for double-quotes by @cuematthew in b1c63da
all: start using "else" in comprehensions by @mvdan in 3f2f654
tweak Claude's allow and deny settings further by @mvdan in ef6bb80
internal/ci: disable checkout persist-credentials by default by @myitcv in 069eac9
cue/load: do not load non-CUE directories as instances by @rogpeppe in a4d2a6f
cue/load: add test case for non-package directories by @rogpeppe in 028411e
cmd/cue: deflake cue_after test by @rogpeppe in 4504db0
all: use reflect.TypeAssert in three more places by @mvdan in 58cbd0c
cue/internal: Make ToFile optionally preserve StructLits by @cuematthew in ec3e289
all: re-apply go fix -any=false ./... after Go version bump by @mvdan in 8579c46
lsp/cache: completions must not return null items list by @cuematthew in 75ee97a
internal/core/export: fix panic in relPathLength for BinaryExpr by @mvdan in 788eeed
tools/fix: use ast.Predeclared to avoid shadowing in value alias conversion by @mvdan in 08a7ec3
cue/ast,cue/ast/astutil: add Predeclared sentinel for builtin references by @mvdan in 42cc85f
tools/fix: add tests for value alias conversion when "self" is in scope by @mvdan in 3dacb0c
cue/ast/astutil: fix false positive in label expression check for let clauses by @mvdan in a93bcc1
cmd/cue/cmd: add failing test for issue #4202 by @mvdan in 0a4a11a
internal/core/export: avoid let name collisions with dependency fields by @mvdan in f2b697a
internal/core/export: add failing test for issue #4221 by @mvdan in b690442
internal/core/adt: fix undefined field in comprehension with structural cycle by @mvdan in 225a1c4
cue/testdata: add regression test for issue #4203 by @mvdan in e3eb948
internal/core/adt: fix panic in memory reclamation by @mvdan in 355d6fd
internal/core/adt: add else clause to comprehensions by @mpvl in 9e2dec3
_scripts: add OpenSpec support for AI-assisted development by @mpvl in [6a78eff](https://redirect.github.com/cue-lang/cue/commit/6a78eff55d0ed36cea1dfcb3dbd6c

