🚨 Update go modules (release-v0.6) (major) by renovate[bot] · Pull Request #3144 · conforma/cli

renovate · 2026-03-01T02:34:15Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/MakeNowJust/heredoc	`v1.0.0` → `v2.0.1`
github.com/golangci/golangci-lint	`v1.63.4` → `v2.11.3`
github.com/open-policy-agent/opa	`v0.70.0` → `v1.14.1`
github.com/santhosh-tekuri/jsonschema/v5	`v5.3.1` → `v6.0.2`
github.com/sigstore/cosign/v2	`v2.4.1` → `v3.0.5`
github.com/tektoncd/pipeline	`v0.70.0` → `v1.10.0`
gopkg.in/go-jose/go-jose.v2	`v2.6.3` → `v4.1.3`
helm.sh/helm/v3	`v3.16.4` → `v4.1.1`

Release Notes

MakeNowJust/heredoc (github.com/MakeNowJust/heredoc)

`v2.0.1`

Compare Source

Version 2.0.1

Fixes

Correct import path for Go modules

`v2.0.0`

Compare Source

Version 2.0.0

Breaking Changes

Treats only white space (U+0020) and horizontal tabs (U+000D) as space characters. (#6)

golangci/golangci-lint (github.com/golangci/golangci-lint)

`v2.11.3`

Compare Source

Released on 2026-03-10

Linters bug fixes
- gosec: from v2.24.7 to 619ce21

`v2.11.2`

Compare Source

Released on 2026-03-07

Fixes
- fmt: fix error when using the fmt command with explicit paths.

`v2.11.1`

Compare Source

Released on 2026-03-06

Due to an error related to AUR, some artifacts of the v2.11.0 release have not been published.

This release contains the same things as v2.11.0.

`v2.11.0`

Compare Source

Released on 2026-03-06

Linters new features or changes
- errcheck: from 1.9.0 to 1.10.0 (exclude crypto/rand.Read by default)
- gosec: from 2.23.0 to 2.24.6 (new rules: G113, G118, G119, G120, G121, G122, G123, G408, G707)
- noctx: from 0.4.0 to 0.5.0 (new detection: httptest.NewRequestWithContext)
- prealloc: from 1.0.2 to 1.1.0
- revive: from 1.14.0 to 1.15.0 (⚠️ Breaking change: package-related checks moved from var-naming to a new rule package-naming)
Linters bug fixes
- gocognit: from 1.2.0 to 1.2.1
- gosec: from 2.24.6 to 2.24.7
- unqueryvet: from 1.5.3 to 1.5.4

`v2.10.1`

Compare Source

Released on 2026-02-17

Fixes
- buildssa panic

`v2.10.0`

Compare Source

Released on 2026-02-17

Linters new features or changes
- ginkgolinter: from 0.22.0 to 0.23.0
- gosec: from 2.22.11 to 2.23.0 (new rules: G117, G602, G701, G702, G703, G704, G705, G706)
- staticcheck: from 0.6.1 to 0.7.0
Linters bug fixes
- godoclint: from 0.11.1 to 0.11.2

`v2.9.0`

Compare Source

Released on 2026-02-10

Enhancements
- 🎉 go1.26 support
Linters new features or changes
- arangolint: from 0.3.1 to 0.4.0 (new rule: detect potential query injections)
- ginkgolinter: from 0.21.2 to 0.22.0 (support for wrappers)
- golines: from 0.14.0 to 0.15.0
- misspell: from 0.7.0 to 0.8.0
- unqueryvet: from 1.4.0 to 1.5.3 (new options: check-n1, check-sql-injection, check-tx-leaks, allow, custom-rules)
- wsl: from 5.3.0 to 5.6.0 (new rule: after-block)
Linters bug fixes
- modernize: from 0.41.0 to 0.42.0
- prealloc: from 1.0.1 to 1.0.2
- protogetter: from 0.3.18 to 0.3.20
Misc.
- Log information about files when configuration verification
- Emit an error when no linters enabled
- Do not collect VCS information when loading code

`v2.8.0`

Compare Source

Released on 2026-01-07

Linters new features or changes
- godoc-lint: from 0.10.2 to 0.11.1 (new rule: require-stdlib-doclink)
- golines: from 442fd00 to 0.14.0
- gomoddirectives: from 0.7.1 to 0.8.0
- gosec: from daccba6 to 2.22.11 (new rule: G116)
- modernize: from 0.39.0 to 0.40.0 (new analyzers: stringscut, unsafefuncs)
- prealloc: from 1.0.0 to 1.0.1 (message changes)
- unqueryvet: from 1.3.0 to 1.4.0 (new options: check-aliased-wildcard, check-string-concat, check-format-strings, check-string-builder, check-subqueries, ignored-functions, sql-builders)
Linters bug fixes
- go-critic: from 0.14.2 to 0.14.3
- go-errorlint: from 1.8.0 to 1.9.0
- govet: from 0.39.0 to 0.40.0
- protogetter: from 0.3.17 to 0.3.18
- revive: add missing enable-default-rules setting
Documentation
- docs: split installation page

`v2.7.2`

Compare Source

Released on 2025-12-07

Linter bug fixes
- gosec: from 2.22.10 to daccba6

`v2.7.1`

Compare Source

Released on 2025-12-04

Linter bug fixes
- modernize: disable stringscut analyzer

`v2.7.0`

Compare Source

Bug fixes
- fix: clone args used by custom command
Linters new features or changes
- no-sprintf-host-port: from 0.2.0 to 0.3.1 (ignore string literals without a colon)
- unqueryvet: from 1.2.1 to 1.3.0 (handles const and var declarations)
- revive: from 1.12.0 to 1.13.0 (new option: enable-default-rules, new rules: forbidden-call-in-wg-go, unnecessary-if, inefficient-map-lookup)
- modernize: from 0.38.0 to 0.39.0 (new analyzers: plusbuild, stringscut)
Linters bug fixes
- perfsprint: from 0.10.0 to 0.10.1
- wrapcheck: from 2.11.0 to 2.12.0
- godoc-lint: from 0.10.1 to 0.10.2
Misc.
- Add some flags to the custom command
Documentation
- docs: split changelog v1 and v2

`v2.6.2`

Compare Source

Released on 2025-11-14

Bug fixes
- fmt command with symlinks
- use file depending on build configuration to invalidate cache
Linters bug fixes
- testableexamples: from 1.0.0 to 1.0.1
- testpackage: from 1.1.1 to 1.1.2

`v2.6.1`

Compare Source

`v2.6.0`

Compare Source

New linters
- Add modernize analyzer suite
Linters new features or changes
- arangolint: from 0.2.0 to 0.3.1
- dupword: from 0.1.6 to 0.1.7 (new option comments-only)
- go-critic: from 0.13.0 to 0.14.0 (new rules/checkers: zeroByteRepeat, dupOption)
- gofumpt: from 0.9.1 to 0.9.2 ("clothe" naked returns is now controlled by the extra-rules option)
- perfsprint: from 0.9.1 to 0.10.0 (new options: concat-loop, loop-other-ops)
- wsl: from 5.2.0 to 5.3.0
Linters bug fixes
- dupword: from 0.1.6 to 0.1.7
- durationcheck: from 0.0.10 to 0.0.11
- exptostd: from 0.4.4 to 0.4.5
- fatcontext: from 0.8.1 to 0.9.0
- forbidigo: from 2.1.0 to 2.3.0
- ginkgolinter: from 0.21.0 to 0.21.2
- godoc-lint: from 0.10.0 to 0.10.1
- gomoddirectives: from 0.7.0 to 0.7.1
- gosec: from 2.22.8 to 2.22.10
- makezero: from 2.0.1 to 2.1.0
- nilerr: from 0.1.1 to 0.1.2
- paralleltest: from 1.0.14 to 1.0.15
- protogetter: from 0.3.16 to 0.3.17
- unparam: from 0df0534 to 5beb8c8
Misc.
- fix: ignore some files to hash the version for custom build

`v2.5.0`

Compare Source

New linters
- Add godoclint linter https://github.com/godoc-lint/godoc-lint
- Add unqueryvet linter https://github.com/MirrexOne/unqueryvet
- Add iotamixing linter https://github.com/AdminBenni/iota-mixing
Linters new features or changes
- embeddedstructfieldcheck: from 0.3.0 to 0.4.0 (new option: empty-line)
- err113: from aea10b5 to 0.1.1 (skip internals of Is methods for error type)
- ginkgolinter: from 0.20.0 to 0.21.0 (new option: force-tonot)
- gofumpt: from 0.8.0 to 0.9.1 (new rule is to "clothe" naked returns for the sake of clarity)
- ineffassign: from 0.1.0 to 0.2.0 (new option: check-escaping-errors)
- musttag: from 0.13.1 to 0.14.0 (support interface methods)
- revive: from 1.11.0 to 1.12.0 (new options: identical-ifelseif-branches, identical-ifelseif-conditions, identical-switch-branches, identical-switch-conditions, package-directory-mismatch, unsecure-url-scheme, use-waitgroup-go, useless-fallthrough)
- thelper: from 0.6.3 to 0.7.1 (skip t.Helper in functions passed to synctest.Test)
- wsl: from 5.1.1 to 5.2.0 (improvements related to subexpressions)
Linters bug fixes
- asciicheck: from 0.4.1 to 0.5.0
- errname: from 1.1.0 to 1.1.1
- fatcontext: from 0.8.0 to 0.8.1
- go-printf-func-name: from 0.1.0 to 0.1.1
- godot: from 1.5.1 to 1.5.4
- gosec: from 2.22.7 to 2.22.8
- nilerr: from 0.1.1 to a temporary fork
- nilnil: from 1.1.0 to 1.1.1
- protogetter: from 0.3.15 to 0.3.16
- tagliatelle: from 0.7.1 to 0.7.2
- testifylint: from 1.6.1 to 1.6.4
Misc.
- fix: "no export data" errors are now handled as a standard typecheck error
Documentation
- Improve nolint section about syntax

`v2.4.0`

Compare Source

Enhancements
- 🎉 go1.25 support
Linters new features or changes
- exhaustruct: from v3.3.1 to 4.0.0 (new options: allow-empty, allow-empty-rx, allow-empty-returns, allow-empty-declarations)
Linters bug fixes
- godox: trim filepath from report messages
- staticcheck: allow empty options
- tagalign: from 1.4.2 to 1.4.3
Documentation
- 🌟 New website (with a search engine)

`v2.3.1`

Compare Source

Linters bug fixes
- gci: from 0.13.6 to 0.13.7
- gosec: from 2.22.6 to 2.22.7
- noctx: from 0.3.5 to 0.4.0
- wsl: from 5.1.0 to 5.1.1
- tagliatelle: force upper case for custom initialisms

`v2.3.0`

Compare Source

Linters new features or changes
- ginkgolinter: from 0.19.1 to 0.20.0 (new option: force-assertion-description)
- iface: from 1.4.0 to 1.4.1 (report message improvements)
- noctx: from 0.3.4 to 0.3.5 (new detections: log/slog, exec, crypto/tls)
- revive: from 1.10.0 to 1.11.0 (new rule: enforce-switch-style)
- wsl: from 5.0.0 to 5.1.0
Linters bug fixes
- gosec: from 2.22.5 to 2.22.6
- noinlineerr: from 1.0.4 to 1.0.5
- sloglint: from 0.11.0 to 0.11.1
Misc.
- fix: panic close of closed channel

`v2.2.2`

Compare Source

Linters bug fixes
- noinlineerr: from 1.0.3 to 1.0.4
Documentation
- Improve debug keys documentation
Misc.
- fix: panic close of closed channel
- godot: add noinline value into the JSONSchema

`v2.2.1`

Compare Source

Linters bug fixes

varnamelen: fix configuration

`v2.2.0`

Compare Source

New linters
- Add arangolint linter https://github.com/Crocmagnon/arangolint
- Add embeddedstructfieldcheck linter https://github.com/manuelarte/embeddedstructfieldcheck
- Add noinlineerr linter https://github.com/AlwxSin/noinlineerr
- Add swaggo formatter https://github.com/golangci/swaggoswag
Linters new features or changes
- errcheck: add verbose option
- funcorder: from 0.2.1 to 0.5.0 (new option alphabetical)
- gomoddirectives: from 0.6.1 to 0.7.0 (new option ignore-forbidden)
- iface: from 1.3.1 to 1.4.0 (new option unexported)
- noctx: from 0.1.0 to 0.3.3 (new report messages, and new rules related to database/sql)
- noctx: from 0.3.3 to 0.3.4 (new SQL functions detection)
- revive: from 1.9.0 to 1.10.0 (new rules: time-date, unnecessary-format, use-fmt-print)
- usestdlibvars: from 1.28.0 to 1.29.0 (new option time-date-month)
- wsl: deprecation
- wsl_v5: from 4.7.0 to 5.0.0 (major version with new configuration)
Linters bug fixes
- dupword: from 0.1.3 to 0.1.6
- exptostd: from 0.4.3 to 0.4.4
- forbidigo: from 1.6.0 to 2.1.0
- gci: consistently format the code
- go-spancheck: from 0.6.4 to 0.6.5
- goconst: from 1.8.1 to 1.8.2
- gosec: from 2.22.3 to 2.22.4
- gosec: from 2.22.4 to 2.22.5
- makezero: from 1.2.0 to 2.0.1
- misspell: from 0.6.0 to 0.7.0
- usetesting: from 0.4.3 to 0.5.0
Misc.
- exclusions: fix path-expect
- formatters: write the input to stdout when using stdin and there are no changes
- migration: improve the error message when trying to migrate a migrated config
- typecheck: deduplicate errors
- typecheck: stops the analysis after the first error
- Deprecate print-resources-usage flag
- Unique version per custom build
Documentation
- Improves typecheck FAQ
- Adds plugin systems recommendations
- Add description for linters.default sets

`v2.1.6`

Compare Source

Linters bug fixes
- godot: from 1.5.0 to 1.5.1
- musttag: from 0.13.0 to 0.13.1
Documentation
- Add note about golangci-lint v2 integration in VS Code

`v2.1.5`

Compare Source

Due to an error related to Snapcraft, some artifacts of the v2.1.4 release have not been published.

This release contains the same things as v2.1.3.

`v2.1.4`

Compare Source

Due to an error related to Snapcraft, some artifacts of the v2.1.3 release have not been published.

This release contains the same things as v2.1.3.

`v2.1.3`

Compare Source

Linters bug fixes
- fatcontext: from 0.7.2 to 0.8.0
Misc.
- migration: fix nakedret.max-func-lines: 0
- migration: fix order of staticcheck settings
- fix: add go.mod hash to the cache salt
- fix: use diagnostic position for related information position

`v2.1.2`

Compare Source

Linters bug fixes
- exptostd: from 0.4.2 to 0.4.3
- gofumpt: from 0.7.0 to 0.8.0
- protogetter: from 0.3.13 to 0.3.15
- usetesting: from 0.4.2 to 0.4.3

`v2.1.1`

Compare Source

The release process of v2.1.0 failed due to a regression inside goreleaser.

The binaries of v2.1.0 have been published, but not the other artifacts (AUR, Docker, etc.).

`v2.1.0`

Compare Source

Enhancements
- Add an option to display absolute paths (--path-mode=abs)
- Add configuration path placeholder (${config-path})
- Add warn-unused option for fmt command
- Colored diff for fmt command (golangci-lint fmt --diff-colored)
New linters
- Add funcorder linter https://github.com/manuelarte/funcorder
Linters new features or changes
- go-errorlint: from 1.7.1 to 1.8.0 (automatic error comparison and type assertion fixes)
- ⚠️ goconst: ignore-strings is deprecated and replaced by ignore-string-values
- goconst: from 1.7.1 to 1.8.1 (new options: find-duplicates, eval-const-expressions)
- govet: add httpmux analyzer
- nilnesserr: from 0.1.2 to 0.2.0 (detect more cases)
- paralleltest: from 1.0.10 to 1.0.14 (checks only _test.go files)
- revive: from 1.7.0 to 1.9.0 (support kebab case for setting names)
- sloglint: from 0.9.0 to 0.11.0 (autofix, new option msg-style, suggest slog.DiscardHandler)
- wrapcheck: from 2.10.0 to 2.11.0 (new option report-internal-errors)
- wsl: from 4.6.0 to 4.7.0 (cgo files are always excluded)
Linters bug fixes
- fatcontext: from 0.7.1 to 0.7.2
- gocritic: fix importshadow checker
- gosec: from 2.22.2 to 2.22.3
- ireturn: from 0.3.1 to 0.4.0
- loggercheck: from 0.10.1 to 0.11.0
- nakedret: from 2.0.5 to 2.0.6
- nonamedreturns: from 1.0.5 to 1.0.6
- protogetter: from 0.3.12 to 0.3.13
- testifylint: from 1.6.0 to 1.6.1
- unconvert: update to HEAD
Misc.
- Fixes memory leaks when using go1.(N) with golangci-lint built with go1.(N-X)
- Adds golangci-lint-fmt pre-commit hook
Documentation
- Improvements
- Updates section about vscode integration

`v2.0.2`

Compare Source

Misc.
- Fixes flags parsing for formatters
- Fixes the filepath used by the exclusion source option
Documentation
- Adds a section about flags migration
- Cleaning pages with v1 options

`v2.0.1`

Compare Source

Linters/formatters bug fixes
- golines: fix settings during linter load
Misc.
- Validates the version field before the configuration
- forbidigo: fix migration

`v2.0.0`

Compare Source

Enhancements
- 🌟 New golangci-lint fmt command with dedicated formatter configuration
- ♻️ New golangci-lint migrate command to help migration from v1 to v2 (cf. Migration guide)
- ⚠️ New default values (cf. Migration guide)
- ⚠️ No exclusions by default (cf. Migration guide)
- ⚠️ New default sort order (cf. Migration guide)
- 🌟 New option run.relative-path-mode (cf. Migration guide)
- 🌟 New linters configuration (cf. Migration guide)
- 🌟 New output format configuration (cf. Migration guide)
- 🌟 New --fast-only flag (cf. Migration guide)
- 🌟 New option linters.exclusions.warn-unused to log a warning if an exclusion rule is unused.
New linters/formatters
- Add golines formatter https://github.com/segmentio/golines
Linters new features
- ⚠️ Merge staticcheck, stylecheck, gosimple into one linter (staticcheck) (cf. Migration guide)
- go-critic: from 0.12.0 to 0.13.0
- gomodguard: from 1.3.5 to 1.4.1 (block explicit indirect dependencies)
- nilnil: from 1.0.1 to 1.1.0 (new option: only-two)
- perfsprint: from 0.8.2 to 0.9.1 (checker name in the diagnostic message)
- staticcheck: new quickfix set of rules
- testifylint: from 1.5.2 to 1.6.0 (new options: equal-values, suite-method-signature, require-string-msg)
- wsl: from 4.5.0 to 4.6.0 (new option: allow-cuddle-used-in-block)
Linters bug fixes
- bidichk: from 0.3.2 to 0.3.3
- errchkjson: from 0.4.0 to 0.4.1
- errname: from 1.0.0 to 1.1.0
- funlen: fix ignore-comments option
- gci: from 0.13.5 to 0.13.6
- gosmopolitan: from 1.2.2 to 1.3.0
- inamedparam: from 0.1.3 to 0.2.0
- intrange: from 0.3.0 to 0.3.1
- protogetter: from 0.3.9 to 0.3.12
- unparam: from 8a5130c to 0df0534
Misc.
- 🧹 Configuration options renaming (cf. Migration guide)
- 🧹 Remove options (cf. Migration guide)
- 🧹 Remove flags (cf. Migration guide)
- 🧹 Remove alternative names (cf. Migration guide)
- 🧹 Remove or replace deprecated elements (cf. Migration guide)
- Adds an option to display some commands as JSON:
  - golangci-lint config path --json
  - golangci-lint help linters --json
  - golangci-lint help formatters --json
  - golangci-lint linters --json
  - golangci-lint formatters --json
  - golangci-lint version --json
Documentation
- Migration guide

`v1.64.8`

Compare Source

Detects use of configuration files from golangci-lint v2

`v1.64.7`

Compare Source

Linters bug fixes
- depguard: from 2.2.0 to 2.2.1
- dupl: from 3e9179a to f665c8d
- gosec: from 2.22.1 to 2.22.2
- staticcheck: from 0.6.0 to 0.6.1
Documentation
- Add GitLab documentation

`v1.64.6`

Compare Source

Linters bug fixes
- asciicheck: from 0.4.0 to 0.4.1
- contextcheck: from 1.1.5 to 1.1.6
- errcheck: from 1.8.0 to 1.9.0
- exptostd: from 0.4.1 to 0.4.2
- ginkgolinter: from 0.19.0 to 0.19.1
- go-exhaustruct: from 3.3.0 to 3.3.1
- gocheckcompilerdirectives: from 1.2.1 to 1.3.0
- godot: from 1.4.20 to 1.5.0
- perfsprint: from 0.8.1 to 0.8.2
- revive: from 1.6.1 to 1.7.0
- tagalign: from 1.4.1 to 1.4.2

`v1.64.5`

Compare Source

Bug fixes
- Add missing flag new-from-merge-base-flag
Linters bug fixes
- asciicheck: from 0.3.0 to 0.4.0
- forcetypeassert: from 0.1.0 to 0.2.0
- gosec: from 2.22.0 to 2.22.1

`v1.64.4`

Compare Source

Linters bug fixes
- gci: fix standard packages list for go1.24

`v1.64.3`

Compare Source

Linters bug fixes
- ginkgolinter: from 0.18.4 to 0.19.0
- go-critic: from 0.11.5 to 0.12.0
- revive: from 1.6.0 to 1.6.1
- gci: fix standard packages list for go1.24
Misc.
- Build Docker images with go1.24

`v1.64.2`

Compare Source

This is the last minor release of golangci-lint v1.
The next release will be golangci-lint v2.

Enhancements
- 🎉 go1.24 support
- New issues.new-from-merge-base option
- New run.relative-path-mode option
Linters new features
- copyloopvar: from 1.1.0 to 1.2.1 (support suggested fixes)
- exptostd: from 0.3.1 to 0.4.1 (handles golang.org/x/exp/constraints.Ordered)
- fatcontext: from 0.5.3 to 0.7.1 (new option: check-struct-pointers)
- perfsprint: from 0.7.1 to 0.8.1 (new options: integer-format, error-format, string-format, bool-format, and hex-format)
- revive: from 1.5.1 to 1.6.0 (new rules: redundant-build-tag, use-errors-new. New option early-return.early-return)
Linters bug fixes
- go-errorlint: from 1.7.0 to 1.7.1
- gochecknoglobals: from 0.2.1 to 0.2.2
- godox: from 006bad1 to 1.1.0
- gosec: from 2.21.4 to 2.22.0
- iface: from 1.3.0 to 1.3.1
- nilnesserr: from 0.1.1 to 0.1.2
- protogetter: from 0.3.8 to 0.3.9
- sloglint: from 0.7.2 to 0.9.0
- spancheck: fix default StartSpanMatchersSlice values
- staticcheck: from 0.5.1 to 0.6.0
Deprecations
- ⚠️ tenv is deprecated and replaced by usetesting.os-setenv: true.
- ⚠️ exportloopref deprecation step 2
Misc.
- Sanitize severities by output format
- Avoid panic with plugin without description
Documentation
- Clarify depguard configuration

`v1.64.1`

Compare Source

Cancelled due to CI failure.

`v1.64.0`

Compare Source

Cancelled due to CI failure.

open-policy-agent/opa (github.com/open-policy-agent/opa)

`v1.14.1`

Compare Source

This is a patch release collecting two bug fixes and various dependency updates for Golang standard library and common package vulnerabilities.

These bug fixes include a revert of the rule indexer tweaks shipped in 1.14.0, which had caused unexpected lookup failures for some users. (We expect to properly fix the issue in 1.15.0, but for now, a revert is the quicker choice.)

Changes

Fix intermittent plugins manager deadlock on opa.configure (#8407)
Revert "ast: make rule index track var assignments and x in {...} (#8341)" (#8410)
build: bump deps (go.mod from main)
build: bump go 1.26.1 (#8409)

`v1.14.0`

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

Improved rule indexing of variable assignments and x in {...} expressions
Support for --h2c with unix domain socket for opa run
A new glossary tooltip for technical terms in the docs
Fixes published in the v1.13.1 and v1.13.2 releases

Improved rule indexing of variable assignments and `x in {...}` expressions (#1841)

With this change, the rule indexer will index expressions like:

allow if input.role in {"admin", "user"}

On lookup, the rule body will only be returned if input.role is either one of "admin" or "user".

The reverse case is also indexed:

allow if "admin" in input.roles

in which the searched collection is unknown.

Authored by @srenatus reported by @nischalsheth

Runtime, SDK, Tooling

cmd,run: Support --h2c with unix domain socket (UDS) (#8282) authored by @srenatus reported by @theJC
cmd,tester: Add line number next to test file in pretty format (#8328) authored by @sspaink reported by @anderseknert
plugins: Fix race accessing registeredTriggers (#8363) reported and authored by @szuecs
rego: Add ResultValue[T]() helper method (#8320) authored by @srenatus
runtime: Add custom storage backend registration API (#8277) authored and reported by @alex60217101990
topdown: Add config option to disable named inter-query built-in cache (#7519) authored by @sspaink reported by @johanfylling

Compiler, Topdown and Rego

ast: Add index else == nil test, fix it (#8348) authored by @srenatus
ast: Add scaffolding to introspect and skip compiler stages (#8304) (authored by @srenatus)
ast: Ensure term values implement ast.StringLengther (#8374) authored by @charlieegan3
ast: Fix double-fix for refs["with-a"].dash as package (#8286) authored by @srenatus
ast: Optimized template-expression handling of values known to be defined (#8310) authored by @anderseknert
ast: Put rule indices into rule tree, change Values to []*Rule (#8298) authored by @srenatus
ast: Replace true expr when appending to empty body (#8299) authored by @anderseknert
ast: Return correct location of unsafe var in object (#7935) authored by @sspaink reported by @anderseknert
ast: Use StageID in WithStageAfterID, also for QueryCompiler (follow-up) (#8306) authored by @srenatus
compile: Add StringLength to lazy object (#8369) authored by @charlieegan3 reported by @robmyersrobmyers
parser: Add test to verify filename interning in Location (#8322) authored by @anderseknert
perf: Allocate less in array unification (#8351) authored by @anderseknert
perf: Various minor eval performance tweaks (#8290) authored by @anderseknert
perf: json.patch + interning improvements (#8289) authored by @anderseknert
topdown: Optimize bindings allocation with dynamic pre-sizing (#7266) authored by @alex60217101990
topdown: Preserve original package name with special characters in optimized builds (#8284) authored by @sspaink reported by @at50989
wasm: Updates (LLVM+tools) (#8295) authored by @srenatus

Docs, Website, Ecosystem

docs: Add examples to glob.match built-in documentation (#8252) authored by @sibasispadhi reported by @anderseknert
docs: Add workflow to auto update Regal docs (#8318) authored by @charlieegan3
docs: Document metrics for http.send, regex, and glob built-ins (#6730) authored by @anivar reported by @rudrakhp
docs: Fix json.patch target description (#8271) authored by @anderseknert
docs: Update broken links (#8285) authored by @charlieegan3
docs: Update bundle signing docs to clarify key config (#8307) authored by @charlieegan3
docs: Update faulty example using bundle optimize (#5379) authored by @sspaink reported by @bluebrown
docs: Update interface{} -> any in golang snippets (#8373) authored by @srenatus
docs/website: Add a new KubeCon event page (#8311) authored by @charlieegan3
docs/website: Add formatting and linting checks (#8288) authored by @charlieegan3
docs/website: Allow Regal import to use local dir (#8312) authored by @charlieegan3
docs/website: Implement new GlossaryTooltip component (#8367) authored by @charlieegan3
docs/website: Markdown linting and spell checking for documentation (#8292) authored by @charlieegan3
docs/website: Redirect /docs/latest/ecosystem (#8315) authored by @charlieegan3 reported by @tweekSun1

Miscellaneous

maintainers: Moving nilekhc to emeritus, and renew maintainer terms (#8276) authored by @JaydipGabani
ast: Add public method to extend the compliance test cases with IR plans (#7556) authored by @sspaink reported by @shomron
ast: Tiny nitpicky cleanup (#8309) authored by @srenatus
chore: Clean up bundle storage tests (#8267) authored by @anderseknert
chore: Remove unnecessary comment from bundle JWT verification impl (#8354) authored by @johanfylling
ci: Bump golangci-lint (v2.9.0), fix issues (#8314) authored by @srenatus
ci: Harden and update all GH Actions workflows (#8356, #8377, #8368 authored by @philipaconrad and @srenatus
go: Cleanup old build flags (#8314) authored by @srenatus
rego: Remove superfluous package import of plugins (#6754) authored by @srenatus reported by @oxisto
tests: Extract runtime Info to new package (#8362) authored by @charlieegan3
tests: Fix BenchmarkFunctionArgumentCounts query (#8327) authored by @alex60217101990
tests: Disable rule indexing for benchmark (#8375) authored by @srenatus
workflows: Add nightly vuln checks for released versions/images (#8336 #8339) authored by @srenatus
Dependency updates; notably:
- build: bump golang from 1.25.6 to 1.26.0
- build(deps): build(deps): bump go.opentelemetry.io deps from 1.39.0/0.64.0 to 1.40.0/0.65.0
  Applying fix for GHSA-9h8m-3fm2-qjrq
- build(deps): bump github.com/dgraph-io/badger/v4 from 4.9.0 to 4.9.1
- build(deps): bump github.com/huandu/go-sqlbuilder from 1.39.0 to 1.39.1
- build(deps): bump golang.org/x/net from 0.49.0 to 0.50.0
- build(deps): bump golang.org/x/text from 0.33.0 to 0.34.0
- build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.1
- build(deps): bump go.opentelemetry.io deps from 1.39.0/0.64.0 to 1.40.0/0.65.0

`v1.13.2`

Compare Source

This release updates the version of Go used to build the OPA binaries and images to 1.25.7.
That version of the Go standard library contains a fix for GO-2026-4337.

Full Changelog: open-policy-agent/opa@v1.13.1...v1.13.2

`v1.13.1`

Compare Source

v1.13.1

This bug fix release addresses an issue found in the new array.flatten built-in function

Fix issue in array.flatten handling of single item arrays (#8273) (#8272) authored by @anderseknert

`v1.13.0`

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

A new immediate upload trigger mode in the Decision Logger
A new array.flatten built-in function
Numerous performance improvements

Immediate Upload Trigger Mode in Decision Logger (#8110)

An immediate trigger mode has been added to the Decision Logger; enabled by setting the decision_logs.reporting.trigger configuration option to immediate.
When enabled, log events are pushed to the log service as soon as the configured upload chunk size criteria is met; or, at latest, when the configured upload delay is reached.

Authored by @sspaink

Runtime, SDK, Tooling

cmd/fmt: Do not overwrite file on fmt without changes (#8222) authored by @Loic-R
cmd/test: Enable sorting JSON test results by duration (#7444) authored by @sspaink
profiler: nil *Profiler should not report Enabled() (#8256) authored by @anderseknert
rego: Add Data function to simplify adding data from map (#5961) authored by @majiayu000 reported by @anderseknert
runtime: Correct naming & docs for version checking (#8191) authored by @charlieegan3

Compiler, Topdown and Rego

ast: Body.String() doesn't panic on empty body (#8244) authored by @srenatus
ast: Improve type error message when referencing functions (#6840) authored by @sspaink
ast: Type Checker recognizes when a variable has multiple assignments but is an undefined function (#7463) authored by @sspaink reported by @anderseknert
ast/parser: Avoid duplicate loc copies (#8142) authored by @srenatus
topdown: Add array.flatten built-in function (#8226) authored by @anderseknert
topdown: Fix issue where numbers.range_step built-in could erroneously return undefined value (#8194) authored by @thevilledev
topdown: Remove hard-coded missing key error in strings.render_template built-in (#7931) authored by @colinjlacy reported by @anderseknert
topdown: Re-introduce cancellation-awareness for regex.replace built-in (#8179) authored by @srenatus
from having been reverted in v1.12.1
topdown: Support arrays as input for json.match_schema (#6615) authored by @sspaink reported by @mscudlik

Performance

ast: Improved annotations parsing (#8210) authored by @anderseknert
ast: Reinstate zero-alloc paths in Ref.String() (#8202) authored by @anderseknert
ast: Replace regex implementation in IsVarCompatibleString (#8164) authored by @anderseknert
ast: Optimize Set.Intersect and Set.Diff (#8167) authored by @thevilledev
ast: Optimize Set.Union (#8172) authored by @thevilledev
ast: Reduce allocations in Expr.MarshalJSON (#8204) authored by @thevilledev
ast: Reduce allocations in Rule.MarshalJSON (#8205) authored by @thevilledev
ast: Reduce allocations in Term.MarshalJSON (#8200) authored by @thevilledev
ast: Reduce allocations in With.MarshalJSON (#8206) authored by @thevilledev
perf: `String()

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-03-01T02:34:17Z

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: acceptance/go.sum

Command failed: go get -t ./...
go: module github.com/sigstore/cosign/v3@v3.0.5 requires go >= 1.25.5; switching to go1.25.8
go: gopkg.in/go-jose/go-jose.v4@v4.1.3: parsing go.mod:
	module declares its path as: github.com/go-jose/go-jose/v4
	        but was required as: gopkg.in/go-jose/go-jose.v4

File name: tools/go.sum

Command failed: go get -t ./...
go: module github.com/golangci/golangci-lint/v2@v2.11.3 requires go >= 1.25.0; switching to go1.25.8
go: downloading github.com/spf13/viper v1.19.0
go: downloading github.com/open-policy-agent/opa v0.70.0
go: downloading oras.land/oras-go v1.2.6
go: downloading github.com/sagikazarmark/locafero v0.6.0
go: downloading github.com/sagikazarmark/slog-shim v0.1.0
go: downloading github.com/spf13/cast v1.7.0
go: downloading github.com/OneOfOne/xxhash v1.2.8
go: downloading github.com/aws/aws-sdk-go-v2 v1.30.4
go: downloading github.com/aws/aws-sdk-go-v2/config v1.27.31
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azcore v1.14.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0
go: downloading github.com/magiconair/properties v1.8.7
go: downloading github.com/klauspost/compress v1.18.2
go: downloading github.com/ulikunitz/xz v0.5.12
go: downloading cuelang.org/go v0.10.0
go: downloading github.com/docker/cli v27.2.0+incompatible
go: downloading github.com/aws/smithy-go v1.20.4
go: downloading github.com/aws/aws-sdk-go-v2/credentials v1.17.30
go: downloading github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.12
go: downloading github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1
go: downloading github.com/aws/aws-sdk-go-v2/service/sso v1.22.5
go: downloading github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.5
go: downloading github.com/aws/aws-sdk-go-v2/service/sts v1.30.5
go: downloading github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.16
go: downloading github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2
go: downloading github.com/docker/docker-credential-helpers v0.8.2
go: downloading github.com/docker/docker v27.2.0+incompatible
go: downloading github.com/gorilla/mux v1.8.1
go: downloading github.com/agnivade/levenshtein v1.2.0
go: downloading github.com/containerd/stargz-snapshotter/estargz v0.15.1
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.4
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.18
go: downloading github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.16
go: downloading github.com/vbatts/tar-split v0.11.5
go: downloading github.com/envoyproxy/go-control-plane v0.13.4
go: github.com/enterprise-contract/ec-cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/golangci/gofmt/goimports: cannot find module providing package github.com/golangci/gofmt/goimports
go: github.com/enterprise-contract/ec-cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/nunnatsa/ginkgolinter/types: cannot find module providing package github.com/nunnatsa/ginkgolinter/types

renovate bot added major release-v0.6 renovate labels Mar 1, 2026

renovate bot added major release-v0.6 labels Mar 1, 2026

github-actions bot added the size: XXL label Mar 1, 2026

renovate bot force-pushed the renovate/release-v0.6-major-go-modules branch 4 times, most recently from a04a19f to a205feb Compare March 9, 2026 15:11

🚨 Update go modules

3d97ba0

renovate bot force-pushed the renovate/release-v0.6-major-go-modules branch from a205feb to 3d97ba0 Compare March 10, 2026 13:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🚨 Update go modules (release-v0.6) (major)#3144

🚨 Update go modules (release-v0.6) (major)#3144
renovate[bot] wants to merge 1 commit intorelease-v0.6from
renovate/release-v0.6-major-go-modules

renovate bot commented Mar 1, 2026 •

edited

Loading

Uh oh!

renovate bot commented Mar 1, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Changes

Improved rule indexing of variable assignments and x in {...} expressions (#​1841)

Runtime, SDK, Tooling

Compiler, Topdown and Rego

Docs, Website, Ecosystem

Miscellaneous

Immediate Upload Trigger Mode in Decision Logger (#​8110)

Runtime, SDK, Tooling

Compiler, Topdown and Rego

Performance

Configuration

Uh oh!

renovate bot commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: acceptance/go.sum

File name: tools/go.sum

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Mar 1, 2026 •

edited

Loading

Improved rule indexing of variable assignments and `x in {...}` expressions (#1841)

Immediate Upload Trigger Mode in Decision Logger (#8110)

renovate bot commented Mar 1, 2026 •

edited

Loading