Skip to content

fix(deps): update all non-major dependencies - #77

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch-digest-pin
Open

fix(deps): update all non-major dependencies#77
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch-digest-pin

Conversation

@renovate

@renovate renovate Bot commented Jul 29, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Confidence
actions/checkout action minor v6.0.2 → v6.1.0 age confidence
actions/setup-go action minor v6.3.0 → v6.5.0 age confidence
alpine (source) final minor 3.23.3 → 3.24.1 age confidence
alpine (source) stage minor 3.23.3 → 3.24.1 age confidence
cli/cli minor 2.87.3 → 2.97.0 age confidence
codecov/codecov-action action patch v5.5.2 → v5.5.5 age confidence
elgohr/Publish-Docker-Github-Action action pinDigest → 8217e91
github.com/Masterminds/semver/v3 require minor v3.4.0 → v3.5.0 age confidence
github.com/go-vela/server require minor v0.27.5 → v0.28.8 age confidence
github.com/sirupsen/logrus require minor v1.9.4 → v1.10.1 age confidence
github.com/urfave/cli/v3 require minor v3.7.0 → v3.11.0 age confidence
github/codeql-action action minor v4.32.5 → v4.37.7 age confidence
reviewdog/action-golangci-lint action minor v2.8.0 → v2.10.0 age confidence

Release Notes

actions/checkout (actions/checkout)

v6.1.0

Compare Source

v6.0.3

Compare Source

actions/setup-go (actions/setup-go)

v6.5.0

Compare Source

v6.4.0

Compare Source

What's Changed
Enhancement
  • Add go-download-base-url input for custom Go distributions by @​gdams in #​721
Dependency update
Documentation update
New Contributors

Full Changelog: actions/setup-go@v6...v6.4.0

cli/cli (cli/cli)

v2.97.0: GitHub CLI 2.97.0

Compare Source

Security

Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.97.0 as soon as possible.

Several commands (including gh gist view, gh api, gh pr diff, gh release download --output -, gh codespace logs, gh skills preview, and gh agent-task view/create) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal.

See GHSA-3m3g-3wcr-px46 for more information.

Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause gh to address a different resource than intended.

See GHSA-4fjg-2h4q-fwg3 for more information.

gh auth status (without --show-token) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as github_pat_*, ghs_*, and ghu_*.

See GHSA-cg6r-mpgc-h9mm for more information.

gh attestation verify built the certificate matcher from --signer-repo and --signer-workflow without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification.

See GHSA-mm27-mwq9-fr5g for more information.

Address project fields and items by name in gh project

gh project item-edit and gh project item-list can now reference project fields and single-select options by name:

# Set an item's field by name
gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress"

# Show named fields as extra columns
gh project item-list 1 --owner "@me" --field "Status" --field "Priority"

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.96.0...v2.97.0

v2.96.0: GitHub CLI 2.96.0

Compare Source

Security

A security vulnerability has been identified, and fixed, that could allow command execution on a user's computer when connecting to a malicious Codespace via gh codespace jupyter.

Users of gh codespace jupyter are advised to update gh to version v2.96.0 as soon as possible.

For more information see: GHSA-8cg3-r6g9-fpg2

Download release assets without authentication

gh release download now works against public repositories without authentication, matching gh extension install. A token is still used when one is present:

# Download assets from a public repository, no login required
gh release download v2.96.0 --repo cli/cli

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.95.0...v2.96.0

v2.95.0: GitHub CLI 2.95.0

Compare Source

Read repository files and directories with gh repo read-file and gh repo read-dir

Two new preview commands read repository contents without cloning:

# Read a single file to stdout
gh repo read-file README.md --repo cli/cli

# Read from a specific branch, tag, or commit
gh repo read-file go.mod --ref v2.94.0 --repo cli/cli

# Write a file to disk (use --clobber to overwrite)
gh repo read-file README.md --output ./README.md --repo cli/cli

# List the entries in a directory
gh repo read-dir script --repo cli/cli

Both commands default to the repository's default branch, accept --ref to target any branch, tag, or commit, and support --json, --jq, and --template for scripting. This makes it easy for agents and automation to inspect a repo without a full checkout.

[!NOTE]
gh repo read-file and gh repo read-dir are in preview and subject to change without notice.

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

Full Changelog: cli/cli@v2.94.0...v2.95.0

v2.94.0: GitHub CLI 2.94.0

Compare Source

Issue types, sub-issues, and relationships in gh issue

issue-view-monas-cafe-with-frame

This release brings GitHub's advanced issue features to gh issue create, edit, view, and list. You can set and view an issue's type, organize work with sub-issues, and track blocked-by and blocking relationships without leaving the command line:

# Set an issue's type
gh issue create --type Bug
gh issue edit 123 --type Bug

# Organize work with sub-issues
gh issue create --parent 100
gh issue edit 100 --add-sub-issue 123

# Track blocked-by and blocking relationships
gh issue create --blocked-by 200
gh issue edit 123 --add-blocking 300

Issue types and sub-issues are available on GitHub.com and GHES 3.17+; relationships require GHES 3.19+.

