fix(deps): update all non-major dependencies by renovate[bot] · Pull Request #220 · go-vela/vela-kaniko

renovate · 2026-03-22T02:01:15Z

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-go	action	minor	`v6.3.0` → `v6.4.0`
alpine	final	patch	`3.23.3` → `3.23.4`
alpine	stage	patch	`3.23.3` → `3.23.4`
codecov/codecov-action	action	patch	`v5.5.3` → `v5.5.4`
docker/login-action	action	minor	`v4.0.0` → `v4.1.0`
elgohr/Publish-Docker-Github-Action (changelog)	action	digest	`4feac4d` → `1c2f28c`
github.com/go-vela/server	require	minor	`v0.27.5` → `v0.28.3`
github.com/urfave/cli/v3	require	minor	`v3.7.0` → `v3.8.0`
github/codeql-action	action	minor	`v4.34.1` → `v4.35.2`
target/kaniko-executor	final	minor	`debug-v1.24.0` → `debug-v1.25.13`

Release Notes

actions/setup-go (actions/setup-go)

`v6.4.0`

Compare Source

What's Changed

Enhancement

Add go-download-base-url input for custom Go distributions by @gdams in #721

Dependency update

Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in #727

Documentation update

Rearrange README.md, add advanced-usage.md by @priyagupta108 in #724
Fix Microsoft build of Go link by @gdams in #734

New Contributors

@gdams made their first contribution in #721

Full Changelog: actions/setup-go@v6...v6.4.0

codecov/codecov-action (codecov/codecov-action)

`v5.5.4`

Compare Source

This is a mirror of v5.5.2. v6 will be released which requires node24

What's Changed

Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" by @thomasrockhu-codecov in #1926
chore(release): 5.5.4 by @thomasrockhu-codecov in #1927

Full Changelog: codecov/codecov-action@v5.5.3...v5.5.4

docker/login-action (docker/login-action)

`v4.1.0`

Compare Source

Fix scoped Docker Hub cleanup path when registry is omitted by @crazy-max in #945
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1020.0 in #930
Bump @docker/actions-toolkit from 0.77.0 to 0.86.0 in #932 #936
Bump brace-expansion from 1.1.12 to 1.1.13 in #952
Bump fast-xml-parser from 5.3.4 to 5.3.6 in #942
Bump flatted from 3.3.3 to 3.4.2 in #944
Bump glob from 10.3.12 to 10.5.0 in #940
Bump handlebars from 4.7.8 to 4.7.9 in #949
Bump http-proxy-agent and https-proxy-agent to 8.0.0 in #937
Bump lodash from 4.17.23 to 4.18.1 in #958
Bump minimatch from 3.1.2 to 3.1.5 in #941
Bump picomatch from 4.0.3 to 4.0.4 in #948
Bump undici from 6.23.0 to 6.24.1 in #938

Full Changelog: docker/login-action@v4.0.0...v4.1.0

go-vela/server (github.com/go-vela/server)

`v0.28.3`

Compare Source

What's Changed

fix(db/hook): trim error to fit db column by @wass3rw3rk in #1440
fix: tighten up UpdateRepo calls and add sync-up to repair by @ecrupper in #1438
fix(router): use install token for caller token and fix ptr derefs by @ecrupper in #1439
fix(cancel): follow through cancel on missing executor by @ecrupper in #1441
fix(hook): matching error with other updatehook calls by @wass3rw3rk in #1442
chore(deps): update all non-major dependencies by @renovate[bot] in #1437

Full Changelog: go-vela/server@v0.28.2...v0.28.3

`v0.28.2`

Compare Source

What's Changed

fix(compiler/types): use struct walk for Substitute instead of JSON marshal by @ecrupper in #1432
fix(scm): handle nil on getcontents by @wass3rw3rk in #1434
fix(deps): update module golang.org/x/crypto to v0.50.0 by @renovate[bot] in #1433

Full Changelog: go-vela/server@v0.28.1...v0.28.2

`v0.28.1`

Compare Source

What's Changed

fix(compiler): address logic bug in de-dup for origin secrets in templates by @ecrupper in #1431
chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #1429
fix(deps): update all non-major dependencies by @renovate[bot] in #1428

Full Changelog: go-vela/server@v0.28.0...v0.28.1

`v0.28.0`

Compare Source

What's Changed

enhance(oidc): add jti claim by @ecrupper in #1356
feat!: remove buildkite dependency by @ecrupper in #1352
fix(compiler): prevent same-name stages in pipeline configs by @ecrupper in #1360
fix(api): yaml expand on stage pipelines by @wass3r in #1363
enhance(api)!: accept installation tokens for MustWrite and MustRead auth using caching by @ecrupper in #1373
fix(mock): add refresh install token mock by @ecrupper in #1374
fix(scm): proper expiration set to worker by @ecrupper in #1380
fix(deps): bump aws-sdk to v2 by @wass3r in #1365
fix(database)!: use transactions tied to repo counters for hook and build to avoid collisions by @ecrupper in #1353
fix(scm): fall back on github info if role map missing entry by @ecrupper in #1382
fix(deps): update module github.com/expr-lang/expr to v1.17.7 [security] by @renovate[bot] in #1379
chore(build): reduce binary size by @wass3r in #1377
chore: bump go-github to v81 by @ecrupper in #1383
fix(deps): update module golang.org/x/crypto to v0.45.0 [security] by @renovate[bot] in #1370
feat!: platform setting for enabling/disabling Vela secrets by @ecrupper in #1384
fix(scm): add deployments as a default perm for deploy events by @ecrupper in #1386
feat(events)!: support merge queue for GitHub SCM by @ecrupper in #1343
fix(compiler): add origin secrets to pipeline validate func by @ecrupper in #1388
enhance(app): add PR and Issue perms for install token by @ecrupper in #1389
enhance(compiler)!: do not add duplicate origin secrets using name as key by @ecrupper in #1390
chore(lint): update codebase for new linter rules by @ecrupper in #1393
feat(artifacts): Object storage integration and artifacts key by @KellyMerrick in #1385
feat: leverage checks API for CI statuses with app installation by @ecrupper in #1392
fix(deps): update module github.com/google/go-github/v81 to v83 by @renovate[bot] in #1391
fix(scm): add merge_group to events set by @ecrupper in #1394
chore(deps): upgrade minor deps and apply some go fix changes by @ecrupper in #1395
chore(deps): update actions/checkout action to v6 by @renovate[bot] in #1371
chore(deps): update github/codeql-action action to v4 by @renovate[bot] in #1358
chore(deps): update actions/github-script action to v8 by @renovate[bot] in #1349
chore(deps): update actions/setup-go action to v6 by @renovate[bot] in #1348
fix(artifacts): add upload to storage service by @timhuynh94 in #1397
fix(deps): update all non-major dependencies by @renovate[bot] in #1396
fix(scm): override details link to point to vela build by @ecrupper in #1400
fix(artifacts): switch from sts to presigned put by @timhuynh94 in #1401
fix(build): reset build number for restarts by @ecrupper in #1404
fix(revert): use commit status API only by @ecrupper in #1405
refactor(compiler): move script gen outside of compiler and into container by @ecrupper in #1403
fix(env): remove id request url from compiler by @ecrupper in #1408
fix(perm): allow for GETs when secrets are disabled by @ecrupper in #1406
fix(deps): update all non-major dependencies by @renovate[bot] in #1398
fix(deps): update module github.com/google/go-github/v83 to v84 by @renovate[bot] in #1399
chore(deps): update docker/login-action action to v4 by @renovate[bot] in #1402
chore(deps): update docker/metadata-action action to v6 by @renovate[bot] in #1407
chore(deps): update docker/build-push-action action to v7 by @renovate[bot] in #1409
chore(deps): bump go to 1.26.1 by @wass3rw3rk in #1410
fix(webhook): generate token for status update on failed compile by @ecrupper in #1412
fix(deps): update all non-major dependencies by @renovate[bot] in #1411
fix: add clearer error message for post-subst unmarshal issues by @ecrupper in #1415
fix(merge_group): set branch to base ref instead of head ref by @ecrupper in #1414
fix(db): only update fields when necessary for repo hot path writes by @ecrupper in #1416
fix(deps): update all non-major dependencies by @renovate[bot] in #1413
fix(admin): add logs for secret toggles by @wass3rw3rk in #1419
enhance: separate clone/build SCM token from status token by @ecrupper in #1420
fix(deps): update all non-major dependencies by @renovate[bot] in #1417
chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 by @dependabot[bot] in #1418
chore(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2 by @dependabot[bot] in #1421
fix(webhook): use webhook parsed build info on compile failures for status by @ecrupper in #1422
fix: use install token if available for changeset call by @ecrupper in #1424
fix(deps): update all non-major dependencies by @renovate[bot] in #1423
chore(deps): update codecov/codecov-action action to v6 by @renovate[bot] in #1425
fix(util): use filepath matching for allowlist by @ecrupper in #1426

Full Changelog: go-vela/server@v0.27.5...v0.28.0

urfave/cli (github.com/urfave/cli/v3)

`v3.8.0`

Compare Source

What's Changed

chore(deps): bump mkdocs-material from 9.7.1 to 9.7.2 in the python-packages group by @dependabot[bot] in #2267
chore(deps): bump mkdocs-material from 9.7.2 to 9.7.3 in the python-packages group by @dependabot[bot] in #2272
chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in the python-packages group by @dependabot[bot] in #2276
Fix: check MutuallyExclusiveFlags across parent command chain by @siutsin in #2274
Modernize source code by @kolyshkin in #2289
flag: replace regexp use by @kolyshkin in #2288
chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in the python-packages group by @dependabot[bot] in #2284
Fix:(issue_2281) Remove incorrect check for local flag for set by @dearchap in #2290
Fix:(issue_2275) Make flag action execution consistent by @dearchap in #2295
Fix:(issue_2293) --flag="" no longer rejected as missing argument by @idelchi in #2297
Fix:(issue_2292) Empty positional args no longer break parse loop by @idelchi in #2296

New Contributors

@idelchi made their first contribution in #2297

Full Changelog: urfave/cli@v3.7.0...v3.8.0

github/codeql-action (github/codeql-action)

`v4.35.2`

Compare Source

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794
Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807
Update default CodeQL bundle version to 2.25.2. #3823

`v4.35.1`

Compare Source

Fix incorrect minimum required Git version for improved incremental analysis: it should have been 2.36.0, not 2.11.0. #3781

`v4.35.0`

Compare Source

Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #3767
Update default CodeQL bundle version to 2.25.1. #3773

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

codecov · 2026-03-22T05:07:26Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 25.22%. Comparing base (6237b93) to head (cef3068).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #220   +/-   ##
=======================================
  Coverage   25.22%   25.22%           
=======================================
  Files           8        8           
  Lines         781      781           
=======================================
  Hits          197      197           
  Misses        581      581           
  Partials        3        3

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

renovate · 2026-03-31T21:27:30Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.25.7` -> `1.26.1`
`golang.org/x/sys`	`v0.39.0` -> `v0.43.0`
`golang.org/x/text`	`v0.32.0` -> `v0.36.0`

renovate Bot added the dependencies Indicates a change to dependencies label Mar 22, 2026

renovate Bot requested a review from a team as a code owner March 22, 2026 02:01

renovate Bot added the dependencies Indicates a change to dependencies label Mar 22, 2026

renovate Bot changed the title ~~chore(deps): update elgohr/publish-docker-github-action digest to 1c2f28c~~ fix(deps): update all non-major dependencies Mar 25, 2026

renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 6 times, most recently from f6f88f1 to 50fddcf Compare March 31, 2026 21:27

renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 2 times, most recently from de7ebdd to 6a7e0d6 Compare April 7, 2026 21:09

renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 2 times, most recently from 186949b to 81ab27a Compare April 16, 2026 09:17

renovate Bot changed the title ~~fix(deps): update all non-major dependencies~~ fix(deps): update all non-major dependencies - autoclosed Apr 17, 2026

renovate Bot closed this Apr 17, 2026

renovate Bot deleted the renovate/all-minor-patch-digest-pin branch April 17, 2026 15:34

fix(deps): update all non-major dependencies

cef3068

renovate Bot changed the title ~~fix(deps): update all non-major dependencies - autoclosed~~ fix(deps): update all non-major dependencies Apr 17, 2026

renovate Bot reopened this Apr 17, 2026

renovate Bot force-pushed the renovate/all-minor-patch-digest-pin branch 2 times, most recently from 81ab27a to cef3068 Compare April 17, 2026 21:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update all non-major dependencies#220

fix(deps): update all non-major dependencies#220
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch-digest-pin

renovate Bot commented Mar 22, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Mar 22, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Mar 31, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Mar 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

Enhancement

Dependency update

Documentation update

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

Configuration

Uh oh!

codecov Bot commented Mar 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

renovate Bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Mar 22, 2026 •

edited

Loading

codecov Bot commented Mar 22, 2026 •

edited

Loading

renovate Bot commented Mar 31, 2026 •

edited

Loading