🚨 Update go modules (main) (major) by renovate[bot] · Pull Request #3133 · conforma/cli

renovate · 2026-02-27T02:25:48Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/MakeNowJust/heredoc	`v1.0.0` → `v2.0.1`
github.com/santhosh-tekuri/jsonschema/v5	`v5.3.1` → `v6.0.3`
gopkg.in/go-jose/go-jose.v2	`v2.6.3` → `v4.1.5`
helm.sh/helm/v3	`v3.20.2` → `v4.3.0`

Release Notes

MakeNowJust/heredoc (github.com/MakeNowJust/heredoc)

`v2.0.1`

Compare Source

Version 2.0.1

Fixes

Correct import path for Go modules

`v2.0.0`

Compare Source

Version 2.0.0

Breaking Changes

Treats only white space (U+0020) and horizontal tabs (U+000D) as space characters. (#6)

santhosh-tekuri/jsonschema (github.com/santhosh-tekuri/jsonschema/v5)

Bug Fixes:

fix/schema: field RecursiveRef misspelled
fix/schema: missing Deprecated field

check https://redirect.github.com/santhosh-tekuri/jsonschema/discussions/172 to see notes for migrating from v5 to v6

`v6.0.0`

Compare Source

Improvements

mixed dialect support
custom $vocabulary support
sermver format
support for localisation for ValidationError
command jv
- support stdin
- --insecure and --cacert flag
- --quiet flag

check https://redirect.github.com/santhosh-tekuri/jsonschema/discussions/172 to see notes for migrating from v5 to v6

helm/helm (helm.sh/helm/v3)

`v4.3.0`: Helm v4.3.0

Compare Source

Helm v4.3.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

Join the discussion in Kubernetes Slack:
- for questions and just to hang out
- for discussing PRs, code, and bugs
Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

feat: Add duration functions by @aeroyorch in #31695
feat(engine): add debug logging when lookup returns empty by @ogulcanaydogan in #32205
feat: add ownership verification before deleting resources during uni… by @banjoh in #31584
feat: honor SOURCE_DATE_EPOCH for chart archives by @lohitkolluri in #32162
feat(rollback): add --description flag to provide rollback reason by @biagiopietro in #31580
fix (internal/plugin): remove zero-width spaces from plugin name comment by @lexfrei in #32134
fix(loader): do not drop values files ending at a 4096-byte boundary by @locker95 in #32525
fix(chart): normalize StampModTimes timestamp to UTC/truncate + Chart.lock reproducibility test by @Mentigen in #32485
fix(provenance): support GnuPG keybox (pubring.kbx) keyrings by @ruslan-shaydullin in #32281
fix(template): regression - route registry messages to stderr in template and show by @amarkdotdev in #32217
refactor: lower resync period from one hour to 3 minutes by @AustinAbro321 in #31944
perf: enable concurrent status computation to prevent multi-minute delays by @mapleeit in #32043
chore(deps): bump the k8s-io group to 0.37.0 - #32598

Installation and Upgrading

Download Helm v4.3.0. The common platform binaries are here:

MacOS amd64 (checksum / 347a784877e0e20eac865e8d1c36a80f6bb0861d6f29abd34defb6570ef95d92)
MacOS arm64 (checksum / d3870437e1e95b67f8edbde964156c84a26503f560821d40c542441658934fba)
Linux amd64 (checksum / 86584a54def73570558f66f5111cc53dfed56689637ae32c1201205d494f54fb)
Linux arm (checksum / 467c353e4a1ab57412dd00c6bfb1a6a2ab4a57d775506f8b38c58502c0ba6861)
Linux arm64 (checksum / 31c5794dd55c66a51e6b7d2e2ac7a114ae8b1de41ff1d9ba51748ac973b06a08)
Linux i386 (checksum / e969a9492ac128097069aef7eb63be3b2504a20b5377a240b4c5c9bfc4b51575)
Linux loong64 (checksum / 4ffe485ef474d722699794851642e1c7037e4776233e77637c649f69f3e9a4ce)
Linux ppc64le (checksum / 5ff7d5ea6f396c15f3cfda3fb8ecb0ecb1b11bc283785adeb55eefb2c62e0bda)
Linux s390x (checksum / ab637a6a1c3d457b9975726c100d74e484e579d5462c4fd2e3bfcfa97df57cd7)
Linux riscv64 (checksum / 5359f5544478de80de2dfd60bdc5e0c22f26255b3c44335483e0f9bd3ba6ec58)
Windows amd64 (checksum / 304ea163cce4d9ad14e189c01846c6a34de9cfdfe48536ae54b2e8ba7884e67c)
Windows arm64 (checksum / 4a9eefa30d26eb73900a9a0f16e97eae678582172204db60cbd454c68acea246)

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

4.3.1 and 3.22.1 are the next patch releases scheduled for October 14, 2026
4.4.0 is the next minor release scheduled for January 13, 2027. There will be no further Helm 3 minor releases (see https://helm.sh/blog/helm-v3-end-of-life)

Changelog

chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 bec5b06 (dependabot[bot])
chore(deps): bump the k8s-io group across 1 directory with 6 updates d0d42e7 (dependabot[bot])
bump version to 4.3 (#32605) 7328f42 (Scott Rigby)
chore: Fix independent-merge lint issues ca6681c (George Jenkins)
refactor(repo): Use byte buffer to build index file (#32579) 37752b7 (Tom Wieczorek)
chore: fix gofumpt extra-rules (#32486) 28e64bd (Matthieu MOREL)
Remove deprecated internal/chart/v3/ code (#32365) 4dfbaa4 (George Jenkins)
fix(template): regression - route registry messages to stderr in template and show (#32217) 9a3c040 (Aaron Mark)
refactor: remove per-file decompression size limit (#31748) 11e2010 (Benoit Tigeot)
Updating the Go version b5b498b (Matt Farina)
Updating the Go version 6d1f67c (Matt Farina)
chore(deps): bump the github-actions group across 1 directory with 4 updates (#32574) 0f4decb (dependabot[bot])
chore(deps): bump the k8s-io group with 7 updates (#32572) fb19300 (dependabot[bot])
fix: correct 'doest not match' in readiness debug logs 6888b0a (MsfPablo)
fix(provenance): support GnuPG keybox (pubring.kbx) keyrings (#32281) 67d54fd (Ruslan Shaydullin)
chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#32562) e9b85e4 (dependabot[bot])
chore(deps): bump the github-actions group across 1 directory with 4 updates (#32556) c000a40 (dependabot[bot])
chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#32555) bafdcde (dependabot[bot])
chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#32545) 2a29f17 (dependabot[bot])
chore(deps): bump golang.org/x/text from 0.40.0 to 0.41.0 (#32543) edb94f8 (dependabot[bot])
test(loader): cover 8192-byte EOF boundary for LoadValues fd4ed49 (Dean Chen)
fix(loader): do not drop values files ending at a 4096-byte boundary 601445e (Dean Chen)
chore(deps): bump the github-actions group with 4 updates (#32523) f3d68cd (dependabot[bot])
fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158 (#32521) a0c2f6d (Terry Howe)
chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 (#32514) f8a308c (dependabot[bot])
chore(deps): bump the github-actions group with 4 updates 47eb219 (dependabot[bot])
chore(deps): bump the github-actions group with 4 updates (#32508) ae877c8 (dependabot[bot])
test(action): poll for the interrupted install goroutine instead of a zero-margin sleep (#32328) a8ab76e (Nikolaus Schuetz)
chore(deps): bump actions/stale in the github-actions group (#32487) ac1c687 (dependabot[bot])
test(package): fix errorlint + exact path match in lock test e923167 (Ilya Kiselev)
fix(chart): normalize StampModTimes timestamp + Chart.lock test 3c3be92 (Ilya Kiselev)
chore(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 ce27485 (dependabot[bot])
fix(scripts): clarify cache-busting behavior bc0114c (Solomon Wakhungu)
chore: fix gofumpt issues 24bbb46 (Matthieu MOREL)
fix(scripts): address cache-busting review feedback bbaf420 (Solomon Wakhungu)
Make golangci-lint happy f3edb83 (MrJack)
Added missing import 94a3315 (MrJack)
Readded "unicode/utf8" 500f02d (MrJack)
Potential fix for pull request finding f1ede7c (MrJack)
Apply suggestions from code review 4fcc4e4 (MrJack)
refactor(rollback): validate description length before cluster reachability check 91520a7 (MrJack)
refactor(test): reuse existing rollback.txt golden file e73dfab (MrJack)
Removed extra space in rollback-with-description.txt b177a8e (MrJack)
Enhance rune count in pkg/cmd/rollback.go and pkg/action/rollback.go a92611c (MrJack)
Use rune count to count properly multi-byte UTF-8 characters 8a34f3b (MrJack)
