[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aqua	uses-with	minor	v2.64.0 → v2.65.2

---

Release Notes

aquaproj/aqua (aqua)

v2.65.2

Compare Source

Bug Fixes

#​5494 Fix the failure of installing aqua on Windows

v2.65.1

Compare Source

🐛 Bug Fixes

#​5486 Fix a bug that it fails to install packslip
#​5486 Fix a bug that aqua upa fails for v2.65.0 or later
#​5493 Publish SLSA Provenance again

Others

#​5490 Update aqua-proxy to v1.2.14

v2.65.0

Compare Source

⚠️ Security

#​5485 Update Go to v1.27.3

This release is built with Go 1.27.3, which fixes CVE-2026-111943 in crypto/x509. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. Verify filters out chains containing those intermediates. The Go team highly recommends upgrading immediately.

aqua relies on crypto/x509 to verify the TLS certificates of the servers it downloads registries, packages, checksums, and signatures from. We recommend upgrading.

ref.

• https://go.dev/doc/devel/release#go1.27.3
• https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html

This release also includes Go 1.27.2 (#​5407), which has security fixes to the go command and the crypto/tls, html/template, net/http, net/textproto, and os packages.

• https://go.dev/doc/devel/release#go1.27.2

Features

Install packages from the releases of Forgejo, Gitea, and GitLab

#​5387 forgejo_release
#​5391 gitea_release
#​5399 gitlab_release

Until now, a package hosted on Codeberg, gitea.com, or gitlab.com had to be an http package with a URL template, often with version_constraint: "false". Nothing could list its versions, so aqua g and aqua up couldn't update it.

These package types have the same fields as github_release, plus host:

packages:
  - type: forgejo_release
    host: codeberg.org
    repo_owner: mergiraf
    repo_name: mergiraf
    asset: mergiraf_{{.Arch}}-{{.OS}}.{{.Format}}
    format: tar.gz
    replacements:
      darwin: apple-darwin
      linux: unknown-linux-gnu
      amd64: x86_64
      arm64: aarch64

aqua gr supports them too, e.g. aqua gr gitlab.com/gitlab-org/cli.

#​5403 Verify packages with packslip

aqua can now verify packages with packslip, like it already does with cosign, slsa-verifier, minisign, and GitHub Artifact Attestations.
aqua downloads the signed release bundle packslip.sigstore.json from the package's release and runs packslip verify <bundle> --artifact <asset> before unarchiving the asset.

packslip:
  enabled: true # optional, default true
  url: ...             # optional, where the bundle is
  pubkey: ...          # --pubkey
  identity: ...        # --identity
  identity_prefix: ... # --identity-prefix
  issuer: ...          # --issuer
  pin: ...             # --pin
  allow_unlogged: true # --allow-unlogged

#​5414 Pass more of the signing certificate to gh attestation verify

github_artifact_attestations gains six optional fields:

Field	Flag
repository	--repo, defaulting to the package's repository as before
signer_repo	--signer-repo
cert_oidc_issuer	--cert-oidc-issuer
deny_self_hosted_runners	--deny-self-hosted-runners
source_ref	--source-ref
source_digest	--source-digest

#​5425 aqua gr: Infer a libc variant for a musl build beside the Linux one

Bug Fixes

#​5362 #​5367 Windows: Fix the infinite loop of a shim started with an upper-case extension such as nu.EXE

Tools that build a command name from PATHEXT, such as Python's shutil.which and just, start a shim as nu.EXE. aqua didn't find the package and ran the shim itself again until it failed. Command names are now matched case-insensitively on all OSes, preferring an exact match, and on Windows aqua skips its bin directory in PATH case-insensitively.

#​5363 #​5375 Windows: Fix the infinite loop of batch files such as npx and npm of nodejs/node

cmd.exe runs the first token of the command line rather than the executable path, so npx.cmd and npm.cmd started the shim again until it ran out of memory. aqua now runs a batch file (.bat / .cmd) by its absolute path.

#​5406 Close the temporary file of a downloaded asset

On Windows, the leaked handle could keep the temporary file from being removed.

#​5423 aqua gr: Cancel a promoted replacement for an OS that doesn't use it
#​5436 aqua gr: Don't take an SBOM for the package's asset
#​5444 aqua gr: Exclude 32-bit ARM assets by name

Others

#​5368 Remove -ldflags
#​5461 ci: Enable split_build of go-release-workflow
#​5431 ci: Use go-autofix-action's reusable workflow
#​5439 ci: Replace go-test-full-workflow with go-test-workflow and test-workflow

Dependency updates

#​5407 #​5485 Update Go to v1.27.3
#​5477 Update github.com/google/go-github to v93
#​5386 Update golang.org/x/sync to v0.24.0
#​5396 Update golang.org/x/sys to v0.49.0

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 09:00 AM and 09:59 PM, only on Sunday and Saturday (* 9-21 * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a9343e3e-1f22-4d6e-ad69-a2c8660078f5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}