Repository navigation
chore(deps): update application-deps - #1612
Merged
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/application-deps
branch
from
October 18, 2026 02:19
e1626a3 to
fea9b71
Compare
renovate
Bot
changed the title
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by Details:
|
renovate
Bot
force-pushed
the
renovate/application-deps
branch
3 times, most recently
from
October 20, 2026 18:39
07cd213 to
828091a
Compare
| datasource | package | from | to | | ---------- | -------------------- | ------ | ------ | | go | helm.sh/helm/v4 | v4.3.0 | v4.3.1 | | go | oras.land/oras-go/v2 | v2.6.2 | v2.6.4 |
renovate
Bot
force-pushed
the
renovate/application-deps
branch
from
October 23, 2026 18:04
828091a to
bd12682
Compare
Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>
slaskawi
approved these changes
Nov 2, 2026
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
chance-coleman
approved these changes
Nov 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v5.19.2→v5.19.3v3.1.3→v3.1.4v4.3.0→v4.3.1v0.37.1→v0.37.2v0.37.1→v0.37.2v0.37.1→v0.37.2v2.6.2→v2.7.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
go-git/go-git (github.com/go-git/go-git/v5)
v5.19.3Compare Source
What's Changed
New Contributors
Full Changelog: go-git/go-git@v5.19.2...v5.19.3
sigstore/cosign (github.com/sigstore/cosign/v3)
v3.1.4Compare Source
Changelog
3428d3cBuild releases with 1.27.3 (#5177)821c9bfAdd AGENTS.md, update contributors.md with reference to AI policy (#5176)cfeaa4aImplementcosign bundle create-from-container(#5144)e2d25b5Mention windows builds in readme (#5147)6a83f9afix(verify): don't panic on a bundle entry with no hash (#5127)0ea1cecrefactor: remove uploadToRekor parameter from ConfirmPrivacyStatementff2a8f4fix(sign): pass digest hash algorithm to underlying signer in SignData7757e8bfix(e2e): enable UseSignedTimestamps in *TSAMTLSWithSigningConfigf624836test(verify): add failure cases for new bundle verification907c3d8fix(sign): propagate BundlePath from SignOptions to KeyOpts0c66ecdclean: update inaccurate warning (#4909)67a1216fix: write referrers when image index has attestations (#5111)ac3a927fix(verify): enforce mutually exclusive key and security key (#5124)048eff5Reorder events in LoadTrustedMaterialAndSigningConfig43d83e8fix(layout): preserve manifest artifactType in index.json when saving (#4821)1dbbc36fix(load): upload bundle layer blobs before manifest PUT81b61e2fix: strip trailing whitespace from attached signature files/stdin (#5058)b327bbafix: clarify COSIGN_REPOSITORY error when repository path is missing3532c1dfix: include annotations in implied payload for offline verifyb84a076Cap the bundle layer read in ociremote.Bundled39ab7cAlign privacy statement prompt behavior (#5076)559c58ccopy annotations by key instead of copying obj (#5103)37cf1bcAdd org.opencontainers.image.title annotation to attestation layers (#4498)dd9ef85feat: Add org.opencontainers.image.source label to images (#5095)00c1772refactor: extract signing flag validation (#5070)39037f1fix: restrict bundle signing and attestation to one artifact (#5081)5b6e930fix: pass missing OIDC flags to KeyOpts (#5079)20c7516fix(verify): support image indexes in local bundle discovery (#5080)81fa4e9fix(verify): propagate CommonVerifyOptions to VerifyCommand (#5094)84effabfix: verify-blob should not force SHA256 for non-default key hash algorithms (#5064)e9af93ffix(providers): clearer errors when GitHub OIDC token request fails (#5062)8b8c87bfeat: --slot option argument shell completion (#5057)0a5f602Deprecate --use-signing-config (#5056)990e273fix: use correct Rekor URLs to activate privacy warning (#5054)151d838fix: only show public-instance privacy statement for the default Rekor URL (#5042)Thanks to all contributors!
helm/helm (helm.sh/helm/v4)
v4.3.1: Helm v4.3.1Compare Source
Helm v4.3.1 is a patch release. Users are encouraged to upgrade for the best experience.
The community keeps growing, and we'd love to see you there!
Notable Changes
Installation and Upgrading
Download Helm v4.3.1. The common platform binaries are here:
This release was signed with
208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155and can be found at @scottrigby keybase account. Please use the attached signatures for verifying this release usinggpg.The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with
bash.What's Next
Changelog
c0d08d0(Terry Howe)0c0146e(dependabot[bot])dd91731(Terry Howe)3a376b2(Ruslan Shaydullin)5fed6a5(Pujitha Paladugu)b227bf4(dependabot[bot])af79b8e(dependabot[bot])ab6b245(dependabot[bot])0f20617(dependabot[bot])e26e158(dependabot[bot])23ab1c5(dependabot[bot])8303180(dependabot[bot])kubernetes/api (k8s.io/api)
v0.37.2Compare Source
kubernetes/apimachinery (k8s.io/apimachinery)
v0.37.2Compare Source
kubernetes/client-go (k8s.io/client-go)
v0.37.2Compare Source
oras-project/oras-go (oras.land/oras-go/v2)
v2.7.0Compare Source
This is a minor release that adds a configurable bearer realm address denylist to the auth client to restore split-host internal registry compatibility, restores authentication after same-host HTTP-to-HTTPS redirects, and backports bug fixes to content copy and verification since v2.6.4.
New Features
auth.Client.BlockedRealmPrefixes,auth.DefaultBlockedRealmPrefixes(), andauth.PrivateRealmPrefixes()to configure which addresses a bearer realm host must not be, or resolve to. A nil list uses the defaults, an empty non-nil list disables address blocking, and a non-empty list is used exactly. IPv4 addresses embedded in IPv4-mapped, NAT64, and 6to4 IPv6 addresses are unwrapped before matching. The scheme check and the https-to-http downgrade check always apply (#1633, #1658)Behavior Change
BlockedRealmPrefixes: append(auth.DefaultBlockedRealmPrefixes(), auth.PrivateRealmPrefixes()...)(#1658)Bug Fixes
artifactTypebefore its config media type inFilterArtifactType, so referrers with an empty config are no longer skipped for OCI layouts andmemory.Storesources (#1641, #1643)artifactTypeand matchFilterArtifactTypeagainst the index'sartifactType(#1645, #1654)read failed: <cause>, matchable witherrors.Is, instead ofErrTrailingData(#1649, #1655)PreCopyreturnsSkipNodeafter the registry declines a cross-repository mount, instead of failing the copy with "skip node" (#1646, #1656)v2.6.4Compare Source
This is a patch release with security fixes to the file store and auth client, and bug fixes to the file store, OCI store, and retry layers since v2.6.3.
Security Fixes
pushFileandpushDir, and open files withO_NOFOLLOWon unix, so a pushed blob can no longer be written through a planted terminal symlink to a file outside the store root (GHSA-2hhj-vj64-hx3j)auth.Client, so a second same-origin hop on the redirect target no longer restores theAuthorizationheader removed by the GHSA-vh4v-2xq2-g5cg guard, and refuse to resend an OAuth2 token request body (password or refresh token) to another origin on a 307 or 308 (GHSA-xc97-9f2f-9hrx)localhostor a DNS name pointing at an internal address no longer bypassesvalidateRealm(GHSA-mm27-wq9c-mxxr)Bug Fixes
blobs/<alg>/during OCI storeGC, which previously aborted on a non-empty directory;os.Removeerrors now include the blob path (#1526, #1579, #1588)retry.DefaultPredicate, so a single reset from a registry no longer fails the whole operation (#1567, #1570)v2.6.3Compare Source
This is a patch release with bug fixes to the file store, OCI store, remote registry, auth client, copy, and retry layers since v2.6.2.
Bug Fixes
DeletewithAutoGCno longer keeps a manifest whose tag has moved to another manifest, along with the blobs only it references, until an explicitGC()(#1468, #1469, #1475)gcIndex, which re-read the first hop on every pass: garbage collection could spin without progress, and a referrer reaching the graph further up the chain was never recognised (#1295, #1458)IgnoreNoNamediscards the manifest, which previously returned early and silently skipped the second name (#1441, #1452, #1459)CopyGraphself-heals a partially copied graph instead of failing (#1212, #1213)auth.Client, which v2.6.1 and v2.6.2 stopped enforcing when noCheckRedirectis set (#1500, #1514, #1519)retry.ExponentialBackoffwhen the jitter is zero, which previously panicked on the first retry becauserand.Int64Nwas called with a zero range (#1549, #1551)Other Changes
golang.org/x/syncfrom 0.22.0 to 0.24.0 (#1413, #1529)release-label triggered workflow authenticated with a PAT, and document the flow inRELEASES.md(#1371, #1422, #1439, #1446)v2branch (#1531)Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.