Enhanced rollback description length cb91040 (MrJack)
Changed if construction e69e424 (MrJack)
Set 256 as limit for maxDescriptionLength. 256 comes from MAX value for key and value b606955 (MrJack)
feat(rollback): add --description flag to provide rollback reason f8180e6 (MrJack)
Update resource_test.go 622f16b (Matthieu MOREL)
Update labels_test.go 61d99a8 (Matthieu MOREL)
Update chartrepo_test.go 532eabf (Matthieu MOREL)
Update show_test.go bfca068 (Matthieu MOREL)
Update rollback_test.go b59dfd3 (Matthieu MOREL)
Potential fix for pull request finding a27f3a0 (Matthieu MOREL)
chore(pkg): refactor: finer tests conversions to testify part 1 828d01a (Matthieu MOREL)
chore(pkg): refactor: finer tests conversions to testify part 3 9a2be11 (Matthieu MOREL)
chore(pkg): refactor: finer tests conversions to testify part 2 4d9c03f (Matthieu MOREL)
chore(internal): refactor: finer tests conversions to testify part 1 5142ca8 (Matthieu MOREL)
chore(deps): bump the k8s-io group across 1 directory with 7 updates (#32459) 8f74dce (dependabot[bot])
chore(deps): bump ossf/scorecard-action in the github-actions group (#32458) 050d3e9 (dependabot[bot])
chore(deps): bump the github-actions group with 4 updates ea7c838 (dependabot[bot])
chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 fe3f98b (dependabot[bot])
chore(deps): bump actions/labeler from 6.2.0 to 7.0.0 (#32441) ed246e2 (dependabot[bot])
chore(deps): bump github/codeql-action/upload-sarif (#32440) 5223cea (dependabot[bot])
chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2 a0f954e (dependabot[bot])
chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2 cdccef4 (dependabot[bot])
chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2 065d3a6 (dependabot[bot])
chore: group github-actions dependabot updates cd4c5d3 (Terry Howe)
chore(pkg): refactor: convert tests to testify assert/require part 19 33c2839 (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 22 0b1aa55 (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 21 a934b82 (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 20 1d4665e (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 18 fb8a62b (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 16 0fa9f7d (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 17 4073566 (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 15 7173365 (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 14 dc66ee7 (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 13 aae82bf (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 12 a3fa28a (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 11 dc3e3a5 (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 10 2f5a33f (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 9 13d1edc (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 8 e5f0e07 (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 7 ca1767b (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 2 0daa77f (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 1 d4ec8e9 (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 6 0844b3b (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 5 3ff05c8 (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 4 658a8fa (Matthieu MOREL)
chore(pkg): refactor: convert tests to testify assert/require part 3 df2d013 (Matthieu MOREL)
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#32411) 8c7f3a1 (dependabot[bot])
chore(internal): refactor: convert tests to testify assert/require part 4 (#32408) 6c45810 (Matthieu MOREL)
chore(internal): refactor: convert tests to testify assert/require part 3 668e7e5 (Matthieu MOREL)
chore(internal): refactor: convert tests to testify assert/require part 5 f1d5979 (Matthieu MOREL)
chore(internal): refactor: convert tests to testify assert/require part 6 f3402c1 (Matthieu MOREL)
chore(internal): refactor: convert tests to testify assert/require part 1 ba31ca0 (Matthieu MOREL)
chore(internal): refactor: convert tests to testify assert/require part 2 615a299 (Matthieu MOREL)
fix: pass registry client to downloader.Manager in upgrade 0604d8f (Gates Wang)
perf: enable concurrent status computation to prevent multi-minute delays (#32043) 3bcf965 (Zhaofeng Miao)
remove legacy import comments from remaining packages (#31933) 82be04d (Abhay Chaurasiya)
Potential fix for pull request finding c2fda5a (Terry Howe)
fix: enhance error handling and improve test assertions (#32352) a2b1a60 (Matthieu MOREL)
fix(scripts): add cache-busting to get-helm-3 version check 5a30c7a (Solomon Wakhungu)
chore(deps): bump github/codeql-action init and analyze to 4.37.1 0563162 (Terry Howe)
chore(deps): bump github/codeql-action/upload-sarif (#32378) 06b9586 (dependabot[bot])
chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#32376) a494169 (dependabot[bot])
chore(deps): bump github/codeql-action/autobuild from 4.37.0 to 4.37.1 eeb37ed (dependabot[bot])
chore: Add AI Vendor specific paths to .gitignore 8cd3a48 (George Jenkins)
ci: auto-label PRs targeting main with v4.x 9f3c89a (Benoit Tigeot)
fix: 'gocritic: filepathJoin path seperator' lint error 96a25ab (George Jenkins)
chore(internal): refactor: convert tests to testify assert/require part 3 caac755 (Matthieu MOREL)
feat: honor SOURCE_DATE_EPOCH for chart archives (#32162) ad93b7d (Lohit Kolluri)
Fix missing conflict retry with server-side apply (#32088) aa1ae3a (Jakub Jaruszewski)
chore: fix elseif and ifElseChain issues from gocritic (#32289) a02a571 (Matthieu MOREL)
chore(internal): refactor: convert tests to testify assert/require part 2 f280d9c (Matthieu MOREL)
chore(internal): refactor: convert tests to testify assert/require part 1 d72b28e (Matthieu MOREL)
fix(ci): pin govulncheck-action to the v1.1.0 release (#32304) 68977ec (秀吉)
ci: track GitHub Actions updates on dev-v3 via Dependabot b963afa (Terry Howe)
chore(deps): bump actions/stale from 10.3.0 to 10.4.0 (#32330) fb53c00 (dependabot[bot])
chore(deps): bump github.com/mattn/go-shellwords from 1.0.13 to 1.0.14 (#32334) dad026a (dependabot[bot])
chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#32333) 84e63e5 (dependabot[bot])
Address review comments 73c1fb2 (Matheus Pimenta)
Fix vanishing empty lines bfebbb7 (Matheus Pimenta)
fix: add missing https:// to Oracle link in ADOPTERS.md (#32324) 7b9a5c8 (Akanksha Trehun)
fix: remove trailing whitespace in .golangci.yml (#32325) cfa3b24 (Akanksha Trehun)
fix(Makefile): update outdated .sha256 comment for Helm v4 (#32323) a91e9f6 (Akanksha Trehun)
feat(linters): add new revive rules for better code quality 16787d6 (Matthieu MOREL)
refactor: enable several checks from gocritic 9662fdd (Matthieu MOREL)
fix(linters): update golangci-lint to 2.12.2 7bfcdb0 (Matthieu MOREL)
chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.37.0 8118a4d (Terry Howe)
chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 0fc3b93 (Terry Howe)
chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.37.0 71901a4 (Terry Howe)
chore(deps): bump github/codeql-action/init from 4.36.2 to 4.37.0 (#32313) a71eb99 (dependabot[bot])
chore(deps): bump github/codeql-action/autobuild from 4.36.2 to 4.37.0 (#32305) ea52bdf (dependabot[bot])
chore(deps): bump golang.org/x/text from 0.39.0 to 0.40.0 (#32309) a242855 (dependabot[bot])
chore(deps): bump github/codeql-action/upload-sarif (#32311) f25f955 (dependabot[bot])
Potential fix for pull request finding ed651de (Benoit Tigeot)
fix(ci): resolve Node 20 deprecation in govulncheck ca24a55 (Benoit Tigeot)
chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 e3fbe2e (dependabot[bot])
chore: fix emptyStringTest, nestingReduce and singleCaseSwitch checks issues from gocritic 96b315f (Matthieu MOREL)
Update pkg/cmd/history_test.go c1569ea (Matthieu MOREL)
