Skip to content

chore(deps): update non-major dependencies - #62

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major-dependencies
Open

chore(deps): update non-major dependencies#62
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major-dependencies

Conversation

@renovate

@renovate renovate Bot commented Jul 18, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence Type Update
@astrojs/starlight (source) 0.41.30.41.6 age confidence dependencies patch
anchore/syft v1.48.0v1.50.0 age confidence minor
aquasecurity/trivy v0.72.0v0.73.0 age confidence minor
astro (source) 7.1.07.1.6 age confidence dependencies patch
github.com/digitalocean/godo v1.199.0v1.202.0 age confidence require minor
github.com/getsops/sops/v3 v3.13.2v3.13.3 age confidence require patch
github.com/goreleaser/goreleaser/v2 v2.17.0v2.17.1 age confidence patch
github.com/mattn/go-isatty v0.0.23v0.0.24 age confidence require patch

Release Notes

withastro/starlight (@​astrojs/starlight)

v0.41.6

Compare Source

Patch Changes

v0.41.5

Compare Source

Patch Changes

v0.41.4

Compare Source

Patch Changes
anchore/syft (anchore/syft)

v1.50.0

Compare Source

Added Features
Bug Fixes
Additional Changes
Dependencies

14 dependency changes (14 updated). 1 vulnerability remediated.

🟢 Remediated (1)

Updated (14 packages)
  • github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0v1.32.0
  • github.com/cncf/xds/go v0.0.0-ee656c7v0.0.0-dba9d58
  • github.com/envoyproxy/go-control-plane/envoy v1.36.0v1.37.0
  • github.com/envoyproxy/protoc-gen-validate v1.3.0v1.3.3
  • github.com/gpustack/gguf-parser-go v0.24.1v0.25.0
  • go.opentelemetry.io/contrib/detectors/gcp v1.39.0v1.43.0
  • google.golang.org/genproto/googleapis/api v0.0.0-9d38bb4v0.0.0-afd174a
  • google.golang.org/genproto/googleapis/rpc v0.0.0-6f92a3bv0.0.0-afd174a
  • google.golang.org/grpc v1.80.0v1.82.1 (🟢 remediated GHSA-hrxh-6v49-42gf)
  • modernc.org/cc/v4 v4.28.4v4.29.0
  • modernc.org/ccgo/v4 v4.34.4v4.34.6
  • modernc.org/gc/v3 v3.1.3v3.1.4
  • modernc.org/libc v1.73.4v1.74.1
  • modernc.org/sqlite v1.53.0v1.54.0

(Full Changelog)

v1.49.0

Compare Source

Added Features
Bug Fixes
Dependencies

16 dependency changes (16 updated).

Updated (16 packages)
  • github.com/anchore/go-rpmdb v0.1.0v0.2.0
  • github.com/anchore/stereoscope v0.2.2v0.3.0
  • github.com/containerd/containerd/v2 v2.3.2v2.3.3
  • github.com/docker/cli v29.5.3+incompatiblev29.6.1+incompatible
  • github.com/gkampitakis/go-snaps v0.5.22v0.5.23
  • github.com/moby/moby/api v1.54.2v1.55.0
  • github.com/moby/moby/client v0.4.1v0.5.0
  • github.com/pelletier/go-toml/v2 v2.3.1v2.4.3
  • golang.org/x/crypto v0.53.0v0.54.0
  • golang.org/x/mod v0.37.0v0.38.0
  • golang.org/x/net v0.56.0v0.57.0
  • golang.org/x/sync v0.21.0v0.22.0
  • golang.org/x/sys v0.46.0v0.47.0
  • golang.org/x/term v0.44.0v0.45.0
  • golang.org/x/text v0.38.0v0.40.0
  • golang.org/x/tools v0.47.0v0.48.0

(Full Changelog)

aquasecurity/trivy (aquasecurity/trivy)

v0.73.0

Compare Source

⚡ Highlights ⚡

👉 https://redirect.github.com/aquasecurity/trivy/discussions/11033

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0730-2026-08-03

withastro/astro (astro)

v7.1.6

Compare Source

Patch Changes
  • #​17536 ff97b86 Thanks @​dmgawel! - Fixes concurrent static builds failing to generate i18n rewrite fallbacks for dynamic routes

  • #​17383 296e1b0 Thanks @​thelazylamaGit! - Fixes stale dev CSS after editing component style blocks and CSS files in dev

  • #​17543 bbc1ec9 Thanks @​ematipico! - Adds a feature to experimental.collectionStorage that allows to change the size of chunks.

    For example, you can reduce the size of chunks to 1MB:

    // astro.config.mjs
    import { defineConfig } from 'astro/config';
    
    export default defineConfig({
      experimental: {
        collectionStorage: {
          type: 'chunked',
          chunkSize: 1024 * 1024,
        },
      },
    });
  • #​17545 5214663 Thanks @​ematipico! - Bumps the Astro compiler to the latest version. Changelog.

v7.1.5

Compare Source

Patch Changes

v7.1.4

Compare Source

Patch Changes
  • #​17488 d4f266d Thanks @​emerson-d-lopes! - Fixes duplicate CSS files being emitted in server output when a prerendered page and a server-rendered page share the same styles (e.g. a shared layout importing Tailwind). The prerender and SSR environments each emitted their own copy of the same stylesheet (index.X.css and _..Y.css); the SSR build now reuses the CSS asset filename from the prerender build when the stylesheet is backed by the same CSS source modules, so only a single file is emitted.

  • #​17472 4dc590c Thanks @​astrobot-houston! - Adds the missing background prop to the <Image /> and <Picture /> component types. The prop already worked at runtime, but was absent from the types, causing astro check to report that background does not exist on the component props

  • #​17292 0fc519d Thanks @​astrobot-houston! - Fixes missing scoped styles for child components inside client:only islands in production builds

  • #​17421 f1448de Thanks @​iamkaleemsajjad-hue! - Fixes session runtime errors being silently swallowed by console.error instead of routing through Astro's logger

  • #​17421 f1448de Thanks @​iamkaleemsajjad-hue! - Fixes a session being left in a partial state after a storage failure during session.regenerate(), preventing unnecessary storage reads on subsequent operations

  • #​17517 82bf7e2 Thanks @​Hashim1999164! - Prevents a visible terminal window from popping up on Windows when the dev server runs in background mode. The detached child process is now spawned with windowsHide: true, so console-subsystem grandchildren (such as workerd.exe) no longer get a new focus-stealing window allocated by Windows Terminal.

  • #​17510 eaa1fb0 Thanks @​astrobot-houston! - Fixes the glob() loader watcher so negation patterns like !docs/drafts/** correctly exclude files during development, matching the behavior of the initial scan. Previously, negations were treated as independent matchers, causing unrelated files (including .astro/data-store.json) to be ingested as collection entries

  • #​17511 704e570 Thanks @​astrobot-houston! - Fixes TypeScript path aliases from tsconfig.json not resolving in astro.config.ts

v7.1.3

Compare Source

Patch Changes
  • #​17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

v7.1.2

Compare Source

Patch Changes
  • #​17445 a5f7230 Thanks @​ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

  • #​17402 a89c137 Thanks @​farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

  • #​17405 91992ef Thanks @​Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

v7.1.1

Compare Source

Patch Changes
digitalocean/godo (github.com/digitalocean/godo)

v1.202.0

Compare Source

v1.201.0

Compare Source

v1.200.0

Compare Source

getsops/sops (github.com/getsops/sops/v3)

v3.13.3

Compare Source

Installation

To install sops, download one of the pre-built binaries provided for your platform from the artifacts attached to this release.

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.linux.amd64

# Move the binary in to your PATH
mv sops-v3.13.3.linux.amd64 /usr/local/bin/sops

# Make the binary executable
chmod +x /usr/local/bin/sops
Verify checksums file signature

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate and signature
curl -LO https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.checksums.txt
curl -LO https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.checksums.sigstore.json

# Verify the checksums file
cosign verify-blob sops-v3.13.3.checksums.txt \
  --bundle sops-v3.13.3.checksums.sigstore.json \
  --certificate-identity-regexp=https://github.com/getsops \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com
Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature:

# Verify the binary using the checksums file
sha256sum -c sops-v3.13.3.checksums.txt --ignore-missing
Verify artifact provenance

The SLSA provenance of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an in-toto link metadata file named sops-v3.13.3.intoto.jsonl. To verify the provenance of an artifact, you can utilize the slsa-verifier tool:

# Download the metadata file
curl -LO  https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.intoto.jsonl

# Verify the provenance of the artifact
slsa-verifier verify-artifact <artifact> \
  --provenance-path sops-v3.13.3.intoto.jsonl \
  --source-uri github.com/getsops/sops \
  --source-tag v3.13.3

Container Images

The sops binaries are also available as container images, based on Debian (slim) and Alpine Linux. The Debian-based container images include any dependencies which may be required to make use of certain key services, such as GnuPG, AWS KMS, Azure Key Vault, and Google Cloud KMS. The Alpine-based container images are smaller in size, but do not include these dependencies.

These container images are available for the following architectures: linux/amd64 and linux/arm64.

GitHub Container Registry
  • ghcr.io/getsops/sops:v3.13.3
  • ghcr.io/getsops/sops:v3.13.3-alpine
Quay.io
  • quay.io/getsops/sops:v3.13.3
  • quay.io/getsops/sops:v3.13.3-alpine
Verify container image signature

The container images are signed using Cosign with GitHub OIDC. To validate the signature of an image, run the following command:

cosign verify ghcr.io/getsops/sops:v3.13.3 \
  --certificate-identity-regexp=https://github.com/getsops \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  -o text
Verify container image provenance

The container images include SLSA provenance attestations. For more information around the verification of this, please refer to the slsa-verifier documentation.

Software Bill of Materials

The Software Bill of Materials (SBOM) for each binary is accessible within the artifacts enclosed with this release. It is presented as an SPDX JSON file, formatted as <binary>.spdx.sbom.json.

What's Changed

New Contributors

Full Changelog: getsops/sops@v3.13.2...v3.13.3

goreleaser/goreleaser (github.com/goreleaser/goreleaser/v2)

v2.17.1

Compare Source

Announcement

Read the official announcement: Announcing GoReleaser v2.17.

Changelog

Bug fixes
Documentation updates
Other work

Full Changelog: goreleaser/goreleaser@v2.17.0...v2.17.1

Helping out

This release is only possible thanks to all the support of some awesome people!

Want to be one of them?
You can sponsor, get a Pro License or contribute with code.

Where to go next?

GoReleaser logo

mattn/go-isatty (github.com/mattn/go-isatty)

v0.0.24

Compare Source


Configuration

📅 Schedule: (in timezone America/Chicago)

  • Branch creation
    • "before 6am"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Jul 18, 2026
@renovate renovate Bot changed the title chore(deps): update dependency astro to v7.1.1 chore(deps): update dependency astro to v7.1.3 Jul 20, 2026
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 2 times, most recently from 7bd73d6 to 3468db8 Compare July 21, 2026 20:54
@renovate renovate Bot changed the title chore(deps): update dependency astro to v7.1.3 chore(deps): update non-major dependencies Jul 21, 2026
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 2 times, most recently from 6873283 to f38f3d6 Compare July 23, 2026 06:39
@renovate

renovate Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 38 additional dependencies were updated

Details:

Package Change
cloud.google.com/go/auth v0.20.0 -> v0.22.0
cloud.google.com/go/iam v1.11.0 -> v1.12.0
cloud.google.com/go/kms v1.31.0 -> v1.32.0
cloud.google.com/go/longrunning v1.1.0 -> v1.2.0
cloud.google.com/go/monitoring v1.29.0 -> v1.30.0
cloud.google.com/go/storage v1.63.0 -> v1.63.1
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 -> v1.34.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0 -> v0.58.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.57.0 -> v0.58.0
github.com/aws/aws-sdk-go-v2 v1.42.0 -> v1.42.1
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.13 -> v1.7.14
github.com/aws/aws-sdk-go-v2/config v1.32.25 -> v1.32.30
github.com/aws/aws-sdk-go-v2/credentials v1.19.24 -> v1.19.29
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29 -> v1.18.30
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.28 -> v1.22.34
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 -> v1.4.30
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 -> v2.7.30
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.30 -> v1.4.31
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12 -> v1.13.13
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.22 -> v1.9.23
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.29 -> v1.13.30
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.29 -> v1.19.31
github.com/aws/aws-sdk-go-v2/service/kms v1.53.4 -> v1.54.1
github.com/aws/aws-sdk-go-v2/service/s3 v1.104.0 -> v1.105.2
github.com/aws/aws-sdk-go-v2/service/signin v1.2.0 -> v1.4.1
github.com/aws/aws-sdk-go-v2/service/sso v1.31.3 -> v1.32.1
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.6 -> v1.37.1
github.com/aws/aws-sdk-go-v2/service/sts v1.43.3 -> v1.44.1
github.com/aws/smithy-go v1.27.3 -> v1.27.4
github.com/googleapis/enterprise-certificate-proxy v0.3.17 -> v0.3.18
github.com/googleapis/gax-go/v2 v2.22.0 -> v2.23.0
github.com/huaweicloud/huaweicloud-sdk-go-v3 v0.1.202 -> v0.1.207
golang.org/x/net v0.56.0 -> v0.57.0
google.golang.org/api v0.286.0 -> v0.289.0
google.golang.org/genproto v0.0.0-20260622175928-b703f567277d -> v0.0.0-20260720171339-e059f2f05d78
google.golang.org/genproto/googleapis/api v0.0.0-20260622175928-b703f567277d -> v0.0.0-20260720171339-e059f2f05d78
google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d -> v0.0.0-20260720171339-e059f2f05d78
google.golang.org/grpc v1.81.1 -> v1.82.1

@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 8 times, most recently from 9d378dc to 4d1515c Compare July 30, 2026 14:05
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch from 4d1515c to 9ba40ca Compare July 31, 2026 23:08
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch from 9ba40ca to 28e901c Compare August 3, 2026 12:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants