Update Go Dependencies by red-hat-konflux[bot] · Pull Request #370 · securesign/fulcio

red-hat-konflux · 2026-03-30T18:48:30Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Pending
chainguard.dev/sdk	require	patch	`v0.1.103` → `v0.1.228`	`v0.1.244` (+15)
cloud.google.com/go/auth	indirect	minor	`v0.22.0` → `v0.23.2`
cloud.google.com/go/iam	indirect	minor	`v1.12.0` → `v1.13.0`
cloud.google.com/go/longrunning	indirect	major	`v0.8.0` → `v1.2.0`
cloud.google.com/go/security	require	minor	`v1.26.0` → `v1.27.0`
github.com/Azure/azure-sdk-for-go/sdk/azcore	indirect	minor	`v1.22.0` → `v1.23.1`
github.com/Azure/azure-sdk-for-go/sdk/azidentity	indirect	patch	`v1.14.0` → `v1.14.1`
github.com/AzureAD/microsoft-authentication-library-for-go	indirect	minor	`v1.7.2` → `v1.9.0`
github.com/ThalesGroup/crypto11	require	patch	`v1.6.4` → `v1.6.8`
github.com/aws/aws-sdk-go-v2	indirect	minor	`v1.43.0` → `v1.45.1`
github.com/aws/aws-sdk-go-v2/config	indirect	minor	`v1.32.31` → `v1.33.2`
github.com/aws/aws-sdk-go-v2/credentials	indirect	minor	`v1.19.30` → `v1.20.2`
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	indirect	minor	`v1.18.31` → `v1.19.1`
github.com/aws/aws-sdk-go-v2/internal/configsources	indirect	minor	`v1.4.31` → `v1.5.1`
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	indirect	minor	`v2.7.31` → `v2.8.1`
github.com/aws/aws-sdk-go-v2/internal/v4a	indirect	minor	`v1.4.32` → `v1.5.1`
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	indirect	patch	`v1.13.13` → `v1.13.19`
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	indirect	minor	`v1.13.31` → `v1.14.1`
github.com/aws/aws-sdk-go-v2/service/kms	indirect	minor	`v1.55.0` → `v1.58.0`
github.com/aws/aws-sdk-go-v2/service/signin	indirect	minor	`v1.5.0` → `v1.8.0`
github.com/aws/aws-sdk-go-v2/service/sso	indirect	minor	`v1.33.0` → `v1.36.0`
github.com/aws/aws-sdk-go-v2/service/ssooidc	indirect	minor	`v1.38.0` → `v1.41.0`
github.com/aws/aws-sdk-go-v2/service/sts	indirect	minor	`v1.45.0` → `v1.48.0`
github.com/aws/smithy-go	indirect	minor	`v1.27.4` → `v1.28.1`
github.com/bmatcuk/doublestar/v4	indirect	minor	`v4.9.1` → `v4.10.0`
github.com/cenkalti/backoff/v4	indirect	major	`v4.3.0` → `v7.0.0`
github.com/cenkalti/backoff/v5	indirect	major	`v5.0.3` → `v7.0.0`
github.com/clipperhouse/uax29/v2	indirect	minor	`v2.2.0` → `v2.7.0`
github.com/google/go-containerregistry	indirect	minor	`v0.21.7` → `v0.22.0`	`v0.22.1`
github.com/googleapis/api-linter/v2	indirect	minor	`v2.0.0` → `v2.3.1`
github.com/googleapis/enterprise-certificate-proxy	indirect	patch	`v0.3.19` → `v0.3.20`
github.com/googleapis/gax-go/v2	indirect	minor	`v2.23.0` → `v2.24.0`	`v2.24.1`
github.com/grpc-ecosystem/go-grpc-middleware	require	major	`v1.4.0` → `v2.3.4`
github.com/grpc-ecosystem/go-grpc-middleware/v2	indirect	patch	`v2.3.3` → `v2.3.4`
github.com/grpc-ecosystem/grpc-gateway/v2	indirect	minor	`v2.27.3` → `v2.30.0`
github.com/grpc-ecosystem/grpc-gateway/v2	require	minor	`v2.29.0` → `v2.30.0`
github.com/hashicorp/hcl	indirect	major	`v1.0.1-vault-7` → `v2.24.0`
github.com/letsencrypt/boulder	indirect	minor	`v0.20260720.0` → `v0.20260825.0`	`v0.20260901.0`
github.com/magiconair/properties	require	minor	`v1.8.10` → `v1.18.11`
github.com/mattn/go-runewidth	indirect	patch	`v0.0.21` → `v0.0.28`	`v0.0.29`
github.com/olekukonko/tablewriter	indirect	major	`v0.0.5` → `v1.1.4`
github.com/prometheus/client_model	require	patch	`v0.6.2` → `v0.6.3`
github.com/prometheus/common	require	minor	`v0.70.1` → `v0.71.0`
github.com/prometheus/procfs	indirect	minor	`v0.21.1` → `v0.22.0`
github.com/rogpeppe/go-internal	indirect	minor	`v1.14.1` → `v1.16.0`
github.com/secure-systems-lab/go-securesystemslib	indirect	patch	`v0.11.0` → `v0.11.1`
github.com/sigstore/protobuf-specs	require	patch	`v0.5.1` → `v0.5.2`
github.com/sigstore/sigstore	require	patch	`v1.10.8` → `v1.10.9`
github.com/sigstore/sigstore/pkg/signature/kms/aws	require	patch	`v1.10.8` → `v1.10.9`
github.com/sigstore/sigstore/pkg/signature/kms/azure	require	patch	`v1.10.8` → `v1.10.9`
github.com/sigstore/sigstore/pkg/signature/kms/gcp	require	patch	`v1.10.8` → `v1.10.9`
github.com/sigstore/sigstore/pkg/signature/kms/hashivault	require	patch	`v1.10.8` → `v1.10.9`
github.com/stretchr/testify	require	minor	`v1.11.1` → `v1.12.1`
github.com/tink-crypto/tink-go-gcpkms/v2	require	minor	`v2.3.0` → `v2.4.0`
github.com/tink-crypto/tink-go/v2	require	minor	`v2.7.0` → `v2.8.0`
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	indirect	minor	`v0.69.0` → `v0.71.0`
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	indirect	minor	`v0.69.0` → `v0.71.0`
go.opentelemetry.io/otel	indirect	minor	`v1.44.0` → `v1.46.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace	indirect	minor	`v1.44.0` → `v1.46.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	indirect	minor	`v1.44.0` → `v1.46.0`
go.opentelemetry.io/otel/metric	indirect	minor	`v1.44.0` → `v1.46.0`
go.opentelemetry.io/otel/sdk	indirect	minor	`v1.44.0` → `v1.46.0`
go.opentelemetry.io/otel/trace	indirect	minor	`v1.44.0` → `v1.46.0`
go.yaml.in/yaml/v3	indirect	patch	`v3.0.4` → `v3.0.5`
go.yaml.in/yaml/v3	require	patch	`v3.0.4` → `v3.0.5`
goa.design/goa/v3	require	minor	`v3.28.0` → `v3.30.0`
golang.org/x/crypto	indirect	minor	`v0.54.0` → `v0.55.0`	`v0.56.0`
golang.org/x/net	indirect	minor	`v0.55.0` → `v0.58.0`
golang.org/x/net	indirect	minor	`v0.57.0` → `v0.58.0`
golang.org/x/sync	indirect	minor	`v0.20.0` → `v0.22.0`
golang.org/x/sys	indirect	minor	`v0.45.0` → `v0.47.0`
golang.org/x/text	indirect	minor	`v0.37.0` → `v0.41.0`
golang.org/x/text	indirect	minor	`v0.40.0` → `v0.41.0`
google.golang.org/api	require	minor	`v0.290.0` → `v0.296.0`	`v0.297.0`
google.golang.org/genproto	indirect	digest	`3fe39f3` → `18b4a75`
google.golang.org/genproto/googleapis/api	indirect	digest	`d00831a` → `18b4a75`
google.golang.org/genproto/googleapis/api	require	digest	`3fe39f3` → `18b4a75`
google.golang.org/genproto/googleapis/rpc	indirect	digest	`d00831a` → `18b4a75`
google.golang.org/genproto/googleapis/rpc	indirect	digest	`3fe39f3` → `18b4a75`
google.golang.org/grpc	indirect	minor	`v1.79.3` → `v1.83.2`
google.golang.org/grpc	require	minor	`v1.82.1` → `v1.83.2`
google.golang.org/grpc/cmd/protoc-gen-go-grpc	indirect	patch	`v1.6.1` → `v1.6.2`
google.golang.org/protobuf	indirect	patch	`v1.36.11` → `v1.36.12`
google.golang.org/protobuf	require	patch	`v1.36.12-0.20260120151049-f2248ac996af` → `v1.36.12`

Release Notes

chainguard-dev/sdk (chainguard.dev/sdk)

`v0.1.228`

Compare Source

Update chainguard.dev/apko dependency to v1.2.43

`v0.1.227`

Compare Source

Add image selection to AddChart: AddChartRequest.images picks which chart images to provision by repo name, AddChartResult reports per-image requirement and entitlement slot use, and ChartImage carries the catalog repo_name

`v0.1.226`

Compare Source

Move PackageInfo from the registry proto to the shared packages proto

`v0.1.225`

Compare Source

registry v1: add image group membership fields (included_in_image_group, image_group_name, external_image_group_id) to EntitlementImage and EntitledImage.
registry v1: RemoveEntitlementImages and SwapEntitlementImages now populate id on the images they report as removed.

`v0.1.224`

Compare Source

Add the chainguard.platform.actions.v1alpha2 Actions service, exposing the GitHub Actions dependency graph: SetDependencies, SetHardenedRevision, ListDependents and ListRevisions. Reads are scoped per group; both capabilities are internal only.

`v0.1.223`

Compare Source

Update MockRegistryClient, move MockChartsClient and MockPoliciesClient.
Renames PackageLicense to PackageInfo since the name is misleading, this message can carry additional APK identity fields.

`v0.1.222`

Compare Source

Add the SANDBOX service principal for the ACID sandbox Runs control plane

`v0.1.221`

Compare Source

Add ListChartImageBindings batch RPC and ChartImageBinding.image_repo field; ChartImageBinding.chart_repo values are now chainguard-private chart repo UIDPs instead of bare names (wire type unchanged).
Add new capability and role for being able to access Athena documentation without having any further capabilities.
Add updated_since timestamps to ListOrgVulnsRequest and ArgosDocumentFilter

`v0.1.220`

Compare Source

Add ComponentLocationChanged advisory event to advisory v2 api

`v0.1.219`

Compare Source

Extends FetchPolicyInputResponse and PolicyInput to carry the license of the package(s) in an image.

`v0.1.218`

Compare Source

Update MockRegistryClient

`v0.1.217`

Compare Source

Add artifact_id to policy Override, identifying the waived artifact by image digest or package URL. The digest field is deprecated and now mirrors artifact_id.

`v0.1.216`

Compare Source

Add ListCatalogImages to the v2 registry API for browsing the published Chainguard Images catalog

`v0.1.215`

Compare Source

Add database_specific.chainguard.fixed_artifacts to the Athena OSV record, naming the exact published Chainguard rebuilds that contain a fix and the upstream version each was built from

`v0.1.214`

Compare Source

Add source_types filter to the Libraries v1 Artifacts List and ListVersions APIs

`v0.1.213`

Compare Source

Regenerate protobuf code with Go 1.27.0 (comment formatting only, no functional changes)

`v0.1.212`

Compare Source

Retry the HTTP/1-downgrade STS exchange on 5xx responses, matching the gRPC path

`v0.1.211`

Compare Source

Add libraries.remote_registries.{create,list,delete} capabilities for the upcoming RemoteRegistry resource

`v0.1.210`

Compare Source

Automated release.

`v0.1.209`

Compare Source

Update chainguard.dev/apko to v1.2.36, chainguard.dev/melange to v0.58.0, github.com/chainguard-dev/terraform-provider-cosign to v0.4.14

`v0.1.208`

Compare Source

iam: mark the OIDC client_secret and the one-time SCIM bearer token (GenerateScimTokenResponse/RegenerateScimTokenResponse) as debug_redact so redaction-aware log formatting omits these credentials.

`v0.1.207`

Compare Source

Expose chainctl errors when fetching token

`v0.1.206`

Compare Source

Add receiver.NewHTTPHandler for serving verified Chainguard webhooks, and return an error instead of panicking when request data is absent

`v0.1.205`

Compare Source

guardener: add Guardener.ListScans and Guardener.GetScan with the guardener.scan.list and guardener.scan.get capabilities (granted to viewers) — list summaries of a group's repository dependency scans (newest per repository) and fetch one scan by id (artifact purls, declaring file paths, and artifact relationships).
Add OverlayBindingCreatedEventType and OverlayBindingDeletedEventType CloudEvents constants

`v0.1.204`

Compare Source

Clarify the LibrariesRebuilderSourceResolverCaps capability-bundle documentation

`v0.1.203`

Compare Source

BREAKING (registry v2beta1): Overlay.packages is replaced by Overlay.config, a CustomOverlay message matching Repo.custom_overlay. Send config: {contents: {packages: [...]}}; only config.contents.packages is accepted and any other field fails with InvalidArgument.

`v0.1.202`

Compare Source

Add the libraries v2beta1 RequestGroups service for requesting Chainguard-built library versions and tracking them per library

`v0.1.201`

Compare Source

Add hardened and keywords fields to the Skills catalog Skill (ListSkills/GetSkill/UpdateSkill)

`v0.1.200`

Compare Source

Remove the referenced_by field from the v2beta1 Overlay payload. Find an overlay's attachments via ListOverlayBindings filtered to the overlay.

`v0.1.199`

Compare Source

Update MockEntitlementsClient
Add Registry.GetRepoTagsSummary

`v0.1.198`

Compare Source

Add the registry v2beta1 Overlays services for tag-scoped Custom Assembly: create, get, list, and delete reusable packages-only overlays, and attach or detach them to repos under exact-tag selectors via overlay bindings, with paginated lists and CloudEvents on mutations. New capabilities registry.overlays.list and registry.overlays.edit.

`v0.1.197`

Compare Source

Add the dev.chainguard.entitlement.changed.v1 CloudEvent type (public/sdk/events/entitlements)

`v0.1.196`

Compare Source

: Add swap capability to owners

`v0.1.195`

Compare Source

Add the correlation_rule field and CorrelationRule enum to the v1 IdentityProviders OIDC config

`v0.1.194`

Compare Source

Add deduplicate_results to MalwareBlockListFilter to collapse block list entries flagged by multiple advisories

`v0.1.193`

Compare Source

Add ParseChartLockAttestationFromPayload for parsing chart-lock predicates from unwrapped in-toto statements

`v0.1.192`

Compare Source

Add GO and GO_ATHENA Libraries ecosystem enum values and libraries.go.list/create capabilities

`v0.1.191`

Compare Source

Add clients/v2 aggregator for the v2 (GA) API surface.

`v0.1.190`

Compare Source

Add database_specific.patch_status to Athena OSV records where applicable. Patch status currently indicates the status of the reported version's patch, not all potentially affected versions. To see if the version you are interested in has been patched, look at the affected[].ranges[].events[].fixed to see what has been patched, or verify your version doesn't show up in the affected[].versions array.

`v0.1.189`

Compare Source

Add iam v2 (GA) API surface — identical copy of v2beta1 (9 services) served at /iam/v2/ paths; activates ping and events v2 registration.

`v0.1.188`

Compare Source

Add built-in rebuilder IAM roles libraries.rebuilder.source-resolver (source-coordinate write) and libraries.rebuilder.resolve (enqueue-only on-demand resolution).

`v0.1.187`

Compare Source

Add the SkillsHarden API (POST /skills/v1alpha1/harden) for submitting uploaded skill artifacts to be hardened, plus a deterministic harden job-id helper.

`v0.1.186`

Compare Source

Add events v2 (GA) API surface — identical copy of v2beta1 Subscriptions, served at /events/v2/ paths once registered.

`v0.1.185`

Compare Source

Add Entitlements.SwapEntitlementImages: atomically remove and add catalog images on an organization's entitlements in one call, gated on the new registry.entitlements.images.swap capability and charged against the rolling 30-day swap quota.

`v0.1.184`

Compare Source

Add ping v2 (GA) API surface — identical copy of v2beta1, served at /ping/v2/ paths once registered.

`v0.1.183`

Compare Source

Add registry v2 (GA) API surface — identical copy of v2beta1 Repos/Tags/Images served at /registry/v2/ paths.

`v0.1.182`

Compare Source

Add the internal-only libraries.rebuilder.source_coordinates.resolve capability.
libraries: corrected stale LibraryPolicyBindings ecosystem doc-strings (JAVA is accepted alongside JAVASCRIPT and PYTHON). Comment-only; no API or behavior change.

`v0.1.181`

Compare Source

Add advisory v2 (GA) API surface — identical copy of v2beta1 served at /advisory/v2/ paths.

`v0.1.180`

Compare Source

Add the internal-only libraries.rebuilder.source_coordinates.write capability.

`v0.1.179`

Compare Source

Automated release.

`v0.1.178`

Compare Source

Add the correlation_rule field and CorrelationRule enum to the v2beta1 IdentityProviders OIDC config
Preserve correlation_rule in v2beta1 IdentityProvider audit-event payloads

`v0.1.177`

Compare Source

Add vulnerabilities v2 (GA) API surface — identical copy of v2beta1 served at /vulnerabilities/v2/ paths.

`v0.1.176`

Compare Source

Create a MICROVM service principal

`v0.1.175`

Compare Source

Add libraries v2 (GA) API surface — identical copy of v2beta1 served at /libraries/v2/ paths.

`v0.1.174`

Compare Source

Update dependencies: google.golang.org/grpc v1.83.0, cloud.google.com/go/longrunning v1.2.0, and golang.org/x/exp.

`v0.1.173`

Compare Source

Update dependencies: apko v1.2.33, go-grpc-kit v0.18.0, aws-sdk-go-v2 v1.43.3, go-oidc/v3 v3.20.0, google.golang.org/api v0.291.0, and k8s.io/apimachinery v0.36.3.
Add the skills.harden capability (CAP_SKILLS_HARDEN) gating access to the Skills harden API.

`v0.1.172`

Compare Source

argos OSV records now carry a repeated sink_locator (multiple confirmed sinks per vulnerability) instead of a single sink.

`v0.1.171`

Compare Source

Add ArgosOSVDumperCaps and CAP_ARGOS_OSV_DUMP capability, which are required for the OSV Dump API

`v0.1.170`

Compare Source

libraries: add DOTNET and DOTNET_ATHENA to the Ecosystem enum and the libraries.dotnet.list / libraries.dotnet.create capabilities. Gated off by default per environment; inert until enabled.

`v0.1.169`

Compare Source

WhoAmI capability entries resolve group-mapped roles to one entry per role and carry the raw capabilities.

`v0.1.168`

Compare Source

Annotate Roles.{Create,Update,Delete} RPCs with audit event annotations (audience: CUSTOMER)

`v0.1.167`

Compare Source

Preserve pkce_enabled in v1 and v2beta1 IdentityProvider audit-event payloads

`v0.1.166`

Compare Source

Add skills.{list,write,delete} capabilities (writes internal-only)
Skills catalog API: ListSkills takes a UIDP filter (org-agnostic); add UpdateSkill (AIP-134 create-or-update) and DeleteSkill

`v0.1.165`

Compare Source

Refactors octosts credential helpers to use consistent TokenSource setup for all funcs.

`v0.1.164`

Compare Source

Add auth.ExtractAudiences and token.ListAudiences helpers
GetEffectiveEntitlements now returns swap_refill_time: when the organization's next catalog-image swap becomes available (set only when no swaps are currently available).

`v0.1.163`

Compare Source

ArgosDocuments: ArgosDocument gains output-only per-file bindings (filename, analysis status, CGP IDs), derived by the platform from the submission archive.

`v0.1.162`

Compare Source

Add the Charts.FindChart RPC and ChartCatalog enum to chainguard.platform.registry.v1 for server-side chart name resolution.

`v0.1.161`

Compare Source

Add the libraries/v1 ResolutionCache service (Zap, SetOptOut, Status, List) and the CAP_LIBRARIES_CACHE_LIST capability for managing the Libraries resolution cache.

`v0.1.160`

Compare Source

chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1

`v0.1.159`

Compare Source

feat(skills): public Skills catalog API — ListSkills/GetSkill (ACID-363) (#47844)

`v0.1.158`

Compare Source

add image-to-chart lookup to api (#48009)

`v0.1.157`

Compare Source

docs(iter): fix SDK-3 violation in doc.go integration example [skillup] (#48063)

`v0.1.156`

Compare Source

oidc: enable public OIDC clients (client id + PKCE) (#47654)

`v0.1.155`

Compare Source

feat(sdk): add SCIM token lifecycle surface to v1 IdentityProviders (#47753)

`v0.1.154`

Compare Source

refactor(policies): policies declare a single supported_resource_type (#47245)

`v0.1.153`

Compare Source

fix(public/sdk/hack): add doc.go and example_test.go [skillup] (#47670)

`v0.1.152`

Compare Source

fix(iter): use cmp.Or for page size default [skillup] (#47682)

`v0.1.151`

Compare Source

fix(scim): decouple token lifecycle from provisioning enablement (#47522)

`v0.1.150`

Compare Source

feat(registry): enforce catalog-image swap quota and expose it in GetEffectiveEntitlements (#47230)
fix(sdk/sts): send HTTP/1 downgrade STS requests form-encoded (#47475)

`v0.1.149`

Compare Source

feat(private-osv): add OSV-spec withdrawn field (#47542)

`v0.1.148`

Compare Source

test(capabilities): bit-space hygiene invariants via descriptor reflection (CUS-849) (#46213)

`v0.1.147`

Compare Source

feat(capabilities): StringifyAllContext, Parse error propagation, Set.String placeholders (CUS-849) (#46212)

`v0.1.146`

Compare Source

fix(libraries): partial package search on malware blocklist (#45938)

`v0.1.145`

Compare Source

fix(iam): add description to hidden MCP annotations [skillup] (#47353)

`v0.1.144`

Compare Source

feat(scim): implement token lifecycle service (#47071)

`v0.1.143`

Compare Source

fix(sdk/sts): honor HTTP(S)_PROXY in HTTP/1 downgrade exchanger CUS-1012 (#46170)

`v0.1.142`

Compare Source

test(registry): pin PathMutation uid/gid presence semantics (CON-1931 follow-up) (#47018)

`v0.1.141`

Compare Source

chore(deps): bump chainguard.dev/apko to v1.2.23 (CON-1931) (#46716)
fix(sdk): add missing example_test.go and doc.go files [skillup] (#47151)

`v0.1.140`

Compare Source

fix(ping): add mcp description to Ping RPC annotation [skillup] (#47141)

`v0.1.139`

Compare Source

fix: add missing doc.go and example_test.go files [skillup] (#47136)

`v0.1.138`

Compare Source

fix(advisory): rename reports field to resolved_vulns_reports [skillup] (#47040)
feat(scim): define token lifecycle API and permissions (#46676)

`v0.1.137`

Compare Source

feat(advisory): migrate SecurityAdvisory endpoints to v2beta1 (#45820)

`v0.1.136`

Compare Source

feat(iam): add a guardener service principal (#46988)

`v0.1.135`

Compare Source

feat(chainctl): add hidden policies validate subcommand (#45586)

`v0.1.134`

Compare Source

feat(capabilities): mark all rebuilder-api capabilities internal_only

`v0.1.133`

Compare Source

feat(osv-dump)[ARG-201] Add OSV Dump and wire up staging to build the tarball manually (#45694)

`v0.1.132`

Compare Source

feat(roles): adds custom policies capabilities (#46535)

`v0.1.131`

Compare Source

feat(registry): add CreateTag, promote DeleteTag to v2beta1, remove v2alpha1 (#45208)

`v0.1.130`

Compare Source

oidc: Add backend support for custom IDPs to enable PKCE (#44767)

`v0.1.129`

Compare Source

docs(sdk): add doc.go and example tests for githubflow, uploads, uidp [skillup] (#46514)

`v0.1.128`

Compare Source

feat(rexie): the split rexie protocol packages + class capabilities (#46559)

`v0.1.127`

Compare Source

feat(guardener): on-demand actions migration API with long-running operations (#45466)

`v0.1.126`

Compare Source

fix(iam/v2beta1): add field_behavior to oidc oneof field [skillup] (#46469)

`v0.1.125`

Compare Source

fix(iter): add maxPages ceiling and fix test UIDs [skillup] (#46063)

`v0.1.124`

Compare Source

feat(libraries): cache source_type/malware, default to Chainguard-built with upstream opt-in (#45337)

`v0.1.123`

Compare Source

feat(libraries): reject inert allow entries; warn on block/allow overlap (#45684)

`v0.1.122`

Compare Source

feat(registry): add custom APK keyring proto fields (CON-1873, PR 1/6) (#43731)

`v0.1.121`

Compare Source

feat(chainctl): filter required/optional helm refs (#44641)

`v0.1.120`

Compare Source

Elastic Build: the event producer for the build index (#45935)

`v0.1.119`

Compare Source

fix(iam/v2beta1): add CloudEvents annotations and event.go for roles [skillup] (#45982)

`v0.1.118`

Compare Source

aws-marketplace: move LIST cap to viewer role (#45964)

`v0.1.117`

Compare Source

feat(rebuilder-api) add untrusted to libraries.rebuilder.admin, sa-signer, sa-publish, sa-build for updating status with minted JWT (#45858)

`v0.1.116`

Compare Source

feat(libraries): surface Athena entitlement tiers in public APIs (#45765)

`v0.1.115`

Compare Source

feat(registry): promote RepoReadme endpoints to v2beta1 (#45740)

`v0.1.114`

Compare Source

feat(guardener): add support-only entitlement service (#45525)

`v0.1.113`

Compare Source

feat(iam): add v1 ExternalGroupRoleMappings BatchDelete (#45725)

`v0.1.112`

Compare Source

feat(rexie): the deployed edge — REv2 surface over an in-process scheduler (#45292)
fix(api-impl/registry): resolve UpdateRepoReadme authz scope and honor update_mask (#45530)

`v0.1.111`

Compare Source

fix #45468: auth/aws.VerifyToken: canonicalize audience/identity header values to match SigV4 (whitespace hygiene) (#45470)

`v0.1.110`

Compare Source

feat(policies-proto): allow ValidatePolicy to accept parameter_schemas (#45492)

`v0.1.109`

Compare Source

feat(api-impl/registry): error on managed repo field changes for synced repos (#45363)

`v0.1.108`

Compare Source

feat(libraries): persist LibraryPolicy blocked_licenses end to end (#45373)

`v0.1.107`

Compare Source

fix(sdk/auth/aws): require binding headers, host, and date to be signed in VerifyToken (#45286)

`v0.1.106`

Compare Source

feat(chainctl): add guardener github status to list linked GitHub orgs (#45328)

`v0.1.105`

Compare Source

Policies/add validate policy rpc (#44846)
feat(dfc): add a server-built build report with base image changes (#45187)

`v0.1.104`

Compare Source

feat(iam): grant guardener admin capabilities to the Owner role (#45194)

googleapis/google-cloud-go (cloud.google.com/go/auth)

`v0.23.0`

Compare Source

bigquery: Add DDL stats to query statistics.
bigtable:
- cbt: Add cells-per-column limit for row lookup.
- cbt: Make it possible to combine read filters.
dlp: v2beta2 client removed. Use the v2 client instead.
firestore, spanner: Fix compilation errors due to protobuf changes.

AzureAD/microsoft-authentication-library-for-go (github.com/AzureAD/microsoft-authentication-library-for-go)

`v1.9.0`

Compare Source

What's Changed

ci: stage MSAL Go pipeline + add Managed Identity IMDS & Azure Arc E2E tests by @gladjohn in #641
Fix intermittent "context canceled" token failures in managed identity retry() by @4gust in #642
Add user-assigned managed identity (UAMI) support for Azure Arc (MSAL.NET #6128 parity) by @gladjohn in #644
Reject legacy RFC 1423 encrypted PEM in CertFromPEM by @Robbie-Microsoft in #645
Harden regional authority validation by @4gust in #650
fix(managedidentity): pin Service Fabric TLS certificate by @4gust in #656
Fix ID token credential type casing by @4gust in #657
Fix WS-Trust endpoint selection helper by @4gust in #655
Prepare MSAL Go 1.9.0 release by @4gust in #658

Full Changelog: AzureAD/microsoft-authentication-library-for-go@v1.8.0...v1.9.0

`v1.8.0`

[Compare Source](https://redirect.github.com/AzureAD/microsoft-authentication-li

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

red-hat-konflux · 2026-04-02T18:53:41Z

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

1 additional dependency was updated

Details:

Package	Change
`github.com/googleapis/gax-go/v2`	`v2.19.0` -> `v2.20.0`

red-hat-konflux · 2026-04-02T23:59:34Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated

Details:

Package	Change
`google.golang.org/protobuf`	`v1.36.11` -> `v1.36.12-0.20260120151049-f2248ac996af`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.41.10` -> `v1.44.0`

red-hat-konflux · 2026-07-13T11:32:34Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: module chainguard.dev/sdk@v0.1.228 requires go >= 1.27.0; switching to go1.27.1
go: downloading go1.27.1 (linux/amd64)
go: github.com/ThalesGroup/crypto11@v1.6.8: parsing go.mod:
	module declares its path as: github.com/eclipse-keypont/crypto11
	        but was required as: github.com/ThalesGroup/crypto11

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot added the dependencies label Mar 30, 2026

red-hat-konflux Bot changed the title ~~chore(deps): update go dependencies to d5a96ad~~ chore(deps): update go dependencies Mar 31, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/go-deps branch 7 times, most recently from 65b0879 to dae0ecf Compare April 2, 2026 18:53

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/go-deps branch from dae0ecf to 94ce3dc Compare April 2, 2026 23:59

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/go-deps branch 18 times, most recently from b529537 to 4f52300 Compare April 8, 2026 06:41

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/go-deps branch 27 times, most recently from f7e04ac to 5ab5acd Compare April 20, 2026 16:54

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/go-deps branch from 5ab5acd to 196c4df Compare April 20, 2026 22:20

Update Go Dependencies

761d546

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

Navigation Menu

Uh oh!

Update Go Dependencies - #370

Update Go Dependencies#370
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main/go-deps

red-hat-konflux Bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

red-hat-konflux Bot commented Apr 2, 2026

Uh oh!

red-hat-konflux Bot commented Apr 2, 2026 •

edited

Loading

Uh oh!

red-hat-konflux Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

red-hat-konflux Bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

Configuration

Documentation

Uh oh!

red-hat-konflux Bot commented Apr 2, 2026

ℹ Artifact update notice

File name: go.mod

Uh oh!

red-hat-konflux Bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

red-hat-konflux Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

red-hat-konflux Bot commented Mar 30, 2026 •

edited

Loading

red-hat-konflux Bot commented Apr 2, 2026 •

edited

Loading

red-hat-konflux Bot commented Jul 13, 2026 •

edited

Loading