Skip to content

Update go modules (main)#3131

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/main-go-modules
Open

Update go modules (main)#3131
renovate[bot] wants to merge 1 commit intomainfrom
renovate/main-go-modules

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Feb 27, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Adoption Passing Confidence
github.com/conforma/go-containerregistry replace digest 6f40a373459088
github.com/daixiang0/gci require minor v0.13.7v0.14.0 age adoption passing confidence
github.com/golangci/golangci-lint/v2 require minor v2.11.4v2.12.1 age adoption passing confidence
github.com/konflux-ci/application-api require digest e7eb2ec5154ad2 age adoption passing confidence
github.com/open-policy-agent/opa require minor v1.15.2v1.16.1 age adoption passing confidence
github.com/pkg/diff require digest 20ebb0f4e6772a age adoption passing confidence
github.com/secure-systems-lab/go-securesystemslib require minor v0.10.0v0.11.0 age adoption passing confidence
github.com/testcontainers/testcontainers-go require minor v0.34.0v0.42.0 age adoption passing confidence
github.com/testcontainers/testcontainers-go/modules/registry require minor v0.34.0v0.42.0 age adoption passing confidence
github.com/wiremock/go-wiremock require minor v1.11.0v1.16.0 age adoption passing confidence
golang.org/x/benchmarks require digest a2b48b63c86609 age adoption passing confidence
golang.org/x/exp require digest df92998746e56f age adoption passing confidence
golang.org/x/text require minor v0.35.0v0.36.0 age adoption passing confidence
gotest.tools/gotestsum require minor v1.12.1v1.13.0 age adoption passing confidence
k8s.io/api require minor v0.35.0v0.36.0 age adoption passing confidence
k8s.io/api require minor v0.35.3v0.36.0 age adoption passing confidence
k8s.io/apiextensions-apiserver require minor v0.34.3v0.36.0 age adoption passing confidence
k8s.io/apimachinery require minor v0.35.0v0.36.0 age adoption passing confidence
k8s.io/apimachinery require minor v0.35.3v0.36.0 age adoption passing confidence
k8s.io/client-go require minor v0.35.0v0.36.0 age adoption passing confidence
k8s.io/client-go require minor v0.35.3v0.36.0 age adoption passing confidence
k8s.io/klog/v2 require minor v2.130.1v2.140.0 age adoption passing confidence
k8s.io/kube-openapi require digest 589584f927ab1f age adoption passing confidence
k8s.io/kubernetes require minor v1.34.2v1.36.0 age adoption passing confidence
sigs.k8s.io/kind require minor v0.26.0v0.31.0 age adoption passing confidence
sigs.k8s.io/kustomize/api require minor v0.20.1v0.21.1 age adoption passing confidence
sigs.k8s.io/kustomize/kustomize/v5 require minor v5.7.1v5.8.1 age adoption passing confidence
sigs.k8s.io/kustomize/kyaml require minor v0.20.1v0.21.1 age adoption passing confidence

Release Notes

daixiang0/gci (github.com/daixiang0/gci)

v0.14.0

Compare Source

AST Support is Coming!

See details in #​241

Other Changes

New Contributors

Full Changelog: daixiang0/gci@v0.13.7...v0.14.0

golangci/golangci-lint (github.com/golangci/golangci-lint/v2)

v2.12.1

Compare Source

Released on 2026-05-01

  1. Linters bug fixes
    • gomodguard_v2: fix panic with migration suggestion
  2. Misc.
    • fix install.sh script (if you are still using an URL based on the branch master, please update to use https://golangci-lint.run/install.sh)

v2.12.0

Compare Source

Released on 2026-05-01

  1. New linters
  2. Linters new features or changes
    • dupl: from f665c8d to c99c5cf (extended detection)
    • funcorder: from 0.5.0 to 0.6.0 (new option: function)
    • goconst: add an option to ignore strings from tests
    • goconst: from 1.8.2 to 1.10.0 (extended detection)
    • gomodguard_v2: from 1.4.1 to 2.1.0 (major version with new configuration)
    • gosec: from 619ce21 to 2.26.1 (new checks: G124, G708, G709, G710)
    • govet: add inline analyzer
    • makezero: from 2.1.0 to 2.2.1 (support slice type aliases)
    • paralleltest: expose checkcleanup option
    • sloglint: from 0.11.1 to 0.12.0 (new options: allowed-keys, custom-funcs)
    • wsl_v5: from 5.6.0 to 5.8.0 (new option: cuddle-max-statements; new checks: after-decl, after-defer, after-expr, after-go, cuddle-group)
  3. Linters bug fixes
    • forbidigo: from 2.3.0 to 2.3.1
    • godot: from 1.5.4 to 1.5.6
    • govet-modernize: from 0.43.0 to 0.44.0
    • ireturn: from 0.4.0 to 0.4.1
    • rowserrcheck: from 1.1.1 to c5f79b8
  4. Misc.
    • Decrease cache entropy
    • Embed the JSON schema in the binary
    • Filter env vars when cloning the repository with the custom command
open-policy-agent/opa (github.com/open-policy-agent/opa)

v1.16.1

Compare Source

This is a patch release addressing a regression in the plugin manager that may cause the service to hang on shutdown (#​8590).

v1.16.0

Compare Source

[!WARNING]

A regression has been found in the plugin manager, which may cause the service to hang on shutdown.
Users are advised to go directly to v1.16.1.

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • New uri.parse and uri.is_valid built-in functions
  • Data API Request/Response Metadata
  • Prometheus metrics exported via OTLP
  • Formatter improvements

NOTE:

In v1.15.x, OPA was dropping logs for bundle downloads, print() calls and other plugin-originated logs.
Users are advised to update, v1.16.0 fixes this bug in (#​8544).

New uri.parse and uri.is_valid built-in functions (#​8263)

Two new built-in functions have been added: uri.parse for parsing a given URI, and uri.is_valid for verifying the structure of a given URI.

uri.parse

Parses a URI and returns an object containing its components according to RFC 3986. Empty components are omitted.

package example

test_uri if {
	uri.parse("https://example.com:8080/api?q=1#top") == {
		"scheme": "https",
		"hostname": "example.com",
		"port": "8080",
		"path": "/api",
		"raw_path": "/api",
		"raw_query": "q=1",
		"fragment": "top",
	}
}
uri.is_valid

Returns true if the input can be parsed as a URI, false otherwise.

package example

deny contains "invalid URI" if {
    not uri.is_valid("http://[invalid")
}

Authored by @​charlieegan3 reported by @​anivar

Data API Request/Response Metadata (#​8570)

Wrapping projects can now attach custom metadata to Data API requests and have evaluation produce response metadata.

Two distinct metadata paths are introduced:

  • Request metadata: parsed from extra top-level keys in the request body, made available to builtins via BuiltinContext.RequestMetadata. Logged in the decision log under Custom["request_metadata"].

  • Response metadata: a separate map (BuiltinContext.ResponseMetadata) that builtins can populate during evaluation. Only included in the API response and decision log if non-empty.

In vanilla OPA, no builtins write response metadata, so responses are unchanged. The request metadata map is only allocated when the request carries extra fields; the response map is one empty map per request.

To avoid conflicts with future OPA top-level keys, callers should use a namespaced key: {"input": {...}, "com.example.opa/md": {...}}.

Request with metadata:

curl -H 'Content-Type: application/json' \
  -d '{"input": {"user": "alice"}, "com.example.opa/metadata": {"corp-id": "acme-42"}}' \
  http://localhost:8181/v1/data/example/allow

Response (response metadata included if, for example, set by a custom builtin):

{
  "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
  "result": true,
  "com.example.opa/response": {
    "snapshot_version": "v3"
  }
}

Decision log entry:

{
  "custom": {
    "request_metadata": {
      "com.example.opa/metadata": {
        "corp-id": "acme-42"
      }
    },
    "response_metadata": {
      "com.example.opa/response": {
        "snapshot_version": "v3"
      }
    }
  },
  "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
  "input": { "user": "alice" },
  "msg": "Decision Log",
  "path": "example/allow",
  "result": true
}

Authored by @​srenatus

Runtime, SDK, Tooling
Compiler, Topdown and Rego
Docs, Website, Ecosystem
Miscellaneous
  • build: Exclude domains that cause false positives (#​8533) (#​8495) authored by @​charlieegan3
  • e2e/cli: Add test for debug print() logging (#​8567) authored by @​srenatus
  • e2e/cli: Start CLI E2E tests (#​8545) authored by @​srenatus
  • github: declare formatted rego as rego (#​8564) authored by @​srenatus
  • Security policy update (#​8479) authored by @​anderseknert
  • Dependency updates; notably:
    • build: bump go 1.26.2 (#​8497) authored by @​sspaink
    • build(deps): bump wasmtime-go from v39.0.1 to v43.0.2
    • build(deps): bump go.opentelemetry.io deps from 1.40.0/0.65.0 to 1.43.0/0.68.0
    • build(deps): bump github.com/containerd/containerd/v2 from 2.2.1 to 2.2.3
    • build(deps): bump ithub.com/huandu/go-sqlbuilder from 1.39.1 to 1.40.2
    • build(deps): bump golang.org/x/net from 0.51.0 to 0.53.0
    • build(deps): bump golang.org/x/text from 0.34.0 to 0.36.0
secure-systems-lab/go-securesystemslib (github.com/secure-systems-lab/go-securesystemslib)

v0.11.0

Compare Source

testcontainers/testcontainers-go (github.com/testcontainers/testcontainers-go)

v0.42.0

Compare Source

What's Changed

⚠️ Breaking Changes

🔒 Security

🐛 Bug Fixes

🧹 Housekeeping

📦 Dependency updates

v0.41.0

Compare Source

What's Changed
🚀 Features
🐛 Bug Fixes
📖 Documentation
🧹 Housekeeping
📦 Dependency updates

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Copy Markdown
Contributor Author

renovate Bot commented Feb 27, 2026

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 13 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.25.8 -> 1.26.0
github.com/docker/go-connections v0.5.0 -> v0.6.0
github.com/lufia/plan9stats v0.0.0-20240819163618-b1d8f4d146e7 -> v0.0.0-20251013123823-9fd1530e3ec3
github.com/tklauser/go-sysconf v0.3.14 -> v0.3.16
github.com/tklauser/numcpus v0.8.0 -> v0.11.0
golang.org/x/crypto v0.49.0 -> v0.50.0
golang.org/x/mod v0.33.0 -> v0.35.0
golang.org/x/sys v0.42.0 -> v0.43.0
golang.org/x/term v0.41.0 -> v0.42.0
golang.org/x/text v0.35.0 -> v0.36.0
google.golang.org/protobuf v1.36.11 -> v1.36.12-0.20260120151049-f2248ac996af
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 -> v0.0.0-20260317180543-43fb72c5454a
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 -> v0.0.0-20260210185600-b8788abfbbc2
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 -> v6.3.2
File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 40 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.25.8 -> 1.26.0
golang.org/x/net v0.52.0 -> v0.53.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 -> v1.31.0
github.com/containerd/containerd/v2 v2.2.2 -> v2.2.3
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 -> v4.4.1
github.com/docker/go-connections v0.5.0 -> v0.6.0
github.com/goccy/go-json v0.10.5 -> v0.10.6
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 -> v2.28.0
github.com/huandu/go-sqlbuilder v1.39.1 -> v1.40.2
github.com/lestrrat-go/dsig v1.0.0 -> v1.2.1
github.com/lestrrat-go/httprc/v3 v3.0.2 -> v3.0.5
github.com/lestrrat-go/jwx/v3 v3.0.13 -> v3.1.0
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c -> v0.0.0-20240221224432-82ca36839d55
github.com/prometheus/common v0.67.4 -> v0.67.5
github.com/prometheus/procfs v0.17.0 -> v0.20.1
github.com/stretchr/objx v0.5.2 -> v0.5.3
github.com/tklauser/go-sysconf v0.3.12 -> v0.3.16
github.com/tklauser/numcpus v0.6.1 -> v0.11.0
github.com/valyala/fastjson v1.6.7 -> v1.6.10
github.com/yusufpapurcu/wmi v1.2.3 -> v1.2.4
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 -> v0.65.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 -> v0.68.0
go.opentelemetry.io/otel v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 -> v1.43.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 -> v1.43.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.40.0 -> v1.43.0
go.opentelemetry.io/otel/metric v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/sdk v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/sdk/metric v1.42.0 -> v1.43.0
go.yaml.in/yaml/v2 v2.4.3 -> v2.4.4
golang.org/x/crypto v0.49.0 -> v0.50.0
golang.org/x/mod v0.33.0 -> v0.35.0
golang.org/x/sys v0.42.0 -> v0.43.0
golang.org/x/term v0.41.0 -> v0.42.0
golang.org/x/tools v0.42.0 -> v0.44.0
google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 -> v0.0.0-20260401024825-9d38bb4040a9
google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 -> v0.0.0-20260401024825-9d38bb4040a9
google.golang.org/grpc v1.79.3 -> v1.80.0
google.golang.org/protobuf v1.36.11 -> v1.36.12-0.20260120151049-f2248ac996af
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 -> v0.0.0-20260210185600-b8788abfbbc2
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 -> v6.3.2
File name: tools/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 47 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.25.8 -> 1.26.0
github.com/Masterminds/semver/v3 v3.4.0 -> v3.5.0
github.com/alecthomas/chroma/v2 v2.23.1 -> v2.24.1
github.com/ashanbrown/forbidigo/v2 v2.3.0 -> v2.3.1
github.com/ashanbrown/makezero/v2 v2.1.0 -> v2.2.1
github.com/bombsimon/wsl/v5 v5.6.0 -> v5.8.0
github.com/butuzov/ireturn v0.4.0 -> v0.4.1
github.com/charmbracelet/colorprofile v0.3.1 -> v0.4.3
github.com/charmbracelet/x/ansi v0.10.1 -> v0.11.7
github.com/charmbracelet/x/term v0.2.1 -> v0.2.2
github.com/clipperhouse/displaywidth v0.6.0 -> v0.11.0
github.com/clipperhouse/uax29/v2 v2.3.0 -> v2.7.0
github.com/cyphar/filepath-securejoin v0.6.0 -> v0.6.1
github.com/dlclark/regexp2 v1.11.5 -> v1.12.0
github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32 -> v0.0.0-20260401084720-c99c5cf5c202
