Skip to content

chore: Update Infrastructure dependencies#2014

Merged
Aureliolo merged 1 commit into
mainfrom
renovate/infra
May 19, 2026
Merged

chore: Update Infrastructure dependencies#2014
Aureliolo merged 1 commit into
mainfrom
renovate/infra

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 19, 2026 •
edited
Loading

This PR contains the following updates:

Package Type Update Change Age Confidence
chainguard-dev/apko patch v1.2.12 → v1.2.13 age confidence
chainguard-dev/melange patch v0.50.6 → v0.50.7 age confidence
codecov/codecov-action action patch v6.0.0 → v6.0.1 age confidence
dhi.io/nats (source) digest 21edf17 → e545a82
ghcr.io/astral-sh/uv stage patch 0.11.14 → 0.11.15 age confidence
github.com/google/go-containerregistry require patch v0.21.5 → v0.21.6 age confidence
github.com/theupdateframework/go-tuf/v2 require patch v2.4.1 → v2.4.2 age confidence
goreleaser/goreleaser-action action patch v7.2.1 → v7.2.2 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

chainguard-dev/apko (chainguard-dev/apko)

v1.2.13

Compare Source

Changelog
  • 22c16a5 build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 in the go_modules group across 1 directory (#​2222)
  • 7effda4 build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#​2225)
  • de34d75 build(deps): bump go.step.sm/crypto from 0.77.9 to 0.78.0 (#​2224)
  • f6032be build(deps): bump golang.org/x/sys from 0.43.0 to 0.44.0 (#​2221)
  • f85efc5 build(deps): bump google.golang.org/api from 0.277.0 to 0.278.0 (#​2223)
  • 2483b20 build(deps): bump gopkg.in/ini.v1 from 1.67.1 to 1.67.2 (#​2218)
  • f693e82 build(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 (#​2226)
  • 3e9c1ec cpio: add FromLayers for multi-layer CPIO archives (#​2216)
chainguard-dev/melange (chainguard-dev/melange)

v0.50.7

Compare Source

What's Changed

Full Changelog: chainguard-dev/melange@v0.50.6...v0.50.7

codecov/codecov-action (codecov/codecov-action)

v6.0.1

Compare Source

astral-sh/uv (ghcr.io/astral-sh/uv)

v0.11.15

Compare Source

Released on 2026-05-18.

Security
Enhancements
  • Add TOML v1.1 -> v1.0 backwards compatibility for source distributions (#​18741)
  • Add support for Azure request signing (#​19421)
  • Apply stricter validation to all wheel filename segments (#​19364)
  • Reject empty strings as an invalid package name (#​19435)
  • Use structured errors for signing authentication failures (#​19422)
Preview
Configuration
  • Respect required-environments in uv pip compile (#​19378)
Performance
  • Avoid parsing JSON manifest when local Python is available (#​19398)
  • Avoid walking nested directories in linker conflict registration (#​19382)
  • Optimize async wheel ZIP writing (#​19383)
  • Fix dead "already trimmed" fast-path in Version::only_release_trimmed (#​19425)
Bug fixes
  • Apply workspace-member [tool.uv.sources] credentials under uv sync --frozen (#​19423)
  • Skip empty directories in uv build outputs (#​19437)
  • Fix Git submodule handling when using relative paths (#​12156)
  • Fix line number reporting in netrc parsing (#​19452)
Documentation
  • Move Bazel auth helper setup into integration guide (#​19392)
google/go-containerregistry (github.com/google/go-containerregistry)

v0.21.6

Compare Source

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.21.5...v0.21.6

theupdateframework/go-tuf (github.com/theupdateframework/go-tuf/v2)

v2.4.2

Compare Source

What's Changed

New Contributors

Full Changelog: theupdateframework/go-tuf@v2.4.1...v2.4.2

goreleaser/goreleaser-action (goreleaser/goreleaser-action)

v7.2.2

Compare Source

Configuration

📅 Schedule: (in timezone Etc/UTC)

  • Branch creation
    • Between 12:00 AM and 06:59 AM, only on Saturday (* 0-6 * * 6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from Aureliolo as a code owner May 19, 2026 18:50
@renovate renovate Bot added dependencies Pull requests that update a dependency file type:infra CI/CD, tooling, project setup labels May 19, 2026
@renovate
Copy link
Copy Markdown
Contributor Author

renovate Bot commented May 19, 2026

ℹ️ Artifact update notice

File name: cli/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 4 additional dependencies were updated

Details:

Package Change
github.com/docker/cli v29.4.1+incompatible -> v29.4.3+incompatible
github.com/klauspost/compress v1.18.5 -> v1.18.6
github.com/sigstore/sigstore v1.10.5 -> v1.10.6
golang.org/x/mod v0.35.0 -> v0.36.0

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 19, 2026 •
edited
Loading

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

cli/go.mod

PackageVersionLicenseIssue Type
github.com/docker/cli29.4.3+incompatibleNullUnknown License
github.com/klauspost/compress1.18.6NullUnknown License
Allowed Licenses: MIT, MIT-0, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, PSF-2.0, Unlicense, 0BSD, CC0-1.0, CC-BY-3.0, CC-BY-4.0, Python-2.0, Python-2.0.1, LicenseRef-scancode-free-unknown, LicenseRef-scancode-protobuf, LicenseRef-scancode-google-patent-license-golang, ZPL-2.1, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, BlueOak-1.0.0, OFL-1.1
Excluded from license check: pkg:pypi/mem0ai@2.0.1, pkg:pypi/numpy@2.4.4, pkg:pypi/qdrant-client@1.17.1, pkg:pypi/posthog@7.9.12, pkg:pypi/aiohttp@3.13.5, pkg:pypi/cyclonedx-python-lib@11.7.0, pkg:pypi/fsspec@2026.3.0, pkg:pypi/griffelib@2.0.2, pkg:pypi/grpcio@1.80.0, pkg:pypi/charset-normalizer@3.4.6, pkg:pypi/wrapt@2.1.2, pkg:pypi/pytest-codspeed@4.5.0, pkg:pypi/hypothesis@6.152.4, pkg:pypi/litellm@1.83.14, pkg:pypi/openai@2.33.0, pkg:pypi/pyngrok@8.1.2, pkg:pypi/tokenizers@0.23.1, pkg:pypi/typer@0.25.0, pkg:npm/@img/sharp-wasm32@0.33.5, pkg:npm/@img/sharp-win32-ia32@0.33.5, pkg:npm/@img/sharp-win32-x64@0.33.5, pkg:npm/json-schema-typed@8.0.2, pkg:npm/victory-vendor@37.3.6, pkg:pypi/scikit-learn@1.8.0, pkg:pypi/torch@2.11.0, pkg:pypi/cuda-bindings@13.2.0, pkg:pypi/cuda-pathfinder@1.5.0, pkg:pypi/cuda-toolkit@13.0.2, pkg:pypi/nvidia-cublas@13.1.0.3, pkg:pypi/nvidia-cuda-cupti@13.0.85, pkg:pypi/nvidia-cuda-nvrtc@13.0.88, pkg:pypi/nvidia-cuda-runtime@13.0.96, pkg:pypi/nvidia-cudnn-cu13@9.19.0.56, pkg:pypi/nvidia-cufft@12.0.0.61, pkg:pypi/nvidia-cufile@1.15.1.6, pkg:pypi/nvidia-curand@10.4.0.35, pkg:pypi/nvidia-cusolver@12.0.4.66, pkg:pypi/nvidia-cusparse@12.6.3.3, pkg:pypi/nvidia-cusparselt-cu13@0.8.0, pkg:pypi/nvidia-nccl-cu13@2.28.9, pkg:pypi/nvidia-nvjitlink@13.0.88, pkg:pypi/nvidia-nvshmem-cu13@3.4.5, pkg:pypi/nvidia-nvtx@13.0.85

OpenSSF Scorecard

PackageVersionScoreDetails
actions/goreleaser/goreleaser-action 5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 🟢 4.9
Details
CheckScoreReason
Code-Review⚠️ 0Found 1/22 approved changesets -- score normalized to 0
Maintained🟢 1023 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
gomod/github.com/docker/cli 29.4.3+incompatible UnknownUnknown
gomod/github.com/google/go-containerregistry 0.21.6 🟢 8.1
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Code-Review🟢 8Found 22/25 approved changesets -- score normalized to 8
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Packaging🟢 10packaging workflow detected
Signed-Releases🟢 105 out of the last 5 releases have a total of 5 signed artifacts.
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 10SAST tool is run on all commits
gomod/github.com/klauspost/compress 1.18.6 UnknownUnknown
gomod/github.com/sigstore/sigstore 1.10.6 🟢 9.4
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 1021 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
CII-Best-Practices🟢 5badge detected: Passing
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities🟢 73 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 39 contributing companies or organizations
gomod/github.com/theupdateframework/go-tuf/v2 2.4.2 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 43 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 4
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
SAST🟢 10SAST tool is run on all commits
gomod/golang.org/x/mod 0.36.0 UnknownUnknown

Scanned Files

  • .github/workflows/cli.yml
  • cli/go.mod

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 19, 2026 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedgolang/​github.com/​google/​go-containerregistry@​v0.21.5 ⏵ v0.21.673 +1100100100100
Updatedgolang/​github.com/​theupdateframework/​go-tuf/​v2@​v2.4.1 ⏵ v2.4.298 +1100100100100

View full report

@codecov
Copy link
Copy Markdown

codecov Bot commented May 19, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.08%. Comparing base (29b64e3) to head (210d23d).
✅ All tests successful. No failed tests found.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #2014      +/-   ##
==========================================
- Coverage   85.09%   85.08%   -0.01%     
==========================================
  Files        1913     1913              
  Lines      113388   113388              
  Branches     9673     9673              
==========================================
- Hits        96487    96481       -6     
- Misses      14532    14536       +4     
- Partials     2369     2371       +2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate renovate Bot force-pushed the renovate/infra branch from ee902a6 to 210d23d Compare May 19, 2026 19:24
Aureliolo
Aureliolo approved these changes May 19, 2026
View reviewed changes
Copy link
Copy Markdown
Owner

@Aureliolo Aureliolo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Decision: Patch/digest-only infrastructure bump (8 deps); CI fully green; no breaking changes; lands three security patches.

Changelog digest:

  • Covered: chainguard-dev/apko v1.2.12->v1.2.13, melange v0.50.6->v0.50.7, codecov-action v6.0.0->v6.0.1, dhi.io/nats digest 21edf17->e545a82, ghcr.io/astral-sh/uv 0.11.14->0.11.15, google/go-containerregistry v0.21.5->v0.21.6, theupdateframework/go-tuf/v2 v2.4.1->v2.4.2, goreleaser-action v7.2.1->v7.2.2.
  • Relevant (security): uv 0.11.15 fixes TAR partial-diff GHSA-3cv2-h65g-fgmm + entry-point-escape GHSA-4gg8-gxpx-9rph (used in Docker build stage); go-containerregistry v0.21.6 ships multiple SSRF-hardening fixes + 429 retry + OOM-bounded HTTP reads (CLI image ops); go-tuf v2.4.2 rejects empty Target-role hashes and fixes threshold counting for duplicate keys (CLI TUF path).
  • Reviewed but not relevant: apko/melange internal dep bumps + Go 1.26.2 (build-tooling only, no behaviour change for us); codecov-action / goreleaser-action / nats digest are routine patch/digest refreshes with no functional release notes.

Follow-ups: none.

@Aureliolo Aureliolo merged commit 0b16bdf into main May 19, 2026
95 checks passed
@Aureliolo Aureliolo deleted the renovate/infra branch May 19, 2026 20:09
@synthorg-repo-bot synthorg-repo-bot Bot mentioned this pull request May 19, 2026
Merged
Aureliolo pushed a commit that referenced this pull request May 19, 2026
@synthorg-repo-bot @github-actions
chore(main): release 0.8.6 (#2002)
f60e9ed 
<!-- HIGHLIGHTS_START -->
## Highlights

> _AI-generated summary (model: `openai/gpt-4.1-mini` via GitHub
Models). Commit-based changelog below._

### What you'll notice
- Multi-agent coordination is now active immediately on startup for
smoother operation.
- Governance rules are fully enforced during use, ensuring compliance at
all times.
- Coordination metrics update live, giving real-time insights into
system activity.
- Review agents are now reliably processed, preventing silent drops in
tasks.
- Sandbox containers can be reused for agents and tasks, speeding up
execution and reducing overhead.

### What's new
- Agents support online runtime with a minimal safety framework to
improve stability.
- Recorded LLM interactions can be deterministically replayed at the
provider interface.
- Distributed path validation has been enhanced for more robust data
routing.
- A client-simulation runtime was added for end-to-end testing of the
IntakeEngine.
- A new work pipeline spine architecture has been introduced to
streamline task processing.

### Under the hood
- Infrastructure, Python, and web dependencies have all been updated to
latest versions.
- Updated apko lockfiles in the CI/CD pipeline improve build
consistency.

<!-- HIGHLIGHTS_END -->

:robot: I have created a release *beep* *boop*
---


##
[0.8.6](v0.8.5...v0.8.6)
(2026-05-19)


### Features

* agent runtime online + minimal safety spine (runtime root)
([#2003](#2003))
([e5eef1a](e5eef1a)),
closes [#1956](#1956)
* deterministic recorded-LLM cassette replay at the provider chokepoint
([#2010](#2010))
([cabf55d](cabf55d))
* distributed path validation + hardening
([#2011](#2011))
([a382e4a](a382e4a)),
closes [#1966](#1966)
* wire IntakeEngine via boot client-simulation runtime (e2e test
harness) ([#2006](#2006))
([6a9c0aa](6a9c0aa)),
closes [#1961](#1961)
* work pipeline spine
([#1960](#1960))
([#2013](#2013))
([29b64e3](29b64e3))


### Bug Fixes

* bring the multi-agent coordinator online at boot
([#2007](#2007))
([180b38a](180b38a)),
closes [#1958](#1958)
* full governance enforcement online
([#1957](#1957))
([#2005](#2005))
([4140fc5](4140fc5))
* harden anti-ghost-wiring gate and fix silently-dropped review agents
([#2000](#2000))
([89b57ce](89b57ce))
* make coordination metrics live
([#1959](#1959))
([#2012](#2012))
([c4775e2](c4775e2))
* sandbox lifecycle dispatch (per-agent / per-task container reuse)
([#2008](#2008))
([03d2587](03d2587)),
closes [#1965](#1965)


### Documentation

* add GitButler concept-only concurrency research
([#1978](#1978))
([#2009](#2009))
([9e4f5c1](9e4f5c1))
* honest-hybrid refresh of README, site, and design specs
([#2001](#2001))
([f485bea](f485bea))


### CI/CD

* update apko lockfiles
([#2004](#2004))
([e2b9eee](e2b9eee))


### Maintenance

* Update Infrastructure dependencies
([#2014](#2014))
([0b16bdf](0b16bdf))
* Update Python dependencies
([#2015](#2015))
([a7224bb](a7224bb))
* Update Web dependencies
([#2016](#2016))
([7a7fe76](7a7fe76))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: synthorg-repo-bot[bot] <279117679+synthorg-repo-bot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Aureliolo Aureliolo Aureliolo approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file type:infra CI/CD, tooling, project setup

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Aureliolo