[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aqua	uses-with	minor	v2.63.0 → v2.65.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

aquaproj/aqua (aqua)

v2.65.2

Compare Source

Bug Fixes

#​5494 Fix the failure of installing aqua on Windows

v2.65.1

Compare Source

🐛 Bug Fixes

#​5486 Fix a bug that it fails to install packslip
#​5486 Fix a bug that aqua upa fails for v2.65.0 or later
#​5493 Publish SLSA Provenance again

Others

#​5490 Update aqua-proxy to v1.2.14

v2.65.0

Compare Source

⚠️ Security

#​5485 Update Go to v1.27.3

This release is built with Go 1.27.3, which fixes CVE-2026-111943 in crypto/x509. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. Verify filters out chains containing those intermediates. The Go team highly recommends upgrading immediately.

aqua relies on crypto/x509 to verify the TLS certificates of the servers it downloads registries, packages, checksums, and signatures from. We recommend upgrading.

ref.

• https://go.dev/doc/devel/release#go1.27.3
• https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html

This release also includes Go 1.27.2 (#​5407), which has security fixes to the go command and the crypto/tls, html/template, net/http, net/textproto, and os packages.

• https://go.dev/doc/devel/release#go1.27.2

Features

Install packages from the releases of Forgejo, Gitea, and GitLab

#​5387 forgejo_release
#​5391 gitea_release
#​5399 gitlab_release

Until now, a package hosted on Codeberg, gitea.com, or gitlab.com had to be an http package with a URL template, often with version_constraint: "false". Nothing could list its versions, so aqua g and aqua up couldn't update it.

These package types have the same fields as github_release, plus host:

packages:
  - type: forgejo_release
    host: codeberg.org
    repo_owner: mergiraf
    repo_name: mergiraf
    asset: mergiraf_{{.Arch}}-{{.OS}}.{{.Format}}
    format: tar.gz
    replacements:
      darwin: apple-darwin
      linux: unknown-linux-gnu
      amd64: x86_64
      arm64: aarch64

aqua gr supports them too, e.g. aqua gr gitlab.com/gitlab-org/cli.

#​5403 Verify packages with packslip

aqua can now verify packages with packslip, like it already does with cosign, slsa-verifier, minisign, and GitHub Artifact Attestations.
aqua downloads the signed release bundle packslip.sigstore.json from the package's release and runs packslip verify <bundle> --artifact <asset> before unarchiving the asset.

packslip:
  enabled: true # optional, default true
  url: ...             # optional, where the bundle is
  pubkey: ...          # --pubkey
  identity: ...        # --identity
  identity_prefix: ... # --identity-prefix
  issuer: ...          # --issuer
  pin: ...             # --pin
  allow_unlogged: true # --allow-unlogged

#​5414 Pass more of the signing certificate to gh attestation verify

github_artifact_attestations gains six optional fields:

Field	Flag
repository	--repo, defaulting to the package's repository as before
signer_repo	--signer-repo
cert_oidc_issuer	--cert-oidc-issuer
deny_self_hosted_runners	--deny-self-hosted-runners
source_ref	--source-ref
source_digest	--source-digest

#​5425 aqua gr: Infer a libc variant for a musl build beside the Linux one

Bug Fixes

#​5362 #​5367 Windows: Fix the infinite loop of a shim started with an upper-case extension such as nu.EXE

Tools that build a command name from PATHEXT, such as Python's shutil.which and just, start a shim as nu.EXE. aqua didn't find the package and ran the shim itself again until it failed. Command names are now matched case-insensitively on all OSes, preferring an exact match, and on Windows aqua skips its bin directory in PATH case-insensitively.

#​5363 #​5375 Windows: Fix the infinite loop of batch files such as npx and npm of nodejs/node

cmd.exe runs the first token of the command line rather than the executable path, so npx.cmd and npm.cmd started the shim again until it ran out of memory. aqua now runs a batch file (.bat / .cmd) by its absolute path.

#​5406 Close the temporary file of a downloaded asset

On Windows, the leaked handle could keep the temporary file from being removed.

#​5423 aqua gr: Cancel a promoted replacement for an OS that doesn't use it
#​5436 aqua gr: Don't take an SBOM for the package's asset
#​5444 aqua gr: Exclude 32-bit ARM assets by name

Others

#​5368 Remove -ldflags
#​5461 ci: Enable split_build of go-release-workflow
#​5431 ci: Use go-autofix-action's reusable workflow
#​5439 ci: Replace go-test-full-workflow with go-test-workflow and test-workflow

Dependency updates

#​5407 #​5485 Update Go to v1.27.3
#​5477 Update github.com/google/go-github to v93
#​5386 Update golang.org/x/sync to v0.24.0
#​5396 Update golang.org/x/sys to v0.49.0

v2.64.0

Compare Source

Features

#​5364 Support installing only specified packages by command or package names

aqua install now accepts command names or package names as positional arguments. Only packages matching them are installed.

aqua i gh                                 # by command name
aqua i cli/cli                            # by package name
aqua i gh suzuki-shunsuke/tfcmt           # multiple names

If any of the given names isn't found in the configuration files, the command fails:

ERR aqua failed not_found="[bar foo]" error="packages or commands aren't found in configuration files"

#​5279 Add a settings file

${XDG_CONFIG_HOME:-$HOME/.config}/aquaproj-aqua/config.yaml

checksum:
  enabled: true
  require: true
  enforce: true
  enforce_require: true
lazy_install: true
policy:
  enabled: true
  config: /home/foo/policy.yaml
tracking: true
progress_bar: false
log:
  level: info
  color: auto
max_parallelism: 5
global_config: /home/foo/aqua-global.yaml
root_dir: /home/foo/.local/share/aquaproj-aqua
keyring: false

config.yaml	environment variable
checksum.enabled	AQUA_CHECKSUM
checksum.require	AQUA_REQUIRE_CHECKSUM
checksum.enforce	AQUA_ENFORCE_CHECKSUM
checksum.enforce_require	AQUA_ENFORCE_REQUIRE_CHECKSUM
lazy_install	AQUA_DISABLE_LAZY_INSTALL (inverted)
policy.enabled	AQUA_DISABLE_POLICY (inverted)
policy.config	AQUA_POLICY_CONFIG
tracking	AQUA_DISABLE_TRACKING (inverted)
progress_bar	AQUA_PROGRESS_BAR
log.level	AQUA_LOG_LEVEL
log.color	AQUA_LOG_COLOR
max_parallelism	AQUA_MAX_PARALLELISM
global_config	AQUA_GLOBAL_CONFIG
root_dir	AQUA_ROOT_DIR
keyring	AQUA_KEYRING_ENABLED

Precedence: Environment variable > settings file > default

Performance Improvement

#​5283 Detect glibc by its loader instead of by running ldd

Bug Fixes

#​5284 gr: Don't take a build for particular hardware as the ordinary one
#​5285 gr: shorter isn't the point, the same name with less on it is
#​5287 Say what cosign said, and wait long enough for it to matter
#​5310 gr: Don't claim a provenance that is another artifact's

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 09:00 AM and 03:59 PM, only on Sunday and Saturday (* 9-15 * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 078a1857-cf96-4b0b-a5e8-61f6173a7562

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}