github.com/hashicorp/go-version v1.8.0 -> v1.9.0
github.com/jgautheron/goconst v1.8.2 -> v1.10.0
github.com/lib/pq v1.11.2 -> v1.12.3
github.com/lucasb-eyer/go-colorful v1.3.0 -> v1.4.0
github.com/manuelarte/funcorder v0.5.0 -> v0.6.0
github.com/mattn/go-runewidth v0.0.19 -> v0.0.23
github.com/moby/spdystream v0.5.0 -> v0.5.1
github.com/pelletier/go-toml/v2 v2.2.4 -> v2.3.0
github.com/prometheus/procfs v0.17.0 -> v0.19.2
github.com/securego/gosec/v2 v2.24.8-0.20260309165252-619ce2117e08 -> v2.26.1
github.com/sourcegraph/go-diff v0.7.0 -> v0.8.0
github.com/tetafro/godot v1.5.4 -> v1.5.6
github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67 -> v0.0.0-20260129054331-73d1f95b84b4
go-simpler.org/sloglint v0.11.1 -> v0.12.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 -> v0.65.0
golang.org/x/crypto v0.49.0 -> v0.50.0
golang.org/x/exp v0.0.0-20250911091902-df9299821621 -> v0.0.0-20251219203646-944ab1f22d93
golang.org/x/mod v0.34.0 -> v0.35.0
golang.org/x/net v0.52.0 -> v0.53.0
golang.org/x/sys v0.42.0 -> v0.43.0
golang.org/x/term v0.41.0 -> v0.42.0
golang.org/x/text v0.35.0 -> v0.36.0
golang.org/x/tools v0.43.0 -> v0.44.0
google.golang.org/protobuf v1.36.11 -> v1.36.12-0.20260120151049-f2248ac996af
gopkg.in/evanphx/json-patch.v4 v4.12.0 -> v4.13.0
k8s.io/klog/v2 v2.130.1 -> v2.140.0
k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b -> v0.0.0-20260317180543-43fb72c5454a
k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d -> v0.0.0-20260210185600-b8788abfbbc2
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 -> v0.0.0-20250730193827-2d320260d730
sigs.k8s.io/kustomize/api v0.20.1 -> v0.21.1
sigs.k8s.io/kustomize/cmd/config v0.20.1 -> v0.21.1
sigs.k8s.io/kustomize/kyaml v0.20.1 -> v0.21.1
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 -> v6.3.2
File name: tools/kubectl/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 24 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.25.8 -> 1.26.0
github.com/moby/spdystream v0.5.0 -> v0.5.1
github.com/prometheus/common v0.66.1 -> v0.67.5
github.com/prometheus/procfs v0.16.1 -> v0.19.2
github.com/spf13/cobra v1.9.1 -> v1.10.2
github.com/spf13/pflag v1.0.6 -> v1.0.9
go.opentelemetry.io/otel v1.35.0 -> v1.41.0
go.opentelemetry.io/otel/trace v1.35.0 -> v1.41.0
go.yaml.in/yaml/v2 v2.4.2 -> v2.4.3
golang.org/x/net v0.43.0 -> v0.49.0
golang.org/x/oauth2 v0.30.0 -> v0.34.0
golang.org/x/sync v0.17.0 -> v0.19.0
golang.org/x/sys v0.37.0 -> v0.40.0
golang.org/x/term v0.34.0 -> v0.39.0
golang.org/x/text v0.28.0 -> v0.33.0
google.golang.org/protobuf v1.36.10 -> v1.36.12-0.20260120151049-f2248ac996af
gopkg.in/evanphx/json-patch.v4 v4.12.0 -> v4.13.0
k8s.io/klog/v2 v2.130.1 -> v2.140.0
k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b -> v0.0.0-20260317180543-43fb72c5454a
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 -> v0.0.0-20260210185600-b8788abfbbc2
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 -> v0.0.0-20250730193827-2d320260d730
sigs.k8s.io/kustomize/api v0.20.1 -> v0.21.1
sigs.k8s.io/kustomize/kustomize/v5 v5.7.1 -> v5.8.1
sigs.k8s.io/kustomize/kyaml v0.20.1 -> v0.21.1
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 -> v6.3.2

@renovate renovate Bot added the main label Feb 27, 2026
@renovate renovate Bot force-pushed the renovate/main-go-modules branch 10 times, most recently from b7bbfdc to 02074a5 Compare March 6, 2026 09:52
@renovate renovate Bot force-pushed the renovate/main-go-modules branch 13 times, most recently from ae12a07 to b6bcb99 Compare March 12, 2026 19:21
@renovate renovate Bot force-pushed the renovate/main-go-modules branch 2 times, most recently from eb3bd95 to 50d854b Compare March 15, 2026 12:52
@renovate renovate Bot force-pushed the renovate/main-go-modules branch 8 times, most recently from 763e061 to 27dd37f Compare March 31, 2026 03:53
@renovate renovate Bot force-pushed the renovate/main-go-modules branch 5 times, most recently from 9055a4c to c5750d4 Compare April 7, 2026 09:51
@renovate renovate Bot force-pushed the renovate/main-go-modules branch 16 times, most recently from 9f4d6ea to 6a3d6d6 Compare April 15, 2026 10:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants