build(aqua-proj): 🌊 minor aqua (#91)

renovate[bot] · sheldonhull · web-flow · commit 02386bec7efc · 2025-01-16T22:14:03.000Z
This PR contains the following updates:

| Package | Type | Update | Change | OpenSSF |
|---|---|---|---|---|
| [anchore/syft](https://redirect.github.com/anchore/syft) | | minor |
`v1.12.2` -&gt; `v1.18.1` | [![OpenSSF
Scorecard](https://api.securityscorecards.dev/projects/github.com/anchore/syft/badge)](https://securityscorecards.dev/viewer/?uri=github.com/anchore/syft)
|
| [aquaproj/aqua](https://redirect.github.com/aquaproj/aqua) | | minor |
`v2.30.0` -&gt; `v2.42.2` | [![OpenSSF
Scorecard](https://api.securityscorecards.dev/projects/github.com/aquaproj/aqua/badge)](https://securityscorecards.dev/viewer/?uri=github.com/aquaproj/aqua)
|
|
[aquaproj/aqua-installer](https://redirect.github.com/aquaproj/aqua-installer)
| action | minor | `v3.0.1` -&gt; `v3.1.0` | [![OpenSSF
Scorecard](https://api.securityscorecards.dev/projects/github.com/aquaproj/aqua-installer/badge)](https://securityscorecards.dev/viewer/?uri=github.com/aquaproj/aqua-installer)
|
|
[aquaproj/aqua-registry](https://redirect.github.com/aquaproj/aqua-registry)
| | minor | `v4.205.0` -&gt; `v4.296.0` | [![OpenSSF
Scorecard](https://api.securityscorecards.dev/projects/github.com/aquaproj/aqua-registry/badge)](https://securityscorecards.dev/viewer/?uri=github.com/aquaproj/aqua-registry)
|
| [cli/cli](https://redirect.github.com/cli/cli) | | minor | `v2.53.0`
-&gt; `v2.65.0` | [![OpenSSF
Scorecard](https://api.securityscorecards.dev/projects/github.com/cli/cli/badge)](https://securityscorecards.dev/viewer/?uri=github.com/cli/cli)
|
| [direnv/direnv](https://redirect.github.com/direnv/direnv) | | minor |
`v2.34.0` -&gt; `v2.35.0` | [![OpenSSF
Scorecard](https://api.securityscorecards.dev/projects/github.com/direnv/direnv/badge)](https://securityscorecards.dev/viewer/?uri=github.com/direnv/direnv)
|
| [golang/go](https://redirect.github.com/golang/go) | | minor |
`1.22.5` -&gt; `1.23.5` | [![OpenSSF
Scorecard](https://api.securityscorecards.dev/projects/github.com/golang/go/badge)](https://securityscorecards.dev/viewer/?uri=github.com/golang/go)
|
|
[golangci/golangci-lint](https://redirect.github.com/golangci/golangci-lint)
| | minor | `v1.59.1` -&gt; `v1.63.4` | [![OpenSSF
Scorecard](https://api.securityscorecards.dev/projects/github.com/golangci/golangci-lint/badge)](https://securityscorecards.dev/viewer/?uri=github.com/golangci/golangci-lint)
|
|
[goreleaser/goreleaser](https://redirect.github.com/goreleaser/goreleaser)
| | minor | `v2.1.0` -&gt; `v2.5.1` | [![OpenSSF
Scorecard](https://api.securityscorecards.dev/projects/github.com/goreleaser/goreleaser/badge)](https://securityscorecards.dev/viewer/?uri=github.com/goreleaser/goreleaser)
|
| [mikefarah/yq](https://redirect.github.com/mikefarah/yq) | | minor |
`v4.44.3` -&gt; `v4.45.1` | [![OpenSSF
Scorecard](https://api.securityscorecards.dev/projects/github.com/mikefarah/yq/badge)](https://securityscorecards.dev/viewer/?uri=github.com/mikefarah/yq)
|
| [miniscruff/changie](https://redirect.github.com/miniscruff/changie) |
| minor | `v1.19.1` -&gt; `v1.21.0` | [![OpenSSF
Scorecard](https://api.securityscorecards.dev/projects/github.com/miniscruff/changie/badge)](https://securityscorecards.dev/viewer/?uri=github.com/miniscruff/changie)
|
| [mvdan/gofumpt](https://redirect.github.com/mvdan/gofumpt) | | minor |
`v0.6.0` -&gt; `v0.7.0` | [![OpenSSF
Scorecard](https://api.securityscorecards.dev/projects/github.com/mvdan/gofumpt/badge)](https://securityscorecards.dev/viewer/?uri=github.com/mvdan/gofumpt)
|

---

### Release Notes

&lt;details&gt;
&lt;summary&gt;anchore/syft (anchore/syft)&lt;/summary&gt;

###
[`v1.18.1`](https://redirect.github.com/anchore/syft/releases/tag/v1.18.1)

[Compare
Source](https://redirect.github.com/anchore/syft/compare/v1.18.0...v1.18.1)

##### Bug Fixes

- Runtime Error with Syft on Singularity .sif file (panic: index out of
range)
\[[#&amp;#8203;3390](https://redirect.github.com/anchore/syft/issues/3390)]
- SPDX expressions are lost from CycloneDX if they contain extra
parenthesis
\[[#&amp;#8203;3441](https://redirect.github.com/anchore/syft/issues/3441)
[#&amp;#8203;3517](https://redirect.github.com/anchore/syft/pull/3517)
[@&amp;#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]

##### Additional Changes

- migrate syft to use anchore fork of archiver without replace
\[[#&amp;#8203;3516](https://redirect.github.com/anchore/syft/pull/3516)
[@&amp;#8203;spiffcs](https://redirect.github.com/spiffcs)]

**[(Full
Changelog)](https://redirect.github.com/anchore/syft/compare/v1.18.0...v1.18.1)**

###
[`v1.18.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.18.0)

[Compare
Source](https://redirect.github.com/anchore/syft/compare/v1.17.0...v1.18.0)

##### Added Features

- convert spdx absolute to relative
\[[#&amp;#8203;3509](https://redirect.github.com/anchore/syft/pull/3509)
[@&amp;#8203;spiffcs](https://redirect.github.com/spiffcs)]
- Add relationships for rust audit binary packages
\[[#&amp;#8203;3500](https://redirect.github.com/anchore/syft/pull/3500)
[@&amp;#8203;wagoodman](https://redirect.github.com/wagoodman)]
- support configuration of layer size in Syft
\[[#&amp;#8203;3428](https://redirect.github.com/anchore/syft/issues/3428)
[#&amp;#8203;3464](https://redirect.github.com/anchore/syft/pull/3464)
[@&amp;#8203;tomersein](https://redirect.github.com/tomersein)]
- Support Dart arm/v7 in 3.x and 2.x
\[[#&amp;#8203;3278](https://redirect.github.com/anchore/syft/issues/3278)
[#&amp;#8203;3475](https://redirect.github.com/anchore/syft/pull/3475)
[@&amp;#8203;witchcraze](https://redirect.github.com/witchcraze)]

##### Bug Fixes

- fix order of rust dependencies and support git sources in Cargo.lock
dependencies
\[[#&amp;#8203;3502](https://redirect.github.com/anchore/syft/pull/3502)
[@&amp;#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]
- Use file indexer directly when scanning with file source
\[[#&amp;#8203;3333](https://redirect.github.com/anchore/syft/pull/3333)
[@&amp;#8203;adammcclenaghan](https://redirect.github.com/adammcclenaghan)]
- Remove incorrect power-user help text that only image sources are
supported
\[[#&amp;#8203;2046](https://redirect.github.com/anchore/syft/issues/2046)]
- Invalid SPDX: missing copyright text
\[[#&amp;#8203;3346](https://redirect.github.com/anchore/syft/issues/3346)
[#&amp;#8203;3495](https://redirect.github.com/anchore/syft/pull/3495)
[@&amp;#8203;spiffcs](https://redirect.github.com/spiffcs)]
- Scanning a source tree with duplicate conanfile.txt dependencies
generates multiple components
\[[#&amp;#8203;3403](https://redirect.github.com/anchore/syft/issues/3403)]

**[(Full
Changelog)](https://redirect.github.com/anchore/syft/compare/v1.17.0...v1.18.0)**

###
[`v1.17.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.17.0)

[Compare
Source](https://redirect.github.com/anchore/syft/compare/v1.16.0...v1.17.0)

##### Added Features

- Surface Rust dependency relationships
\[[#&amp;#8203;2353](https://redirect.github.com/anchore/syft/issues/2353)
[#&amp;#8203;3443](https://redirect.github.com/anchore/syft/pull/3443)
[@&amp;#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]
- Support node 6.x versions
\[[#&amp;#8203;3404](https://redirect.github.com/anchore/syft/issues/3404)
[#&amp;#8203;3419](https://redirect.github.com/anchore/syft/pull/3419)
[@&amp;#8203;witchcraze](https://redirect.github.com/witchcraze)]

##### Bug Fixes

- Restore log on UI teardown
\[[#&amp;#8203;3427](https://redirect.github.com/anchore/syft/pull/3427)
[@&amp;#8203;wagoodman](https://redirect.github.com/wagoodman)]
- Syft should log warnings even when no TTY is present
\[[#&amp;#8203;3081](https://redirect.github.com/anchore/syft/issues/3081)
[#&amp;#8203;3466](https://redirect.github.com/anchore/syft/pull/3466)
[@&amp;#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]
- Special characters (tab, newline) in license URL
\[[#&amp;#8203;3122](https://redirect.github.com/anchore/syft/issues/3122)
[#&amp;#8203;3449](https://redirect.github.com/anchore/syft/pull/3449)
[@&amp;#8203;spiffcs](https://redirect.github.com/spiffcs)]
- LicenseDeclared not as per SPDX License List
\[[#&amp;#8203;3030](https://redirect.github.com/anchore/syft/issues/3030)
[#&amp;#8203;3461](https://redirect.github.com/anchore/syft/pull/3461)
[@&amp;#8203;spiffcs](https://redirect.github.com/spiffcs)]

##### Additional Changes

- doc: Add official Syft logo license information
\[[#&amp;#8203;3421](https://redirect.github.com/anchore/syft/pull/3421)
[@&amp;#8203;popey](https://redirect.github.com/popey)]

**[(Full
Changelog)](https://redirect.github.com/anchore/syft/compare/v1.16.0...v1.17.0)**

###
[`v1.16.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.16.0)

[Compare
Source](https://redirect.github.com/anchore/syft/compare/v1.15.0...v1.16.0)

##### Added Features

- omit devDependencies for package-lock.json files by default
\[[#&amp;#8203;2348](https://redirect.github.com/anchore/syft/issues/2348)
[#&amp;#8203;3371](https://redirect.github.com/anchore/syft/pull/3371)
[@&amp;#8203;njv299](https://redirect.github.com/njv299)]

##### Bug Fixes

- add support for dependencies and purl for Native Image SBOMs
\[[#&amp;#8203;3399](https://redirect.github.com/anchore/syft/pull/3399)
[@&amp;#8203;rudsberg](https://redirect.github.com/rudsberg)]
- stop bubbling fileResolver errors from binary cataloger
\[[#&amp;#8203;3410](https://redirect.github.com/anchore/syft/pull/3410)
[@&amp;#8203;spiffcs](https://redirect.github.com/spiffcs)]
- malformed pom.xml may cause recursive loop
\[[#&amp;#8203;3391](https://redirect.github.com/anchore/syft/pull/3391)
[@&amp;#8203;kzantow](https://redirect.github.com/kzantow)]
- syft convert: broken link in help - documentation no longer existing
\[[#&amp;#8203;3143](https://redirect.github.com/anchore/syft/issues/3143)
[#&amp;#8203;3407](https://redirect.github.com/anchore/syft/pull/3407)
[@&amp;#8203;Makefolder](https://redirect.github.com/Makefolder)]

**[(Full
Changelog)](https://redirect.github.com/anchore/syft/compare/v1.15.0...v1.16.0)**

###
[`v1.15.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.15.0)

[Compare
Source](https://redirect.github.com/anchore/syft/compare/v1.14.2...v1.15.0)

##### Added Features

- Merge config files hierarchically and add support for config profiles
\[[#&amp;#8203;3337](https://redirect.github.com/anchore/syft/pull/3337)
[@&amp;#8203;kzantow](https://redirect.github.com/kzantow)]
- Enable cargo-auditable-binary-cataloger for files/directories
\[[#&amp;#8203;3376](https://redirect.github.com/anchore/syft/pull/3376)
[@&amp;#8203;ariel-miculas](https://redirect.github.com/ariel-miculas)]
- Improve mariadb binary classifer to detect older versions
\[[#&amp;#8203;3052](https://redirect.github.com/anchore/syft/issues/3052)]
- Look for dpkg status file at additional globs
\[[#&amp;#8203;2692](https://redirect.github.com/anchore/syft/issues/2692)
[#&amp;#8203;3373](https://redirect.github.com/anchore/syft/pull/3373)
[@&amp;#8203;njv299](https://redirect.github.com/njv299)]
- Emit relationships for Java dependencies
\[[#&amp;#8203;3189](https://redirect.github.com/anchore/syft/issues/3189)
[#&amp;#8203;3363](https://redirect.github.com/anchore/syft/pull/3363)
[@&amp;#8203;kzantow](https://redirect.github.com/kzantow)]

**[(Full
Changelog)](https://redirect.github.com/anchore/syft/compare/v1.14.2...v1.15.0)**

###
[`v1.14.2`](https://redirect.github.com/anchore/syft/releases/tag/v1.14.2)

[Compare
Source](https://redirect.github.com/anchore/syft/compare/v1.14.1...v1.14.2)

##### Bug Fixes

- Use single license scanner for all catalogers
\[[#&amp;#8203;3348](https://redirect.github.com/anchore/syft/pull/3348)
[@&amp;#8203;wagoodman](https://redirect.github.com/wagoodman)]
- use official CPE for linux kernel
\[[#&amp;#8203;3343](https://redirect.github.com/anchore/syft/pull/3343)
[@&amp;#8203;westonsteimel](https://redirect.github.com/westonsteimel)]
- improve mariadb binary classifer to detect older versions
\[[#&amp;#8203;3339](https://redirect.github.com/anchore/syft/pull/3339)
[@&amp;#8203;westonsteimel](https://redirect.github.com/westonsteimel)]

##### Additional Changes

- Update to latest packageurl-go
\[[#&amp;#8203;3347](https://redirect.github.com/anchore/syft/pull/3347)
[@&amp;#8203;wagoodman](https://redirect.github.com/wagoodman)]

**[(Full
Changelog)](https://redirect.github.com/anchore/syft/compare/v1.14.1...v1.14.2)**

###
[`v1.14.1`](https://redirect.github.com/anchore/syft/releases/tag/v1.14.1)

[Compare
Source](https://redirect.github.com/anchore/syft/compare/v1.14.0...v1.14.1)

##### Bug Fixes

- stop some log.Warn spam due parsing an empty string as a CPE
\[[#&amp;#8203;3330](https://redirect.github.com/anchore/syft/pull/3330)
[@&amp;#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]
- improve go binary semver extraction for traefik
\[[#&amp;#8203;3325](https://redirect.github.com/anchore/syft/pull/3325)
[@&amp;#8203;westonsteimel](https://redirect.github.com/westonsteimel)]

**[(Full
Changelog)](https://redirect.github.com/anchore/syft/compare/v1.14.0...v1.14.1)**

###
[`v1.14.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.14.0)

[Compare
Source](https://redirect.github.com/anchore/syft/compare/v1.13.0...v1.14.0)

##### Added Features

- Report known unknowns directly in the output SBOM
\[[#&amp;#8203;518](https://redirect.github.com/anchore/syft/issues/518)
[#&amp;#8203;2998](https://redirect.github.com/anchore/syft/pull/2998)
[@&amp;#8203;kzantow](https://redirect.github.com/kzantow)]
- Identify `bash.preinst`
\[[#&amp;#8203;3191](https://redirect.github.com/anchore/syft/issues/3191)
[#&amp;#8203;3228](https://redirect.github.com/anchore/syft/pull/3228)
[@&amp;#8203;wagoodman](https://redirect.github.com/wagoodman)]
- Support HAProxy rc and some old versions
\[[#&amp;#8203;3233](https://redirect.github.com/anchore/syft/issues/3233)
[#&amp;#8203;3277](https://redirect.github.com/anchore/syft/pull/3277)
[@&amp;#8203;witchcraze](https://redirect.github.com/witchcraze)]
- Support Redis arm/v5, arm/v7, 386 in 7.2, 7.4, 8.0
\[[#&amp;#8203;3279](https://redirect.github.com/anchore/syft/issues/3279)
[#&amp;#8203;3281](https://redirect.github.com/anchore/syft/pull/3281)
[@&amp;#8203;witchcraze](https://redirect.github.com/witchcraze)]
- Support node old versions
\[[#&amp;#8203;3236](https://redirect.github.com/anchore/syft/issues/3236)
[#&amp;#8203;3284](https://redirect.github.com/anchore/syft/pull/3284)
[@&amp;#8203;witchcraze](https://redirect.github.com/witchcraze)]
- Support rubylang/ruby dev versions
\[[#&amp;#8203;3239](https://redirect.github.com/anchore/syft/issues/3239)
[#&amp;#8203;3285](https://redirect.github.com/anchore/syft/pull/3285)
[@&amp;#8203;witchcraze](https://redirect.github.com/witchcraze)]
- Support ruby rc, preview
\[[#&amp;#8203;3238](https://redirect.github.com/anchore/syft/issues/3238)
[#&amp;#8203;3285](https://redirect.github.com/anchore/syft/pull/3285)
[@&amp;#8203;witchcraze](https://redirect.github.com/witchcraze)]

##### Bug Fixes

- performance: instantiate license check scanner to prevent memory leak
\[[#&amp;#8203;3290](https://redirect.github.com/anchore/syft/pull/3290)
[@&amp;#8203;govrin](https://redirect.github.com/govrin)]
- Parse package.json with non-standard fields in 'author' section
\[[#&amp;#8203;3300](https://redirect.github.com/anchore/syft/pull/3300)
[@&amp;#8203;nuada](https://redirect.github.com/nuada)]
- make failed CPE validation correctly return error
\[[#&amp;#8203;2762](https://redirect.github.com/anchore/syft/pull/2762)
[@&amp;#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]
- Improve subpath to mount matching
\[[#&amp;#8203;3269](https://redirect.github.com/anchore/syft/pull/3269)
[@&amp;#8203;cdupuis](https://redirect.github.com/cdupuis)]

##### Additional Changes

- add pull request template
\[[#&amp;#8203;3294](https://redirect.github.com/anchore/syft/pull/3294)
[@&amp;#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]

**[(Full
Changelog)](https://redirect.github.com/anchore/syft/compare/v1.13.0...v1.14.0)**

###
[`v1.13.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.13.0)

[Compare
Source](https://redirect.github.com/anchore/syft/compare/v1.12.2...v1.13.0)

##### Added Features

- \--enrich flag for data enrichment feature enablement
\[[#&amp;#8203;3182](https://redirect.github.com/anchore/syft/pull/3182)
[@&amp;#8203;kzantow](https://redirect.github.com/kzantow)]
- Add classifier for Dart lang
\[[#&amp;#8203;3265](https://redirect.github.com/anchore/syft/pull/3265)
[@&amp;#8203;LaurentGoderre](https://redirect.github.com/LaurentGoderre)]
- add binary classifiers for lighttp, proftpd, zstd, xz, gzip, jq, and
sqlcipher
\[[#&amp;#8203;3252](https://redirect.github.com/anchore/syft/pull/3252)
[@&amp;#8203;krysgor](https://redirect.github.com/krysgor)]
- Catalog JDKs more completely
\[[#&amp;#8203;3188](https://redirect.github.com/anchore/syft/issues/3188)
[#&amp;#8203;3217](https://redirect.github.com/anchore/syft/pull/3217)
[@&amp;#8203;wagoodman](https://redirect.github.com/wagoodman)]
- Show richer information for JVM installations
\[[#&amp;#8203;1426](https://redirect.github.com/anchore/syft/issues/1426)
[#&amp;#8203;3217](https://redirect.github.com/anchore/syft/pull/3217)
[@&amp;#8203;wagoodman](https://redirect.github.com/wagoodman)]
- Allow for stubbing unknown versions over dropping packages
\[[#&amp;#8203;2652](https://redirect.github.com/anchore/syft/issues/2652)
[#&amp;#8203;3257](https://redirect.github.com/anchore/syft/pull/3257)
[@&amp;#8203;wagoodman](https://redirect.github.com/wagoodman)]
- Name and Version empty for Java package when scanning provided image
\[[#&amp;#8203;2132](https://redirect.github.com/anchore/syft/issues/2132)
[#&amp;#8203;3257](https://redirect.github.com/anchore/syft/pull/3257)
[@&amp;#8203;wagoodman](https://redirect.github.com/wagoodman)]
- Support bitnami/mysql:8.x
\[[#&amp;#8203;3025](https://redirect.github.com/anchore/syft/issues/3025)]

##### Bug Fixes

- OpenJDK CPEs
\[[#&amp;#8203;2422](https://redirect.github.com/anchore/syft/issues/2422)
[#&amp;#8203;3217](https://redirect.github.com/anchore/syft/pull/3217)
[@&amp;#8203;wagoodman](https://redirect.github.com/wagoodman)]
- SBOM generated from poetry lock file contains no license information
on any dependencies
\[[#&amp;#8203;3204](https://redirect.github.com/anchore/syft/issues/3204)]
- Scanning a folder with a jar archive with no metadata creates a SPDX
package without versionInfo (Non-NTIA compliant)
\[[#&amp;#8203;2039](https://redirect.github.com/anchore/syft/issues/2039)
[#&amp;#8203;3257](https://redirect.github.com/anchore/syft/pull/3257)
[@&amp;#8203;wagoodman](https://redirect.github.com/wagoodman)]
- Using replace in a go.mod creates a SPDX package without versionInfo
(Non-NTIA compliant)
\[[#&amp;#8203;2038](https://redirect.github.com/anchore/syft/issues/2038)
[#&amp;#8203;3257](https://redirect.github.com/anchore/syft/pull/3257)
[@&amp;#8203;wagoodman](https://redirect.github.com/wagoodman)]
- Command `make add-snippet` can fail in some cases
\[[#&amp;#8203;3249](https://redirect.github.com/anchore/syft/issues/3249)]

**[(Full
Changelog)](https://redirect.github.com/anchore/syft/compare/v1.12.2...v1.13.0)**

&lt;/details&gt;

&lt;details&gt;
&lt;summary&gt;aquaproj/aqua (aquaproj/aqua)&lt;/summary&gt;

###
[`v2.42.2`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.42.2)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.42.1...v2.42.2)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.42.2)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.42.2)
| https://github.com/aquaproj/aqua/compare/v2.42.1...v2.42.2

##### 🐛 Bug Fixes

[#&amp;#8203;3436](https://redirect.github.com/aquaproj/aqua/issues/3436)
Fix a bug that `aqua update` command fails if `version_expr` or
`go_version_file` is used

As of this release, `aqua update` command ignores packages with
`version_expr` or `go_version_file`.

###
[`v2.42.1`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.42.1)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.42.0...v2.42.1)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.42.1)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.42.1)
| https://github.com/aquaproj/aqua/compare/v2.42.0...v2.42.1

#### 🐞 Bug Fixes

[#&amp;#8203;3433](https://redirect.github.com/aquaproj/aqua/issues/3433)
Create symlinks if unarchived files are symlinks

This fixes a bug of aqua v2.42.0.
[#&amp;#8203;3432](https://redirect.github.com/aquaproj/aqua/issues/3432)

###
[`v2.42.0`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.42.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.41.0...v2.42.0)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.42.0)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.42.0)
| https://github.com/aquaproj/aqua/compare/v2.41.0...v2.42.0

&gt; \[!CAUTION]
&gt; This version has a known
bu[https://github.com/aquaproj/aqua/issues/3432](https://redirect.github.com/aquaproj/aqua/issues/3432)/3432
&gt; This bug was fixed at v2.42.1.
https://github.com/aquaproj/aqua/releases/tag/v2.42.1

##### Features

[#&amp;#8203;3422](https://redirect.github.com/aquaproj/aqua/issues/3422)
Support 7 zip

##### Others

[#&amp;#8203;3422](https://redirect.github.com/aquaproj/aqua/issues/3422)
Replace [mholt/archiver/v3](https://redirect.github.com/mholt/archiver)
with [mholt/archives](https://redirect.github.com/mholt/archives)

mholt/archiver/v3 was deprecated and it's encourage to migrate to
mholt/archives.

###
[`v2.41.0`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.41.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.40.0...v2.41.0)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.41.0)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.41.0)
| https://github.com/aquaproj/aqua/compare/v2.40.0...v2.41.0

#### Features

[#&amp;#8203;3407](https://redirect.github.com/aquaproj/aqua/issues/3407)
Support cargo install's `--locked` option

https://aquaproj.github.io/docs/reference/registry-config/cargo-package

e.g. registry.yaml:

```yaml
            type: cargo
            crate: rhit
            cargo:
              locked: true
```

--locked Assert that `Cargo.lock` will remain unchanged

[#&amp;#8203;3399](https://redirect.github.com/aquaproj/aqua/issues/3399)
update: Support filtering updated packages using package tags

https://aquaproj.github.io/docs/guides/package-tag

e.g.

```sh
aqua up -t bootstrap # Update only packages with a tag `bootstrap`
aqua up --exclude-tags bootstrap # Exclude packages with a tag `bootstrap`
```

###
[`v2.40.0`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.40.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.39.1...v2.40.0)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.40.0)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.40.0)
| https://github.com/aquaproj/aqua/compare/v2.39.1...v2.40.0

##### Features

[#&amp;#8203;3363](https://redirect.github.com/aquaproj/aqua/issues/3363)
Support getting package versions from external files

This release enables you to get package versions from external files.
This feature is useful when:

-   Migrate any tool to aqua gradually
-   Support aqua and other tools

This release adds some fields to aqua.yaml's packages.

- version_expr: An
[expr](https://expr-lang.org/docs/language-definition) expression to
read external files
-   version_expr_prefix: A prefix of version

e.g.

```yaml
packages:
- name: hashicorp/terraform
  version_expr: |
    "v" + readFile('.terraform-version')
```

```yaml
  version_expr: |
    readJSON('version.json').version
  version_expr_prefix: cli-
```

```yaml
  version_expr: |
    readYAML('version.yaml').version
```

`version_expr` is evaluated using
[expr](https://expr-lang.org/docs/language-definition).
The following custom functions are available.

-   readFile("file path"): reads a file and returns a file content
- readJSON("file path"): read and unmarshal a JSON file and returns an
object
- readYAML("file path"): read and unmarshal a YAML file and returns an
object

##### :warning: Constraint of `version_expr`

Allowing to read external files is potentially risky in terms of
security.
Malicious users can try to read secret files and expose secrets via log
using `version_expr`.
To prevent such a threat, we restrict the evaluation result of
`version_expr`.
It must match with the regular expression
`^v?\d+\.\d+(\.\d+)*[.-]?((alpha|beta|dev|rc)[.-]?)?\d*`.

###
[`v2.39.1`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.39.1)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.39.0...v2.39.1)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.39.1)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.39.1)
| https://github.com/aquaproj/aqua/compare/v2.39.0...v2.39.1

#### Fixes

[#&amp;#8203;3365](https://redirect.github.com/aquaproj/aqua/issues/3365)
cargo: Normalize the install path of cargo packages

#### Others

[#&amp;#8203;3361](https://redirect.github.com/aquaproj/aqua/issues/3361)
Refactor reading config

###
[`v2.39.0`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.39.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.38.4...v2.39.0)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.39.0)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.39.0)
| https://github.com/aquaproj/aqua/compare/v2.38.4...v2.39.0

#### Features

[#&amp;#8203;3354](https://redirect.github.com/aquaproj/aqua/issues/3354)
policy: add a code comment for YAML Language Servers to a generated file
`aqua-policy.yaml`

```yaml

### yaml-language-server: $schema=https://raw.githubusercontent.com/aquaproj/aqua/main/json-schema/policy.json
```

[#&amp;#8203;3352](https://redirect.github.com/aquaproj/aqua/issues/3352)
init: Add a code comment for YAML Language Servers to a generated file
`aqua.yaml`

```yaml

### yaml-language-server: $schema=https://raw.githubusercontent.com/aquaproj/aqua/main/json-schema/aqua-yaml.json
```

These code comments are useful when you edit files with editors such as
VSCode.

&lt;img width="980" alt="image"
src="https://github.com/user-attachments/assets/7935b72a-3702-4ea9-b2c9-3663e4c068bf"
/&gt;

&lt;img width="543" alt="image"
src="https://github.com/user-attachments/assets/dcff2fb5-064b-4087-9bd6-374b52cc9321"
/&gt;

###
[`v2.38.4`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.38.4)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.38.3...v2.38.4)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.38.4)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.38.4)
| https://github.com/aquaproj/aqua/compare/v2.38.3...v2.38.4

##### Bug Fixes

[#&amp;#8203;3337](https://redirect.github.com/aquaproj/aqua/issues/3337)
generate-registry: Fix a bug that unused replacements are added

###
[`v2.38.3`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.38.3)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.38.2...v2.38.3)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.38.3)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.38.3)
| https://github.com/aquaproj/aqua/compare/v2.38.2...v2.38.3

##### Bug Fixes

[#&amp;#8203;3325](https://redirect.github.com/aquaproj/aqua/issues/3325)
[#&amp;#8203;3333](https://redirect.github.com/aquaproj/aqua/issues/3333)
Fix a bug that `aqua g -i` removes comments from `packages`

###
[`v2.38.2`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.38.2)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.38.1...v2.38.2)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.38.2)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.38.2)
| https://github.com/aquaproj/aqua/compare/v2.38.1...v2.38.2

##### 🐛 Bug Fixes

[#&amp;#8203;3307](https://redirect.github.com/aquaproj/aqua/issues/3307)
generate-registry: Fix a bug that description isn't formatted

###
[`v2.38.1`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.38.1)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.38.0...v2.38.1)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.38.1)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.38.1)
| https://github.com/aquaproj/aqua/compare/v2.38.0...v2.38.1

#### Fixes

[#&amp;#8203;3297](https://redirect.github.com/aquaproj/aqua/issues/3297)
completion: Improve the completion settings suggested in `aqua
completion --help`
[@&amp;#8203;akinomyoga](https://redirect.github.com/akinomyoga)

###
[`v2.38.0`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.38.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.37.2...v2.38.0)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.38.0)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.38.0)
| https://github.com/aquaproj/aqua/compare/v2.37.2...v2.38.0

#### Features

[#&amp;#8203;3269](https://redirect.github.com/aquaproj/aqua/issues/3269)
Get available versions from [Go Module Proxy](https://proxy.golang.org/)


https://aquaproj.github.io/docs/reference/registry-config/go-version-path

This release adds the new field `go_version_path` to registries.

e.g.

```yaml
packages:
  - name: _go/sigsum.org/sigsum-go#cmd/sigsum-key
    type: go_install
    path: sigsum.org/sigsum-go/cmd/sigsum-key
    go_version_path: sigsum.org/sigsum-go
```

If this field is set, `aqua g` and `aqua up` commands gets available
versions from [Go Module Proxy](https://proxy.golang.org/).

###
[`v2.37.2`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.37.2)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.37.1...v2.37.2)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.37.2)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.37.2)
| https://github.com/aquaproj/aqua/compare/v2.37.1...v2.37.2

##### Fixes

[#&amp;#8203;3233](https://redirect.github.com/aquaproj/aqua/issues/3233)
which, exec: Search configuration files even if `AQUA_CONFIG` is set

###
[`v2.37.1`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.37.1)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.37.0...v2.37.1)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.37.1)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.37.1)
| https://github.com/aquaproj/aqua/compare/v2.37.0...v2.37.1

#### Bug Fixes

[#&amp;#8203;3226](https://redirect.github.com/aquaproj/aqua/issues/3226)
[#&amp;#8203;584](https://redirect.github.com/aquaproj/aqua/issues/584) Fix
a bug that newlines in aqua.yaml are removed when updating aqua.yaml by
`aqua g -i` and `aqua up`

This issue came from the bug of goccy/go-yaml.
[https://github.com/goccy/go-yaml/issues/285](https://redirect.github.com/goccy/go-yaml/issues/285)
The issue was solved at goccy/go-yaml 1.13.3.
So we updated goccy/go-yaml to 1.13.3 and solve the issue.

###
[`v2.37.0`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.37.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.36.2...v2.37.0)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.37.0)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.37.0)
| https://github.com/aquaproj/aqua/compare/v2.36.2...v2.37.0

##### Features

[#&amp;#8203;3224](https://redirect.github.com/aquaproj/aqua/issues/3224)
Allow to set command aliases in aqua.yaml

You can now define command aliases in aqua.yaml.
This is useful to use multiple versions of the same package.

e.g.

```yaml
registries:
- type: standard
  ref: v4.246.0 # renovate: depName=aquaproj/aqua-registry
packages:
- name: hashicorp/terraform@v1.9.8
- name: hashicorp/terraform
  version: v0.13.7
  command_aliases:
    - command: terraform
      alias: terraform-013

##### no_link: true
```

Then you can run `terraform` (v1.9.8) and `terraform-013` (v0.13.7).

```console
$ terraform version
Terraform v1.9.8
on darwin_arm64

$ terraform-013 version
Terraform v0.13.7

Your version of Terraform is out of date! The latest version
is 1.9.8. You can update by downloading from https://www.terraform.io/downloads.html
```

You can skip creating symbolic links for aliases by `no_link: true`

```yaml
  command_aliases:
    - command: terraform
      alias: terraform-013
      no_link: true
```

You can still run aliases via `aqua exec`.

```sh
aqua exec -- terraform-013 version
```

###
[`v2.36.2`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.36.2)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.36.1...v2.36.2)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.36.2)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.36.2)
| https://github.com/aquaproj/aqua/compare/v2.36.1...v2.36.2

##### Bug Fixes

[#&amp;#8203;3193](https://redirect.github.com/aquaproj/aqua/issues/3193)
[#&amp;#8203;3194](https://redirect.github.com/aquaproj/aqua/issues/3194)
Fix a bug that `vars` are not replaced in `files[].src`

###
[`v2.36.1`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.36.1)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.36.0...v2.36.1)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.36.1)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.36.1)
| https://github.com/aquaproj/aqua/compare/v2.36.0...v2.36.1

#### Fixes

[#&amp;#8203;3146](https://redirect.github.com/aquaproj/aqua/issues/3146)
generate-registry: Remove `rosetta2` and `windows_arm_emulation` if
`{{.Arch}}` isn't included in `asset`

#### Dependency updates

[#&amp;#8203;3148](https://redirect.github.com/aquaproj/aqua/issues/3148)
Update aqua-proxy to 1.2.8
[#&amp;#8203;3149](https://redirect.github.com/aquaproj/aqua/issues/3149)
Update Go to 1.23.2

###
[`v2.36.0`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.36.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.35.0...v2.36.0)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.36.0)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.36.0)
| https://github.com/aquaproj/aqua/compare/v2.35.0...v2.36.0

##### Features

[#&amp;#8203;3130](https://redirect.github.com/aquaproj/aqua/issues/3130)
[#&amp;#8203;3134](https://redirect.github.com/aquaproj/aqua/issues/3134)
support changing $0 by symlink

Some tools change their behavior by `$0`.

For example, `granted` changes the behavior based on `args[0]`.


https://github.com/common-fate/granted/blob/e8de3ec7d62d543062d8be802b27abb3d8fac429/cmd/granted/main.go#L37-L44

```go
	// Use a single binary to keep keychain ACLs simple, swapping behavior via argv[0]
	var app *cli.App
	switch filepath.Base(os.Args[0]) {
	case "assumego", "assumego.exe", "dassumego", "dassumego.exe":
		app = assume.GetCliApp()
	default:
		app = granted.GetCliApp()
	}
```

This release supports changing $0 by symlink.

```yaml
        files:
          - name: granted
          - name: assumego
            src: granted
            link: assumego # link is the relative path from src to the symlink
```

##### Bug Fixes

[#&amp;#8203;3136](https://redirect.github.com/aquaproj/aqua/issues/3136)
[#&amp;#8203;3137](https://redirect.github.com/aquaproj/aqua/issues/3137)
remove: Handle panic error when package is not found
[@&amp;#8203;Shion1305](https://redirect.github.com/Shion1305)
[#&amp;#8203;3138](https://redirect.github.com/aquaproj/aqua/issues/3138)
remove: Ignore not found commands

###
[`v2.35.0`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.35.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.34.0...v2.35.0)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.35.0)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.35.0)
| https://github.com/aquaproj/aqua/compare/v2.34.0...v2.35.0

##### Features

[#&amp;#8203;3119](https://redirect.github.com/aquaproj/aqua/issues/3119)
[#&amp;#8203;3131](https://redirect.github.com/aquaproj/aqua/issues/3131)
Verify packages' GitHub Artifact Attestations

When aqua installs packages, it verifies their GitHub Artifact
Attestations if they are provided and registries have settings for
GitHub Artifact Attestations.

[#&amp;#8203;3117](https://redirect.github.com/aquaproj/aqua/issues/3117)
Create GitHub Artifact Attestations of aqua

We start providing aqua's GitHub Artifact Attestations!

https://github.com/aquaproj/aqua/attestations

If you download aqua from GitHub Releases, you can verify GitHub
Artifact Attestations using GitHub CLI.


https://aquaproj.github.io/docs/install#verify-downloaded-binaries-from-github-releases

Reference:

-
https://aquaproj.github.io/docs/reference/security/github-artifact-attestations
-
https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds

##### Fixes

[#&amp;#8203;3129](https://redirect.github.com/aquaproj/aqua/issues/3129)
Redirect stdout of some commands to stderr

aqua executes some os commands to install packages.

-   go install
-   go build
-   cargo
-   cosign
-   slsa-verifier
-   minisign
-   gh attestation verify

aqua should redirect the stdout of these commands to stderr.

###
[`v2.34.0`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.34.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.33.0...v2.34.0)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.34.0)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.34.0)
| https://github.com/aquaproj/aqua/compare/v2.33.0...v2.34.0

##### Features

[#&amp;#8203;3103](https://redirect.github.com/aquaproj/aqua/issues/3103)
Enabling you to verify checksum files using Minisign

You can now verify checksum files using Minisign.

e.g.

```yaml
        checksum:
          type: github_release
          asset: sha256.txt
          algorithm: sha256
          minisign:
            type: github_release
            asset: sha256.txt.minisig
            public_key: RWQ/i9xseZwBVE7pEniCNjlNOeeyp4BQgdZDLQcAohxEAH5Uj5DEKjv6
```

###
[`v2.33.0`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.33.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.32.0...v2.33.0)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.33.0)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.33.0)
| https://github.com/aquaproj/aqua/compare/v2.32.0...v2.33.0

##### Features

[#&amp;#8203;3101](https://redirect.github.com/aquaproj/aqua/issues/3101)
Enable you to remove `go_install` and `http` packages

You can now uninstall  `go_install` and `http` packages!
Furthermore, the uninstall can now handles version_overrides properly.

###
[`v2.32.0`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.32.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.31.0...v2.32.0)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.32.0)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.32.0)
| https://github.com/aquaproj/aqua/compare/v2.31.0...v2.32.0

##### Features

[#&amp;#8203;3075](https://redirect.github.com/aquaproj/aqua/issues/3075)
[#&amp;#8203;3094](https://redirect.github.com/aquaproj/aqua/issues/3094)
Support removing links from the `bin` directory

By default, `aqua remove` command removes only packages from the `pkgs`
directory and doesn't remove links from the `bin` directory.
This release has added the command line option `-mode` to the remove
command.
The value of `-mode` is a string containing characters `l` and `p`.
The order of the characters doesn't matter.

```sh
aqua rm -m l cli/cli # Remove only links
aqua rm -m pl cli/cli # Remove links and packages
```

You can also configure the mode by the environment variable
`AQUA_REMOVE_MODE`, so you can change the default behaviour of `aqua
remove` command by setting `AQUA_REMOVE_MODE` in your shell setting such
as `.bashrc`.

```sh
export AQUA_REMOVE_MODE=pl
```

###
[`v2.31.0`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.31.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua/compare/v2.30.0...v2.31.0)

[Pull
Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.31.0)
|
[Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.31.0)
| https://github.com/aquaproj/aqua/compare/v2.30.0...v2.31.0

##### Overview

##### Featuers

[#&amp;#8203;2978](https://redirect.github.com/aquaproj/aqua/issues/2978)
[#&amp;#8203;2994](https://redirect.github.com/aquaproj/aqua/issues/2994)
Support verifying packages with minisign
[#&amp;#8203;3052](https://redirect.github.com/aquaproj/aqua/issues/3052)
Support passing variables

##### Fixes

[#&amp;#8203;3012](https://redirect.github.com/aquaproj/aqua/issues/3012)
Fix typo `temporal`. Replace them with `temporary`
[#&amp;#8203;3017](https://redirect.github.com/aquaproj/aqua/issues/3017)
[#&amp;#8203;3024](https://redirect.github.com/aquaproj/aqua/issues/3024)
Stop using `replace` directive

##### Others

Update Go 1.22.5 to 1.22.6

##### Feature - Support verifying packages with minisign

[#&amp;#8203;2978](https://redirect.github.com/aquaproj/aqua/issues/2978)
[#&amp;#8203;2994](https://redirect.github.com/aquaproj/aqua/issues/2994)

Support verifying packages with
[minisign](https://redirect.github.com/jedisct1/minisign).

##### Why is the feature needed?

To install some packages securely.
For example, [zig](https://ziglang.org/download/) is signed by minisign.

##### Example Code

This feature is similar to Cosign and slsa-verifier.

https://aquaproj.github.io/docs/reference/registry-config/cosign/

This feature depends on minisign.
So aqua should install minisign transparently same as Cosign and
slsa-verifier.

registry.yaml

```yaml
minisign:
  enabled: true
  public_key: "RWSGOq2NVecA2UPNdBUZykf1CCb147pkmdtYxgb3Ti+JO/wCYvhbAb/U"

##### public_key_url: https://example/signature.pub
```

##### Feature - Support passing variables

[#&amp;#8203;3052](https://redirect.github.com/aquaproj/aqua/issues/3052)

Add the optional field `vars` in aqua.yaml and Registry.

##### `vars` in Registry

e.g.

```yaml
packages:
  - type: github_release
    repo_owner: indygreg
    repo_name: python-build-standalone
    asset: cpython-{{.Vars.python_version}}+{{.Version}}-{{.Arch}}-{{.OS}}-install_only.{{.Format}} # .Vars.python_version
    vars:
      - name: python_version
        required: true

##### ...
```

`vars` is a list of variables.
Fields of a variable

-   name: string (Required): A variable name
- required: boolean (Optional): If true, the variable is required. To
use the package, users need to set the variable in aqua.yaml
-   default: any (Optional): The default value of the variable

Variables are passed to template strings as `.Vars.&lt;template name&gt;`.

e.g.

asset:
cpython-{{.Vars.python_version}}+{{.Version}}-{{.Arch}}-{{.OS}}-install_only.{{.Format}}

##### `vars` in aqua.yaml

e.g.

```yaml
packages:
  - name: indygreg/python-build-standalone@20240726
    vars:
      python_version: 3.11.9
```

`vars` is a map of variables.
The key is a variable name and the value is a variable value.

&lt;/details&gt;

&lt;details&gt;
&lt;summary&gt;aquaproj/aqua-installer (aquaproj/aqua-installer)&lt;/summary&gt;

###
[`v3.1.0`](https://redirect.github.com/aquaproj/aqua-installer/releases/tag/v3.1.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua-installer/compare/v3.0.2...v3.1.0)

#### SHA256 checksum

62fecc49c98bdec0bba1ff1e5c2719f116e235769e0998090a7397473ef631e9
aqua-installer

#### Features


[#&amp;#8203;709](https://redirect.github.com/aquaproj/aqua-installer/issues/709)
action: Add an input `skip_install_aqua`

If this true and aqua is already installed, installing aqua is skipped.
This input is useful when you want to ensure aqua is installed.

#### Fixes


[#&amp;#8203;708](https://redirect.github.com/aquaproj/aqua-installer/issues/708)
action: stop adding `bat` to $PATH on Windows

###
[`v3.0.2`](https://redirect.github.com/aquaproj/aqua-installer/releases/tag/v3.0.2)

[Compare
Source](https://redirect.github.com/aquaproj/aqua-installer/compare/v3.0.1...v3.0.2)

##### SHA256 checksum

62fecc49c98bdec0bba1ff1e5c2719f116e235769e0998090a7397473ef631e9
aqua-installer

##### Bug Fixes


[#&amp;#8203;703](https://redirect.github.com/aquaproj/aqua-installer/issues/703)
Fix the feature of the input `enable_aqua_install`.

1.  Update $PATH even if `enable_aqua_install` is false
2.  Stop running `aqua i` if `enable_aqua_install` isn't true

##### Others


[#&amp;#8203;704](https://redirect.github.com/aquaproj/aqua-installer/issues/704)
Update the bootstrap aqua version to v2.37.2

[#&amp;#8203;666](https://redirect.github.com/aquaproj/aqua-installer/issues/666)
refactor: Use `$GITHUB_ACTION_PATH`

We ever stopped using `${{ github.action_path }}` and copied
aqua-installer in action.yaml due to the bug of GitHub Actions.
[https://github.com/aquaproj/aqua-installer/pull/463](https://redirect.github.com/aquaproj/aqua-installer/pull/463)
But we noticed that `$GITHUB_ACTION_PATH` worked well in containers as
well, so we use it instead of coping aqua-installer in action.yaml.

&lt;/details&gt;

&lt;details&gt;
&lt;summary&gt;aquaproj/aqua-registry (aquaproj/aqua-registry)&lt;/summary&gt;

###
[`v4.296.0`](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.296.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua-registry/compare/v4.295.1...v4.296.0)


[Issues](https://redirect.github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.296.0)
| [Pull
Requests](https://redirect.github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.296.0)
| https://github.com/aquaproj/aqua-registry/compare/v4.295.1...v4.296.0

#### 🎉 New Packages


[#&amp;#8203;30887](https://redirect.github.com/aquaproj/aqua-registry/issues/30887)
[justjanne/powerline-go](https://redirect.github.com/justjanne/powerline-go):
Beautiful and useful low-latency prompt for your shell, written in go
[@&amp;#8203;scop](https://redirect.github.com/scop)

[#&amp;#8203;30904](https://redirect.github.com/aquaproj/aqua-registry/issues/30904)
[suzuki-shunsuke/deny-self-approve](https://redirect.github.com/suzuki-shunsuke/deny-self-approve):
CLI to deny self-approved GitHub Pull Requests

#### Fixes


[#&amp;#8203;30814](https://redirect.github.com/aquaproj/aqua-registry/issues/30814)
ycd/dstp: Re-scaffold

###
[`v4.295.1`](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.295.1)

[Compare
Source](https://redirect.github.com/aquaproj/aqua-registry/compare/v4.295.0...v4.295.1)


[Issues](https://redirect.github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.295.1)
| [Pull
Requests](https://redirect.github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.295.1)
| https://github.com/aquaproj/aqua-registry/compare/v4.295.0...v4.295.1

##### Fixes


[#&amp;#8203;30794](https://redirect.github.com/aquaproj/aqua-registry/issues/30794)
sharkdp/bat: Re-scaffold sharkdp/bat
[@&amp;#8203;yudai-nkt](https://redirect.github.com/yudai-nkt)

[#&amp;#8203;30801](https://redirect.github.com/aquaproj/aqua-registry/issues/30801)
sharkdp/bat: Drop the support of old versions using cargo

###
[`v4.295.0`](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.295.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua-registry/compare/v4.294.1...v4.295.0)


[Issues](https://redirect.github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.295.0)
| [Pull
Requests](https://redirect.github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.295.0)
| https://github.com/aquaproj/aqua-registry/compare/v4.294.1...v4.295.0

##### 🎉 New Packages


[#&amp;#8203;30715](https://redirect.github.com/aquaproj/aqua-registry/issues/30715)
[kcl-lang/cli](https://redirect.github.com/kcl-lang/cli) - The KCL
Command Line Interface (CLI)
[@&amp;#8203;SanderKnape](https://redirect.github.com/SanderKnape)

[#&amp;#8203;30712](https://redirect.github.com/aquaproj/aqua-registry/issues/30712)
[kcl-lang/kcl](https://redirect.github.com/kcl-lang/kcl) - KCL
Programming Language (CNCF Sandbox Project). https://kcl-lang.io
[@&amp;#8203;SanderKnape](https://redirect.github.com/SanderKnape)

##### Fixes


[#&amp;#8203;30791](https://redirect.github.com/aquaproj/aqua-registry/issues/30791)
imsnif/bandwhich: Re-scaffold to support linux/arm64

###
[`v4.294.1`](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.294.1)

[Compare
Source](https://redirect.github.com/aquaproj/aqua-registry/compare/v4.294.0...v4.294.1)


[Issues](https://redirect.github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.294.1)
| [Pull
Requests](https://redirect.github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.294.1)
| https://github.com/aquaproj/aqua-registry/compare/v4.294.0...v4.294.1

##### Fixes


[#&amp;#8203;30789](https://redirect.github.com/aquaproj/aqua-registry/issues/30789)
bridgecrewio/checkov: Re-scafold the setting

[#&amp;#8203;30786](https://redirect.github.com/aquaproj/aqua-registry/issues/30786)
magodo/pipeform: Change the package type to github_release

[#&amp;#8203;30781](https://redirect.github.com/aquaproj/aqua-registry/issues/30781)
gradle/gradle-distributions: Support milestone versions
[@&amp;#8203;risu729](https://redirect.github.com/risu729)

###
[`v4.294.0`](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.294.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua-registry/compare/v4.293.0...v4.294.0)


[Issues](https://redirect.github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.294.0)
| [Pull
Requests](https://redirect.github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.294.0)
| https://github.com/aquaproj/aqua-registry/compare/v4.293.0...v4.294.0

##### 🎉 New Packages


[#&amp;#8203;30603](https://redirect.github.com/aquaproj/aqua-registry/issues/30603)
[apache/spark](https://redirect.github.com/apache/spark): Apache Spark -
A unified analytics engine for large-scale data processing

[#&amp;#8203;30736](https://redirect.github.com/aquaproj/aqua-registry/issues/30736)
[magodo/pipeform](https://redirect.github.com/magodo/pipeform):
Terraform runtime TUI

&gt; \[!WARNING]
&gt; pipeform has some requirements:
&gt;
https://github.com/magodo/pipeform/blob/91dbcabf38da01e1b59856e00cfa6068200c7237/README.md?plain=1#L48
&gt;
&gt; &gt; Note that the clipboard functionality is only enabled when the tool
is built properly (CGO might be required) on a supported platform.
[Details](https://redirect.github.com/golang-design/clipboard?tab=readme-ov-file#platform-specific-details).
&gt; &gt;
&gt; &gt; -   macOS: require Cgo, no dependency
&gt; &gt; - Linux: require X11 dev package. For instance, install libx11-dev
or xorg-dev or libX11-devel to access X window system.
&gt; &gt; -   Windows: no Cgo, no dependency

##### Fixes


[#&amp;#8203;30735](https://redirect.github.com/aquaproj/aqua-registry/issues/30735)
editorconfig-checker/editorconfig-checker: Re-scaffold the setting

[#&amp;#8203;30751](https://redirect.github.com/aquaproj/aqua-registry/issues/30751)
typst/typst: Re-scaffold the setting. Support linux/arm64

###
[`v4.293.0`](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.293.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua-registry/compare/v4.292.0...v4.293.0)


[Issues](https://redirect.github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.293.0)
| [Pull
Requests](https://redirect.github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.293.0)
| https://github.com/aquaproj/aqua-registry/compare/v4.292.0...v4.293.0

#### 🎉 New Packages


[#&amp;#8203;30662](https://redirect.github.com/aquaproj/aqua-registry/issues/30662)
[pinterest/ktlint](https://redirect.github.com/pinterest/ktlint): An
anti-bikeshedding Kotlin linter with built-in formatter
[@&amp;#8203;itochan](https://redirect.github.com/itochan)

#### Fixes


[#&amp;#8203;30690](https://redirect.github.com/aquaproj/aqua-registry/issues/30690)
sharkdp/fd: Re-scaffold

[#&amp;#8203;30627](https://redirect.github.com/aquaproj/aqua-registry/issues/30627)
ariga/atlas: Drop the support of old versions


[https://github.com/ariga/atlas/issues/3296#issuecomment-2574924728](https://redirect.github.com/ariga/atlas/issues/3296#issuecomment-2574924728)

&gt; Old Versions of Atlas
&gt; As part of our Supported Version Policy mentioned above, binaries for
versions that were published more than 6 months ago will be removed from
the CDN and Docker Hub.

###
[`v4.292.0`](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.292.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua-registry/compare/v4.291.0...v4.292.0)


[Issues](https://redirect.github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.292.0)
| [Pull
Requests](https://redirect.github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.292.0)
| https://github.com/aquaproj/aqua-registry/compare/v4.291.0...v4.292.0

##### 🎉 New Packages


[#&amp;#8203;30540](https://redirect.github.com/aquaproj/aqua-registry/issues/30540)
[PowerShell/PowerShell](https://redirect.github.com/PowerShell/PowerShell):
PowerShell for every system

##### Fixes


[#&amp;#8203;30586](https://redirect.github.com/aquaproj/aqua-registry/issues/30586)
Dreamacro/clash: Remove the package

GitHub Repository isn't found

###
[`v4.291.0`](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.291.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua-registry/compare/v4.290.0...v4.291.0)


[Issues](https://redirect.github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.291.0)
| [Pull
Requests](https://redirect.github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.291.0)
| https://github.com/aquaproj/aqua-registry/compare/v4.290.0...v4.291.0

##### 🎉 New Packages


[#&amp;#8203;30569](https://redirect.github.com/aquaproj/aqua-registry/issues/30569)
[jorgerojas26/lazysql](https://redirect.github.com/jorgerojas26/lazysql):
A cross-platform TUI database management tool written in Go
[@&amp;#8203;wancup](https://redirect.github.com/wancup)

###
[`v4.290.0`](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.290.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua-registry/compare/v4.289.0...v4.290.0)


[Issues](https://redirect.github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.290.0)
| [Pull
Requests](https://redirect.github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.290.0)
| https://github.com/aquaproj/aqua-registry/compare/v4.289.0...v4.290.0

#### 🎉 New Packages


[#&amp;#8203;30556](https://redirect.github.com/aquaproj/aqua-registry/issues/30556)
[Automattic/harper/harper-cli](https://redirect.github.com/Automattic/harper):
The Grammar Checker for Developers

#### Fixes


[#&amp;#8203;30535](https://redirect.github.com/aquaproj/aqua-registry/issues/30535)
koalaman/shellcheck: Re-scaffold the setting
[@&amp;#8203;yudai-nkt](https://redirect.github.com/yudai-nkt)

###
[`v4.289.0`](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.289.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua-registry/compare/v4.288.0...v4.289.0)


[Issues](https://redirect.github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.289.0)
| [Pull
Requests](https://redirect.github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.289.0)
| https://github.com/aquaproj/aqua-registry/compare/v4.288.0...v4.289.0

#### 🎉 New Packages


[#&amp;#8203;30518](https://redirect.github.com/aquaproj/aqua-registry/issues/30518)
[dskkato/rjo](https://redirect.github.com/dskkato/rjo): A small utility
to create JSON objects, written in Rust
[@&amp;#8203;jihchi](https://redirect.github.com/jihchi)

###
[`v4.288.0`](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.288.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua-registry/compare/v4.287.0...v4.288.0)


[Issues](https://redirect.github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.288.0)
| [Pull
Requests](https://redirect.github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.288.0)
| https://github.com/aquaproj/aqua-registry/compare/v4.287.0...v4.288.0

#### 🎉 New Packages


[#&amp;#8203;30465](https://redirect.github.com/aquaproj/aqua-registry/issues/30465)
[fujiwara/apprun-cli](https://redirect.github.com/fujiwara/apprun-cli):
apprun-cli is a command line interface for AppRun β Sakura Cloud
[@&amp;#8203;ponkio-o](https://redirect.github.com/ponkio-o)

[#&amp;#8203;30464](https://redirect.github.com/aquaproj/aqua-registry/issues/30464)
[samwho/spacer](https://redirect.github.com/samwho/spacer) - CLI tool to
insert spacers when command output stops
[@&amp;#8203;ryoppippi](https://redirect.github.com/ryoppippi)

#### Fixes


[#&amp;#8203;30442](https://redirect.github.com/aquaproj/aqua-registry/issues/30442)
Canop/rhit: Support windows and darwin by cargo

[aqua &gt;= v2.41.0 is
required](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.41.0)

###
[`v4.287.0`](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.287.0)

[Compare
Source](https://redirect.github.com/aquaproj/aqua-registry/compare/v4.286.0...v4.287.0)


[Issues](https://redirect.github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.287.0)
| [Pull
Requests](https://redirect.github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.287.0)
| https://github.com/aquaproj/aqua-registry/compare/v4.286.0...v4.287.0

##### 🎉 New Packages


[#&amp;#8203;30439](https://redirect.github.com/aquaproj/aqua-registry/issues/30439)
[Canop/rhit](https://redirect.github.com/Canop/rhit): A nginx log
explorer [@&amp;#8203;tmeijn](https://redirect.github.com/tmeijn)

[#&amp;#8203;30441](https://redirect.github.com/aquaproj/aqua-registry/issues/30441)
[Lifailon/lazyjournal](https://redirect.github.com/Lifailon/lazyjournal):
TUI for journalctl, file system logs, as well Docker and Podman
containers for quick viewing and filtering with fuzzy find, regex
support (like fzf and grep) and coloring the output, written in Go with
the gocui library [@&amp;#8203;tmeijn](https://redirect.github.com/tmeijn)

[#&amp;#8203;30440](https://redirect.github.com/aquaproj/aqua-registry/issues/30440)
[robinovitch61/kl](https://redirect.github.com/robinovitch61/kl): An
interactive Kubernetes log viewer for your terminal
[@&amp;#8203;tmeijn](https://redirect.github.com/tmeijn)

### [`v4.286.0`](https://redirect.

&lt;/details&gt;

---

### Configuration

📅 **Schedule**: Branch creation - "after 10pm on monday,before 3am on
monday" in timezone America/Chicago, Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/DelineaXPM/github-workflows).

&lt;!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xMDcuMCIsInVwZGF0ZWRJblZlciI6IjM5LjEwNy4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--&gt;

Co-authored-by: renovate[bot] &lt;29139614+renovate[bot]@users.noreply.github.com&gt;
Co-authored-by: sheldonhull &lt;sheldonhull@users.noreply.github.com&gt;
diff --git a/.aqua/aqua.yaml b/.aqua/aqua.yaml
@@ -3,27 +3,27 @@
 # https://aquaproj.github.io/
 registries:
   - type: standard
-    ref: v4.205.0 # renovate: depName=aquaproj/aqua-registry
+    ref: v4.296.0 # renovate: depName=aquaproj/aqua-registry
 packages:
-  - name: miniscruff/changie@v1.19.1
+  - name: miniscruff/changie@v1.21.0
     tags:
       - release
-  - name: golang/go@go1.22.5
-  - name: direnv/direnv@v2.34.0
+  - name: golang/go@go1.23.5
+  - name: direnv/direnv@v2.35.0
   - name: magefile/mage@v1.15.0
   - name: charmbracelet/glow@v2.0.0
-  - name: goreleaser/goreleaser@v2.1.0
-  - name: mvdan/gofumpt@v0.6.0
-  - name: anchore/syft@v1.12.2
-  - name: golangci/golangci-lint@v1.59.1
+  - name: goreleaser/goreleaser@v2.5.1
+  - name: mvdan/gofumpt@v0.7.0
+  - name: anchore/syft@v1.18.1
+  - name: golangci/golangci-lint@v1.63.4
     tags: ['lint']
   - name: git-town/git-town@v17.2.0
   - name: DelineaXPM/dsv-cli@v1.41.1
-  - name: cli/cli@v2.53.0
+  - name: cli/cli@v2.65.0
     tags: ['foo', release]
-  - name: mikefarah/yq@v4.44.3
+  - name: mikefarah/yq@v4.45.1
     tags:
       - release
-  - name: miniscruff/changie@v1.19.1
+  - name: miniscruff/changie@v1.21.0
     tags:
       - release
diff --git a/.github/workflows/changie-trigger-release.yml b/.github/workflows/changie-trigger-release.yml
@@ -45,10 +45,10 @@ jobs:
               echo "Branch exists. Skipping workflow."
               echo "BRANCH_ALREADY_EXISTS=true" >> "$GITHUB_OUTPUT"
           fi
-      - uses: aquaproj/aqua-installer@6ce1f8848ec8e61f14d57bd5d7597057a6dd187c # v3.0.1
+      - uses: aquaproj/aqua-installer@f13c5d2f0357708d85477aabe50fd3f725528745 # v3.1.0
         if: steps.check_branch.outputs.BRANCH_ALREADY_EXISTS == 'false'
         with:
-          aqua_version: v2.30.0
+          aqua_version: v2.42.2
           aqua_opts: '--only-link' # lazy install so we can start this way
           policy_allow: true
         env:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -31,10 +31,10 @@ jobs:
           else
             echo "👉 No aqua-policy.yaml file found, skipping setting AQUA_POLICY_CONFIG"
           fi
-      - uses: aquaproj/aqua-installer@6ce1f8848ec8e61f14d57bd5d7597057a6dd187c # v3.0.1
+      - uses: aquaproj/aqua-installer@f13c5d2f0357708d85477aabe50fd3f725528745 # v3.1.0
         continue-on-error: true
         with:
-          aqua_version: v2.30.0
+          aqua_version: v2.42.2
           enable_aqua_install: true
           aqua_opts: '--tags lint' # if using aqua.yaml config any special items in your repo like Golangci-lint using tags so it only installs what's needed
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -28,9 +28,9 @@ jobs:
           else
             echo "👉 No aqua-policy.yaml file found, skipping setting AQUA_POLICY_CONFIG"
           fi
-      - uses: aquaproj/aqua-installer@6ce1f8848ec8e61f14d57bd5d7597057a6dd187c # v3.0.1
+      - uses: aquaproj/aqua-installer@f13c5d2f0357708d85477aabe50fd3f725528745 # v3.1.0
         with:
-          aqua_version: v2.30.0
+          aqua_version: v2.42.2
           # working_directory:
           aqua_opts: '--tags release'
         env:
diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
@@ -29,9 +29,9 @@ jobs:
           else
             echo "👉 No aqua-policy.yaml file found, skipping setting AQUA_POLICY_CONFIG"
           fi
-      - uses: aquaproj/aqua-installer@6ce1f8848ec8e61f14d57bd5d7597057a6dd187c # v3.0.1
+      - uses: aquaproj/aqua-installer@f13c5d2f0357708d85477aabe50fd3f725528745 # v3.1.0
         with:
-          aqua_version: v2.30.0
+          aqua_version: v2.42.2
           enable_aqua_install: true
           aqua_opts: '--tags scan'
         env:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -41,9 +41,9 @@ jobs:
           else
             echo "👉 No aqua-policy.yaml file found, skipping setting AQUA_POLICY_CONFIG"
           fi
-      - uses: aquaproj/aqua-installer@6ce1f8848ec8e61f14d57bd5d7597057a6dd187c # v3.0.1
+      - uses: aquaproj/aqua-installer@f13c5d2f0357708d85477aabe50fd3f725528745 # v3.1.0
         with:
-          aqua_version: v2.30.0
+          aqua_version: v2.42.2
           enable_aqua_install: true
           aqua_opts: '--tags test'
         env:
