[renovate]

This PR contains the following updates:

Package	Update	Change	Pending	Age	Adoption	Passing	Confidence
aquasecurity/trivy	minor	v0.75.0 → v0.76.0	v0.76.1
github.com/golangci/golangci-lint/v2	minor	v2.14.0 → v2.15.0
github.com/goreleaser/goreleaser/v2	patch	v2.18.2 → v2.18.3
golang.org/x/tools	minor	v0.51.0 → v0.52.0
golang.org/x/vuln	minor	v1.8.0 → v1.9.0
istio/istio	patch	1.31.1 → 1.31.2	1.31.3
k8s.io/kube-openapi	patch	v0.0.0-20261007072838-e2e80c32a35f → v0.0.0-20261014044854-ca3452a79603
oras.land/oras	patch	v1.3.4 → v1.3.5
rclone/rclone	patch	v1.75.1 → v1.75.2
redhat-openshift-ecosystem/openshift-preflight	patch	1.21.1 → 1.21.2
sigs.k8s.io/controller-tools	minor	v0.22.0 → v0.23.0
sigs.k8s.io/kube-api-linter	patch	v0.0.0-20260716143926-092fe0c72997 → v0.0.0-20261012124120-79b557aa8c8d

---

Release Notes

aquasecurity/trivy

v0.76.0

Compare Source

⚡ Highlights ⚡

👉 https://redirect.github.com/aquasecurity/trivy/discussions/11409

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0760-2026-10-14

golangci/golangci-lint (github.com/golangci/golangci-lint/v2)

v2.15.0

Compare Source

Released on 2026-10-16

1. Linters new features or changes
   • errcheck: from 1.20.0 to 1.30.0
   • exhaustive: from 0.13.0 to 0.15.0 (⚠️ changes)
   • gocognit: from 1.2.1 to 1.3.0
   • golines: from 0.15.0 to 0.16.0
   • govet-modernize: from 0.50.0 to 0.52.0
   • loggercheck: from 0.12.0 to 0.13.0
   • predeclared: from 0.2.2 to 0.3.0
   • wrapcheck: from 2.12.0 to 2.13.0
2. Linters bug fixes
   • bidichk: from 0.3.3 to 0.3.4
   • canonicalheader: from a25c71c to e18e5c5
   • gofumpt: improve deprecation logs
   • gosec: improve concurrency default value
   • iface: from 1.5.1 to 1.5.3
   • paralleltest: from 1.0.15 to 1.0.16
   • revive: from 1.17.0 to 1.17.1
   • revive: the rules context-keys-type, errorf, modifies-value-receiver, range-val-address, string-of-int, time-equal, time-naming, unexported-return, unhandled-error, var-declaration are working (less randomly).
   • rowserrcheck: from c5f79b8 to e0740d5
   • staticcheck: from 0.8.1 to 0.8.2
3. Bug fixes
   • fix: compute custom version hash with module versions
   • fix: env vars loading (related to revive)

⚠️ Changes of the exhaustive linter:

• The replaced options still exists, and partially works, but they are deprecated.
• The options explicit-exhaustive-switch and explicit-exhaustive-map have been replaced by explicit-exhaustive.
• The check the value map has been replaced by mapliteral.
• The option ignore-enum-members (string) has been replaced by ignore-constants (slice).
• The option ignore-enum-types (string) has been replaced by ignore-types (slice).
• New report messages.
• The linter is a now a "slow" linter.

goreleaser/goreleaser (github.com/goreleaser/goreleaser/v2)

v2.18.3

Compare Source

Announcement

Read the official announcement: Announcing GoReleaser v2.18.

Changelog

Bug fixes

• 6f22aef: fix(announce): let webhook headers override the default headers (#​7174) (@​NitinKumar004)
• 16edc75: fix(aur,aursources): reject duplicate package names (#​7171) (@​hktitof)
• d396fca: fix(brew,cask): sort dependencies case-insensitively (#​7186) (@​caarlos0)
• b091543: fix(ci): restore linux build (#​7175) (@​caarlos0)
• 1942d44: fix(docker): preserve buildx metadata key in lint checks (#​7187) (@​caarlos0)
• 1a1adec: fix(docs): point nightly links to the current nightly release (#​7155) (@​caarlos0)
• 01e1d6f: fix(git): handle remote URLs with a trailing slash (#​7170) (@​00200200)
• ede6721: fix(github): explain upload redirects caused by a moved repository (#​7179) (@​MrBeldum)
• 3205096: fix: dockers_v2 reports the image config digest (#​7181) (@​Zak4sad)

Other work

• 048a586: chore: auto-update generated files (#​7152) (@​goreleaserbot)
• 827aa03: chore: auto-update generated files (#​7159) (@​goreleaserbot)
• ff8de3d: chore: auto-update generated files (#​7165) (@​goreleaserbot)
• 27ef66d: chore: auto-update generated files (#​7166) (@​goreleaserbot)
• a9d676f: chore: auto-update generated files (#​7172) (@​goreleaserbot)
• 38962f0: chore: auto-update generated files (#​7183) (@​goreleaserbot)

Full Changelog: goreleaser/goreleaser@v2.18.2...v2.18.3

Helping out

This release is only possible thanks to all the support of some awesome people!

Want to be one of them?
You can sponsor, get a Pro License or contribute with code.

Where to go next?

• Find examples and commented usage of all options in our website.
• Reach out on Discord, Twitter, and Telegram!

istio/istio

v1.31.2: Istio 1.31.2

Compare Source

Release Notes

oras-project/oras (oras.land/oras)

v1.3.5

Compare Source

Changelog

• d6e7b58 bump: tag and release ORAS CLI v1.3.5 (#​2244)
• 4431829 docs: require cve fixes to land before preparing a release (#​2258)
• 8ee66ac docs: add ORAS CLI release process (#​2248)
• e09a8bb chore: bump oras-go to v2.6.4 in e2e tests (#​2247)
• 8270f5f chore: update oras-go to v2.6.4 (#​2242)
• ba3a3dc fix: validate extra destination tags before pushing (#​2237)
• 6ca02d0 build(deps): bump the github-actions group across 1 directory with 3 updates (#​2240)
• c9ccd95 build(deps): bump library/golang from 1.27.1-alpine to 1.27.2-alpine (#​2239)
• b2dc645 build(deps): bump github.com/onsi/ginkgo/v2 from 2.33.0 to 2.33.1 in /test/e2e (#​2238)
• bae5056 Preserve the index media type when the index body omits it (#​2235)
• 227fc74 chore: update oras-go to v2.6.3 (#​2234)
• 4d6c6e8 build(deps): bump golang.org/x/term from 0.46.0 to 0.47.0 (#​2232)
• 21193d8 build(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0 (#​2231)
• 8b3b8bd Fall back to config media type for old-style artifact types (#​2114)
• e58fee3 fix: validate format before special handling (#​2205)
• 4e9a756 fix: validate empty OCI layout path with digest (#​2230)
• b0a7bda fix: restore pretty output for manifest fetch-config (#​2228)
• ab0ff3d fix: limit manifest config fetch size (#​2222)
• 80f72e1 build(deps): bump anchore/sbom-action/download-syft from 0.24.2 to 0.24.3 in the github-actions group (#​2223)
• d608889 docs(e2e): correct test/e2e/README.md references (#​2219)
• 8d737cd chore: drop dead .gitignore entries for the Docker e2e registry mounts (#​2220)
• 02c5c20 ci: remove Docker-based e2e test run (#​2208)
• d41f4eb fix: detect credentials in multiple JSON values (#​2218)
• 5c33ab2 ci: pin e2e-k8s.yml action refs to commit SHAs (#​2216)
• 1033ebb fix: generate coverage report in covhtml (#​2214)
• ccf3e26 chore: update golang.org/x/crypto (#​2207)
• 715917d feat(cp): support multiple platforms (#​2191)
• 488b3fa fix: correct manifest fetch format error (#​2203)
• a826d9a fix: clarify absolute path validation warning (#​2201)
• 7327064 ci: replace action-publish with snapcraft CLI (#​2199)
• 1dd0de8 build(deps): bump the github-actions group with 4 updates (#​2200)
• 7c53cbf fix: clean up partial pull output on failure (#​2194)
• bdf7835 test(errors): cover the CLI error type and its constructors (#​2196)
• 88f46a4 build(deps): bump github.com/onsi/gomega from 1.43.1 to 1.44.0 in /test/e2e (#​2195)
• 8c979f1 test(display): cover the pulled-file model (#​2189)
• a0cd4de feat: add Kubernetes-based e2e testing infrastructure (#​1913)
• be79214 fix: fix concurrency in Tagged (#​2183)
• 44e831a ci: publish stable rolling image tags (#​2184)
• bc28b9c fix: keep an index's own children out of its reported referrers (#​2174)
• 458c186 build(deps): bump the github-actions group across 1 directory with 3 updates (#​2186)
• ba0b7df build(deps): bump library/alpine from 3.24.1 to 3.24.2 (#​2185)
• 8016ba3 fix: only infer platform from OCI image configs (#​2177)
• a9965b3 test(display): cover the raw content handlers (#​2182)
• e0dd8f2 build(deps): bump github.com/onsi/gomega from 1.43.0 to 1.43.1 in /test/e2e (#​2180)
• ce4dc19 fix(display): report files as [] instead of null when a pull produces none (#​2175)
• 0d1f61e test(display): cover the metadata model types (#​2176)
• 283000c build(deps): bump github.com/onsi/ginkgo/v2 from 2.32.2 to 2.33.0 in /test/e2e (#​2179)
• 87495d5 fix(display): report referenceAsTags as [] instead of null when untagged (#​2170)
• 4e589f5 feat: add release automation script (#​1992)
• 1cd8618 test(display): split template repo handler tests to match source files (#​2171)
• 27c2d04 test(display): cover the pull metadata handler (#​2168)
• ec461af build(deps): bump the github-actions group with 2 updates (#​2172)
• 0afd96e build(deps): bump github.com/onsi/ginkgo/v2 from 2.32.1 to 2.32.2 in /test/e2e (#​2167)
• 36a446d build(deps): bump golang.org/x/term from 0.45.0 to 0.46.0 (#​2166)
• d1c4808 test(display): cover the template and descriptor metadata handlers (#​2164)
• d0da4a9 build(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 (#​2162)
• 898a195 fix(cli): pluralize "argument" in argument-count errors (#​2161)
• 4728be6 test(credential): fix TestNewStoreError failing on Windows (#​2159)
• 003dfd1 build(deps): bump library/golang from 1.27.0-alpine to 1.27.1-alpine (#​2160)
• c508a57 build(deps): bump the github-actions group across 1 directory with 5 updates (#​2149)
• b16846a fix(ci): resolve licenserc go.mod path relative to config directory (#​2155)
• f54f368 fix: attribute recursive copy tag failures to the destination (#​2157)
• c75e8f3 feat(ci): add windows/arm64 build to github release (#​2153)
• 749d9c1 build(deps): bump github.com/onsi/gomega from 1.42.1 to 1.43.0 in /test/e2e (#​2147)
• 86eb615 build(deps): bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 (#​2146)
• 71d17dd build: bump Go toolchain to 1.26 (#​2145)
• 20df556 ci: fetch full history for release changelog (#​2143)

Verification

Release artifacts are signed with the ORAS project release key C6FC42F0DE84A345FAADB742F44418110791EF37. Signatures (.asc files) are attached to this release.

Public keys are available in the KEYS file.

rclone/rclone

v1.75.2: rclone v1.75.2

Compare Source

This is the v1.75.2 release of rclone.

Full details of the changes can be found in the changelog.

redhat-openshift-ecosystem/openshift-preflight

v1.21.2

Compare Source

What's Changed

• build(deps): bump github.com/bmatcuk/doublestar/v4 from 4.10.0 to 4.10.2 in the prod-dependencies group by @​dependabot[bot] in #​1547
• build(deps): bump the test-dependencies group with 2 updates by @​dependabot[bot] in #​1546
• check container: copy preflight.log into offline artifacts tar (CERTSA-78) by @​vikasmulaje in #​1548
• build(deps): bump the prod-dependencies group with 4 updates by @​dependabot[bot] in #​1552
• adding ubi micro runtime packages needed by openshift ci by @​acornett21 in #​1545
• engine: harden layer pull retries utilizing k8s lib for backoff by @​acornett21 in #​1549
• build(deps): bump github.com/onsi/gomega from 1.43.1 to 1.44.0 in the test-dependencies group by @​dependabot[bot] in #​1551

Full Changelog: redhat-openshift-ecosystem/openshift-preflight@1.21.1...1.21.2

kubernetes-sigs/controller-tools (sigs.k8s.io/controller-tools)

v0.23.0

Compare Source

This is an additional minor release independent of the Kubernetes release cadence to deliver
#​1474 because this bug fix is a breaking change so it was not possible to backport it.

What's Changed

• ✨ Add option to omit controller-gen version in generated output by @​pedjak in #​1437
• 🐛 Fix +listType marker not working on type alias fields by @​sivchari in #​1359
• 🐛 Inject min boundaries for +k8s:required on strings, maps, and slices by @​lalitc375 in #​1458
• 🐛 crd: support Kubernetes declarative validation bounds by @​kannon92 in #​1474

Dependency bumps

• 🌱 Bump github.com/onsi/gomega from 1.43.1 to 1.44.0 in the all-go-mod-patch-and-minor group by @​dependabot[bot] in #​1480
• 🌱 Bump golang.org/x/tools from 0.50.0 to 0.51.0 in the all-go-mod-patch-and-minor group by @​dependabot[bot] in #​1487
• 🌱 Bump golangci-lint to v2.14.0 and enable promlinter, reassign linters by @​dongjiang1989 in #​1488
• 🌱 Bump sigs.k8s.io/controller-runtime from v0.24.0 to v0.25.0 by @​dongjiang1989 in #​1476
• 🌱 Bump softprops/action-gh-release from 3.0.2 to 3.0.3 in the all-github-actions group by @​dependabot[bot] in #​1475
• 🌱 Bump the all-go-mod-patch-and-minor group across 1 directory with 3 updates by @​dependabot[bot] in #​1478

Full Changelog: kubernetes-sigs/controller-tools@v0.22.0...v0.23.0

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[erikgb]

/lgtm
/approve

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: erikgb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [erikgb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment