🚨 Update go modules (main) (major) #3061

renovate · 2025-12-12T10:13:59Z

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/MakeNowJust/heredoc	`v1.0.0` -> `v2.0.1`
github.com/golangci/golangci-lint	`v1.63.4` -> `v2.7.2`
github.com/santhosh-tekuri/jsonschema/v5	`v5.3.1` -> `v6.0.2`
github.com/sigstore/cosign/v2	`v2.4.1` -> `v3.0.3`
github.com/tektoncd/pipeline	`v0.66.0` -> `v1.7.0`
gopkg.in/go-jose/go-jose.v2	`v2.6.3` -> `v4.1.3`
helm.sh/helm/v3	`v3.18.5` -> `v4.0.4`

Release Notes

MakeNowJust/heredoc (github.com/MakeNowJust/heredoc)

`v2.0.1`

Compare Source

Version 2.0.1

Fixes

Correct import path for Go modules

`v2.0.0`

Compare Source

Version 2.0.0

Breaking Changes

Treats only white space (U+0020) and horizontal tabs (U+000D) as space characters. (#6)

golangci/golangci-lint (github.com/golangci/golangci-lint)

`v2.7.2`

Compare Source

Released on 2025-12-07

Linter bug fixes
- gosec: from 2.22.10 to daccba6

`v2.7.1`

Compare Source

Released on 2025-12-04

Linter bug fixes
- modernize: disable stringscut analyzer

`v2.7.0`

Compare Source

Bug fixes
- fix: clone args used by custom command
Linters new features or changes
- no-sprintf-host-port: from 0.2.0 to 0.3.1 (ignore string literals without a colon)
- unqueryvet: from 1.2.1 to 1.3.0 (handles const and var declarations)
- revive: from 1.12.0 to 1.13.0 (new option: enable-default-rules, new rules: forbidden-call-in-wg-go, unnecessary-if, inefficient-map-lookup)
- modernize: from 0.38.0 to 0.39.0 (new analyzers: plusbuild, stringscut)
Linters bug fixes
- perfsprint: from 0.10.0 to 0.10.1
- wrapcheck: from 2.11.0 to 2.12.0
- godoc-lint: from 0.10.1 to 0.10.2
Misc.
- Add some flags to the custom command
Documentation
- docs: split changelog v1 and v2

`v2.6.2`

Compare Source

Released on 2025-11-14

Bug fixes
- fmt command with symlinks
- use file depending on build configuration to invalidate cache
Linters bug fixes
- testableexamples: from 1.0.0 to 1.0.1
- testpackage: from 1.1.1 to 1.1.2

`v2.6.1`

Compare Source

`v2.6.0`

Compare Source

New linters
- Add modernize analyzer suite
Linters new features or changes
- arangolint: from 0.2.0 to 0.3.1
- dupword: from 0.1.6 to 0.1.7 (new option comments-only)
- go-critic: from 0.13.0 to 0.14.0 (new rules/checkers: zeroByteRepeat, dupOption)
- gofumpt: from 0.9.1 to 0.9.2 ("clothe" naked returns is now controlled by the extra-rules option)
- perfsprint: from 0.9.1 to 0.10.0 (new options: concat-loop, loop-other-ops)
- wsl: from 5.2.0 to 5.3.0
Linters bug fixes
- dupword: from 0.1.6 to 0.1.7
- durationcheck: from 0.0.10 to 0.0.11
- exptostd: from 0.4.4 to 0.4.5
- fatcontext: from 0.8.1 to 0.9.0
- forbidigo: from 2.1.0 to 2.3.0
- ginkgolinter: from 0.21.0 to 0.21.2
- godoc-lint: from 0.10.0 to 0.10.1
- gomoddirectives: from 0.7.0 to 0.7.1
- gosec: from 2.22.8 to 2.22.10
- makezero: from 2.0.1 to 2.1.0
- nilerr: from 0.1.1 to 0.1.2
- paralleltest: from 1.0.14 to 1.0.15
- protogetter: from 0.3.16 to 0.3.17
- unparam: from 0df0534 to 5beb8c8
Misc.
- fix: ignore some files to hash the version for custom build

`v2.5.0`

Compare Source

New linters
- Add godoclint linter https://github.com/godoc-lint/godoc-lint
- Add unqueryvet linter https://github.com/MirrexOne/unqueryvet
- Add iotamixing linter https://github.com/AdminBenni/iota-mixing
Linters new features or changes
- embeddedstructfieldcheck: from 0.3.0 to 0.4.0 (new option: empty-line)
- err113: from aea10b5 to 0.1.1 (skip internals of Is methods for error type)
- ginkgolinter: from 0.20.0 to 0.21.0 (new option: force-tonot)
- gofumpt: from 0.8.0 to 0.9.1 (new rule is to "clothe" naked returns for the sake of clarity)
- ineffassign: from 0.1.0 to 0.2.0 (new option: check-escaping-errors)
- musttag: from 0.13.1 to 0.14.0 (support interface methods)
- revive: from 1.11.0 to 1.12.0 (new options: identical-ifelseif-branches, identical-ifelseif-conditions, identical-switch-branches, identical-switch-conditions, package-directory-mismatch, unsecure-url-scheme, use-waitgroup-go, useless-fallthrough)
- thelper: from 0.6.3 to 0.7.1 (skip t.Helper in functions passed to synctest.Test)
- wsl: from 5.1.1 to 5.2.0 (improvements related to subexpressions)
Linters bug fixes
- asciicheck: from 0.4.1 to 0.5.0
- errname: from 1.1.0 to 1.1.1
- fatcontext: from 0.8.0 to 0.8.1
- go-printf-func-name: from 0.1.0 to 0.1.1
- godot: from 1.5.1 to 1.5.4
- gosec: from 2.22.7 to 2.22.8
- nilerr: from 0.1.1 to a temporary fork
- nilnil: from 1.1.0 to 1.1.1
- protogetter: from 0.3.15 to 0.3.16
- tagliatelle: from 0.7.1 to 0.7.2
- testifylint: from 1.6.1 to 1.6.4
Misc.
- fix: "no export data" errors are now handled as a standard typecheck error
Documentation
- Improve nolint section about syntax

`v2.4.0`

Compare Source

Enhancements
- 🎉 go1.25 support
Linters new features or changes
- exhaustruct: from v3.3.1 to 4.0.0 (new options: allow-empty, allow-empty-rx, allow-empty-returns, allow-empty-declarations)
Linters bug fixes
- godox: trim filepath from report messages
- staticcheck: allow empty options
- tagalign: from 1.4.2 to 1.4.3
Documentation
- 🌟 New website (with a search engine)

`v2.3.1`

Compare Source

Linters bug fixes
- gci: from 0.13.6 to 0.13.7
- gosec: from 2.22.6 to 2.22.7
- noctx: from 0.3.5 to 0.4.0
- wsl: from 5.1.0 to 5.1.1
- tagliatelle: force upper case for custom initialisms

`v2.3.0`

Compare Source

Linters new features or changes
- ginkgolinter: from 0.19.1 to 0.20.0 (new option: force-assertion-description)
- iface: from 1.4.0 to 1.4.1 (report message improvements)
- noctx: from 0.3.4 to 0.3.5 (new detections: log/slog, exec, crypto/tls)
- revive: from 1.10.0 to 1.11.0 (new rule: enforce-switch-style)
- wsl: from 5.0.0 to 5.1.0
Linters bug fixes
- gosec: from 2.22.5 to 2.22.6
- noinlineerr: from 1.0.4 to 1.0.5
- sloglint: from 0.11.0 to 0.11.1
Misc.
- fix: panic close of closed channel

`v2.2.2`

Compare Source

Linters bug fixes
- noinlineerr: from 1.0.3 to 1.0.4
Documentation
- Improve debug keys documentation
Misc.
- fix: panic close of closed channel
- godot: add noinline value into the JSONSchema

`v2.2.1`

Compare Source

Linters bug fixes

varnamelen: fix configuration

`v2.2.0`

Compare Source

New linters
- Add arangolint linter https://github.com/Crocmagnon/arangolint
- Add embeddedstructfieldcheck linter https://github.com/manuelarte/embeddedstructfieldcheck
- Add noinlineerr linter https://github.com/AlwxSin/noinlineerr
- Add swaggo formatter https://github.com/golangci/swaggoswag
Linters new features or changes
- errcheck: add verbose option
- funcorder: from 0.2.1 to 0.5.0 (new option alphabetical)
- gomoddirectives: from 0.6.1 to 0.7.0 (new option ignore-forbidden)
- iface: from 1.3.1 to 1.4.0 (new option unexported)
- noctx: from 0.1.0 to 0.3.3 (new report messages, and new rules related to database/sql)
- noctx: from 0.3.3 to 0.3.4 (new SQL functions detection)
- revive: from 1.9.0 to 1.10.0 (new rules: time-date, unnecessary-format, use-fmt-print)
- usestdlibvars: from 1.28.0 to 1.29.0 (new option time-date-month)
- wsl: deprecation
- wsl_v5: from 4.7.0 to 5.0.0 (major version with new configuration)
Linters bug fixes
- dupword: from 0.1.3 to 0.1.6
- exptostd: from 0.4.3 to 0.4.4
- forbidigo: from 1.6.0 to 2.1.0
- gci: consistently format the code
- go-spancheck: from 0.6.4 to 0.6.5
- goconst: from 1.8.1 to 1.8.2
- gosec: from 2.22.3 to 2.22.4
- gosec: from 2.22.4 to 2.22.5
- makezero: from 1.2.0 to 2.0.1
- misspell: from 0.6.0 to 0.7.0
- usetesting: from 0.4.3 to 0.5.0
Misc.
- exclusions: fix path-expect
- formatters: write the input to stdout when using stdin and there are no changes
- migration: improve the error message when trying to migrate a migrated config
- typecheck: deduplicate errors
- typecheck: stops the analysis after the first error
- Deprecate print-resources-usage flag
- Unique version per custom build
Documentation
- Improves typecheck FAQ
- Adds plugin systems recommendations
- Add description for linters.default sets

`v2.1.6`

Compare Source

Linters bug fixes
- godot: from 1.5.0 to 1.5.1
- musttag: from 0.13.0 to 0.13.1
Documentation
- Add note about golangci-lint v2 integration in VS Code

`v2.1.5`

Compare Source

Due to an error related to Snapcraft, some artifacts of the v2.1.4 release have not been published.

This release contains the same things as v2.1.3.

`v2.1.4`

Compare Source

Due to an error related to Snapcraft, some artifacts of the v2.1.3 release have not been published.

This release contains the same things as v2.1.3.

`v2.1.3`

Compare Source

Linters bug fixes
- fatcontext: from 0.7.2 to 0.8.0
Misc.
- migration: fix nakedret.max-func-lines: 0
- migration: fix order of staticcheck settings
- fix: add go.mod hash to the cache salt
- fix: use diagnostic position for related information position

`v2.1.2`

Compare Source

Linters bug fixes
- exptostd: from 0.4.2 to 0.4.3
- gofumpt: from 0.7.0 to 0.8.0
- protogetter: from 0.3.13 to 0.3.15
- usetesting: from 0.4.2 to 0.4.3

`v2.1.1`

Compare Source

The release process of v2.1.0 failed due to a regression inside goreleaser.

The binaries of v2.1.0 have been published, but not the other artifacts (AUR, Docker, etc.).

`v2.1.0`

Compare Source

Enhancements
- Add an option to display absolute paths (--path-mode=abs)
- Add configuration path placeholder (${config-path})
- Add warn-unused option for fmt command
- Colored diff for fmt command (golangci-lint fmt --diff-colored)
New linters
- Add funcorder linter https://github.com/manuelarte/funcorder
Linters new features or changes
- go-errorlint: from 1.7.1 to 1.8.0 (automatic error comparison and type assertion fixes)
- ⚠️ goconst: ignore-strings is deprecated and replaced by ignore-string-values
- goconst: from 1.7.1 to 1.8.1 (new options: find-duplicates, eval-const-expressions)
- govet: add httpmux analyzer
- nilnesserr: from 0.1.2 to 0.2.0 (detect more cases)
- paralleltest: from 1.0.10 to 1.0.14 (checks only _test.go files)
- revive: from 1.7.0 to 1.9.0 (support kebab case for setting names)
- sloglint: from 0.9.0 to 0.11.0 (autofix, new option msg-style, suggest slog.DiscardHandler)
- wrapcheck: from 2.10.0 to 2.11.0 (new option report-internal-errors)
- wsl: from 4.6.0 to 4.7.0 (cgo files are always excluded)
Linters bug fixes
- fatcontext: from 0.7.1 to 0.7.2
- gocritic: fix importshadow checker
- gosec: from 2.22.2 to 2.22.3
- ireturn: from 0.3.1 to 0.4.0
- loggercheck: from 0.10.1 to 0.11.0
- nakedret: from 2.0.5 to 2.0.6
- nonamedreturns: from 1.0.5 to 1.0.6
- protogetter: from 0.3.12 to 0.3.13
- testifylint: from 1.6.0 to 1.6.1
- unconvert: update to HEAD
Misc.
- Fixes memory leaks when using go1.(N) with golangci-lint built with go1.(N-X)
- Adds golangci-lint-fmt pre-commit hook
Documentation
- Improvements
- Updates section about vscode integration

`v2.0.2`

Compare Source

Misc.
- Fixes flags parsing for formatters
- Fixes the filepath used by the exclusion source option
Documentation
- Adds a section about flags migration
- Cleaning pages with v1 options

`v2.0.1`

Compare Source

Linters/formatters bug fixes
- golines: fix settings during linter load
Misc.
- Validates the version field before the configuration
- forbidigo: fix migration

`v2.0.0`

Compare Source

Enhancements
- 🌟 New golangci-lint fmt command with dedicated formatter configuration
- ♻️ New golangci-lint migrate command to help migration from v1 to v2 (cf. Migration guide)
- ⚠️ New default values (cf. Migration guide)
- ⚠️ No exclusions by default (cf. Migration guide)
- ⚠️ New default sort order (cf. Migration guide)
- 🌟 New option run.relative-path-mode (cf. Migration guide)
- 🌟 New linters configuration (cf. Migration guide)
- 🌟 New output format configuration (cf. Migration guide)
- 🌟 New --fast-only flag (cf. Migration guide)
- 🌟 New option linters.exclusions.warn-unused to log a warning if an exclusion rule is unused.
New linters/formatters
- Add golines formatter https://github.com/segmentio/golines
Linters new features
- ⚠️ Merge staticcheck, stylecheck, gosimple into one linter (staticcheck) (cf. Migration guide)
- go-critic: from 0.12.0 to 0.13.0
- gomodguard: from 1.3.5 to 1.4.1 (block explicit indirect dependencies)
- nilnil: from 1.0.1 to 1.1.0 (new option: only-two)
- perfsprint: from 0.8.2 to 0.9.1 (checker name in the diagnostic message)
- staticcheck: new quickfix set of rules
- testifylint: from 1.5.2 to 1.6.0 (new options: equal-values, suite-method-signature, require-string-msg)
- wsl: from 4.5.0 to 4.6.0 (new option: allow-cuddle-used-in-block)
Linters bug fixes
- bidichk: from 0.3.2 to 0.3.3
- errchkjson: from 0.4.0 to 0.4.1
- errname: from 1.0.0 to 1.1.0
- funlen: fix ignore-comments option
- gci: from 0.13.5 to 0.13.6
- gosmopolitan: from 1.2.2 to 1.3.0
- inamedparam: from 0.1.3 to 0.2.0
- intrange: from 0.3.0 to 0.3.1
- protogetter: from 0.3.9 to 0.3.12
- unparam: from 8a5130c to 0df0534
Misc.
- 🧹 Configuration options renaming (cf. Migration guide)
- 🧹 Remove options (cf. Migration guide)
- 🧹 Remove flags (cf. Migration guide)
- 🧹 Remove alternative names (cf. Migration guide)
- 🧹 Remove or replace deprecated elements (cf. Migration guide)
- Adds an option to display some commands as JSON:
  - golangci-lint config path --json
  - golangci-lint help linters --json
  - golangci-lint help formatters --json
  - golangci-lint linters --json
  - golangci-lint formatters --json
  - golangci-lint version --json
Documentation
- Migration guide

`v1.64.8`

Compare Source

Detects use of configuration files from golangci-lint v2

`v1.64.7`

Compare Source

Linters bug fixes
- depguard: from 2.2.0 to 2.2.1
- dupl: from 3e9179a to f665c8d
- gosec: from 2.22.1 to 2.22.2
- staticcheck: from 0.6.0 to 0.6.1
Documentation
- Add GitLab documentation

`v1.64.6`

Compare Source

Linters bug fixes
- asciicheck: from 0.4.0 to 0.4.1
- contextcheck: from 1.1.5 to 1.1.6
- errcheck: from 1.8.0 to 1.9.0
- exptostd: from 0.4.1 to 0.4.2
- ginkgolinter: from 0.19.0 to 0.19.1
- go-exhaustruct: from 3.3.0 to 3.3.1
- gocheckcompilerdirectives: from 1.2.1 to 1.3.0
- godot: from 1.4.20 to 1.5.0
- perfsprint: from 0.8.1 to 0.8.2
- revive: from 1.6.1 to 1.7.0
- tagalign: from 1.4.1 to 1.4.2

`v1.64.5`

Compare Source

Bug fixes
- Add missing flag new-from-merge-base-flag
Linters bug fixes
- asciicheck: from 0.3.0 to 0.4.0
- forcetypeassert: from 0.1.0 to 0.2.0
- gosec: from 2.22.0 to 2.22.1

`v1.64.4`

Compare Source

Linters bug fixes
- gci: fix standard packages list for go1.24

`v1.64.3`

Compare Source

Linters bug fixes
- ginkgolinter: from 0.18.4 to 0.19.0
- go-critic: from 0.11.5 to 0.12.0
- revive: from 1.6.0 to 1.6.1
- gci: fix standard packages list for go1.24
Misc.
- Build Docker images with go1.24

`v1.64.2`

Compare Source

This is the last minor release of golangci-lint v1.
The next release will be golangci-lint v2.

Enhancements
- 🎉 go1.24 support
- New issues.new-from-merge-base option
- New run.relative-path-mode option
Linters new features
- copyloopvar: from 1.1.0 to 1.2.1 (support suggested fixes)
- exptostd: from 0.3.1 to 0.4.1 (handles golang.org/x/exp/constraints.Ordered)
- fatcontext: from 0.5.3 to 0.7.1 (new option: check-struct-pointers)
- perfsprint: from 0.7.1 to 0.8.1 (new options: integer-format, error-format, string-format, bool-format, and hex-format)
- revive: from 1.5.1 to 1.6.0 (new rules: redundant-build-tag, use-errors-new. New option early-return.early-return)
Linters bug fixes
- go-errorlint: from 1.7.0 to 1.7.1
- gochecknoglobals: from 0.2.1 to 0.2.2
- godox: from 006bad1 to 1.1.0
- gosec: from 2.21.4 to 2.22.0
- iface: from 1.3.0 to 1.3.1
- nilnesserr: from 0.1.1 to 0.1.2
- protogetter: from 0.3.8 to 0.3.9
- sloglint: from 0.7.2 to 0.9.0
- spancheck: fix default StartSpanMatchersSlice values
- staticcheck: from 0.5.1 to 0.6.0
Deprecations
- ⚠️ tenv is deprecated and replaced by usetesting.os-setenv: true.
- ⚠️ exportloopref deprecation step 2
Misc.
- Sanitize severities by output format
- Avoid panic with plugin without description
Documentation
- Clarify depguard configuration

`v1.64.1`

Compare Source

Cancelled due to CI failure.

`v1.64.0`

Compare Source

Cancelled due to CI failure.

santhosh-tekuri/jsonschema (github.com/santhosh-tekuri/jsonschema/v5)

`v6.0.2`

Compare Source

`v6.0.1`

Compare Source

Bug Fixes:

fix/schema: field RecursiveRef misspelled
fix/schema: missing Deprecated field

check https://redirect.github.com/santhosh-tekuri/jsonschema/discussions/172 to see notes for migrating from v5 to v6

`v6.0.0`

Compare Source

Improvements

mixed dialect support
custom $vocabulary support
sermver format
support for localisation for ValidationError
command jv
- support stdin
- --insecure and --cacert flag
- --quiet flag

check https://redirect.github.com/santhosh-tekuri/jsonschema/discussions/172 to see notes for migrating from v5 to v6

sigstore/cosign (github.com/sigstore/cosign/v2)

`v3.0.3`

Compare Source

Thank you for all of your feedback on Cosign v3! v3.0.3 fixes a number of bugs reported by
the community along with adding compatibility for the new bundle format and attestation
storage in OCI to additional commands. We're continuing to work on compatibility with
the remaining commands and will have a new release shortly. If you run into any problems,
please file an issue

Changes

4554: Closes 4554 - Add warning when --output* is used (#4556)
Protobuf bundle support for subcommand clean (#4539)
Add staging flag to initialize with staging TUF metadata
Updating sign-blob to also support signing with a certificate (#4547)
Protobuf bundle support for subcommands save and load (#4538)
Fix cert attachment for new bundle with signing config
Fix OCI verification with local cert - old bundle
Deprecate tlog-upload flag (#4458)
fix: Use signal context for sign cli package.
update offline verification directions (#4526)
Fix signing/verifying annotations for new bundle
Add support to download and attach for protobuf bundles (#4477)
Add --signing-algorithm flag (#3497)
Refactor signcommon bundle helpers
Add --bundle and fix --upload for new bundle
Pass insecure registry flags through to referrers
Add protobuf bundle support for tree subcommand (#4491)
Remove stale embed import (#4492)
Support multiple container identities
Fix segfault when no attestations are found (#4472)
Use overridden repository for new bundle format (#4473)
Remove --out flag from cosign initialize (#4462)
Deprecate offline flag (#4457)
Deduplicate code in sign/attest* and verify* commands (#4449)
Cache signing config when calling initialize (#4456)

`v3.0.2`

Compare Source

v3.0.2 is a functionally equivalent release to v3.0.0 and v3.0.1, with a fix for CI to publish signed releases in the new bundle format.

Note that the --bundle flag specifying an output file to write the Sigstore bundle (which contains all relevant verification material) has moved from optional to required in v3.

Changes

choose different signature filename for KMS-signed release signatures (#4448)
Update rekor-tiles version path (#4450)

`v3.0.1`

Compare Source

v3.0.1 is an equivalent release to v3.0.0, which was never published due to a failure in our CI workflows.

Note that the --bundle flag specifying an output file to write the Sigstore bundle (which contains all relevant verification material) has moved from optional to required in v3.

Changes

update goreleaser config for v3.0.0 release (#4446)

`v3.0.0`

Compare Source

Announcing the next major release of Cosign!

Cosign v3 is a minor change from Cosign v2.6.x, with all of the new capabilities of recent
releases on by default, but will still allow you to disable them if you need the older functionality.
These new features include support for the standardized bundle format (--new-bundle-fomat), providing roots
of trust for verification and service URLs for signing via one file (--trusted-root, --signing-config),
and container signatures stored as an OCI Image 1.1 referring artifact.

Learn more on our v3 announcement blog post! See
the changelogs for v2.6.0, v2.5.0, and v2.4.0 for more information on recent
changes.

If you have any feedback, please reach out on Slack or file an issue on GitHub.

Changes

Default to using the new protobuf format (#4318)
Fetch service URLs from the TUF PGI signing config by default (#4428)
Bump module version to v3 for Cosign v3.0 (#4427)

`v2.6.1`

Compare Source

Bug Fixes

Partially populate the output of cosign verify when working with new bundles (#4416)
Bump sigstore-go, move conformance back to tagged release (#4426)

`v2.6.0`

Compare Source

v2.6.0 introduces a number of new features, including:

Signing an in-toto statement rather than Cosign constructing one from a predicate, along with verifying a statement's subject using a digest and digest algorithm rather than providing a file reference (#4306)
Uploading a signature and its verification material (a "bundle") as an OCI Image 1.1 referring artifact, completing #3927 (#4316)
Providing service URLs for signing and attesting using a SigningConfig. Note that this is required when using a Rekor v2 instance (#4319)

Example generation and verification of a signed in-toto statement:

cosign attest-blob --new-bundle-format=true --bundle="digest-key-test.sigstore.json" --key="cosign.key" --statement="../sigstore-go/examples/sigstore-go-signing/intoto.txt"
cosign verify-blob-attestation --bundle="digest-key-test.sigstore.json" --key=cosign.pub --type=unused --digest="b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9" --digestAlg="sha256"

Example container signing and verification using the new bundle format and referring artifacts:

cosign sign --new-bundle-format=true ghcr.io/user/alpine@sha256:a19367999603840546b8612572e338ec076c6d1f2fec61760a9e11410f546733
cosign verify --new-bundle-format=true ghcr.io/user/alpine@sha256:a19367999603840546b8612572e338ec076c6d1f2fec61760a9e11410f546733

Example usage of a signing config provided by the public good instance's TUF repository:

cosign sign-blob --use-signing-config --bundle sigstore.json README.md
cosign verify-blob --new-bundle-format --bundle sigstore.json --certificate-identity $EMAIL --certificate-oidc-issuer $ISSUER --use-signed-timestamps README.md

v2.6.0 leverages sigstore-go's signing and verification APIs gated behind these new flags. In an upcoming major release, we will be
updating Cosign to default to producing and consuming bundles to align with all other Sigstore SDKs.

Features

Add to attest-blob the ability to supply a complete in-toto statement, and add to verify-blob-attestation the ability to verify with just a digest (#4306)
Have cosign sign support bundle format (#4316)
Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)
Add support for SigningConfig in sign/attest (#4371)
Support self-managed keys when signing with sigstore-go (#4368)
Don't require timestamps when verifying with a key (#4337)
Don't load content from TUF if trusted root path is specified (#4347)
Add a terminal spinner while signing with sigstore-go (#4402)
Require exclusively a SigningConfig or service URLs when signing (#4403)
Remove SHA256 assumption in sign-blob/verify-blob (#4050)
Bump sigstore-go, support alternative hash algorithms with keys (#4386)

Breaking API Changes

sign.SignerFromKeyOpts no longer generates a key. Instead, it returns whether or not the client needs to generate a key, and if so, clients
should call sign.KeylessSigner. This allows clients to more easily manage key generation.

Bug Fixes

Verify subject with bundle only when checking claims (#4320)
Fixes to cosign sign / verify for the new bundle format (#4346)

`v2.5.3`

Compare Source

Features

Add signing-config create command (#4280)
Allow multiple services to be specified for trusted-root create (#4285)
feat: Add OCI 1.1+ experimental support to tree (#4205)
Add validity period end for trusted-root create (#4271)

Bug Fixes

Fix cert verification logic for trusted-root/SCTs (#4294)
force when copying the latest image to overwrite (#4298)
avoid double-loading trustedroot from file (#4264)

`v2.5.2`

Compare Source

Bug Fixes

Do not load trusted root when CT env key is set

Documentation

docs: improve doc for --no-upload option (#4206)

`v2.5.1`

Compare Source

Features

Add Rekor v2 support for trusted-root create (#4242)
Add baseUrl and Uri to trusted-root create command
Upgrade to TUF v2 client with trusted root
Don't verify SCT for a private PKI cert (#4225)
Bump TSA library to relax EKU chain validation rules (#4219)

Bug Fixes

Bump sigstore-go to pick up log index=0 fix (#4162)
remove unused recursive flag on attest command (#4187)

Docs

Fix indentation in verify-blob cmd examples (#4160)

Releases

ensure we copy the latest tags on each release (#4157)

Contributors

arthurus-rex
Babak K. Shandiz
Bob Callaway
Carlos Tadeu Panato Junior
Colleen Murphy
Dmitry Savintsev
Emmanuel Ferdman
Hayden B
Ville Skyttä

`v2.5.0`

Compare Source

v2.5.0 includes an implementation of the new bundle specification,
attesting and verifying OCI image attestations uploaded as OCI artifacts.
This feature is currently gated behind the --new-bundle-format flag
when running cosign attest.

Features

Add support for new bundle specification for attesting/verifying OCI image attestations (#3889)
Feat/non filename completions (#4115)
Add TSA certificate related flags and fields for cosign attest (#4079)

Fixes

cmd/cosign/cli: fix typo in ignoreTLogMessage (#4111)
Fix replace with compliant image mediatype (#4077)

Contributors

Bob Callaway
Carlos Tadeu Panato Junior
Cody Soyland
Dmitry Savintsev
Hayden B
Ramon Petgrave
Riccardo Schirone
Stef Graces
Ville Skyttä

`v2.4.3`

Compare Source

Features

Bump sigstore/sigstore to support KMS plugins (#4073)
Enable fetching signatures without remote get. (#4047)
Feat/file flag completion improvements (#4028)
Update builder to use go1.23.6 (#4052)

Bug Fixes

fix parsing error in --only for cosign copy (#4049)

Cleanup

Refactor verifyNewBundle into library function (#4013)
fix comment typo and imports order (#4061)
sync comment with parameter name in function signature (#4063)
sort properly Go imports (#4071)

Contributors

Bob Callaway
Carlos Tadeu Panato Junior
Cody Soyland
Dmitry Savintsev
Hayden B
Tomasz Janiszewski
Ville Skyttä

`v2.4.2`

Compare Source

Features

Updated open-policy-agent to 1.1.0 library (#4036)
- Note that only Rego v0 policies are supported at this time
Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
Add support for verifying root checksum in cosign initialize (#3953)
Detect if user supplied a valid protobuf bundle (#3931)
Add a log message if user doesn't provide --trusted-root (#3933)
Support mTLS towards container registry (#3922)
Add bundle create helper command (#3901)
Add trusted-root create helper command (#3876)

Bug Fixes

fix: set tls config while retaining other fields from default http transport (#4007)
policy fuzzer: ignore known panics (#3993)
Fix for multiple WithRemote options (#3982)
Add nightly conformance test workflow (#3979)
Fix copy --only for signatures + update/align docs (#3904)

Documentation

Remove usage.md from spec, point to client spec (#3918)
move reference from gcr to ghcr (#3897)

Contributors

AdamKorcz
Aditya Sirish
Bob Callaway
Carlos Tadeu Panato Junior
Cody Soyland
Colleen Murphy
Hayden B
Jussi Kukkonen
Marco Franssen
Nianyu Shen
Slavek Kabrda
Søren Juul
Warren Hodgkinson
Zach Steindler

tektoncd/pipeline (github.com/tektoncd/pipeline)

`v1.7.0`: Tekton Pipeline release v1.7.0 "LaPerm Little Helper"

Compare Source

🎉 Bug fixes, stability improvements and dependency updates 🎉

-Docs @ v1.7.0
-Examples @ v1.7.0

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.7.0/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a0af3ff47db2d68605b227b75af0aa40d87262257e2b9295f35454fe3d050ed38

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a0af3ff47db2d68605b227b75af0aa40d87262257e2b9295f35454fe3d050ed38
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.7.0/release.yaml
REKOR_UUID=108e9186e8c5677a0af3ff47db2d68605b227b75af0aa40d87262257e2b9295f35454fe3d050ed38

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.7.0@&#8203;sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Fixes

🐛 fix: Populate step statuses before TaskRun timeout handling (#9184)

Fix a race condition on timeout that would result in a TaskRun status without steps statuses.

🐛 fix: panic in v1beta1 matrix validation for invalid result refs (#9135)

Resolved an issue where Pipelines with invalid result references in matrix parameters would cause a panic during validation (v1beta1 API)

🐛 Use patch instead of update to replace sidecars with nop image (#9128)

Fixed race condition causing TaskRuns to fail with 409 conflict error when stopping sidecars.
StopSidecars now uses Patch instead of Update to avoid conflicts with concurrent kubelet pod status updates.

🐛 fix: Add missing comma in slash commands workflow (#9157)
🐛 Fix tekton/publish sed for combined-based-image digest replacement (#9119)
🐛 examples: reduce the size of the matrix to reduce flakiness (#9187)

Misc

🔨 Migrate tests images out of dockerhub. (#9158)
🔨 refactor: add clock injection to cache for testing (#9142)
🔨 Remove deprecated // +build directive from most files (#9118)
🔨 build(deps): bump tj-actions/changed-files from 6da3c88 to abdd2f6 (#9196)
🔨 chore(release-pipeline): update references to oci bucket (#9189)
🔨 .github/workflows: fix e2e-matrix-extras (#9185)
🔨 build(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#9181)
🔨 build(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#9180)
🔨 build(deps): bump golangci/golangci-lint-action from 9.0.0 to 9.1.0 (#9179)
🔨 .github: add a dependabot configuration to monitor .ko.yaml (#9173)
🔨 feat: Add GitHub Actions cherry-pick slash command (#9172)
🔨 build(deps): bump the all group in /tekton with 4 updates (#9170)
🔨 build(deps): bump actions/dependency-review-action from 4.8.1 to 4.8.2 (#9169)
🔨 build(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#9168)
🔨 build(deps): bump tj-actions/changed-files from 7006987 to 6da3c88 (#9167)
🔨 build(deps): bump chainguard-dev/actions from 1.5.3 to 1.5.10 (#9166)
🔨 build(deps): bump github/codeql-action from 4.31.0 to 4.31.5 (#9165)
🔨 Fix commit SHA of actions/github-script in e2e-extras workflow (#9161)
🔨 Fix the e2e-extras slash command (#9160)
🔨 examples: make sure we use the same image for sidecar and step (#9139)
🔨 fix(ci): correct grep patterns in detect job (#9137)
🔨 build(deps): bump the all group in /tekton with 4 updates (#9134)
🔨 build(deps): bump chainguard-dev/actions from 1.5.7 to 1.5.8 (#9133)
🔨 build(deps): bump tj-actions/changed-files from 0ff001d to 7006987 (#9132)
🔨 build(deps): bump step-security/harden-runner from 2.13.1 to 2.13.2 ([#9131](https://redirect.github.com/tektoncd/pipeline/issues/913

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2025-12-12T10:14:01Z

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: acceptance/go.sum

Command failed: go get -t ./...
go: module github.com/sigstore/cosign/v3@v3.0.3 requires go >= 1.25.0; switching to go1.25.5
go: downloading go1.25.5 (linux/amd64)
go: download go1.25.5: golang.org/toolchain@v0.0.1-go1.25.5.linux-amd64: verifying module: checksum database disabled by GOSUMDB=off

File name: go.sum

Command failed: go get -t ./...
go: module github.com/sigstore/cosign/v3@v3.0.3 requires go >= 1.25.0; switching to go1.25.5
go: downloading go1.25.5 (linux/amd64)
go: download go1.25.5: golang.org/toolchain@v0.0.1-go1.25.5.linux-amd64: verifying module: checksum database disabled by GOSUMDB=off