test: replace assert.Equal with require.EqualError for improved error handling 65077c1 (Matthieu MOREL)
test: replace assert.Contains with assert.ErrorContains for better error handling 4ade4a5 (Matthieu MOREL)
chore: fix several checks issues from testifylint f34ad6c (Matthieu MOREL)
test(cli): use t.Cleanup for resetEnv with t.Setenv 47bde11 (LarytheLord)
test(cli): isolate user-agent rest config test from host kubeconfig 9b30076 (LarytheLord)
chore: fix several checks issues from gocritic 07259ec (Matthieu MOREL)
fix(engine): prevent Files.Lines panic on empty file 143631f (Mahesh Sadupalli)
Potential fix for pull request finding d539556 (kimsungmin1)
chore(deps): bump github/codeql-action/upload-sarif e9eda8c (dependabot[bot])
fix(registry): resolve golangci-lint issues in token-auth tests 503acff (kimsm28)
chore: go mod tidy after rebase on main 4e9ca06 (kimsm28)
fix(registry): use plain-http registry in token-auth scope test 3cbee7e (kimsm28)
Update pkg/registry/client.go 26ada49 (Terry Howe)
test: improve client_scope_test.go to avoid data races and brittle assertions 9b7a70f (kimsm28)
fix typos in withScopeHint function comment ee181f4 (kimsm28)
fix registry test failures by adjusting DockerRegistryHost and auth server listener management 1f0a728 (kimsm28)
fix variable naming requestUrl -> requestURL 8883c9c (kimsm28)
fix typo, remove unnecessary code, fix to avoid to use the assertion in http hanlder 530e728 (kimsm28)
change suite.Nil, suite.NotNill to more proper function(suite.NoError, suite.Error) 26e5071 (kimsungmin1)
change client_scope_test.go to use httptest 8c8d6e3 (kimsungmin1)
fix typo 9d77ccd (kimsungmin1)
remove freeport dependency fc743b2 (kimsungmin1)
add newline in license header 319e06c (kimsungmin1)
fix scope when helm push to a registry that use token auth 301e3a1 (kimsungmin1)
chore(deps): bump github.com/fluxcd/cli-utils from 1.2.1 to 1.2.2 5a9b8a7 (dependabot[bot])
chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 f76136d (dependabot[bot])
Potential fix for pull request finding 144246c (George Jenkins)
chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 07faec5 (dependabot[bot])
Apply suggestions 61bba7c (Will Noble)
Properly format the extra field in gzipped packages d887779 (Will Noble)
refactor(internal): convert tests to testify assert/require addbab2 (George Jenkins)
refactor(internal/release): convert tests to testify assert/require 7ab295f (George Jenkins)
refactor(pkg/release): convert tests to testify assert/require 4cce0e9 (George Jenkins)
refactor(pkg/registry): convert tests to testify assert/require 8b0a167 (George Jenkins)
refactor(internal): convert tests to testify assert/require 3ce02c5 (George Jenkins)
refactor(repotest): convert tests to testify assert/require b42faba (George Jenkins)
chore: enable contextcheck, fatcontext and noctx linters 34cfdfd (Matthieu MOREL)
chore(deps): bump github.com/cyphar/filepath-securejoin a0c7d1e (dependabot[bot])
chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 5848047 (dependabot[bot])
test: use assert.Empty for zero-length assertions in validate_test c36e4d5 (Terry Howe)
docs: fix typo in helm version command description dd442c0 (s3onghyun)
chore(deps): bump the k8s-io group across 1 directory with 7 updates fa68e6c (dependabot[bot])
chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 3d2ff2a (dependabot[bot])
refactor(pkg/strvals): convert tests to testify assert/require daa045d (George Jenkins)
refactor(pkg/cli): convert tests to testify assert/require 16b0760 (George Jenkins)
Revert "fix(kube): prevent spurious early exit in WaitForDelete during informer sync" d3bd091 (George Jenkins)
Update pkg/ignore/rules_test.go 9ad5620 (George Jenkins)
docs: improve CONTRIBUTING.md wording fa9cb49 (devShaik010)
refactor(pkg): convert tests to testify assert/require f4d713a (George Jenkins)