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-03-04T02:21:25Z

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

73 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.24.6` -> `1.25.6`
`github.com/tektoncd/pipeline`	`v0.70.0` -> `v1.9.1`
`cel.dev/expr`	`v0.24.0` -> `v0.25.1`
`cloud.google.com/go/kms`	`v1.21.1` -> `v1.23.2`
`cloud.google.com/go/longrunning`	`v0.6.5` -> `v0.7.0`
`github.com/Azure/go-ansiterm`	`v0.0.0-20230124172434-306776ec8161` -> `v0.0.0-20250102033503-faa5f7b0171c`
`github.com/containerd/stargz-snapshotter/estargz`	`v0.16.3` -> `v0.18.2`
`github.com/docker/cli`	`v28.2.2+incompatible` -> `v29.2.1+incompatible`
`github.com/docker/docker`	`v28.3.3+incompatible` -> `v28.5.2+incompatible`
`github.com/docker/go-connections`	`v0.5.0` -> `v0.6.0`
`github.com/fatih/color`	`v1.17.0` -> `v1.18.0`
`github.com/go-jose/go-jose/v4`	`v4.1.2` -> `v4.1.3`
`github.com/go-openapi/analysis`	`v0.23.0` -> `v0.24.1`
`github.com/go-openapi/errors`	`v0.22.1` -> `v0.22.6`
`github.com/go-openapi/jsonpointer`	`v0.21.0` -> `v0.22.4`
`github.com/go-openapi/jsonreference`	`v0.21.0` -> `v0.21.4`
`github.com/go-openapi/loads`	`v0.22.0` -> `v0.23.2`
`github.com/go-openapi/runtime`	`v0.28.0` -> `v0.29.2`
`github.com/go-openapi/spec`	`v0.21.0` -> `v0.22.3`
`github.com/go-openapi/swag`	`v0.23.1` -> `v0.25.4`
`github.com/golang/snappy`	`v0.0.4` -> `v1.0.0`
`github.com/google/cel-go`	`v0.26.0` -> `v0.27.0`
`github.com/google/certificate-transparency-go`	`v1.2.1` -> `v1.3.2`
`github.com/grpc-ecosystem/grpc-gateway/v2`	`v2.26.3` -> `v2.27.4`
`github.com/in-toto/attestation`	`v1.1.0` -> `v1.1.2`
`github.com/klauspost/compress`	`v1.18.2` -> `v1.18.4`
`github.com/letsencrypt/boulder`	`v0.0.0-20240830194243-1fcf0ee08180` -> `v0.20251110.0`
`github.com/lufia/plan9stats`	`v0.0.0-20240819163618-b1d8f4d146e7` -> `v0.0.0-20251013123823-9fd1530e3ec3`
`github.com/magiconair/properties`	`v1.8.7` -> `v1.8.10`
`github.com/mattn/go-colorable`	`v0.1.13` -> `v0.1.14`
`github.com/mitchellh/mapstructure`	`v1.5.0` -> `v1.5.1-0.20231216201459-8508981c8b6c`
`github.com/moby/term`	`v0.5.0` -> `v0.5.2`
`github.com/open-policy-agent/opa`	`v1.6.0` -> `v1.8.0`
`github.com/prometheus/common`	`v0.66.1` -> `v0.67.5`
`github.com/prometheus/procfs`	`v0.16.1` -> `v0.17.0`
`github.com/sagikazarmark/locafero`	`v0.7.0` -> `v0.11.0`
`github.com/sigstore/protobuf-specs`	`v0.4.1` -> `v0.5.0`
`github.com/sourcegraph/conc`	`v0.3.0` -> `v0.3.1-0.20240121214520-5f936abd7ae8`
`github.com/spf13/afero`	`v1.12.0` -> `v1.15.0`
`github.com/spf13/cast`	`v1.7.1` -> `v1.10.0`
`github.com/spf13/cobra`	`v1.9.1` -> `v1.10.2`
`github.com/spf13/pflag`	`v1.0.7` -> `v1.0.10`
`github.com/spf13/viper`	`v1.20.1` -> `v1.21.0`
`github.com/tklauser/go-sysconf`	`v0.3.14` -> `v0.3.16`
`github.com/tklauser/numcpus`	`v0.8.0` -> `v0.11.0`
`github.com/vbatts/tar-split`	`v0.12.1` -> `v0.12.2`
`go.mongodb.org/mongo-driver`	`v1.16.1` -> `v1.17.6`
`go.opentelemetry.io/auto/sdk`	`v1.1.0` -> `v1.2.1`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.61.0` -> `v0.64.0`
`go.opentelemetry.io/otel`	`v1.37.0` -> `v1.40.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`	`v1.36.0` -> `v1.37.0`
`go.opentelemetry.io/otel/metric`	`v1.37.0` -> `v1.40.0`
`go.opentelemetry.io/otel/trace`	`v1.37.0` -> `v1.40.0`
`go.uber.org/zap`	`v1.27.0` -> `v1.27.1`
`go.yaml.in/yaml/v2`	`v2.4.2` -> `v2.4.3`
`golang.org/x/crypto`	`v0.45.0` -> `v0.48.0`
`golang.org/x/mod`	`v0.29.0` -> `v0.33.0`
`golang.org/x/net`	`v0.47.0` -> `v0.50.0`
`golang.org/x/oauth2`	`v0.30.0` -> `v0.35.0`
`golang.org/x/sync`	`v0.18.0` -> `v0.19.0`
`golang.org/x/sys`	`v0.38.0` -> `v0.41.0`
`golang.org/x/term`	`v0.37.0` -> `v0.40.0`
`golang.org/x/text`	`v0.31.0` -> `v0.34.0`
`gomodules.xyz/jsonpatch/v2`	`v2.4.0` -> `v2.5.0`
`google.golang.org/api`	`v0.228.0` -> `v0.260.0`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20250804133106-a7a43d27e69b` -> `v0.0.0-20251222181119-0a764e51fe1b`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20250804133106-a7a43d27e69b` -> `v0.0.0-20251222181119-0a764e51fe1b`
`google.golang.org/grpc`	`v1.76.0` -> `v1.78.0`
`google.golang.org/protobuf`	`v1.36.10` -> `v1.36.11`
`gopkg.in/evanphx/json-patch.v4`	`v4.12.0` -> `v4.13.0`
`k8s.io/kube-openapi`	`v0.0.0-20250710124328-f3f2b991d03b` -> `v0.0.0-20250910181357-589584f1c912`
`k8s.io/utils`	`v0.0.0-20250604170112-4c0f3b243397` -> `v0.0.0-20251002143259-bc988d571ff4`
`knative.dev/pkg`	`v0.0.0-20250117084104-c43477f0052b` -> `v0.0.0-20250415155312-ed3e2158b883`
`sigs.k8s.io/json`	`v0.0.0-20241014173422-cfa47c3a1cc8` -> `v0.0.0-20250730193827-2d320260d730`

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

109 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.24.6` -> `1.25.3`
`cel.dev/expr`	`v0.24.0` -> `v0.25.1`
`cloud.google.com/go`	`v0.118.3` -> `v0.121.6`
`cloud.google.com/go/auth`	`v0.15.0` -> `v0.18.0`
`cloud.google.com/go/compute/metadata`	`v0.7.0` -> `v0.9.0`
`cloud.google.com/go/iam`	`v1.4.1` -> `v1.5.3`
`cloud.google.com/go/monitoring`	`v1.24.0` -> `v1.24.3`
`cloud.google.com/go/storage`	`v1.50.0` -> `v1.57.1`
`github.com/Azure/go-ansiterm`	`v0.0.0-20230124172434-306776ec8161` -> `v0.0.0-20250102033503-faa5f7b0171c`
`github.com/BurntSushi/toml`	`v1.5.0` -> `v1.6.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.29.0` -> `v1.30.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric`	`v0.49.0` -> `v0.54.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping`	`v0.49.0` -> `v0.54.0`
`github.com/ProtonMail/go-crypto`	`v1.1.6` -> `v1.3.0`
`github.com/aws/aws-sdk-go`	`v1.55.6` -> `v1.55.8`
`github.com/aws/aws-sdk-go-v2`	`v1.36.3` -> `v1.41.0`
`github.com/aws/aws-sdk-go-v2/config`	`v1.29.10` -> `v1.32.5`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.17.63` -> `v1.19.5`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.16.30` -> `v1.18.16`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.3.34` -> `v1.4.16`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.6.34` -> `v2.7.16`
`github.com/aws/aws-sdk-go-v2/internal/ini`	`v1.8.3` -> `v1.8.4`
`github.com/aws/aws-sdk-go-v2/service/ecr`	`v1.32.2` -> `v1.45.1`
`github.com/aws/aws-sdk-go-v2/service/ecrpublic`	`v1.25.4` -> `v1.33.2`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.12.3` -> `v1.13.4`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.12.15` -> `v1.13.16`
`github.com/cenkalti/backoff/v5`	`v5.0.2` -> `v5.0.3`
`github.com/cncf/xds/go`	`v0.0.0-20250501225837-2ac532fd4443` -> `v0.0.0-20251210132809-ee656c7534f5`
`github.com/containerd/containerd/v2`	`v2.2.0` -> `v2.2.1`
`github.com/containerd/stargz-snapshotter/estargz`	`v0.16.3` -> `v0.18.1`
`github.com/coreos/go-oidc/v3`	`v3.12.0` -> `v3.17.0`
`github.com/cyberphone/json-canonicalization`	`v0.0.0-20231217050601-ba74d44ecf5f` -> `v0.0.0-20241213102144-19d51d7fe467`
`github.com/cyphar/filepath-securejoin`	`v0.4.1` -> `v0.5.1`
`github.com/dgraph-io/badger/v4`	`v4.7.0` -> `v4.9.1`
`github.com/docker/cli`	`v28.2.2+incompatible` -> `v29.0.3+incompatible`
`github.com/docker/go-connections`	`v0.5.0` -> `v0.6.0`
`github.com/envoyproxy/go-control-plane/envoy`	`v1.32.4` -> `v1.36.0`
`github.com/envoyproxy/protoc-gen-validate`	`v1.2.1` -> `v1.3.0`
`github.com/go-git/go-billy/v5`	`v5.6.2` -> `v5.8.0`
`github.com/go-jose/go-jose/v4`	`v4.1.2` -> `v4.1.3`
`github.com/go-openapi/analysis`	`v0.23.0` -> `v0.24.1`
`github.com/go-openapi/errors`	`v0.22.1` -> `v0.22.6`
`github.com/go-openapi/jsonpointer`	`v0.21.0` -> `v0.22.4`
`github.com/go-openapi/jsonreference`	`v0.21.0` -> `v0.21.4`
`github.com/go-openapi/loads`	`v0.22.0` -> `v0.23.2`
`github.com/go-openapi/runtime`	`v0.28.0` -> `v0.29.2`
`github.com/go-openapi/spec`	`v0.21.0` -> `v0.22.3`
`github.com/go-openapi/swag`	`v0.23.1` -> `v0.25.4`
`github.com/google/cel-go`	`v0.26.0` -> `v0.26.1`
`github.com/google/certificate-transparency-go`	`v1.2.1` -> `v1.3.2`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.6` -> `v0.3.9`
`github.com/googleapis/gax-go/v2`	`v2.14.1` -> `v2.16.0`
`github.com/grpc-ecosystem/grpc-gateway/v2`	`v2.26.3` -> `v2.27.7`
`github.com/hashicorp/go-getter`	`v1.7.9` -> `v1.8.3`
`github.com/hashicorp/go-retryablehttp`	`v0.7.7` -> `v0.7.8`
`github.com/hashicorp/hcl`	`v1.0.1-vault-5` -> `v1.0.1-vault-7`
`github.com/mattn/go-runewidth`	`v0.0.16` -> `v0.0.19`
`github.com/mitchellh/mapstructure`	`v1.5.0` -> `v1.5.1-0.20231216201459-8508981c8b6c`
`github.com/moby/buildkit`	`v0.23.2` -> `v0.26.3`
`github.com/moby/term`	`v0.5.0` -> `v0.5.2`
`github.com/prometheus/common`	`v0.66.1` -> `v0.67.4`
`github.com/prometheus/procfs`	`v0.16.1` -> `v0.17.0`
`github.com/rcrowley/go-metrics`	`v0.0.0-20201227073835-cf1acfcdf475` -> `v0.0.0-20250401214520-65e299d6c5c9`
`github.com/sagikazarmark/locafero`	`v0.7.0` -> `v0.11.0`
`github.com/sigstore/fulcio`	`v1.6.3` -> `v1.8.4`
`github.com/sigstore/protobuf-specs`	`v0.4.1` -> `v0.5.0`
`github.com/sourcegraph/conc`	`v0.3.0` -> `v0.3.1-0.20240121214520-5f936abd7ae8`
`github.com/spf13/cast`	`v1.7.1` -> `v1.10.0`
`github.com/spiffe/go-spiffe/v2`	`v2.5.0` -> `v2.6.0`
`github.com/stoewer/go-strcase`	`v1.3.0` -> `v1.3.1`
`github.com/ulikunitz/xz`	`v0.5.12` -> `v0.5.15`
`github.com/vbatts/tar-split`	`v0.12.1` -> `v0.12.2`
`github.com/vektah/gqlparser/v2`	`v2.5.28` -> `v2.5.31`
`github.com/yusufpapurcu/wmi`	`v1.2.3` -> `v1.2.4`
`go.mongodb.org/mongo-driver`	`v1.16.1` -> `v1.17.6`
`go.opentelemetry.io/auto/sdk`	`v1.1.0` -> `v1.2.1`
`go.opentelemetry.io/contrib/detectors/gcp`	`v1.36.0` -> `v1.39.0`
`go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc`	`v0.60.0` -> `v0.63.0`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.61.0` -> `v0.65.0`
`go.opentelemetry.io/otel`	`v1.37.0` -> `v1.40.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace`	`v1.36.0` -> `v1.40.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`	`v1.36.0` -> `v1.40.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`	`v1.36.0` -> `v1.40.0`
`go.opentelemetry.io/otel/metric`	`v1.37.0` -> `v1.40.0`
`go.opentelemetry.io/otel/sdk`	`v1.37.0` -> `v1.40.0`
`go.opentelemetry.io/otel/sdk/metric`	`v1.37.0` -> `v1.40.0`
`go.opentelemetry.io/otel/trace`	`v1.37.0` -> `v1.40.0`
`go.opentelemetry.io/proto/otlp`	`v1.6.0` -> `v1.9.0`
`go.step.sm/crypto`	`v0.60.0` -> `v0.75.0`
`go.uber.org/zap`	`v1.27.0` -> `v1.27.1`
`go.yaml.in/yaml/v2`	`v2.4.2` -> `v2.4.3`
`golang.org/x/crypto`	`v0.45.0` -> `v0.48.0`
`golang.org/x/mod`	`v0.29.0` -> `v0.33.0`
`golang.org/x/oauth2`	`v0.30.0` -> `v0.35.0`
`golang.org/x/sys`	`v0.38.0` -> `v0.41.0`
`golang.org/x/term`	`v0.37.0` -> `v0.40.0`
`golang.org/x/text`	`v0.31.0` -> `v0.34.0`
`golang.org/x/tools`	`v0.38.0` -> `v0.42.0`
`google.golang.org/api`	`v0.228.0` -> `v0.260.0`
`google.golang.org/genproto`	`v0.0.0-20250303144028-a0af3efb3deb` -> `v0.0.0-20251202230838-ff82c1b0f217`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20250804133106-a7a43d27e69b` -> `v0.0.0-20260128011058-8636f8732409`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20250804133106-a7a43d27e69b` -> `v0.0.0-20260128011058-8636f8732409`
`google.golang.org/grpc`	`v1.76.0` -> `v1.79.1`
`google.golang.org/protobuf`	`v1.36.10` -> `v1.36.11`
`gopkg.in/evanphx/json-patch.v4`	`v4.12.0` -> `v4.13.0`
`gopkg.in/ini.v1`	`v1.67.0` -> `v1.67.1`
`k8s.io/api`	`v0.34.3` -> `v0.35.2`
`k8s.io/utils`	`v0.0.0-20250604170112-4c0f3b243397` -> `v0.0.0-20251002143259-bc988d571ff4`
`sigs.k8s.io/json`	`v0.0.0-20241014173422-cfa47c3a1cc8` -> `v0.0.0-20250730193827-2d320260d730`
`sigs.k8s.io/release-utils`	`v0.8.4` -> `v0.12.3`

File name: tools/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

206 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.24.6` -> `1.25.6`
`4d63.com/gocheckcompilerdirectives`	`v1.2.1` -> `v1.3.0`
`4d63.com/gochecknoglobals`	`v0.2.1` -> `v0.2.2`
`cel.dev/expr`	`v0.24.0` -> `v0.25.1`
`cloud.google.com/go`	`v0.116.0` -> `v0.121.6`
`cloud.google.com/go/auth`	`v0.13.0` -> `v0.18.0`
`cloud.google.com/go/auth/oauth2adapt`	`v0.2.6` -> `v0.2.8`
`cloud.google.com/go/compute/metadata`	`v0.7.0` -> `v0.9.0`
`cloud.google.com/go/firestore`	`v1.17.0` -> `v1.20.0`
`cloud.google.com/go/iam`	`v1.2.2` -> `v1.5.3`
`cloud.google.com/go/kms`	`v1.20.1` -> `v1.23.2`
`cloud.google.com/go/longrunning`	`v0.6.2` -> `v0.7.0`
`cloud.google.com/go/monitoring`	`v1.21.2` -> `v1.24.3`
`cloud.google.com/go/storage`	`v1.49.0` -> `v1.57.1`
`cuelang.org/go`	`v0.13.2` -> `v0.15.1`
`filippo.io/edwards25519`	`v1.1.0` -> `v1.1.1`
`github.com/4meepo/tagalign`	`v1.4.1` -> `v1.4.2`
`github.com/Azure/azure-sdk-for-go/sdk/azcore`	`v1.16.0` -> `v1.20.0`
`github.com/Azure/azure-sdk-for-go/sdk/azidentity`	`v1.8.0` -> `v1.13.1`
`github.com/Azure/azure-sdk-for-go/sdk/internal`	`v1.10.0` -> `v1.11.2`
`github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys`	`v1.1.0` -> `v1.4.0`
`github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal`	`v1.0.1` -> `v1.2.0`
`github.com/AzureAD/microsoft-authentication-library-for-go`	`v1.3.2` -> `v1.6.0`
`github.com/BurntSushi/toml`	`v1.5.0` -> `v1.6.0`
`github.com/Crocmagnon/fatcontext`	`v0.5.3` -> `v0.7.1`
`github.com/CycloneDX/cyclonedx-go`	`v0.9.2` -> `v0.9.3`
`github.com/GaijinEntertainment/go-exhaustruct/v3`	`v3.3.0` -> `v3.3.1`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.29.0` -> `v1.30.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric`	`v0.48.1` -> `v0.54.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping`	`v0.48.1` -> `v0.54.0`
`github.com/IBM/sarama`	`v1.43.3` -> `v1.45.2`
`github.com/Masterminds/semver/v3`	`v3.3.0` -> `v3.4.0`
`github.com/OpenPeeDeeP/depguard/v2`	`v2.2.0` -> `v2.2.1`
`github.com/ProtonMail/go-crypto`	`v1.0.0` -> `v1.3.0`
`github.com/alingse/nilnesserr`	`v0.1.1` -> `v0.1.2`
`github.com/aws/aws-sdk-go`	`v1.55.5` -> `v1.55.8`
`github.com/aws/aws-sdk-go-v2`	`v1.30.4` -> `v1.41.0`
`github.com/aws/aws-sdk-go-v2/config`	`v1.27.31` -> `v1.32.5`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.17.30` -> `v1.19.5`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.16.12` -> `v1.18.16`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.3.16` -> `v1.4.16`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.6.16` -> `v2.7.16`
`github.com/aws/aws-sdk-go-v2/internal/ini`	`v1.8.1` -> `v1.8.4`
`github.com/aws/aws-sdk-go-v2/service/ecr`	`v1.32.2` -> `v1.45.1`
`github.com/aws/aws-sdk-go-v2/service/ecrpublic`	`v1.25.4` -> `v1.33.2`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.11.4` -> `v1.13.4`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.11.18` -> `v1.13.16`
`github.com/aws/aws-sdk-go-v2/service/kms`	`v1.35.5` -> `v1.49.1`
`github.com/catenacyber/perfsprint`	`v0.7.1` -> `v0.8.2`
`github.com/containerd/containerd`	`v1.7.29` -> `v1.7.30`
`github.com/containerd/stargz-snapshotter/estargz`	`v0.16.3` -> `v0.18.2`
`github.com/coreos/go-oidc/v3`	`v3.11.0` -> `v3.17.0`
`github.com/cyberphone/json-canonicalization`	`v0.0.0-20231217050601-ba74d44ecf5f` -> `v0.0.0-20241213102144-19d51d7fe467`
`github.com/cyphar/filepath-securejoin`	`v0.4.1` -> `v0.6.1`
`github.com/docker/cli`	`v28.2.2+incompatible` -> `v29.2.1+incompatible`
`github.com/docker/docker`	`v28.2.2+incompatible` -> `v28.5.2+incompatible`
`github.com/envoyproxy/go-control-plane/envoy`	`v1.32.4` -> `v1.35.0`
`github.com/evanphx/json-patch/v5`	`v5.9.0` -> `v5.9.11`
`github.com/gdamore/tcell/v2`	`v2.7.4` -> `v2.9.0`
`github.com/ghostiam/protogetter`	`v0.3.8` -> `v0.3.9`
`github.com/go-chi/chi/v5`	`v5.1.0` -> `v5.2.4`
`github.com/go-critic/go-critic`	`v0.11.5` -> `v0.12.0`
`github.com/go-jose/go-jose/v4`	`v4.1.2` -> `v4.1.3`
`github.com/go-openapi/analysis`	`v0.23.0` -> `v0.24.1`
`github.com/go-openapi/errors`	`v0.22.0` -> `v0.22.6`
`github.com/go-openapi/jsonpointer`	`v0.21.0` -> `v0.22.4`
`github.com/go-openapi/jsonreference`	`v0.21.0` -> `v0.21.4`
`github.com/go-openapi/loads`	`v0.22.0` -> `v0.23.2`
`github.com/go-openapi/runtime`	`v0.28.0` -> `v0.29.2`
`github.com/go-openapi/spec`	`v0.21.0` -> `v0.22.3`
`github.com/go-openapi/strfmt`	`v0.23.0` -> `v0.25.0`
`github.com/go-openapi/swag`	`v0.23.0` -> `v0.25.4`
`github.com/go-viper/mapstructure/v2`	`v2.3.0` -> `v2.4.0`
`github.com/gofrs/flock`	`v0.12.1` -> `v0.13.0`
`github.com/golang-jwt/jwt/v5`	`v5.2.2` -> `v5.3.0`
`github.com/golang/snappy`	`v0.0.4` -> `v1.0.0`
`github.com/golangci/dupl`	`v0.0.0-20180902072040-3e9179ac440a` -> `v0.0.0-20250308024227-f665c8d69b32`
`github.com/golangci/gofmt`	`v0.0.0-20241223200906-057b0627d9b9` -> `v0.0.0-20250106114630-d62b90e6713d`
`github.com/golangci/revgrep`	`v0.5.3` -> `v0.8.0`
`github.com/google/cel-go`	`v0.26.0` -> `v0.27.0`
`github.com/google/certificate-transparency-go`	`v1.2.1` -> `v1.3.2`
`github.com/google/go-containerregistry`	`v0.20.2` -> `v0.21.0`
`github.com/google/s2a-go`	`v0.1.8` -> `v0.1.9`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.4` -> `v0.3.9`
`github.com/googleapis/gax-go/v2`	`v2.14.1` -> `v2.16.0`
`github.com/gostaticanalysis/comment`	`v1.4.2` -> `v1.5.0`
`github.com/gostaticanalysis/forcetypeassert`	`v0.1.0` -> `v0.2.0`
`github.com/grpc-ecosystem/grpc-gateway/v2`	`v2.26.3` -> `v2.27.4`
`github.com/hashicorp/go-getter`	`v1.7.9` -> `v1.8.3`
`github.com/hashicorp/go-retryablehttp`	`v0.7.7` -> `v0.7.8`
`github.com/hashicorp/go-secure-stdlib/parseutil`	`v0.1.8` -> `v0.2.0`
`github.com/hashicorp/go-sockaddr`	`v1.0.6` -> `v1.0.7`
`github.com/hashicorp/go-version`	`v1.7.0` -> `v1.8.0`
`github.com/hashicorp/hcl`	`v1.0.1-vault-5` -> `v1.0.1-vault-7`
`github.com/hashicorp/vault/api`	`v1.14.0` -> `v1.22.0`
`github.com/jellydator/ttlcache/v3`	`v3.3.0` -> `v3.4.0`
`github.com/jmespath/go-jmespath`	`v0.4.0` -> `v0.4.1-0.20220621161143-b0104c826a24`
`github.com/karamaru-alpha/copyloopvar`	`v1.1.0` -> `v1.2.1`
`github.com/kisielk/errcheck`	`v1.8.0` -> `v1.9.0`
`github.com/kkHAIKE/contextcheck`	`v1.1.5` -> `v1.1.6`
`github.com/klauspost/compress`	`v1.18.2` -> `v1.18.4`
`github.com/ktr0731/go-fuzzyfinder`	`v0.8.0` -> `v0.9.0`
`github.com/ldez/exptostd`	`v0.3.1` -> `v0.4.2`
`github.com/ldez/gomoddirectives`	`v0.6.0` -> `v0.6.1`
`github.com/ldez/grignotin`	`v0.7.0` -> `v0.9.0`
`github.com/lucasb-eyer/go-colorful`	`v1.2.0` -> `v1.3.0`
`github.com/mailru/easyjson`	`v0.7.7` -> `v0.9.0`
`github.com/matoous/godox`	`v0.0.0-20240105082147-c5b5e0e7c0c0` -> `v1.1.0`
`github.com/mattn/go-colorable`	`v0.1.13` -> `v0.1.14`
`github.com/mattn/go-runewidth`	`v0.0.16` -> `v0.0.19`
`github.com/mgechev/revive`	`v1.5.1` -> `v1.7.0`
`github.com/mitchellh/mapstructure`	`v1.5.0` -> `v1.5.1-0.20231216201459-8508981c8b6c`
`github.com/moby/buildkit`	`v0.23.2` -> `v0.26.3`
`github.com/nunnatsa/ginkgolinter`	`v0.18.4` -> `v0.19.1`
`github.com/pierrec/lz4/v4`	`v4.1.21` -> `v4.1.22`
`github.com/polyfloyd/go-errorlint`	`v1.7.0` -> `v1.7.1`
`github.com/prometheus/common`	`v0.66.1` -> `v0.67.5`
`github.com/prometheus/procfs`	`v0.16.1` -> `v0.17.0`
`github.com/rcrowley/go-metrics`	`v0.0.0-20201227073835-cf1acfcdf475` -> `v0.0.0-20250401214520-65e299d6c5c9`
`github.com/rubenv/sql-migrate`	`v1.8.0` -> `v1.8.1`
`github.com/sagikazarmark/locafero`	`v0.7.0` -> `v0.11.0`
`github.com/secure-systems-lab/go-securesystemslib`	`v0.8.0` -> `v0.10.0`
`github.com/securego/gosec/v2`	`v2.21.4` -> `v2.22.2`
`github.com/sergi/go-diff`	`v1.3.2-0.20230802210424-5b0b94c5c0d3` -> `v1.4.0`
`github.com/sigstore/cosign/v2`	`v2.4.0` -> `v2.6.2`
`github.com/sigstore/fulcio`	`v1.6.3` -> `v1.8.5`
`github.com/sigstore/protobuf-specs`	`v0.3.2` -> `v0.5.0`
`github.com/sigstore/rekor`	`v1.3.6` -> `v1.5.0`
`github.com/sigstore/sigstore`	`v1.8.8` -> `v1.10.4`
`github.com/sigstore/sigstore/pkg/signature/kms/aws`	`v1.8.8` -> `v1.10.3`
`github.com/sigstore/sigstore/pkg/signature/kms/azure`	`v1.8.8` -> `v1.10.3`
`github.com/sigstore/sigstore/pkg/signature/kms/gcp`	`v1.8.8` -> `v1.10.3`
`github.com/sigstore/sigstore/pkg/signature/kms/hashivault`	`v1.8.8` -> `v1.10.3`
`github.com/sourcegraph/conc`	`v0.3.0` -> `v0.3.1-0.20240121214520-5f936abd7ae8`
`github.com/spf13/afero`	`v1.12.0` -> `v1.15.0`
`github.com/spf13/cast`	`v1.7.1` -> `v1.10.0`
`github.com/spf13/cobra`	`v1.9.1` -> `v1.10.2`
`github.com/spf13/pflag`	`v1.0.7` -> `v1.0.10`
`github.com/spf13/viper`	`v1.20.1` -> `v1.21.0`
`github.com/spiffe/go-spiffe/v2`	`v2.5.0` -> `v2.6.0`
`github.com/stoewer/go-strcase`	`v1.3.0` -> `v1.3.1`
`github.com/tdakkota/asciicheck`	`v0.3.0` -> `v0.4.1`
`github.com/tektoncd/hub`	`v1.18.0` -> `v1.23.6`
`github.com/tektoncd/pipeline`	`v0.66.0` -> `v1.9.1`
`github.com/tektoncd/triggers`	`v0.29.1` -> `v0.35.0`
`github.com/tetafro/godot`	`v1.4.20` -> `v1.5.0`
`github.com/ulikunitz/xz`	`v0.5.12` -> `v0.5.15`
`github.com/uudashr/iface`	`v1.3.0` -> `v1.3.1`
`github.com/vbatts/tar-split`	`v0.12.1` -> `v0.12.2`
`github.com/vektah/gqlparser/v2`	`v2.5.28` -> `v2.5.31`
`go-simpler.org/sloglint`	`v0.7.2` -> `v0.9.0`
`go.mongodb.org/mongo-driver`	`v1.16.1` -> `v1.17.6`
`go.opentelemetry.io/auto/sdk`	`v1.1.0` -> `v1.2.1`
`go.opentelemetry.io/contrib/detectors/gcp`	`v1.36.0` -> `v1.38.0`
`go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc`	`v0.60.0` -> `v0.63.0`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.61.0` -> `v0.63.0`
`go.opentelemetry.io/otel`	`v1.37.0` -> `v1.40.0`
`go.opentelemetry.io/otel/metric`	`v1.37.0` -> `v1.40.0`
`go.opentelemetry.io/otel/sdk`	`v1.37.0` -> `v1.39.0`
`go.opentelemetry.io/otel/sdk/metric`	`v1.37.0` -> `v1.39.0`
`go.opentelemetry.io/otel/trace`	`v1.37.0` -> `v1.40.0`
`go.step.sm/crypto`	`v0.51.2` -> `v0.75.0`
`go.uber.org/zap`	`v1.27.0` -> `v1.27.1`
`go.yaml.in/yaml/v2`	`v2.4.2` -> `v2.4.3`
`goa.design/goa/v3`	`v3.18.2` -> `v3.23.4`
`gocloud.dev`	`v0.39.0` -> `v0.43.0`
`gocloud.dev/docstore/mongodocstore`	`v0.39.0` -> `v0.43.0`
`gocloud.dev/pubsub/kafkapubsub`	`v0.39.0` -> `v0.43.0`
`golang.org/x/crypto`	`v0.42.0` -> `v0.48.0`
`golang.org/x/exp`	`v0.0.0-20250408133849-7e4ce0ab07d0` -> `v0.0.0-20250911091902-df9299821621`
`golang.org/x/exp/typeparams`	`v0.0.0-20241108190413-2d47ceb2692f` -> `v0.0.0-20250210185358-939b2ce775ac`
`golang.org/x/mod`	`v0.29.0` -> `v0.33.0`
`golang.org/x/net`	`v0.44.0` -> `v0.50.0`
`golang.org/x/oauth2`	`v0.30.0` -> `v0.35.0`
`golang.org/x/sync`	`v0.17.0` -> `v0.19.0`
`golang.org/x/sys`	`v0.37.0` -> `v0.41.0`
`golang.org/x/term`	`v0.35.0` -> `v0.40.0`
`golang.org/x/text`	`v0.29.0` -> `v0.34.0`
`golang.org/x/tools`	`v0.37.0` -> `v0.42.0`
`gomodules.xyz/jsonpatch/v2`	`v2.4.0` -> `v2.5.0`
`google.golang.org/api`	`v0.215.0` -> `v0.260.0`
`google.golang.org/genproto`	`v0.0.0-20241118233622-e639e219e697` -> `v0.0.0-20251202230838-ff82c1b0f217`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20250804133106-a7a43d27e69b` -> `v0.0.0-20251222181119-0a764e51fe1b`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20250804133106-a7a43d27e69b` -> `v0.0.0-20251222181119-0a764e51fe1b`
`google.golang.org/grpc`	`v1.76.0` -> `v1.78.0`
`google.golang.org/protobuf`	`v1.36.10` -> `v1.36.11`
`gopkg.in/evanphx/json-patch.v4`	`v4.12.0` -> `v4.13.0`
`gopkg.in/ini.v1`	`v1.67.0` -> `v1.67.1`
`honnef.co/go/tools`	`v0.5.1` -> `v0.6.1`
`k8s.io/api`	`v0.34.2` -> `v0.35.0`
`k8s.io/apiextensions-apiserver`	`v0.34.2` -> `v0.35.0`
`k8s.io/apimachinery`	`v0.34.2` -> `v0.35.0`
`k8s.io/apiserver`	`v0.34.2` -> `v0.35.0`
`k8s.io/cli-runtime`	`v0.34.2` -> `v0.35.0`
`k8s.io/client-go`	`v0.34.2` -> `v0.35.0`
`k8s.io/component-base`	`v0.34.2` -> `v0.35.0`
`k8s.io/component-helpers`	`v0.34.2` -> `v0.35.0`
`k8s.io/kube-openapi`	`v0.0.0-20250710124328-f3f2b991d03b` -> `v0.0.0-20250910181357-589584f1c912`
`k8s.io/kubectl`	`v0.34.2` -> `v0.35.0`
`k8s.io/metrics`	`v0.34.2` -> `v0.35.0`
`k8s.io/utils`	`v0.0.0-20250604170112-4c0f3b243397` -> `v0.0.0-20251002143259-bc988d571ff4`
`knative.dev/pkg`	`v0.0.0-20240815051656-89743d9bbf7c` -> `v0.0.0-20250415155312-ed3e2158b883`
`sigs.k8s.io/json`	`v0.0.0-20241014173422-cfa47c3a1cc8` -> `v0.0.0-20250730193827-2d320260d730`
`sigs.k8s.io/kustomize/api`	`v0.20.1` -> `v0.21.1`
`sigs.k8s.io/kustomize/cmd/config`	`v0.20.1` -> `v0.21.1`
`sigs.k8s.io/kustomize/kyaml`	`v0.20.1` -> `v0.21.1`
`sigs.k8s.io/release-utils`	`v0.8.4` -> `v0.12.3`

File name: tools/kubectl/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

14 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.24.6` -> `1.25.0`
`github.com/spf13/cobra`	`v1.9.1` -> `v1.10.0`
`github.com/spf13/pflag`	`v1.0.6` -> `v1.0.9`
`go.opentelemetry.io/otel`	`v1.35.0` -> `v1.36.0`
`go.opentelemetry.io/otel/trace`	`v1.35.0` -> `v1.36.0`
`go.yaml.in/yaml/v2`	`v2.4.2` -> `v2.4.3`
`golang.org/x/net`	`v0.43.0` -> `v0.47.0`
`golang.org/x/sync`	`v0.17.0` -> `v0.18.0`
`golang.org/x/sys`	`v0.37.0` -> `v0.38.0`
`golang.org/x/term`	`v0.34.0` -> `v0.37.0`
`golang.org/x/text`	`v0.28.0` -> `v0.31.0`
`gopkg.in/evanphx/json-patch.v4`	`v4.12.0` -> `v4.13.0`
`k8s.io/kube-openapi`	`v0.0.0-20250710124328-f3f2b991d03b` -> `v0.0.0-20250910181357-589584f1c912`
`k8s.io/utils`	`v0.0.0-20250604170112-4c0f3b243397` -> `v0.0.0-20251002143259-bc988d571ff4`
`sigs.k8s.io/json`	`v0.0.0-20241014173422-cfa47c3a1cc8` -> `v0.0.0-20250730193827-2d320260d730`

Update go modules

2deccf9

renovate bot added release-v0.7 renovate labels Mar 4, 2026

github-actions bot added the size: XXL label Mar 4, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update go modules (release-v0.7) (minor)#3157

Update go modules (release-v0.7) (minor)#3157
renovate[bot] wants to merge 1 commit intorelease-v0.7from
renovate/release-v0.7-go-modules

renovate bot commented Mar 4, 2026

Uh oh!

renovate bot commented Mar 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Mar 4, 2026

Release Notes

v0.16.0

Language

The new try experiment

Evaluator

Performance

Other changes

cmd/cue

LSP server

Encodings

Standard library

Go API

Configuration

Uh oh!

renovate bot commented Mar 4, 2026

ℹ️ Artifact update notice

File name: acceptance/go.mod

File name: go.mod

File name: tools/go.mod

File name: tools/kubectl/go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v0.16.0`

The new `try` experiment

`cmd/cue`