[renovate]

This PR contains the following updates:

Package	Type	Update	Change
ghalint	tools	patch	1.5.3 → 1.5.7

---

Release Notes

suzuki-shunsuke/ghalint (ghalint)

v1.5.7

Compare Source

⚠️ Security

#​1507 Update Go to v1.27.3

This release is built with Go 1.27.3, which fixes CVE-2026-111943 in crypto/x509. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. Verify filters out chains containing those intermediates. The Go team highly recommends upgrading immediately.

ghalint relies on crypto/x509 to verify the TLS certificate of the GitHub API, which ghalint experiment validate-input calls. Other commands don't access the network.

ref.

• https://go.dev/doc/devel/release#go1.27.3
• https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html

v1.5.6 was built with Go 1.26.2. This release also includes Go 1.26.3 (#​1325), 1.26.4 (#​1357), 1.26.5 (#​1396), 1.26.6 (#​1428), and 1.27.2 (#​1490), which have security fixes to the go command, the pack tool, and the crypto/tls, crypto/x509, encoding/asn1, encoding/xml, html/template, mime, net, net/http, net/http/httputil, net/mail, net/textproto, net/url, os, and syscall packages.

• https://go.dev/doc/devel/release#go1.26.3
• https://go.dev/doc/devel/release#go1.26.4
• https://go.dev/doc/devel/release#go1.26.5
• https://go.dev/doc/devel/release#go1.26.6
• https://go.dev/doc/devel/release#go1.27.2

⚠️ Changes of Release Assets

The ghalint binary itself isn't affected, but the release assets for verification have changed.

• #​1373 *.sig and *.pem aren't published anymore, and *.bundle is renamed to *.sigstore.json (Sigstore bundle)
• #​1482 multiple.intoto.jsonl isn't published anymore. Use Cosign, GitHub Artifact Attestations, or packslip instead
• #​1517 A signed packslip packslip.sigstore.json is published. You can verify downloaded assets with packslip

⚠️ aqua-registry v4.579.0 or later is required

If you install ghalint with aqua, please update aqua-registry to v4.579.0 or later.

• https://github.com/aquaproj/aqua-registry/releases/tag/v4.579.0
• aquaproj/aqua-registry#63343

Dependency Updates

#​1325 #​1357 #​1396 #​1428 #​1430 #​1445 #​1490 #​1507 Update Go to v1.27.3

#​1326 #​1340 #​1344 #​1394 #​1424 #​1447 #​1459 #​1505 github.com/google/go-github/v93
#​1330 #​1374 #​1379 #​1387 #​1429 #​1458 #​1467 #​1480 github.com/urfave/cli/v3 v3.14.0
#​1469 github.com/suzuki-shunsuke/urfave-cli-v3-util v0.2.4
#​1448 golang.org/x/oauth2 v0.37.0
#​1433 github.com/buger/jsonparser v1.1.2

v1.5.6

Compare Source

🐛 Bug Fixes

#​1307 deny_job_container_latest_image: Skip check if variables are used

v1.5.5

Compare Source

🐛 Bug Fixes

#​1210 fix a bug that -log-color doesn't work

Refactoring

#​1209 Use Destination pattern for urfave/cli/v3 flags

v1.5.4

Compare Source

#​1143 Replace logrus with slog
#​1147 Refactoring

Others

#​1055 fix Homebrew cask postinstall script for Linux

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.