[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Adoption	Passing	Confidence
aqua:aquasecurity/trivy	tools	minor	0.75.0 → 0.76.1
aqua:cli/cli	tools	minor	2.102.0 → 2.103.0	2.103.3 (+2)
npm:socket	tools	minor	1.8.2 → 1.10.1	1.11.0
pipx:semgrep (changelog)	tools	minor	1.180.0 → 1.182.1

Release notes are maintained in a PR comment by the renovate-release-notes-comment workflow.

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Between 03:00 AM and 05:59 AM (* 3-5 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[scottames-github-bot]

Renovate Release Notes

Generated from Renovate's update table by the renovate-release-notes-comment workflow.

Packages that cannot be summarized from GitHub releases are listed explicitly below.

aquasecurity/trivy (aqua:aquasecurity/trivy)

v0.76.1: v0.76.1

Compare Source

🔐 Security update: eMudhra CA incident 🛡️

Trivy v0.76.1 includes mitigations for the eMudhra intermediate CA key compromise.

• Official binaries are built with Go 1.27.3, which includes the certificate distrust mitigation tracked as CVE-2026-111943.
• Official container images include an updated Alpine CA trust store that rejects the affected certificate chains.

We recommend upgrading to v0.76.1 and redeploying container images to apply these updates. If you build Trivy from source, use Go 1.27.3 or later and keep your runtime CA trust store up to date.

Changelog

• e713f67f7d54decdcd9b3132c9751833dcced698 release: v0.76.1 [release/v0.76] (#11445)
• 6647bd6ec5924087956285b773b8cae10508736e fix(deps): bump the aws group across 1 directory with 6 updates [backport: release/v0.76] (#11446)
• e0964c97819b1d6a45b7e0426803745f173fc550 fix(deps): bump the docker group with 3 updates [backport: release/v0.76] (#11443)
• 992c360c33d9f9627bb24c1fe3f20815110c88e5 fix(deps): bump the common group with 3 updates [backport: release/v0.76] (#11442)

v0.76.0: v0.76.0

Compare Source

⚡ Highlights ⚡

👉 aquasecurity/trivy#11409

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0760-2026-10-14

cli/cli (aqua:cli/cli)

v2.103.0: GitHub CLI 2.103.0

Compare Source

Expiring, auto-refreshing OAuth tokens (preview)

gh can now sign in with expiring OAuth credentials that it refreshes automatically. When you opt in, gh stores a short-lived access token alongside a rotating refresh token and refreshes the access token whenever it is needed, so you stay signed in without having to authenticate again.

To opt in for a single sign-in, run:

gh auth login --expiring

To prefer expiring credentials for every sign-in, run:

gh config set expiring_credentials enabled

gh auth status shows whether a credential is refreshable and when the current access token expires. Both gh auth status and gh auth token automatically refresh the access token when needed. Expiring tokens are available on github.com and GHE.com; on hosts that do not issue them, gh falls back to a regular non-expiring token.

If you use HTTPS as your git protocol, we advise using git 2.46 or newer and letting gh act as your git credential helper by running gh auth setup-git. This way gh serves and refreshes the expiring credential for git, and git does not cache it past its lifetime.

[!IMPORTANT]
Expiring access tokens should not be cached. Scripts and extensions that store the output of gh auth token will eventually hold an expired token, so run gh auth token again each time a token is needed. Tokens supplied through GH_TOKEN or GITHUB_TOKEN are never refreshed.

For more information, see Authenticating with GitHub CLI.

Manage issue artifacts with gh issue artifact (private preview)

gh issue artifact brings issue artifacts to the command line. Users and organizations enrolled in the private preview can use the list, view, create, edit, download, and delete commands to manage issue artifacts.

# Create a Markdown document with an attached image
gh issue artifact create 142 signin-plan.md --attach ./signin-flow.png

# Create an HTML document
gh issue artifact create 142 menu-prototype.html

# List or view artifacts
gh issue artifact list 142
gh issue artifact view 142 2

# Update a document or restore an earlier version
gh issue artifact edit 142 2 --body-file signin-plan-v2.md
gh issue artifact edit 142 2 --restore-version 5

Artifacts can also be addressed by their GitHub URLs, and Markdown documents support image and video attachments with --attach.

[!IMPORTANT]
Issue artifacts are in private preview. These commands only work for repositories enrolled in the preview. See the Issue Artifacts private preview announcement and feedback discussion for access instructions and to share feedback.

What's Changed

✨ Features

• Replace extension browse with Bubble Tea by @​williammartin in Replace extension browse with Bubble Tea cli/cli#14578
• gh issue artifact stack 1/12: Resolve --attach references against the body file's directory by @​BagToad in gh issue artifact stack 1/12: Resolve --attach references against the body file's directory cli/cli#14564
• gh issue artifact stack 2/12: Attach one set of files to several Markdown documents by @​BagToad in gh issue artifact stack 2/12: Attach one set of files to several Markdown documents cli/cli#14565
• gh issue artifact stack 3/12: Add the command group and list by @​BagToad in gh issue artifact stack 3/12: Add the command group and list cli/cli#14566
• gh issue artifact stack 4/12: Add view by @​BagToad in gh issue artifact stack 4/12: Add view cli/cli#14567
• gh issue artifact stack 5/12: Add delete by @​BagToad in gh issue artifact stack 5/12: Add delete cli/cli#14568
• gh issue artifact stack 6/12: Add download by @​BagToad in gh issue artifact stack 6/12: Add download cli/cli#14569
• gh issue artifact stack 7/12: Add create by @​BagToad in gh issue artifact stack 7/12: Add create cli/cli#14570
• gh issue artifact stack 8/12: Add edit by @​BagToad in gh issue artifact stack 8/12: Add edit cli/cli#14571
• gh issue artifact stack 10/12: Add edit --restore-version by @​BagToad in gh issue artifact stack 10/12: Add edit --restore-version cli/cli#14580
• gh issue artifact stack 11/12: Address review feedback by @​BagToad in gh issue artifact stack 11/12: Address review feedback cli/cli#14640
• gh issue artifact stack 12/12: Add artifact URLs by @​BagToad in gh issue artifact stack 12/12: Add artifact URLs cli/cli#14678
• Support HTML documents in gh issue artifact by @​BagToad in Support HTML documents in gh issue artifact cli/cli#14720
• Refreshable tokens (1/7): foundation credential model, storage migration, and file lock by @​babakks in Refreshable tokens (1/7): foundation credential model, storage migration, and file lock cli/cli#14450
• Refreshable tokens (2/7): refresher domain, OAuth refresher, storage, and wiring by @​babakks in Refreshable tokens (2/7): refresher domain, OAuth refresher, storage, and wiring cli/cli#14451
• Refreshable tokens (3/7): short-lived login, refresh, and git credential path by @​babakks in Refreshable tokens (3/7): short-lived login, refresh, and git credential path cli/cli#14452
• Refreshable tokens (4/7): gh auth token refresh and secure-storage handling by @​babakks in Refreshable tokens (4/7): gh auth token refresh and secure-storage handling cli/cli#14453
• Refreshable tokens (5/7): gh auth status short-lived token details by @​babakks in Refreshable tokens (5/7): gh auth status short-lived token details cli/cli#14454
• Refreshable tokens (6/7): agent-task and CAPI per-request refresh by @​babakks in Refreshable tokens (6/7): agent-task and CAPI per-request refresh cli/cli#14455
• Refreshable tokens: review fixes across the stack by @​babakks in Refreshable tokens: review fixes across the stack cli/cli#14663
• Refreshable tokens: rename --short-lived flag to --expiring by @​babakks in Refreshable tokens: rename --short-lived flag to --expiring cli/cli#14665
• Refreshable tokens: add prefer_expiring_credentials config option by @​babakks in Refreshable tokens: add prefer_expiring_credentials config option cli/cli#14672
• Refreshable tokens: capture auth_invocation telemetry on login and refresh by @​babakks in Refreshable tokens: capture auth_invocation telemetry on login and refresh cli/cli#14673
• Refreshable tokens: review fixes (round 2) by @​babakks in Refreshable tokens: review fixes (round 2) cli/cli#14717
• Refreshable tokens: show relative time-to-expiry in gh auth status by @​babakks in Refreshable tokens: show relative time-to-expiry in gh auth status cli/cli#14745
• Refreshable tokens: build-gated debug overrides for testing token expiry by @​babakks in Refreshable tokens: build-gated debug overrides for testing token expiry cli/cli#14752
• Refreshable tokens: bump cli/oauth to v1.3.0 and fix gh status column width by @​babakks in Refreshable tokens: bump cli/oauth to v1.3.0 and fix gh status column width cli/cli#14768

🐛 Fixes

• Bump go-runewidth to v0.0.30 for faster startup by @​williammartin in Bump go-runewidth to v0.0.30 for faster startup cli/cli#14577
• Avoid spawning git for each extension at startup by @​williammartin in Avoid spawning git for each extension at startup cli/cli#14620
• Fix the unclean background colors of gh-search-code by @​A4-Tacks in Fix the unclean background colors of gh-search-code cli/cli#14648
• Fix help text that references nonexistent flags by @​BagToad in Fix help text that references nonexistent flags cli/cli#14719

📚 Docs & Chores

• docs: recommend nix-shell and declarative config for Nix/NixOS by @​reginaldalfret in docs: recommend nix-shell and declarative config for Nix/NixOS cli/cli#14592
• Clarify issue view comment output modes by @​babakks with @​Copilot in Clarify issue view comment output modes cli/cli#14616
• Add ACCESSIBILITY.md by @​BagToad in Add ACCESSIBILITY.md cli/cli#14583
• Bump shell-quote to 1.11.0 in cli-exercise skill by @​williammartin in Bump shell-quote to 1.11.0 in cli-exercise skill cli/cli#14625
• Leave validation checks to CI in bump-go script by @​williammartin in Leave validation checks to CI in bump-go script cli/cli#14631
• Remove CLAUDE.md in favor of AGENTS.md by @​jarrensj in Remove CLAUDE.md in favor of AGENTS.md cli/cli#14474
• Clarify --repo and --owner checks for attestation bundles by @​bdehamer in Clarify --repo and --owner checks for attestation bundles cli/cli#14650
• Fix Go vendoring in Dependabot triage and bump gh-aw by @​williammartin in Fix Go vendoring in Dependabot triage and bump gh-aw cli/cli#14682
• gh issue artifact stack 9/12: Document gh issue artifact in the gh skill by @​BagToad in gh issue artifact stack 9/12: Document gh issue artifact in the gh skill cli/cli#14572
• Clarify --comments behavior when piped in view commands by @​arsalanyavari in Clarify --comments behavior when piped in view commands cli/cli#14714
• Clarify release creation atomicity and immutability by @​bdehamer in Clarify release creation atomicity and immutability cli/cli#14722
• Add deterministic Dependabot scheduler by @​williammartin in Add deterministic Dependabot scheduler cli/cli#14750
• Merge v2.102.1 release branch into trunk by @​BagToad in Merge v2.102.1 release branch into trunk cli/cli#14770
• Refreshable tokens (7/7): guided end-to-end verification scripts by @​babakks in Refreshable tokens (7/7): guided end-to-end verification scripts cli/cli#14456
• Document expiring tokens in the gh skill by @​babakks in Document expiring tokens in the gh skill cli/cli#14782

Dependencies

• Bump Go to 1.27.2 by @​github-actions[bot] in Bump Go to 1.27.2 cli/cli#14632
• chore(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0 by @​dependabot[bot] in chore(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0 cli/cli#14633
• chore(deps): bump github.com/mattn/go-colorable from 0.1.15 to 0.1.16 by @​dependabot[bot] in chore(deps): bump github.com/mattn/go-colorable from 0.1.15 to 0.1.16 cli/cli#14634
• chore(deps): bump golang.org/x/crypto from 0.57.0 to 0.58.0 by @​dependabot[bot] in chore(deps): bump golang.org/x/crypto from 0.57.0 to 0.58.0 cli/cli#14660
• chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @​dependabot[bot] in chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 cli/cli#14656
• chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @​dependabot[bot] in chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 cli/cli#14655
• chore(deps): bump the codeql-actions group with 3 updates by @​dependabot[bot] in chore(deps): bump the codeql-actions group with 3 updates cli/cli#14654
• chore(deps): bump charm.land/bubbletea/v2 from 2.0.10 to 2.1.0 by @​dependabot[bot] in chore(deps): bump charm.land/bubbletea/v2 from 2.0.10 to 2.1.0 cli/cli#14657
• chore(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 by @​dependabot[bot] in chore(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 cli/cli#14485
• chore(deps): bump github.com/cli/go-gh/v2 from 2.16.1 to 2.16.2 by @​dependabot[bot] in chore(deps): bump github.com/cli/go-gh/v2 from 2.16.1 to 2.16.2 cli/cli#14696
• chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 by @​dependabot[bot] in chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 cli/cli#14697
• chore(deps): bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0 by @​dependabot[bot] in chore(deps): bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0 cli/cli#14707
• chore(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3 by @​dependabot[bot] in chore(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3 cli/cli#14705
• chore(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 by @​dependabot[bot] in chore(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 cli/cli#14706
• chore(deps): bump the codeql-actions group with 3 updates by @​dependabot[bot] in chore(deps): bump the codeql-actions group with 3 updates cli/cli#14751
• Bump Go to 1.27.3 by @​github-actions[bot] in Bump Go to 1.27.3 cli/cli#14767
• chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.15 to 1.4.16 by @​dependabot[bot] in chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.15 to 1.4.16 cli/cli#14766
• Update glamour to v2 by @​heaths in Update glamour to v2 cli/cli#14148

New Contributors

• @​reginaldalfret made their first contribution in docs: recommend nix-shell and declarative config for Nix/NixOS cli/cli#14592
• @​jarrensj made their first contribution in Remove CLAUDE.md in favor of AGENTS.md cli/cli#14474
• @​A4-Tacks made their first contribution in Fix the unclean background colors of gh-search-code cli/cli#14648
• @​arsalanyavari made their first contribution in Clarify --comments behavior when piped in view commands cli/cli#14714

Full Changelog: cli/cli@v2.102.1...v2.103.0

v2.102.1: GitHub CLI 2.102.1

Compare Source

What's Changed

Dependencies

chore(deps): bump Go toolchain from 1.27.1 to 1.27.3 and golang.org/x/net from 0.58.0 to 0.60.0

Full Changelog: cli/cli@v2.102.0...v2.102.1

SocketDev/socket-cli (npm:socket)

v1.10.1: v1.10.1

Compare Source

What's Changed

• upgrading coana to version 15.12.12 by @​socket-pr-bot[bot] in upgrading coana to version 15.12.12 SocketDev/socket-cli#1641
• fix(manifest): report a facts build that fails before writing its records by @​jfblaa in fix(manifest): report a facts build that fails before writing its records SocketDev/socket-cli#1643
• fix(scan): upload the analyzed facts files next to the reachability report by @​jfblaa in fix(scan): upload the analyzed facts files next to the reachability report SocketDev/socket-cli#1653
• fix(manifest): leave a component with a missing artifact file without targets by @​jfblaa in fix(manifest): leave a component with a missing artifact file without targets SocketDev/socket-cli#1644
• fix(manifest): materialize the healthy Maven dependencies of a partial graph by @​jfblaa in fix(manifest): materialize the healthy Maven dependencies of a partial graph SocketDev/socket-cli#1645
• fix(manifest): report the Maven POMs that Maven only warns about by @​jfblaa in fix(manifest): report the Maven POMs that Maven only warns about SocketDev/socket-cli#1646
• fix(manifest): block on a non-blocking JVM failure whose module resolved nowhere by @​jfblaa in fix(manifest): block on a non-blocking JVM failure whose module resolved nowhere SocketDev/socket-cli#1647
• fix(manifest): report the Gradle failures the facts init script swallowed by @​jfblaa in fix(manifest): report the Gradle failures the facts init script swallowed SocketDev/socket-cli#1648
• fix(manifest): report the sbt jars that could not be fetched by @​jfblaa in fix(manifest): report the sbt jars that could not be fetched SocketDev/socket-cli#1649
• fix(manifest): keep the paths of a module excluded with --exclude-paths by @​jfblaa in fix(manifest): keep the paths of a module excluded with --exclude-paths SocketDev/socket-cli#1650
• chore(release): 1.10.1 by @​socket-release-bot[bot] in chore(release): 1.10.1 SocketDev/socket-cli#1654

Full Changelog: SocketDev/socket-cli@v1.10.0...v1.10.1

v1.10.0: v1.10.0

Compare Source

What's Changed

• feat(manifest): name failing JVM dependencies and remedies the command accepts by @​jfblaa in feat(manifest): name failing JVM dependencies and remedies the command accepts SocketDev/socket-cli#1638
• chore(release): 1.10.0 by @​socket-release-bot[bot] in chore(release): 1.10.0 SocketDev/socket-cli#1639

Full Changelog: SocketDev/socket-cli@v1.9.1...v1.10.0

v1.9.1: v1.9.1

Compare Source

What's Changed

• fix(fix): list Yarn classic under --allow-overrides by @​mtorp in fix(fix): list Yarn classic under --allow-overrides SocketDev/socket-cli#1635
• upgrading coana to version 15.12.11 by @​socket-pr-bot[bot] in upgrading coana to version 15.12.11 SocketDev/socket-cli#1636
• chore(release): 1.9.1 by @​socket-release-bot[bot] in chore(release): 1.9.1 SocketDev/socket-cli#1637

Full Changelog: SocketDev/socket-cli@v1.9.0...v1.9.1

v1.9.0: v1.9.0

Compare Source

What's Changed

• fix(api): show the Socket API's error message on failed requests by @​BarrensZeppelin in fix(api): show the Socket API's error message on failed requests SocketDev/socket-cli#1627
• refactor: pin the Coana CLI version in the source by @​BarrensZeppelin in refactor: pin the Coana CLI version in the source SocketDev/socket-cli#1628
• feat: launch the Coana CLI from GCS instead of npm by @​BarrensZeppelin in feat: launch the Coana CLI from GCS instead of npm SocketDev/socket-cli#1629
• refactor(dlx): drop the force option and range detection by @​BarrensZeppelin in refactor(dlx): drop the force option and range detection SocketDev/socket-cli#1630
• upgrading coana to version 15.12.10 by @​socket-pr-bot[bot] in upgrading coana to version 15.12.10 SocketDev/socket-cli#1633
• chore(release): 1.9.0 by @​socket-release-bot[bot] in chore(release): 1.9.0 SocketDev/socket-cli#1634

Full Changelog: SocketDev/socket-cli@v1.8.4...v1.9.0

v1.8.4: v1.8.4

Compare Source

What's Changed

• fix(fix): exit 5 when computed fixes go unapplied by @​mtorp in fix(fix): exit 5 when computed fixes go unapplied SocketDev/socket-cli#1624
• upgrading coana to version 15.12.9 by @​socket-pr-bot[bot] in upgrading coana to version 15.12.9 SocketDev/socket-cli#1625
• chore(release): 1.8.4 by @​socket-release-bot[bot] in chore(release): 1.8.4 SocketDev/socket-cli#1626

Full Changelog: SocketDev/socket-cli@v1.8.3...v1.8.4

v1.8.3: v1.8.3

Compare Source

What's Changed

• fix(manifest): cover recursive build roots by build file, not directory by @​jfblaa in fix(manifest): cover recursive build roots by build file, not directory SocketDev/socket-cli#1620
• upgrading coana to version 15.12.8 by @​socket-pr-bot[bot] in upgrading coana to version 15.12.8 SocketDev/socket-cli#1622
• chore(release): 1.8.3 by @​socket-release-bot[bot] in chore(release): 1.8.3 SocketDev/socket-cli#1623

Full Changelog: SocketDev/socket-cli@v1.8.2...v1.8.3

Skipped Packages

GitHub Release Notes Unavailable

• pipx:semgrep: No GitHub release was found for 1.182.1