File name: tools/go.sum

Command failed: go get -t ./...
go: downloading github.com/golangci/golangci-lint v1.57.2
go: downloading github.com/tektoncd/chains v0.22.2
go: downloading github.com/tektoncd/cli v0.38.0
go: downloading gotest.tools/gotestsum v1.12.1
go: downloading k8s.io/kubernetes v1.34.2
go: downloading golang.org/x/sync v0.18.0
go: downloading golang.org/x/tools v0.39.0
go: downloading github.com/spf13/cobra v1.10.2
go: downloading github.com/gofrs/flock v0.13.0
go: downloading github.com/hashicorp/go-version v1.8.0
go: downloading golang.org/x/term v0.37.0
go: downloading golang.org/x/crypto v0.45.0
go: downloading github.com/tektoncd/triggers v0.29.0
go: downloading golang.org/x/mod v0.30.0
go: downloading golang.org/x/sys v0.39.0
go: downloading github.com/go-viper/mapstructure/v2 v2.4.0
go: downloading github.com/ldez/gomoddirectives v0.7.1
go: downloading github.com/golangci/plugin-module-register v0.1.2
go: downloading github.com/spf13/afero v1.15.0
go: downloading github.com/go-openapi/jsonpointer v0.21.1
go: downloading cloud.google.com/go/kms v1.22.0
go: downloading cloud.google.com/go v0.121.2
go: downloading google.golang.org/api v0.239.0
go: downloading cloud.google.com/go/storage v1.53.0
go: downloading google.golang.org/genproto v0.0.0-20250603155806-513f23925822
go: downloading golang.org/x/net v0.47.0
go: downloading golang.org/x/text v0.31.0
go: downloading github.com/ldez/grignotin v0.10.1
go: downloading github.com/golangci/revgrep v0.8.0
go: downloading 4d63.com/gocheckcompilerdirectives v1.3.0
go: downloading 4d63.com/gochecknoglobals v0.2.2
go: downloading github.com/4meepo/tagalign v1.4.3
go: downloading github.com/Abirdcfly/dupword v0.1.7
go: downloading github.com/Antonboom/errname v1.1.1
go: downloading github.com/Antonboom/nilnil v1.1.1
go: downloading github.com/Antonboom/testifylint v1.6.4
go: downloading github.com/Djarvur/go-err113 v0.1.1
go: downloading github.com/OpenPeeDeeP/depguard/v2 v2.2.1
go: downloading github.com/alexkohler/nakedret/v2 v2.0.6
go: downloading github.com/bombsimon/wsl/v4 v4.7.0
go: downloading github.com/breml/bidichk v0.3.3
go: downloading github.com/breml/errchkjson v0.4.1
go: downloading github.com/butuzov/ireturn v0.4.0
go: downloading github.com/catenacyber/perfsprint v0.10.1
go: downloading github.com/charithe/durationcheck v0.0.11
go: downloading github.com/ckaznocha/intrange v0.3.1
go: downloading github.com/firefart/nonamedreturns v1.0.6
go: downloading github.com/ghostiam/protogetter v0.3.17
go: downloading github.com/go-critic/go-critic v0.14.2
go: downloading github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32
go: downloading github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d
go: downloading github.com/golangci/misspell v0.7.0
go: downloading github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e
go: downloading github.com/gordonklaus/ineffassign v0.2.0
go: downloading github.com/gostaticanalysis/forcetypeassert v0.2.0
go: downloading github.com/gostaticanalysis/nilerr v0.1.2
go: downloading github.com/jgautheron/goconst v1.8.2
go: downloading github.com/jirfag/go-printf-func-name v0.0.0-20200119135958-7558a9eaa5af
go: downloading github.com/jjti/go-spancheck v0.6.5
go: downloading github.com/karamaru-alpha/copyloopvar v1.2.2
go: downloading github.com/kisielk/errcheck v1.9.0
go: downloading github.com/kkHAIKE/contextcheck v1.1.6
go: downloading github.com/kulti/thelper v0.7.1
go: downloading github.com/kunwardeep/paralleltest v1.0.15
go: downloading github.com/ldez/tagliatelle v0.7.2
go: downloading github.com/lufeee/execinquery v1.2.1
go: downloading github.com/macabu/inamedparam v0.2.0
go: downloading github.com/maratori/testableexamples v1.0.1
go: downloading github.com/maratori/testpackage v1.1.2
go: downloading github.com/matoous/godox v1.1.0
go: downloading github.com/mgechev/revive v1.13.0
go: downloading github.com/nunnatsa/ginkgolinter v0.21.2
go: downloading github.com/polyfloyd/go-errorlint v1.8.0
go: downloading github.com/ryancurrah/gomodguard v1.4.1
go: downloading github.com/sashamelentyev/usestdlibvars v1.29.0
go: downloading github.com/securego/gosec/v2 v2.22.11-0.20251204091113-daccba6b93d7
go: downloading github.com/sonatard/noctx v0.4.0
go: downloading github.com/stbenjam/no-sprintf-host-port v0.3.1
go: downloading github.com/tetafro/godot v1.5.4
go: downloading github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67
go: downloading github.com/timonwong/loggercheck v0.11.0
go: downloading github.com/tomarrell/wrapcheck/v2 v2.12.0
go: downloading github.com/xen0n/gosmopolitan v1.3.0
go: downloading go-simpler.org/musttag v0.14.0
go: downloading go-simpler.org/sloglint v0.11.1
go: downloading honnef.co/go/tools v0.6.1
go: downloading mvdan.cc/gofumpt v0.9.2
go: downloading mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15
go: downloading cloud.google.com/go/iam v1.5.2
go: downloading cloud.google.com/go/longrunning v0.6.7
go: downloading github.com/googleapis/gax-go/v2 v2.15.0
go: downloading cloud.google.com/go/auth v0.16.5
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c
go: downloading cloud.google.com/go/firestore v1.18.0
go: downloading cloud.google.com/go/compute/metadata v0.8.0
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0
go: downloading github.com/alfatraining/structtag v1.0.0
go: downloading github.com/quasilyte/go-ruleguard v0.4.5
go: downloading github.com/gostaticanalysis/comment v1.5.0
go: downloading github.com/Masterminds/semver/v3 v3.4.0
go: downloading github.com/ccojocar/zxcvbn-go v1.0.4
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0
go: downloading cloud.google.com/go/monitoring v1.24.2
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0
go: downloading golang.org/x/exp/typeparams v0.0.0-20251023183803-a4bb9ffd2546
go: downloading codeberg.org/chavacava/garif v0.2.0
go: downloading github.com/prometheus/procfs v0.17.0
go: downloading github.com/ProtonMail/go-crypto v1.3.0
go: downloading github.com/cloudflare/circl v1.6.1
go: downloading github.com/golangci/gofmt v0.0.0-20251215234548-e7be49a5ab4d
go: downloading helm.sh/helm/v3 v3.19.4
go: downloading helm.sh/helm v2.17.0+incompatible
go: downloading github.com/cyphar/filepath-securejoin v0.6.1
go: github.com/conforma/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/golangci/gofmt/goimports: cannot find module providing package github.com/golangci/gofmt/goimports
go: github.com/conforma/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/nunnatsa/ginkgolinter/types: cannot find module providing package github.com/nunnatsa/ginkgolinter/types
go: warning: github.com/klauspost/compress@v1.18.1: retracted by module author: https://github.com/klauspost/compress/issues/1114
go: to switch to the latest unretracted version, run:
	go get github.com/klauspost/compress@latest

renovate bot added main major renovate labels Dec 12, 2025

github-actions bot added the size: XS label Dec 12, 2025

renovate bot force-pushed the renovate/main-major-go-modules branch 4 times, most recently from f61fd07 to ae14d9b Compare December 18, 2025 15:20

🚨 Update go modules

2d107ee

renovate bot force-pushed the renovate/main-major-go-modules branch from ae14d9b to 2d107ee Compare December 19, 2025 11:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

🚨 Update go modules (main) (major) #3061

🚨 Update go modules (main) (major) #3061

renovate bot commented Dec 12, 2025 •

edited

Loading

Uh oh!

renovate bot commented Dec 12, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

🚨 Update go modules (main) (major) #3061

Are you sure you want to change the base?

🚨 Update go modules (main) (major) #3061

Conversation

renovate bot commented Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Improvements

Changes

Changes

Changes

Changes

Bug Fixes

Features

Breaking API Changes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Documentation

Features

Bug Fixes

Docs

Releases

Contributors

Features

Fixes

Contributors

Features

Bug Fixes

Cleanup

Contributors

Features

Bug Fixes

Documentation

Contributors

v1.7.0: Tekton Pipeline release v1.7.0 "LaPerm Little Helper"

🎉 Bug fixes, stability improvements and dependency updates 🎉

Installation one-liner

Attestation

Changes

Fixes

Misc

Configuration

Uh oh!

renovate bot commented Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: acceptance/go.sum

File name: go.sum

File name: tools/go.sum

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Dec 12, 2025 •

edited

Loading

`v1.7.0`: Tekton Pipeline release v1.7.0 "LaPerm Little Helper"

renovate bot commented Dec 12, 2025 •

edited

Loading