refactor(cmd/helm): convert tests to testify assert/require ed76a36 (George Jenkins)
chore: rename savedErr to clear its specific purpose 9c1d5a3 (Jeaeun Kim)
chore: fix lint 99baa2e (Jeaeun Kim)
chore: store err separately for clarity ea847fe (Jeaeun Kim)
chore: Improve error reporting for helm template --debug with --show-only 2014946 (Jeaeun Kim)
fix panic on repeated IsReachable calls 1f7869c (Mohammad Abdolirad)
fix: protect FailingKubeClient.RecordedWaitOptions from data race (#31925) a5552ed (Terry Howe)
fix: route registry client output to stdout instead of stderr (#32056) c2f1b23 (Terry Howe)
fix(engine): add debug logging when lookup returns empty (#32205) 7058f84 (Ogulcan Aydogan)
chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 74c1702 (dependabot[bot])
chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 33b4071 (dependabot[bot])
chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 1019146 (dependabot[bot])
chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 7f855df (dependabot[bot])
chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 c603c50 (dependabot[bot])
chore(deps): bump github/codeql-action from 4.36.0 to 4.36.1 f8abbfd (dependabot[bot])
chore(deps): bump github.com/tetratelabs/wazero from 1.11.0 to 1.12.0 3aa1b74 (dependabot[bot])
Fix empty and len testifylint violations across test files 488c4a8 (Matthieu MOREL)
lower resync period 6dc1c1c (Austin Abro)
chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 7510b83 (dependabot[bot])
ci: enable bidichk linter to prevent invisible Unicode characters e679ec9 (Arnav Nagzirkar)
fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026 54ae27f (Terry Howe)
chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 dbb3e35 (dependabot[bot])
chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 60665e9 (dependabot[bot])
docs: update version status for v4 stable release 442e146 (Benoit Tigeot)
chore(deps): bump actions/stale from 10.2.0 to 10.3.0 ace245b (dependabot[bot])
fix(provenance): check error return in Digest e095e69 (Sebastien Tardif)
internal/plugin: remove zero-width spaces from plugin name comment 979e68f (Aleksei Sviridkin)
Renamed flag from show-rollback to show-rollback-revision d097d88 (MrJack)
fix: skip non-Pod test hooks in GetPodLogs 1a1ec6e (Gregory Man)
fix(upstream): upgrade to cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 378ceac (Matheus Pimenta)
chore(deps): bump github.com/fluxcd/cli-utils from 1.2.0 to 1.2.1 b5a9299 (dependabot[bot])
chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 f772ffe (dependabot[bot])
fix(repo): use structured slog args in index.go ea2343e (Sebastien Tardif)
docs: fix 'than'->'that' typo in deprecatedAPIError godoc 2032ec5 (Kai Tanaka)
refactor: use slices.Backward to simplify the code 432fc8a (box4wangjing)
Potential fix for pull request finding 53d5f13 (Sumit Solanki)
fix(downloader): order DiskCache.Get checks for overlayfs empty dirs 6620fec (Sumit Solanki)
chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 2cc6925 (dependabot[bot])
chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 d9b2716 (dependabot[bot])
Bump to version v4.2 (#32102) 19b3656 (George Jenkins)
Fix lint errors 03a65a7 (Evans Mungai)
fix: address Copilot review on ownership-verified uninstall 0077130 (Evans Mungai)
Potential fix for pull request finding 9728c5a (Evans Mungai)
fix: address review feedback 922558f (Sebastien Tardif)
fix: fetch logs from all containers in test pods 854f7f6 (Sebastien Tardif)
fix(registry): remove pre-Go-1.20 transport cloner fallback 73f71bc (Ogulcan Aydogan)
testifylint: enable error-is-as and error-nil rules f8ba28b (Matthieu MOREL)
fix(kube): always propagate context.Canceled in WaitForDelete 5e09ee7 (Terry Howe)
fix(kube): prevent spurious early exit in WaitForDelete during informer sync 4e24ee4 (Terry Howe)
fix(v

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM (* 0-3 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-02-27T09:54:33Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: acceptance/go.sum

Command failed: go get -t ./...
go: gopkg.in/go-jose/go-jose.v4@v4.1.5: parsing go.mod:
	module declares its path as: github.com/go-jose/go-jose/v4
	        but was required as: gopkg.in/go-jose/go-jose.v4

fullsend-ai-review · 2026-08-13T17:18:59Z

🤖 Finished Review · ✅ Success · Started 5:18 PM UTC · Completed 5:35 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-14T16:30:03Z

🤖 Finished Review · ✅ Success · Started 4:30 PM UTC · Completed 4:42 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-20T13:14:55Z

🤖 Finished Review · ✅ Success · Started 1:14 PM UTC · Completed 1:26 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-20T19:28:30Z

🤖 Finished Review · ✅ Success · Started 7:28 PM UTC · Completed 7:41 PM UTC

Commit: 87c4a29 · View workflow run →

coderabbitai · 2026-09-10T13:48:14Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 602be9e3-5626-4d4b-b6e8-0a9da19d48ab

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

fullsend-ai-review · 2026-09-10T13:49:23Z

🤖 Finished Review · ✅ Success · Started 1:49 PM UTC · Completed 2:00 PM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $5.66

fullsend-ai-review · 2026-09-10T14:00:28Z

Risk Assessment: moderate (2/5)

Details

Bot-authored major Go module bump touching only 5 dependency manifests with no protected/security/CI paths yields low Tier 1 risk, tempered slightly by very recent multi-author churn on go.mod/go.sum files.

fullsend-ai-review · 2026-09-15T00:53:25Z

🤖 Finished Review · ✅ Success · Started 12:53 AM UTC · Completed 1:01 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $3.22

fullsend-ai-review · 2026-09-15T13:09:16Z

🤖 Finished Review · ✅ Success · Started 1:09 PM UTC · Completed 1:20 PM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $6.56

fullsend-ai-review

See the review comment for full details.

fullsend-ai-review · 2026-09-15T13:20:49Z

 	golang.org/x/exp v0.0.0-20260603202125-055de637280b
 	golang.org/x/sync v0.23.0
-	gopkg.in/go-jose/go-jose.v2 v2.6.3
+	gopkg.in/go-jose/go-jose.v4 v4.1.5


[critical] build-break

The PR removes gopkg.in/go-jose/go-jose.v2 v2.6.3 from acceptance/go.mod (replaced by gopkg.in/go-jose/go-jose.v4 v4.1.5), but acceptance/image/image.go:60 still imports gopkg.in/go-jose/go-jose.v2/json. No source file was updated to the v4 import path. Because Go enforces semantic import versioning (major version >= 2 requires the version suffix in the import path), the acceptance module will fail to build: go build ./... will report that no required module provides gopkg.in/go-jose/go-jose.v2/json. Consistent with Renovate's own "Artifact update problem" comment.

Suggested fix: Either (a) restore the gopkg.in/go-jose/go-jose.v2 v2.6.3 require line and keep v4 as an addition until a follow-up PR migrates the code, or (b) update acceptance/image/image.go (and any other v2 users) to import gopkg.in/go-jose/go-jose.v4/json, adjusting for any API differences, then run go mod tidy in the acceptance module to regenerate go.sum with h1: content hashes.

fullsend-ai-review · 2026-09-15T13:20:49Z

 	cuelang.org/go v0.16.0
 	github.com/CycloneDX/cyclonedx-go v0.10.0
-	github.com/MakeNowJust/heredoc v1.0.0
+	github.com/MakeNowJust/heredoc/v2 v2.0.1


[high] no-op-upgrade

The PR declares github.com/MakeNowJust/heredoc/v2 v2.0.1 as a direct dependency, but no source file was modified to import the v2 path — all 16+ existing imports (e.g. cmd/root/root_cmd.go:29, cmd/validate/image.go:31, internal/policy/policy_test.go:30) still reference github.com/MakeNowJust/heredoc (v1). The PR retains github.com/MakeNowJust/heredoc v1.0.0 in the indirect-require block, and go.sum adds only a /go.mod hash for v2 with no h1: module-content hash — Go never actually fetched or built v2's source. The intended major-version upgrade is a no-op; the codebase continues to run against v1.

