chore(deps): update non-major dependencies - #62
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/non-major-dependencies
branch
2 times, most recently
from
July 21, 2026 20:54
7bd73d6 to
3468db8
Compare
renovate
Bot
force-pushed
the
renovate/non-major-dependencies
branch
2 times, most recently
from
July 23, 2026 06:39
6873283 to
f38f3d6
Compare
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
renovate
Bot
force-pushed
the
renovate/non-major-dependencies
branch
8 times, most recently
from
July 30, 2026 14:05
9d378dc to
4d1515c
Compare
renovate
Bot
force-pushed
the
renovate/non-major-dependencies
branch
from
July 31, 2026 23:08
4d1515c to
9ba40ca
Compare
renovate
Bot
force-pushed
the
renovate/non-major-dependencies
branch
from
August 3, 2026 12:16
9ba40ca to
28e901c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.41.3→0.41.6v1.48.0→v1.50.0v0.72.0→v0.73.07.1.0→7.1.6v1.199.0→v1.202.0v3.13.2→v3.13.3v2.17.0→v2.17.1v0.0.23→v0.0.24Release Notes
withastro/starlight (@astrojs/starlight)
v0.41.6Compare Source
Patch Changes
f1dddc0Thanks @delucis! - Adds 1 new icon:forgejov0.41.5Compare Source
Patch Changes
bb06434Thanks @HiDeoo! - Fixes a regression when using a union to extend Starlight’sdocsSchema().v0.41.4Compare Source
Patch Changes
#3936
712eeddThanks @miichom! - Fixes support for modifying Zod enums when passing anextendoption to Starlight’sdocsSchema()#4092
0896b91Thanks @delucis! - Fixes support for links containing a protocol likemailto:in the sidebar#4088
4486ba4Thanks @delucis! - Simplifies Starlight’s client-side sidebar state persistence script slightlyanchore/syft (anchore/syft)
v1.50.0Compare Source
Added Features
Bug Fixes
Additional Changes
Dependencies
14 dependency changes (14 updated). 1 vulnerability remediated.
🟢 Remediated (1)
Updated (14 packages)
v1.31.0→v1.32.0v0.0.0-ee656c7→v0.0.0-dba9d58v1.36.0→v1.37.0v1.3.0→v1.3.3v0.24.1→v0.25.0v1.39.0→v1.43.0v0.0.0-9d38bb4→v0.0.0-afd174av0.0.0-6f92a3b→v0.0.0-afd174av1.80.0→v1.82.1(🟢 remediated GHSA-hrxh-6v49-42gf)v4.28.4→v4.29.0v4.34.4→v4.34.6v3.1.3→v3.1.4v1.73.4→v1.74.1v1.53.0→v1.54.0(Full Changelog)
v1.49.0Compare Source
Added Features
application/vnd.oci.image.index.v1+jsonmanifests in root OCI layout [Issue #1545] [PR #5074 @jasonpaulos]Bug Fixes
Dependencies
16 dependency changes (16 updated).
Updated (16 packages)
v0.1.0→v0.2.0v0.2.2→v0.3.0v2.3.2→v2.3.3v29.5.3+incompatible→v29.6.1+incompatiblev0.5.22→v0.5.23v1.54.2→v1.55.0v0.4.1→v0.5.0v2.3.1→v2.4.3v0.53.0→v0.54.0v0.37.0→v0.38.0v0.56.0→v0.57.0v0.21.0→v0.22.0v0.46.0→v0.47.0v0.44.0→v0.45.0v0.38.0→v0.40.0v0.47.0→v0.48.0(Full Changelog)
aquasecurity/trivy (aquasecurity/trivy)
v0.73.0Compare Source
⚡ Highlights ⚡
👉 https://redirect.github.com/aquasecurity/trivy/discussions/11033
Changelog
https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0730-2026-08-03
withastro/astro (astro)
v7.1.6Compare Source
Patch Changes
#17536
ff97b86Thanks @dmgawel! - Fixes concurrent static builds failing to generate i18n rewrite fallbacks for dynamic routes#17383
296e1b0Thanks @thelazylamaGit! - Fixes stale dev CSS after editing component style blocks and CSS files in dev#17543
bbc1ec9Thanks @ematipico! - Adds a feature toexperimental.collectionStoragethat allows to change the size of chunks.For example, you can reduce the size of chunks to 1MB:
#17545
5214663Thanks @ematipico! - Bumps the Astro compiler to the latest version. Changelog.v7.1.5Compare Source
Patch Changes
#17524
7613030Thanks @matthewp! - Fixes a bug where an error while finalizing a request could prevent a response from being sent#17480
f61ba9cThanks @florian-lefebvre! - Fixes a case where a customlogger.entrypointfailed to load at runtime in a built server bundle.#17525
e614b7bThanks @matthewp! - Fixes action path resolution so that properties of a resolved action function are not treated as routable path segments#17284
c775c1fThanks @matthewp! - Fixes a bug where the custom 404 (or 500) page was not rendered when a middleware rewrite targeted a route that returned an empty 404/500 response, and a blank page was returned instead#17474
c895b12Thanks @nicksnyder! - Updates dependencyjs-yamlto v4.3.0Updated dependencies [
c895b12]:v7.1.4Compare Source
Patch Changes
#17488
d4f266dThanks @emerson-d-lopes! - Fixes duplicate CSS files being emitted in server output when a prerendered page and a server-rendered page share the same styles (e.g. a shared layout importing Tailwind). The prerender and SSR environments each emitted their own copy of the same stylesheet (index.X.cssand_..Y.css); the SSR build now reuses the CSS asset filename from the prerender build when the stylesheet is backed by the same CSS source modules, so only a single file is emitted.#17472
4dc590cThanks @astrobot-houston! - Adds the missingbackgroundprop to the<Image />and<Picture />component types. The prop already worked at runtime, but was absent from the types, causingastro checkto report thatbackgrounddoes not exist on the component props#17292
0fc519dThanks @astrobot-houston! - Fixes missing scoped styles for child components insideclient:onlyislands in production builds#17421
f1448deThanks @iamkaleemsajjad-hue! - Fixes session runtime errors being silently swallowed byconsole.errorinstead of routing through Astro's logger#17421
f1448deThanks @iamkaleemsajjad-hue! - Fixes a session being left in a partial state after a storage failure duringsession.regenerate(), preventing unnecessary storage reads on subsequent operations#17517
82bf7e2Thanks @Hashim1999164! - Prevents a visible terminal window from popping up on Windows when the dev server runs in background mode. The detached child process is now spawned withwindowsHide: true, so console-subsystem grandchildren (such asworkerd.exe) no longer get a new focus-stealing window allocated by Windows Terminal.#17510
eaa1fb0Thanks @astrobot-houston! - Fixes theglob()loader watcher so negation patterns like!docs/drafts/**correctly exclude files during development, matching the behavior of the initial scan. Previously, negations were treated as independent matchers, causing unrelated files (including.astro/data-store.json) to be ingested as collection entries#17511
704e570Thanks @astrobot-houston! - Fixes TypeScript path aliases fromtsconfig.jsonnot resolving inastro.config.tsv7.1.3Compare Source
Patch Changes
630b382Thanks @astrobot-houston! - Fixes image optimization duringastro buildusing too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.v7.1.2Compare Source
Patch Changes
#17445
a5f7230Thanks @ocavue! - Updates dependencycookieto v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded inSet-Cookieheaders; encoded values round-trip exactly as before.#17402
a89c137Thanks @farrosfr! - Fixes a bug where mutatedAstro.localsduring the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)#17405
91992efThanks @Araluma! - Prevents an unhandled promise rejection from the prefetchfetchfallback. In WebKit (Safari),<link rel="prefetch">is unsupported, so prefetch uses thefetch()fallback; on a flaky connection that fetch rejects withTypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with.catch().v7.1.1Compare Source
Patch Changes
4b03702Thanks @matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18ndigitalocean/godo (github.com/digitalocean/godo)
v1.202.0Compare Source
v1.201.0Compare Source
v1.200.0Compare Source
getsops/sops (github.com/getsops/sops/v3)
v3.13.3Compare Source
Installation
To install
sops, download one of the pre-built binaries provided for your platform from the artifacts attached to this release.For instance, if you are using Linux on an AMD64 architecture:
Verify checksums file signature
The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:
Verify binary integrity
To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature:
# Verify the binary using the checksums file sha256sum -c sops-v3.13.3.checksums.txt --ignore-missingVerify artifact provenance
The SLSA provenance of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an in-toto link metadata file named
sops-v3.13.3.intoto.jsonl. To verify the provenance of an artifact, you can utilize theslsa-verifiertool:Container Images
The
sopsbinaries are also available as container images, based on Debian (slim) and Alpine Linux. The Debian-based container images include any dependencies which may be required to make use of certain key services, such as GnuPG, AWS KMS, Azure Key Vault, and Google Cloud KMS. The Alpine-based container images are smaller in size, but do not include these dependencies.These container images are available for the following architectures:
linux/amd64andlinux/arm64.GitHub Container Registry
ghcr.io/getsops/sops:v3.13.3ghcr.io/getsops/sops:v3.13.3-alpineQuay.io
quay.io/getsops/sops:v3.13.3quay.io/getsops/sops:v3.13.3-alpineVerify container image signature
The container images are signed using Cosign with GitHub OIDC. To validate the signature of an image, run the following command:
Verify container image provenance
The container images include SLSA provenance attestations. For more information around the verification of this, please refer to the
slsa-verifierdocumentation.Software Bill of Materials
The Software Bill of Materials (SBOM) for each binary is accessible within the artifacts enclosed with this release. It is presented as an SPDX JSON file, formatted as
<binary>.spdx.sbom.json.What's Changed
New Contributors
Full Changelog: getsops/sops@v3.13.2...v3.13.3
goreleaser/goreleaser (github.com/goreleaser/goreleaser/v2)
v2.17.1Compare Source
Announcement
Read the official announcement: Announcing GoReleaser v2.17.
Changelog
Bug fixes
a734383: fix(builder/go): parse GORISCV64 and GOPPC64 for riscv64 and ppc64le targets (#6698) (@upuddu)dfc7f06: fix(builders/go): sort targets (@caarlos0)7630cd1: fix(deps): go1.26.5 (@caarlos0)9dbb266: fix(notary): poll notarization status every 10s, not 10ns (#6726) (@caarlos0)1ebf881: fix: anchor goarm64 validation regex to reject invalid values (#6727) (@semx)70f6921: fix: migrate from deprecated s3/manager to s3/transfermanager (#6706) (@joeyberkovitz)Documentation updates
eafb0ec: docs(users): update charm domain (#6699) (@andreynering)ae4debb: docs: add /.well-known/security.txt (RFC 9116) (#6710) (@kobihikri)d3764c8: docs: fix typo (@caarlos0)742ae5f: docs: move images to a bucket (#6691) (@caarlos0)55a466e: docs: publish to GitLab package registries with the http upload pipe (#6697) (@ajuijas)65240d8: docs: update users (@caarlos0)Other work
0eb5b0f: chore(ci): update dependabot config (@caarlos0)4bcb2a5: chore(ci): update deps (@caarlos0)5f3f435: chore: auto-update generated files (#6693) (@goreleaserbot)9b85924: chore: auto-update generated files (#6694) (@goreleaserbot)1aab79e: chore: auto-update generated files (#6700) (@goreleaserbot)11d0150: chore: auto-update generated files (#6705) (@goreleaserbot)5747ca7: chore: auto-update generated files (#6707) (@goreleaserbot)83f4c19: chore: auto-update generated files (#6730) (@goreleaserbot)f3a0e63: chore: svu config (@caarlos0)Full Changelog: goreleaser/goreleaser@v2.17.0...v2.17.1
Helping out
This release is only possible thanks to all the support of some awesome people!
Want to be one of them?
You can sponsor, get a Pro License or contribute with code.
Where to go next?
mattn/go-isatty (github.com/mattn/go-isatty)
v0.0.24Compare Source
Configuration
📅 Schedule: (in timezone America/Chicago)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.