Update go modules (main) (patch) by renovate[bot] · Pull Request #1686 · conforma/policy

renovate · 2026-03-03T01:36:42Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/conforma/cli	`v0.9.2` → `v0.9.59`
github.com/conforma/go-containerregistry	`v0.20.7-0.20251103083939-3459088e4bae` → `v0.20.7`
github.com/tektoncd/cli	`v0.42.1` → `v0.42.2`
oras.land/oras	`v1.3.0` → `v1.3.2`

Release Notes

conforma/cli (github.com/conforma/cli)

conforma/go-containerregistry (github.com/conforma/go-containerregistry)

`v0.20.7`

Compare Source

tektoncd/cli (github.com/tektoncd/cli)

`v0.42.2`

Compare Source

v0.42.2 Release 🎉

This patch release addresses the following CVEs: CVE-2026-33186, CVE-2026-33810, CVE-2025-61729 and CVE-2025-61726.

Changelog

1e1782f New version v0.42.2

Full Changelog: tektoncd/cli@v0.42.1...v0.42.2

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM (* 0-3 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-03-03T01:36:45Z

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

112 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.25.3` -> `1.25.8`
`cloud.google.com/go`	`v0.121.6` -> `v0.123.0`
`cloud.google.com/go/auth`	`v0.18.0` -> `v0.18.2`
`cloud.google.com/go/storage`	`v1.57.1` -> `v1.61.3`
`cuelang.org/go`	`v0.15.3` -> `v0.16.0`
`github.com/CycloneDX/cyclonedx-go`	`v0.9.3` -> `v0.10.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric`	`v0.54.0` -> `v0.55.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping`	`v0.54.0` -> `v0.55.0`
`github.com/anchore/go-struct-converter`	`v0.0.0-20230627203149-c72ef8859ca9` -> `v0.1.0`
`github.com/aws/aws-sdk-go-v2`	`v1.41.0` -> `v1.41.4`
`github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream`	`v1.7.1` -> `v1.7.7`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.5` -> `v1.32.12`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.19.5` -> `v1.19.12`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.16` -> `v1.18.20`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.4.16` -> `v1.4.20`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.16` -> `v2.7.20`
`github.com/aws/aws-sdk-go-v2/internal/ini`	`v1.8.4` -> `v1.8.6`
`github.com/aws/aws-sdk-go-v2/internal/v4a`	`v1.4.9` -> `v1.4.21`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.13.4` -> `v1.13.7`
`github.com/aws/aws-sdk-go-v2/service/internal/checksum`	`v1.8.9` -> `v1.9.12`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.13.16` -> `v1.13.20`
`github.com/aws/aws-sdk-go-v2/service/internal/s3shared`	`v1.19.9` -> `v1.19.20`
`github.com/aws/aws-sdk-go-v2/service/s3`	`v1.88.3` -> `v1.97.1`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.0.4` -> `v1.0.8`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.30.7` -> `v1.30.13`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.35.12` -> `v1.35.17`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.41.5` -> `v1.41.9`
`github.com/aws/smithy-go`	`v1.24.0` -> `v1.24.2`
`github.com/cloudflare/circl`	`v1.6.1` -> `v1.6.3`
`github.com/cncf/xds/go`	`v0.0.0-20251022180443-0feb69152e9f` -> `v0.0.0-20251210132809-ee656c7534f5`
`github.com/conforma/go-gather`	`v1.0.2` -> `v1.1.0`
`github.com/containerd/containerd/v2`	`v2.2.0` -> `v2.2.2`
`github.com/containerd/stargz-snapshotter/estargz`	`v0.18.1` -> `v0.18.2`
`github.com/cyphar/filepath-securejoin`	`v0.4.1` -> `v0.6.0`
`github.com/dgraph-io/badger/v4`	`v4.8.0` -> `v4.9.1`
`github.com/docker/cli`	`v29.2.0+incompatible` -> `v29.3.1+incompatible`
`github.com/docker/docker-credential-helpers`	`v0.9.4` -> `v0.9.5`
`github.com/emicklei/proto`	`v1.14.2` -> `v1.14.3`
`github.com/envoyproxy/go-control-plane/envoy`	`v1.35.0` -> `v1.36.0`
`github.com/envoyproxy/protoc-gen-validate`	`v1.2.1` -> `v1.3.0`
`github.com/evanphx/json-patch/v5`	`v5.9.0` -> `v5.9.11`
`github.com/go-git/go-billy/v5`	`v5.6.2` -> `v5.8.0`
`github.com/go-git/go-git/v5`	`v5.16.5` -> `v5.17.1`
`github.com/go-jose/go-jose/v4`	`v4.1.3` -> `v4.1.4`
`github.com/go-openapi/analysis`	`v0.24.1` -> `v0.24.3`
`github.com/go-openapi/errors`	`v0.22.6` -> `v0.22.7`
`github.com/go-openapi/jsonpointer`	`v0.22.4` -> `v0.22.5`
`github.com/go-openapi/jsonreference`	`v0.21.4` -> `v0.21.5`
`github.com/go-openapi/loads`	`v0.23.2` -> `v0.23.3`
`github.com/go-openapi/spec`	`v0.22.3` -> `v0.22.4`
`github.com/go-openapi/strfmt`	`v0.25.0` -> `v0.26.1`
`github.com/go-openapi/swag/conv`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/fileutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/jsonname`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/jsonutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/loading`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/mangling`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/stringutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/typeutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/yamlutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/validate`	`v0.25.1` -> `v0.25.2`
`github.com/go-viper/mapstructure/v2`	`v2.4.0` -> `v2.5.0`
`github.com/google/cel-go`	`v0.26.1` -> `v0.27.0`
`github.com/google/go-containerregistry`	`v0.20.7` -> `v0.21.0`
`github.com/google/go-jsonnet`	`v0.21.0` -> `v0.22.0`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.9` -> `v0.3.14`
`github.com/googleapis/gax-go/v2`	`v2.16.0` -> `v2.17.0`
`github.com/grpc-ecosystem/grpc-gateway/v2`	`v2.27.3` -> `v2.27.7`
`github.com/hashicorp/aws-sdk-go-base/v2`	`v2.0.0-beta.65` -> `v2.0.0-beta.72`
`github.com/hashicorp/go-getter`	`v1.8.3` -> `v1.8.6`
`github.com/hashicorp/go-version`	`v1.7.0` -> `v1.8.0`
`github.com/huandu/go-sqlbuilder`	`v1.38.1` -> `v1.39.1`
`github.com/klauspost/compress`	`v1.18.2` -> `v1.18.5`
`github.com/lestrrat-go/httprc/v3`	`v3.0.1` -> `v3.0.2`
`github.com/lestrrat-go/jwx/v3`	`v3.0.12` -> `v3.0.13`
`github.com/moby/buildkit`	`v0.26.3` -> `v0.29.0`
`github.com/open-policy-agent/conftest`	`v0.66.0` -> `v0.68.2`
`github.com/open-policy-agent/opa`	`v1.12.1` -> `v1.15.2`
`github.com/protocolbuffers/txtpbfmt`	`v0.0.0-20251016062345-16587c79cd91` -> `v0.0.0-20260217160748-a481f6a22f94`
`github.com/spdx/tools-golang`	`v0.5.5` -> `v0.5.7`
`github.com/tektoncd/pipeline`	`v0.70.0` -> `v1.9.2`
`github.com/theupdateframework/go-tuf/v2`	`v2.3.0` -> `v2.4.1`
`github.com/valyala/fastjson`	`v1.6.4` -> `v1.6.7`
`github.com/vektah/gqlparser/v2`	`v2.5.31` -> `v2.5.32`
`go.opentelemetry.io/contrib/detectors/gcp`	`v1.38.0` -> `v1.39.0`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.63.0` -> `v0.65.0`
`go.opentelemetry.io/otel`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace`	`v1.38.0` -> `v1.40.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`	`v1.38.0` -> `v1.40.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`	`v1.38.0` -> `v1.40.0`
`go.opentelemetry.io/otel/metric`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/otel/sdk`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/otel/sdk/metric`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/otel/trace`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/proto/otlp`	`v1.7.1` -> `v1.9.0`
`golang.org/x/crypto`	`v0.47.0` -> `v0.49.0`
`golang.org/x/mod`	`v0.31.0` -> `v0.33.0`
`golang.org/x/net`	`v0.49.0` -> `v0.52.0`
`golang.org/x/oauth2`	`v0.34.0` -> `v0.36.0`
`golang.org/x/sync`	`v0.19.0` -> `v0.20.0`
`golang.org/x/sys`	`v0.40.0` -> `v0.42.0`
`golang.org/x/term`	`v0.39.0` -> `v0.41.0`
`golang.org/x/text`	`v0.33.0` -> `v0.35.0`
`golang.org/x/time`	`v0.14.0` -> `v0.15.0`
`golang.org/x/tools`	`v0.40.0` -> `v0.42.0`
`gomodules.xyz/jsonpatch/v2`	`v2.4.0` -> `v2.5.0`
`google.golang.org/api`	`v0.260.0` -> `v0.271.0`
`google.golang.org/genproto`	`v0.0.0-20251202230838-ff82c1b0f217` -> `v0.0.0-20260128011058-8636f8732409`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20251202230838-ff82c1b0f217` -> `v0.0.0-20260203192932-546029d2fa20`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260203192932-546029d2fa20` -> `v0.0.0-20260226221140-a57be14db171`
`google.golang.org/grpc`	`v1.78.0` -> `v1.79.3`
`k8s.io/apiextensions-apiserver`	`v0.34.2` -> `v0.34.3`
`knative.dev/pkg`	`v0.0.0-20250117084104-c43477f0052b` -> `v0.0.0-20250415155312-ed3e2158b883`

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

113 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.25.5` -> `1.26.2`
`github.com/open-policy-agent/conftest`	`v0.66.0` -> `v0.68.2`
`cloud.google.com/go`	`v0.121.6` -> `v0.123.0`
`cloud.google.com/go/auth`	`v0.18.0` -> `v0.18.2`
`cloud.google.com/go/firestore`	`v1.20.0` -> `v1.21.0`
`cloud.google.com/go/kms`	`v1.23.2` -> `v1.25.0`
`cloud.google.com/go/longrunning`	`v0.7.0` -> `v0.8.0`
`cloud.google.com/go/storage`	`v1.57.1` -> `v1.61.3`
`cuelang.org/go`	`v0.15.3` -> `v0.16.0`
`github.com/CycloneDX/cyclonedx-go`	`v0.9.3` -> `v0.10.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.30.0` -> `v1.31.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric`	`v0.54.0` -> `v0.55.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping`	`v0.54.0` -> `v0.55.0`
`github.com/anchore/go-struct-converter`	`v0.0.0-20230627203149-c72ef8859ca9` -> `v0.1.0`
`github.com/aws/aws-sdk-go-v2`	`v1.41.0` -> `v1.41.4`
`github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream`	`v1.7.2` -> `v1.7.7`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.5` -> `v1.32.12`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.19.5` -> `v1.19.12`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.16` -> `v1.18.20`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.4.16` -> `v1.4.20`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.16` -> `v2.7.20`
`github.com/aws/aws-sdk-go-v2/internal/ini`	`v1.8.4` -> `v1.8.6`
`github.com/aws/aws-sdk-go-v2/internal/v4a`	`v1.4.12` -> `v1.4.21`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.13.4` -> `v1.13.7`
`github.com/aws/aws-sdk-go-v2/service/internal/checksum`	`v1.9.3` -> `v1.9.12`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.13.16` -> `v1.13.20`
`github.com/aws/aws-sdk-go-v2/service/internal/s3shared`	`v1.19.12` -> `v1.19.20`
`github.com/aws/aws-sdk-go-v2/service/s3`	`v1.89.1` -> `v1.97.1`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.0.4` -> `v1.0.8`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.30.7` -> `v1.30.13`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.35.12` -> `v1.35.17`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.41.5` -> `v1.41.9`
`github.com/aws/smithy-go`	`v1.24.0` -> `v1.24.2`
`github.com/cloudflare/circl`	`v1.6.1` -> `v1.6.3`
`github.com/cncf/xds/go`	`v0.0.0-20251022180443-0feb69152e9f` -> `v0.0.0-20251210132809-ee656c7534f5`
`github.com/conforma/go-gather`	`v1.0.2` -> `v1.1.0`
`github.com/containerd/containerd/v2`	`v2.2.0` -> `v2.2.2`
`github.com/containerd/stargz-snapshotter/estargz`	`v0.18.1` -> `v0.18.2`
`github.com/cyphar/filepath-securejoin`	`v0.5.0` -> `v0.6.0`
`github.com/dgraph-io/badger/v4`	`v4.8.0` -> `v4.9.1`
`github.com/docker/cli`	`v29.0.3+incompatible` -> `v29.3.1+incompatible`
`github.com/docker/docker-credential-helpers`	`v0.9.4` -> `v0.9.5`
`github.com/emicklei/proto`	`v1.14.2` -> `v1.14.3`
`github.com/envoyproxy/go-control-plane/envoy`	`v1.35.0` -> `v1.36.0`
`github.com/envoyproxy/protoc-gen-validate`	`v1.2.1` -> `v1.3.0`
`github.com/evanphx/json-patch`	`v5.9.0+incompatible` -> `v5.9.11+incompatible`
`github.com/go-git/go-billy/v5`	`v5.6.2` -> `v5.8.0`
`github.com/go-git/go-git/v5`	`v5.16.5` -> `v5.17.1`
`github.com/go-jose/go-jose/v4`	`v4.1.3` -> `v4.1.4`
`github.com/go-openapi/analysis`	`v0.24.1` -> `v0.24.3`
`github.com/go-openapi/errors`	`v0.22.6` -> `v0.22.7`
`github.com/go-openapi/jsonpointer`	`v0.22.4` -> `v0.22.5`
`github.com/go-openapi/jsonreference`	`v0.21.4` -> `v0.21.5`
`github.com/go-openapi/loads`	`v0.23.2` -> `v0.23.3`
`github.com/go-openapi/spec`	`v0.22.3` -> `v0.22.4`
`github.com/go-openapi/strfmt`	`v0.25.0` -> `v0.26.1`
`github.com/go-openapi/swag/conv`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/fileutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/jsonname`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/jsonutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/loading`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/mangling`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/stringutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/typeutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/swag/yamlutils`	`v0.25.4` -> `v0.25.5`
`github.com/go-openapi/validate`	`v0.25.1` -> `v0.25.2`
`github.com/go-viper/mapstructure/v2`	`v2.4.0` -> `v2.5.0`
`github.com/google/cel-go`	`v0.26.1` -> `v0.27.0`
`github.com/google/go-containerregistry`	`v0.20.7` -> `v0.21.0`
`github.com/google/go-jsonnet`	`v0.21.0` -> `v0.22.0`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.9` -> `v0.3.14`
`github.com/googleapis/gax-go/v2`	`v2.16.0` -> `v2.17.0`
`github.com/grpc-ecosystem/grpc-gateway/v2`	`v2.27.3` -> `v2.27.7`
`github.com/hashicorp/aws-sdk-go-base/v2`	`v2.0.0-beta.65` -> `v2.0.0-beta.72`
`github.com/hashicorp/go-getter`	`v1.8.3` -> `v1.8.6`
`github.com/hashicorp/go-version`	`v1.7.0` -> `v1.8.0`
`github.com/huandu/go-sqlbuilder`	`v1.38.1` -> `v1.39.1`
`github.com/klauspost/compress`	`v1.18.2` -> `v1.18.5`
`github.com/lestrrat-go/httprc/v3`	`v3.0.1` -> `v3.0.2`
`github.com/lestrrat-go/jwx/v3`	`v3.0.12` -> `v3.0.13`
`github.com/moby/buildkit`	`v0.26.3` -> `v0.29.0`
`github.com/morikuni/aec`	`v1.0.0` -> `v1.1.0`
`github.com/open-policy-agent/opa`	`v1.12.1` -> `v1.15.2`
`github.com/protocolbuffers/txtpbfmt`	`v0.0.0-20251016062345-16587c79cd91` -> `v0.0.0-20260217160748-a481f6a22f94`
`github.com/spdx/tools-golang`	`v0.5.5` -> `v0.5.7`
`github.com/tektoncd/pipeline`	`v1.3.1` -> `v1.9.2`
`github.com/valyala/fastjson`	`v1.6.4` -> `v1.6.7`
`github.com/vektah/gqlparser/v2`	`v2.5.31` -> `v2.5.32`
`go.opentelemetry.io/contrib/detectors/gcp`	`v1.38.0` -> `v1.39.0`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.63.0` -> `v0.65.0`
`go.opentelemetry.io/otel`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace`	`v1.38.0` -> `v1.40.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`	`v1.38.0` -> `v1.40.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`	`v1.38.0` -> `v1.40.0`
`go.opentelemetry.io/otel/metric`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/otel/sdk`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/otel/sdk/metric`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/otel/trace`	`v1.39.0` -> `v1.43.0`
`golang.org/x/crypto`	`v0.47.0` -> `v0.49.0`
`golang.org/x/mod`	`v0.31.0` -> `v0.33.0`
`golang.org/x/net`	`v0.49.0` -> `v0.52.0`
`golang.org/x/oauth2`	`v0.34.0` -> `v0.36.0`
`golang.org/x/sync`	`v0.19.0` -> `v0.20.0`
`golang.org/x/sys`	`v0.40.0` -> `v0.42.0`
`golang.org/x/term`	`v0.39.0` -> `v0.41.0`
`golang.org/x/text`	`v0.33.0` -> `v0.35.0`
`golang.org/x/time`	`v0.14.0` -> `v0.15.0`
`golang.org/x/tools`	`v0.40.0` -> `v0.42.0`
`google.golang.org/api`	`v0.260.0` -> `v0.271.0`
`google.golang.org/genproto`	`v0.0.0-20251202230838-ff82c1b0f217` -> `v0.0.0-20260128011058-8636f8732409`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20251202230838-ff82c1b0f217` -> `v0.0.0-20260203192932-546029d2fa20`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260203192932-546029d2fa20` -> `v0.0.0-20260226221140-a57be14db171`
`google.golang.org/grpc`	`v1.78.0` -> `v1.80.0`
`k8s.io/apiextensions-apiserver`	`v0.34.2` -> `v0.34.3`

codecov · 2026-03-03T01:42:44Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

fullsend-ai-review · 2026-06-16T14:23:28Z

🤖 Finished Review · ✅ Success · Started 2:23 PM UTC · Completed 2:31 PM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-06-17T17:10:37Z

🤖 Finished Review · ✅ Success · Started 5:10 PM UTC · Completed 5:17 PM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-06-18T01:50:30Z

🤖 Finished Review · ✅ Success · Started 1:50 AM UTC · Completed 1:57 AM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-06-22T13:22:05Z

🤖 Finished Review · ✅ Success · Started 1:22 PM UTC · Completed 1:31 PM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-06-22T16:02:48Z

🤖 Finished Review · ✅ Success · Started 4:02 PM UTC · Completed 4:09 PM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-06-22T16:36:50Z

🤖 Finished Review · ✅ Success · Started 4:36 PM UTC · Completed 4:41 PM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-06-24T02:54:24Z

🤖 Finished Review · ✅ Success · Started 2:54 AM UTC · Completed 3:02 AM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-06-24T14:35:01Z

🤖 Finished Review · ✅ Success · Started 2:35 PM UTC · Completed 2:44 PM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-06-26T19:20:32Z

🤖 Finished Review · ✅ Success · Started 7:20 PM UTC · Completed 7:27 PM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-06-27T01:08:55Z

🤖 Finished Review · ✅ Success · Started 1:08 AM UTC · Completed 1:21 AM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-07-01T19:14:35Z

🤖 Finished Review · ✅ Success · Started 7:14 PM UTC · Completed 7:20 PM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-07-01T19:59:54Z

🤖 Finished Review · ✅ Success · Started 7:59 PM UTC · Completed 8:07 PM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-07-01T20:39:09Z

🤖 Finished Review · ✅ Success · Started 8:39 PM UTC · Completed 8:46 PM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-07-08T01:08:17Z

🤖 Finished Review · ✅ Success · Started 1:08 AM UTC · Completed 1:13 AM UTC
Commit: 7c8ccca · View workflow run →

fullsend-ai-review · 2026-07-08T13:35:28Z

🤖 Finished Review · ✅ Success · Started 1:35 PM UTC · Completed 1:40 PM UTC
Commit: 7c8ccca · View workflow run →

fullsend-ai-review · 2026-07-08T19:48:37Z

🤖 Finished Review · ✅ Success · Started 7:48 PM UTC · Completed 7:57 PM UTC
Commit: 8f05d87 · View workflow run →

fullsend-ai-review

See the review comment for full details.

fullsend-ai-review · 2026-07-08T19:57:42Z

-go 1.25.3
-
-toolchain go1.25.7
+go 1.26.3


[medium] correctness

Go version jumps from 1.25.3 to 1.26.3 in acceptance module while root stays at 1.25.5, creating a version split. Environments with GOTOOLCHAIN=local and only Go 1.25.x will fail to build the acceptance module.

Suggested fix: Verify CI environments support Go 1.26+. If the root module should also track Go 1.26, update its go directive.

fullsend-ai-review · 2026-07-08T19:57:42Z


 require (
-	github.com/conforma/cli v0.9.2
+	github.com/conforma/cli v0.9.58


[low] supply-chain

conforma/cli jumps 56 patch versions (v0.9.2 to v0.9.58). First-party dependency with narrow integration surface (go run CLI, acceptance test flags). Risk is minimal but the jump is unusually large for a single update.

Suggested fix: Ensure CI acceptance tests pass to validate CLI interface compatibility.

fullsend-ai-review · 2026-07-08T19:57:42Z

 exclude google.golang.org/grpc/stats/opentelemetry v0.0.0-20241028142157-ada6787961b3

-replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.20.7-0.20251103083939-3459088e4bae
+replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.20.7


[low] correctness

Replace directive changes from pseudo-version (v0.20.7-0.20251103083939-3459088e4bae) to proper release tag (v0.20.7) for go-containerregistry. Positive change for reproducibility, but verify the tagged release contains all fixes from the pseudo-version commit.

Suggested fix: Verify go.sum hashes match expectations for the new version.

renovate Bot added main renovate labels Mar 3, 2026

renovate Bot enabled auto-merge (squash) March 3, 2026 01:36

github-actions Bot added the size: L label Mar 3, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch from cca90ca to 4a2c267 Compare March 4, 2026 21:54

renovate Bot changed the title ~~Update module github.com/conforma/cli to v0.8.120 (main)~~ Update module github.com/conforma/cli to v0.8.122 (main) Mar 4, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch from 4a2c267 to d09fee6 Compare March 5, 2026 02:17

renovate Bot changed the title ~~Update module github.com/conforma/cli to v0.8.122 (main)~~ Update module github.com/conforma/cli to v0.8.123 (main) Mar 5, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch from d09fee6 to 201288b Compare March 12, 2026 01:28

renovate Bot changed the title ~~Update module github.com/conforma/cli to v0.8.123 (main)~~ Update module github.com/conforma/cli to v0.8.129 (main) Mar 12, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch from 201288b to 7067591 Compare March 12, 2026 05:09

renovate Bot changed the title ~~Update module github.com/conforma/cli to v0.8.129 (main)~~ Update go modules (main) (patch) Mar 12, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch 5 times, most recently from 8a6ccc5 to a132df5 Compare March 20, 2026 18:16

renovate Bot force-pushed the renovate/main-patch-go-modules branch from a132df5 to 23a5b44 Compare March 25, 2026 12:31

renovate Bot changed the title ~~Update go modules (main) (patch)~~ Update module oras.land/oras to v1.3.1 (main) Mar 25, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch from 23a5b44 to 9a8f12b Compare March 25, 2026 14:50

github-actions Bot added size: XS and removed size: L labels Mar 25, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch from 9a8f12b to 46eef9b Compare April 1, 2026 01:43

renovate Bot changed the title ~~Update module oras.land/oras to v1.3.1 (main)~~ Update go modules (main) (patch) Apr 1, 2026

github-actions Bot added size: L and removed size: XS labels Apr 1, 2026

renovate Bot force-pushed the renovate/main-patch-go-modules branch from 46eef9b to 321f66d Compare April 4, 2026 01:26

This comment was marked as outdated.

Sign in to view

fullsend-ai-review Bot reviewed Jul 8, 2026

View reviewed changes

Update go modules

95026e9

Uh oh!

Conversation

renovate Bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.42.2 Release 🎉

Changelog

Configuration

Uh oh!

renovate Bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: acceptance/go.mod

File name: go.mod

Uh oh!

codecov Bot commented Mar 3, 2026

Codecov Report

Uh oh!

fullsend-ai-review Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

renovate Bot commented Mar 3, 2026 •

edited

Loading

renovate Bot commented Mar 3, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 16, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 17, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 18, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 22, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 22, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 22, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 24, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 24, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 26, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 27, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jul 1, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jul 1, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jul 1, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jul 8, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jul 8, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jul 8, 2026 •

edited

Loading