Suggested fix: Either (a) migrate all github.com/MakeNowJust/heredoc imports to github.com/MakeNowJust/heredoc/v2 and run go mod tidy so v1 is removed and go.sum gains the h1: hash, or (b) drop the v2 require line entirely, since nothing consumes it.

fullsend-ai-review · 2026-09-15T13:20:49Z

 	github.com/package-url/packageurl-go v0.1.3
 	github.com/qri-io/jsonpointer v0.1.1
-	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3


[high] no-op-upgrade

The PR declares github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 as a direct dependency, but no source file imports the v6 path — the three consumers (internal/policy/policy.go:31, internal/evaluation_target/application_snapshot_image/application_snapshot_image.go:33, pkg/schema/schema.go:23) all still import github.com/santhosh-tekuri/jsonschema/v5, and v5 is retained in the indirect-require block. go.sum adds only a /go.mod hash for v6, with no h1: module-content hash. The claimed major-version upgrade does not take effect at runtime; jsonschema/v5 continues to be linked into the binary.

Suggested fix: Either migrate all jsonschema/v5 imports to jsonschema/v6 (the v6 API differs — Compile returns different types, resource resolution uses Loader interface, etc., so adjust callers) and run go mod tidy, or drop the v6 require line.

fullsend-ai-review · 2026-09-15T13:20:49Z

 	gotest.tools/gotestsum v1.12.1
-	helm.sh/helm/v3 v3.20.2
+	helm.sh/helm/v3 v3.22.0
+	helm.sh/helm/v4 v4.3.0


[high] no-op-upgrade

The PR adds helm.sh/helm/v4 v4.3.0 as a direct dependency in tools/go.mod, but no source file imports helm.sh/helm/v4. The only consumer is tools/tools.go:29, which blank-imports _ "helm.sh/helm/v3/cmd/helm" — and the PR simultaneously bumps helm.sh/helm/v3 from v3.20.2 to v3.22.0 (so v3 is still in use). tools/go.sum adds only a /go.mod hash for helm/v4 with no h1: content hash. Since tools/tools.go exists specifically to pin developer tool binaries, adding helm/v4 without a corresponding blank import means the v4 binary will not be built or version-pinned by the tools module.

Suggested fix: Either add _ "helm.sh/helm/v4/cmd/helm" to tools/tools.go (and decide whether v3 should be dropped), or remove the v4 require line from tools/go.mod. Then run go mod tidy in the tools module.

renovate Bot added main major renovate labels Feb 27, 2026

github-actions Bot added the size: S label Feb 27, 2026

renovate Bot force-pushed the renovate/main-major-go-modules branch from 3061ab1 to ad5b351 Compare February 27, 2026 09:54

github-actions Bot added size: L and removed size: S labels Feb 27, 2026

renovate Bot force-pushed the renovate/main-major-go-modules branch 7 times, most recently from 55a7196 to ca1e8bd Compare March 12, 2026 12:48

renovate Bot force-pushed the renovate/main-major-go-modules branch 3 times, most recently from 4ddfa54 to 6a6166b Compare March 18, 2026 09:16

renovate Bot force-pushed the renovate/main-major-go-modules branch 3 times, most recently from 8eb3e76 to f1aa247 Compare March 26, 2026 13:42

github-actions Bot added size: XS and removed size: L labels Mar 26, 2026

renovate Bot force-pushed the renovate/main-major-go-modules branch 2 times, most recently from 7c8ec28 to 2b721f7 Compare April 1, 2026 17:17

renovate Bot force-pushed the renovate/main-major-go-modules branch 2 times, most recently from 2be196d to 458ca5f Compare April 10, 2026 21:58

renovate Bot force-pushed the renovate/main-major-go-modules branch from 458ca5f to 61bcaeb Compare April 16, 2026 19:20

renovate Bot force-pushed the renovate/main-major-go-modules branch from e59397d to 6df0bd0 Compare August 13, 2026 17:17