Manage discussions with gh discussion

discussion-view-monas-cafe-with-frame

This release introduces the discussion command set for working with GitHub Discussions in gh:

# List discussions
gh discussion list

# View a discussion, its comments, or replies to a comment
gh discussion view 123 --comments

# Create a discussion
gh discussion create

# Edit a discussion
gh discussion edit 123

# Comment on a discussion
gh discussion comment 123

# Reply to a comment using its URL
gh discussion comment <url>

Run gh discussion --help for more information.

[!NOTE]
The discussion command set is in preview and is subject to change without notice.

Equip your agents with new gh features

Teach your agents how to leverage new GitHub CLI features on release day by installing the gh skill:

# Install
gh skill install cli/cli gh --scope user

# Or update
gh skill update gh

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

Full Changelog: cli/cli@v2.93.0...v2.94.0

v2.93.0: GitHub CLI 2.93.0

Compare Source

Security

A security vulnerability has been identified, and fixed, that would incorrectly include authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands.

Users are advised to update gh to version v2.93.0 as soon as possible.

For more information see: GHSA-8xvp-7hj6-mcj9

Support agents in gh secret command set

The gh secret command set can now set agent secrets. For more information, see "Configuring secrets and variables for Copilot cloud agent".

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.92.0...v2.93.0

v2.92.0: GitHub CLI 2.92.0

Compare Source

Security

A security vulnerability has been identified, and fixed, that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed.

Users are advised to update gh to version v2.92.0 as soon as possible.

For more information see: GHSA-crc3-h8v6-qh57

Support GitHub Enterprise Cloud (GHEC) in skill commandset

Now gh skill subcommands (install, preview, publish, search, update) are able to work with GHEC hosts with data residency.

Add --allow-hidden-dirs flag to skill preview

Following the addition of --allow-hidden-dirs to skill install in the previous release, now the flag is also supported in skill preview, allowing users to preview skills located in hidden (dot-prefixed) directories such as .claude/skills/, .agents/skills/, and .github/skills/.

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.91.0...v2.92.0

v2.91.0: GitHub CLI 2.91.0

Compare Source

GitHub CLI now collects pseudonymous telemetry

To better understand how features are used in practice, especially as agentic adoption grows, GitHub CLI now sends pseudonymous telemetry.

See Telemetry for more details on what's collected, why, and how to opt out.

Support more agents in gh skill

Thanks to community feedback, gh now supports a large number of agent hosts. Run gh skill install --help for the list of available agents.

Improve skill discovery

gh skill install now adds the --allow-hidden-dirs flag to support discovering skills in hidden (dot-prefixed) directories such as .claude/skills/, .agents/skills/, and .github/skills/.

Detect skills re-published from other sources

GitHub CLI now detects if the skill to be installed is re-published from an upstream source and offers the option to install it from there. The --upstream flag is also added for non-interactive use cases.

What's Changed

✨ Features

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner July 29, 2025 23:59
@renovate renovate Bot added the dependencies Indicates a change to dependencies label Jul 29, 2025
@renovate
renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch from ac4a695 to 2e31ac2 Compare July 30, 2025 19:54
@renovate renovate Bot changed the title chore(deps): update github/codeql-action action to v3.29.5 fix(deps): update all non-major dependencies Jul 30, 2025
@renovate

renovate Bot commented Jul 30, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated

Details:

Package Change
golang.org/x/sys v0.31.0 -> v0.35.0
golang.org/x/text v0.27.0 -> v0.28.0

@renovate
renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 2 times, most recently from 059a60d to 502d485 Compare August 4, 2025 15:53
@renovate
renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 8 times, most recently from 24680d9 to 058fbd7 Compare August 12, 2025 13:52
@renovate
renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 4 times, most recently from 131dd01 to ad9f685 Compare August 21, 2025 23:36
@renovate
renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 4 times, most recently from b7a1abb to ca28efc Compare September 5, 2025 13:11
@renovate
renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 4 times, most recently from 02b0890 to 7e458d1 Compare September 10, 2025 21:13
@renovate
renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 3 times, most recently from 80696d2 to e50cbd3 Compare September 25, 2025 16:07
@renovate
renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 3 times, most recently from fb30c0e to d64463d Compare November 14, 2025 05:07
@renovate
renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 3 times, most recently from 90fc0e2 to 0f86d2b Compare November 19, 2025 12:37
@renovate
renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch from 0f86d2b to b384fdc Compare November 24, 2025 12:44
@renovate
renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 3 times, most recently from 93ad063 to 21e1c18 Compare December 3, 2025 20:53
@renovate
renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 6 times, most recently from b5d118d to 4dd255e Compare December 16, 2025 03:36
@renovate
renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 3 times, most recently from cd85d9a to f24a835 Compare December 18, 2025 09:30
@renovate
renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch from f24a835 to a1551ca Compare December 31, 2025 15:56
@renovate
renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 4 times, most recently from 47c4b0a to 6a6db8a Compare January 18, 2026 05:49
@renovate
renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 4 times, most recently from da8df9a to 1cf43f4 Compare January 28, 2026 04:27
@renovate

renovate Bot commented Mar 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.25.7 -> 1.26.3
github.com/klauspost/compress v1.17.11 -> v1.18.6
golang.org/x/sys v0.39.0 -> v0.45.0
golang.org/x/text v0.32.0 -> v0.37.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Indicates a change to dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants