chore(deps): update non-rpm dependencies to v1 by red-hat-konflux[bot] · Pull Request #107 · konflux-ci/task-runner

red-hat-konflux · 2026-02-15T01:41:24Z

This PR contains the following updates:

Package	Change	Age	Confidence
olot	`==0.1.18` → `==1.0.0`

Configuration

📅 Schedule: (UTC)

Branch creation
- On day 1 and 15 of the month (* * 1,15 * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

red-hat-konflux · 2026-02-15T01:41:25Z

ℹ Artifact update notice

File name: deps/go-tools/cosign/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

85 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.25.0` -> `1.25.5`
`cloud.google.com/go`	`v0.121.6` -> `v0.123.0`
`cloud.google.com/go/auth`	`v0.17.0` -> `v0.18.1`
`cloud.google.com/go/kms`	`v1.23.2` -> `v1.25.0`
`cloud.google.com/go/longrunning`	`v0.6.7` -> `v0.8.0`
`cuelabs.dev/go/oci/ociregistry`	`v0.0.0-20250715075730-49cab49c8e9d` -> `v0.0.0-20250722084951-074d06050084`
`cuelang.org/go`	`v0.14.1` -> `v0.15.4`
`github.com/Azure/azure-sdk-for-go/sdk/azcore`	`v1.20.0` -> `v1.21.0`
`github.com/aws/aws-sdk-go-v2`	`v1.41.0` -> `v1.41.1`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.5` -> `v1.32.7`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.19.5` -> `v1.19.7`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.16` -> `v1.18.17`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.4.16` -> `v1.4.17`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.16` -> `v2.7.17`
`github.com/aws/aws-sdk-go-v2/service/ecr`	`v1.45.1` -> `v1.51.2`
`github.com/aws/aws-sdk-go-v2/service/ecrpublic`	`v1.33.2` -> `v1.38.2`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.13.16` -> `v1.13.17`
`github.com/aws/aws-sdk-go-v2/service/kms`	`v1.49.1` -> `v1.49.5`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.0.4` -> `v1.0.5`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.30.7` -> `v1.30.9`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.35.12` -> `v1.35.13`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.41.5` -> `v1.41.6`
`github.com/awslabs/amazon-ecr-credential-helper/ecr-login`	`v0.10.1` -> `v0.11.0`
`github.com/buildkite/agent/v3`	`v3.104.0` -> `v3.115.4`
`github.com/buildkite/go-pipeline`	`v0.15.0` -> `v0.16.0`
`github.com/docker/docker-credential-helpers`	`v0.9.3` -> `v0.9.4`
`github.com/emicklei/go-restful/v3`	`v3.12.2` -> `v3.13.0`
`github.com/go-chi/chi/v5`	`v5.2.3` -> `v5.2.4`
`github.com/go-openapi/errors`	`v0.22.4` -> `v0.22.6`
`github.com/go-openapi/jsonpointer`	`v0.22.1` -> `v0.22.4`
`github.com/go-openapi/jsonreference`	`v0.21.3` -> `v0.21.4`
`github.com/go-openapi/spec`	`v0.22.1` -> `v0.22.3`
`github.com/goccy/go-json`	`v0.10.3` -> `v0.10.5`
`github.com/google/go-querystring`	`v1.1.0` -> `v1.2.0`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.7` -> `v0.3.11`
`github.com/googleapis/gax-go/v2`	`v2.15.0` -> `v2.17.0`
`github.com/grpc-ecosystem/grpc-gateway/v2`	`v2.27.3` -> `v2.27.5`
`github.com/klauspost/compress`	`v1.18.1` -> `v1.18.2`
`github.com/lestrrat-go/httprc/v3`	`v3.0.0` -> `v3.0.1`
`github.com/lestrrat-go/jwx/v3`	`v3.0.10` -> `v3.0.12`
`github.com/miekg/pkcs11`	`v1.1.1` -> `v1.1.2`
`github.com/open-policy-agent/opa`	`v1.8.0` -> `v1.12.3`
`github.com/prometheus/common`	`v0.67.4` -> `v0.67.5`
`github.com/prometheus/procfs`	`v0.17.0` -> `v0.19.2`
`github.com/protocolbuffers/txtpbfmt`	`v0.0.0-20250627152318-f293424e46b5` -> `v0.0.0-20251016062345-16587c79cd91`
`github.com/rcrowley/go-metrics`	`v0.0.0-20201227073835-cf1acfcdf475` -> `v0.0.0-20250401214520-65e299d6c5c9`
`github.com/secure-systems-lab/go-securesystemslib`	`v0.9.1` -> `v0.10.0`
`github.com/segmentio/asm`	`v1.2.0` -> `v1.2.1`
`github.com/sigstore/fulcio`	`v1.8.4` -> `v1.8.5`
`github.com/sigstore/rekor`	`v1.4.3` -> `v1.5.0`
`github.com/sigstore/rekor-tiles/v2`	`v2.0.1` -> `v2.2.0`
`github.com/sigstore/sigstore`	`v1.10.3` -> `v1.10.4`
`github.com/sigstore/sigstore/pkg/signature/kms/aws`	`v1.10.3` -> `v1.10.4`
`github.com/sigstore/sigstore/pkg/signature/kms/azure`	`v1.10.3` -> `v1.10.4`
`github.com/sigstore/sigstore/pkg/signature/kms/gcp`	`v1.10.3` -> `v1.10.4`
`github.com/sigstore/sigstore/pkg/signature/kms/hashivault`	`v1.10.3` -> `v1.10.4`
`github.com/sigstore/timestamp-authority/v2`	`v2.0.3` -> `v2.0.4`
`github.com/sirupsen/logrus`	`v1.9.3` -> `v1.9.4`
`github.com/theupdateframework/go-tuf/v2`	`v2.3.0` -> `v2.4.1`
`github.com/vektah/gqlparser/v2`	`v2.5.30` -> `v2.5.31`
`gitlab.com/gitlab-org/api/client-go`	`v0.143.3` -> `v1.25.0`
`go.opentelemetry.io/otel`	`v1.38.0` -> `v1.39.0`
`go.opentelemetry.io/otel/metric`	`v1.38.0` -> `v1.39.0`
`go.opentelemetry.io/otel/sdk`	`v1.38.0` -> `v1.39.0`
`go.opentelemetry.io/otel/trace`	`v1.38.0` -> `v1.39.0`
`golang.org/x/crypto`	`v0.46.0` -> `v0.47.0`
`golang.org/x/mod`	`v0.30.0` -> `v0.32.0`
`golang.org/x/net`	`v0.48.0` -> `v0.49.0`
`golang.org/x/oauth2`	`v0.33.0` -> `v0.35.0`
`golang.org/x/sys`	`v0.39.0` -> `v0.40.0`
`golang.org/x/term`	`v0.38.0` -> `v0.39.0`
`golang.org/x/text`	`v0.32.0` -> `v0.33.0`
`google.golang.org/api`	`v0.257.0` -> `v0.267.0`
`google.golang.org/genproto`	`v0.0.0-20250922171735-9219d122eba9` -> `v0.0.0-20260128011058-8636f8732409`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20251022142026-3a174f9686a8` -> `v0.0.0-20260128011058-8636f8732409`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20251213004720-97cd9d5aeac2` -> `v0.0.0-20260203192932-546029d2fa20`
`google.golang.org/grpc`	`v1.77.0` -> `v1.78.0`
`gopkg.in/evanphx/json-patch.v4`	`v4.12.0` -> `v4.13.0`
`gopkg.in/ini.v1`	`v1.67.0` -> `v1.67.1`
`k8s.io/api`	`v0.34.1` -> `v0.35.1`
`k8s.io/apimachinery`	`v0.34.1` -> `v0.35.1`
`k8s.io/client-go`	`v0.34.1` -> `v0.35.1`
`k8s.io/kube-openapi`	`v0.0.0-20250710124328-f3f2b991d03b` -> `v0.0.0-20250910181357-589584f1c912`
`k8s.io/utils`	`v0.0.0-20250820121507-0af2bda4dd1d` -> `v0.0.0-20251002143259-bc988d571ff4`
`sigs.k8s.io/json`	`v0.0.0-20241014173422-cfa47c3a1cc8` -> `v0.0.0-20250730193827-2d320260d730`
`sigs.k8s.io/release-utils`	`v0.12.2` -> `v0.12.3`

mmorhun · 2026-03-02T09:12:30Z

/retest

chmeliik

We should probably hold off on this one and file a story to investigate if cosign v3 doesn't break anything

mmorhun · 2026-03-02T13:38:29Z

@chmeliik agree, that would be better, than just tests.

mkosiarc · 2026-03-10T13:33:26Z

/retest

mkosiarc · 2026-03-10T14:01:25Z

so far, there's even problem building this due to dependencies mismatch

  Processing /cachi2/output/deps/pip/python-dateutil-2.9.0.post0.tar.gz (from -r /tmp/requirements.txt (line 29))
    Installing build dependencies: started
    Installing build dependencies: finished with status 'error'
    error: subprocess-exited-with-error
    
    × pip subprocess to install build dependencies did not run successfully.
    │ exit code: 1
    ╰─> [8 lines of output]
        Looking in links: /cachi2/output/deps/pip, /cachi2/output/deps/pip
        Ignoring setuptools: markers 'python_version == "3.3"' don't match your environment
        Collecting setuptools
          Using cached setuptools-82.0.0-py3-none-any.whl
        Collecting wheel
          Using cached wheel-0.46.3-py3-none-any.whl
        ERROR: Could not find a version that satisfies the requirement setuptools_scm<8.0 (from versions: 9.2.2)
        ERROR: No matching distribution found for setuptools_scm<8.0
        [end of output]

Looking into it

EDIT: split the update to dependencies to focus on cosign in #126

Update cosign go.mod and go.sum from PR konflux-ci#107

Update cosign from v2.6.2 to v3.0.5 This pr was created manually, based on konflux-ci#107 There are 2 reasons for creation of this pr manually: - The renovate update for cosign is broken, it did not actually update cosign to v3 - there is a problem with setuptools_scm version mismatch in that update PR

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot requested a review from a team as a code owner February 15, 2026 01:41

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-non-rpm-dependencies branch from 2de601e to 09ca862 Compare March 1, 2026 02:33

chmeliik requested changes Mar 2, 2026

View reviewed changes

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-non-rpm-dependencies branch from 09ca862 to 5f1900a Compare March 2, 2026 14:32

mkosiarc added a commit to mkosiarc/task-runner that referenced this pull request Mar 10, 2026

chore(deps): update cosign dependencies

7ba492c

Update cosign go.mod and go.sum from PR konflux-ci#107

mkosiarc mentioned this pull request Mar 10, 2026

chore(deps): update cosign dependencies #126

Merged

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-non-rpm-dependencies branch from 5f1900a to 0b9a913 Compare March 15, 2026 02:59

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-non-rpm-dependencies branch from 0b9a913 to 4cf77be Compare April 1, 2026 02:30

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-non-rpm-dependencies branch 6 times, most recently from a47d02a to df353d5 Compare April 15, 2026 22:42

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-non-rpm-dependencies branch 6 times, most recently from 6d88057 to ddfa2dd Compare May 1, 2026 22:51

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-non-rpm-dependencies branch from a7b5401 to 724e369 Compare May 15, 2026 02:31

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-non-rpm-dependencies branch from 724e369 to 5615392 Compare May 15, 2026 07:29

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-non-rpm-dependencies branch from 5615392 to 7a613b9 Compare June 15, 2026 20:12

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-non-rpm-dependencies branch from 7a613b9 to ca5c17b Compare July 1, 2026 01:46

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-non-rpm-dependencies branch from ca5c17b to c93046f Compare July 15, 2026 01:27

red-hat-konflux Bot changed the title ~~chore(deps): update non-rpm dependencies (major)~~ chore(deps): update non-rpm dependencies to v1 Jul 15, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-non-rpm-dependencies branch 4 times, most recently from c9fa672 to 8092b3a Compare July 15, 2026 18:54

chore(deps): update non-rpm dependencies to v1

7bbefa1

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-non-rpm-dependencies branch from 4f6b36f to 7bbefa1 Compare July 15, 2026 21:36

Update generated files

04b510c

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update non-rpm dependencies to v1#107

chore(deps): update non-rpm dependencies to v1#107
red-hat-konflux[bot] wants to merge 2 commits into
mainfrom
konflux/mintmaker/main/major-non-rpm-dependencies

red-hat-konflux Bot commented Feb 15, 2026 •

edited

Loading

Uh oh!

red-hat-konflux Bot commented Feb 15, 2026 •

edited

Loading

Uh oh!

mmorhun commented Mar 2, 2026

Uh oh!

chmeliik left a comment

Uh oh!

mmorhun commented Mar 2, 2026

Uh oh!

mkosiarc commented Mar 10, 2026

Uh oh!

mkosiarc commented Mar 10, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

red-hat-konflux Bot commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Configuration

Documentation

Uh oh!

red-hat-konflux Bot commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ Artifact update notice

File name: deps/go-tools/cosign/go.mod

Uh oh!

mmorhun commented Mar 2, 2026

Uh oh!

chmeliik left a comment

Choose a reason for hiding this comment

Uh oh!

mmorhun commented Mar 2, 2026

Uh oh!

mkosiarc commented Mar 10, 2026

Uh oh!

mkosiarc commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

red-hat-konflux Bot commented Feb 15, 2026 •

edited

Loading

red-hat-konflux Bot commented Feb 15, 2026 •

edited

Loading

mkosiarc commented Mar 10, 2026 •

edited

Loading