Update go modules (release-v0.6) (minor)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
cuelang.org/go	v0.11.1 → v0.16.0					require	minor
github.com/cyberphone/json-canonicalization	ba74d44 → 19d51d7					require	digest
github.com/daixiang0/gci	v0.13.5 → v0.14.0					require	minor
github.com/go-git/go-billy/v5	v5.6.2 → v5.8.0					require	minor
github.com/go-git/go-git/v5	v5.16.5 → v5.17.0					require	minor
github.com/go-openapi/strfmt	v0.23.0 → v0.25.0					require	minor
github.com/golangci/golangci-lint	v1.63.4 → v1.64.8					require	minor
github.com/google/addlicense	v1.1.1 → v1.2.0					require	minor
github.com/google/go-containerregistry	v0.20.2 → v0.21.2					require	minor
github.com/in-toto/in-toto-golang	v0.9.0 → v0.10.0					require	minor
github.com/in-toto/in-toto-golang	v0.9.1-0.20240317085821-8e2966059a09 → v0.10.0					require	minor
github.com/konflux-ci/application-api	e7eb2ec → 5400350					require	digest
github.com/open-policy-agent/conftest	v0.55.0 → v0.66.0					require	minor
github.com/pkg/diff	20ebb0f → 4e6772a					require	digest
github.com/secure-systems-lab/go-securesystemslib	v0.9.0 → v0.10.0					require	minor
github.com/sigstore/cosign/v2	v2.4.1 → v2.6.2					require	minor
github.com/sigstore/rekor	v1.3.6 → v1.5.0					require	minor
github.com/sigstore/sigstore	v1.8.15 → v1.10.4					require	minor
github.com/spf13/afero	v1.11.0 → v1.15.0					require	minor
github.com/spf13/cobra	v1.9.1 → v1.10.2					require	minor
github.com/spf13/viper	v1.19.0 → v1.21.0					require	minor
github.com/tektoncd/chains	v0.22.2 → v0.26.2					require	minor
github.com/tektoncd/cli	v0.38.0 → v0.44.0					require	minor
github.com/testcontainers/testcontainers-go	v0.34.0 → v0.40.0					require	minor
github.com/wiremock/go-wiremock	v1.11.0 → v1.15.0					require	minor
golang.org/x/exp	2d47ceb → 3dfff04					require	digest
golang.org/x/net	v0.47.0 → v0.51.0					require	minor
golang.org/x/sync	v0.18.0 → v0.19.0					require	minor
helm.sh/helm/v3	v3.16.4 → v3.20.0					require	minor
k8s.io/api	v0.34.2 → v0.35.2					require	minor
k8s.io/apiextensions-apiserver	v0.34.2 → v0.35.2					require	minor
k8s.io/apimachinery	v0.34.2 → v0.35.2					require	minor
k8s.io/client-go	v0.34.2 → v0.35.2					require	minor
k8s.io/kube-openapi	f3f2b99 → a19766b					require	digest
k8s.io/kubernetes	v1.34.2 → v1.35.2					require	minor
oras.land/oras-go/v2	v2.5.0 → v2.6.0					require	minor
sigs.k8s.io/kind	v0.26.0 → v0.31.0					require	minor
sigs.k8s.io/kustomize/api	v0.20.1 → v0.21.1					require	minor
sigs.k8s.io/kustomize/kustomize/v5	v5.7.1 → v5.8.1					require	minor
sigs.k8s.io/kustomize/kyaml	v0.20.1 → v0.21.1					require	minor

---

Release Notes

cue-lang/cue (cuelang.org/go)

v0.16.0

Compare Source

Changes which may break some users are marked below with: ⚠️

Language

As a reminder, we have two ongoing language experiments since v0.15; a replacement for struct embedding and a rework of aliases. Please give these a try and report any issues or feedback!

⚠️ The cmdreferencepkg global experiment is now stable, meaning that CUE_EXPERIMENT=cmdreferencepkg is always enabled.

#"""# is now accepted as a string literal quoting a double quote, ".

Multiline string literals now require a trailing newline, matching the language spec.

The new try experiment

This release introduces the try experiment, which adds a try clause in comprehensions as well as the use of ? in field selectors. This addition to the language is intended to provide a more concise syntax for handling optional fields without the risk of unintentionally swallowing errors.

This experiment also introduces the else clause for if and try comprehensions, and the fallback clause for for comprehensions, which trigger when a comprehension produces zero values.

You can try this experiment by following our how-to guides on the try clause and the else clause. For more information, see the proposal on GitHub and the spec change patch.

Evaluator

Performance

Further improve the use of caching in the typochecker algorithm; this provides speed-ups of up to 80% on some large projects.

Very large structs (tested with 20,000 fields) are up to 80% faster now, as we were repeating some work unnecessarily.

A great deal of effort has gone into reducing the allocations and memory usage across a number of projects. For some of these, memory usage is down by as much as 60%.

These improvements were possible thanks to our Unity service, letting us analyze CUE's performance and test for regressions on third party projects. Contact @​mvdan on Discord, Slack, or via the Unity page to ensure that your project is included or you are running into slowness.

A number of changes were made to improve support for using cue.Values concurrently; see Issue #​2733 for more details and ongoing progress.

Other changes

Fix a regression introduced in v0.13 where the or built-in with literal arguments could stop behaving like a disjunction.

A number of panics and other bugs in the evaluator which were reported since v0.15.0 have been fixed; thank you to all who reported these.

cmd/cue

Add support for $DOCKER_AUTH_CONFIG to directly provide the contents of $DOCKER_CONFIG/config.json to authenticate with module registries, matching Docker's current behavior.

The --outfile flag now works when given non-regular files such as named pipes or sockets.

⚠️ cue mod publish no longer ignores sub-directories containing a go.mod file.

⚠️ Using cue inside the cue.mod directory now fails consistently with a clear error message to not place CUE code there. Previously, some commands worked while others failed with confusing errors.

⚠️ The global --verbose and --trace flags have been moved to the cue get go and cue trim commands respectively, as they were the only ones actually using those flags, and this could be confusing to users.

Fix a bug where loading ./...:pkgname could lead to loading directories without CUE files as instances, which could cause poor performance for CUE packages with multiple parent directories.

cue exp writefs gains an encoding optional field for regular files, to specify an encoding rather than infer it from the filename extension.

LSP server

Initial LSP support for editing embedded JSON and YAML files. This feature provides completions and hover-docs when editing JSON or YAML files which are embedded into CUE via the @embed attribute. A teaser video is available on YouTube.

Code Actions: two code actions are now provided, Add surrounding struct braces and Remove surrounding struct braces, which convert between

a: b: c

and

a: {
	b: c
}

with the cursor on b.

A complete overhaul of how the LSP server suggests code completions. This solves the previous naïve implementation which would only make suggestions after a field name or path had been started. Now completions are available from within whitespace.

Embedded paths with mutual dependencies: embedded paths with multiple components (e.g. a.b.c) can in some cases only be fully resolved after the resolution of other embedded paths. The LSP server can now correctly handle these dependencies.

The LSP server now implements LSP Document Symbols functionality. This is often used by editors to provide light-weight breadcrumb navigation within a file.

Some preliminary diagnostics are now sent from the LSP server back to the editor. Initially this mainly indicates syntax errors in CUE files, but this can be extended in the future.

Many bug fixes, including better behaviour for files and directories with spaces; improvements for value aliases (foo: L=x); LSP rename now provides placeholder text; improved jump-to-definition behaviour for package-level fields; fixed issues around imports; path resolution; formatting of standalone CUE files; and others.

See our Getting Started wiki page for instructions on how to set it up with your editor.

Please report any bugs or missing features you encounter via the Issue tracker or via the #lsp channels on Discord or Slack.

Encodings

Add support for encoding YAML tags like key: !Custom value by using CUE attributes like key: "value" @​yaml(,tag="!Custom").

cue get go now detects which Go packages use Kubernetes type semantics via // +k8s:openapi-gen=true and obeys the field annotations // +optional and // +nullable.

cue get go gains a --codec flag to configure the use and priority of Go struct field tags like json or yaml.

Fix a bug where cue get go could skip over fields whose type implements one of the supported marshaling interfaces.

Fix a few bugs where cue get go could result in invalid or failing CUE code.

JSON Schema's Config.OpenOnlyWhenExplicit option is now exposed for the CLI via the filetype tag jsonschema+openOnlyWhenExplicit.

JSON Schema now properly encodes hash references for better compatibility with other tools.

Standard library

The strconv package adds ParseNumber, like ParseInt or ParseFloat but allowing other CUE number strings such as 1Ki.

The net package adds InCIDR to test whether an IP is contained by a CIDR string.

The net package adds ParseCIDR to extract useful information from a CIDR string.

The net package adds CompareIP to compare two IP addresses, which can be useful for computing with IP ranges.

The net/http package adds Serve as an experimental API to listen on a port and serve HTTP requests.

The tool/file package adds Symlink to create symbolic links.

Go API

cue.Value.Decode now supports the new cue.Unmarshaler interface, allowing Go types to implement their own CUE value decoding logic via an UnmarshalCUE(cue.Value) error method.

The new cue.IsIncomplete function reports whether the given value is a CUE incomplete error.

cue/ast gains the NewPredeclared and Ident.IsPredeclared to mark and detect identifiers referencing predeclared names like error or int rather than fields which may shadow those names in the current scope.

⚠️ cue.Value.Decode now uses cue.IsIncomplete to not treat incomplete errors as fatal, allowing the decoding to continue.

Fix a bug where cue.Value.Decode could behave incorrectly when decoding a CUE null or incomplete value.

⚠️ cue/token.Compare now sorts absolute paths before relative ones, to ensure consistent behavior between Unix-like systems and Windows.

⚠️ The long-deprecated cue/ast.Node.Comments and cue/ast.Node.AddComment interface methods are now removed; use cue/ast.Comments and cue/ast.AddComment respectively.

⚠️ The long-deprecated and unused cue/parser.FromVersion and cue/parser.DeprecationError APIs are now removed.

⚠️ The long-deprecated and hidden cue.Instance.Eval method is now removed.

Full list of changes since v0.15.0

• internal/ci: use OIDC with the Central Registry for the e2e tests by @​mvdan in de47a5e
• re-enable staticcheck's SA4000 and SA4003 checks by @​mvdan in 771e253
• internal: bump staticcheck to v0.7.0 for Go 1.26 support by @​mvdan in e1de78e
• lsp/eval: correct resolution of package-level fields by @​cuematthew in e3306a9
• lsp/eval: add test showing bad behaviour by @​cuematthew in da5d43a
• lsp/server: make "Remove surrounding struct braces" preferred by @​cuematthew in 5f20a71
• doc/ref: clarify who maintains this document by @​mvdan in 3ee970f
• allow more commands in Claude by @​mvdan in 6d50284
• lspaux/protocol: initial implementation for protocol by @​cuematthew in 3ee106b
• cue/load: check some errors that were ignored by @​rogpeppe in 13fdcdb
• doc/ref: fix three mistakes in the matchIf examples by @​mvdan in 000506e
• cue/load: do not panic when load.Instances(args, nil) fails very early by @​mvdan in cd6a481
• cmd/cue: add a test case for issue 4286 by @​mvdan in edc89df
• lsp/eval: add support for comprehension else/fallback by @​cuematthew in e2d8f7b
• cmd/cue: support explicit encodings in exp writefs by @​mvdan in d0eca3f
• cmd/cue: rewrite exp writefs with internal/filetypes and internal/encoding by @​mvdan in 766668d
• cmd/cue: add first exp writefs testscript by @​mvdan in 00eddbf
• internal/core/adt: missed missing missing by @​mpvl in 8732213
• cue/parser: simplify else/fallback clause rules by @​mpvl in 0cbc9a1
• cue/parser: restrict else to single clause only by @​mpvl in 28f0246
• cue: add fallback keyword for for comprehensions by @​mpvl in fe9f503
• cue/testdata: rename out/eval to out/evalalpha when appropriate by @​rogpeppe in c76dc5a
• cue/build: fix stale identifier resolution across instances by @​mvdan in dd7361a
• cmd/cue: add regression test for issue 4275 by @​mvdan in 791e697
• encoding/yaml: improve ast.StructLit and ListLit positions by @​cuematthew in cde471e
• cmd/cue: be more helpful when publishing a module without source by @​mvdan in 3dfa50a
• encoding/jsonschema: remove net/url.Parse workaround for Go 1.26 by @​mvdan in 6cce9bc
• internal/core/export: fix self-referential lets for recursive definitions by @​mvdan in c257634
• internal/core/compile: avoid double error for invalid optional references by @​mpvl in c1be2bb
• update all dependencies by @​mvdan in 9fb0173
• internal/core/adt: add regression test for error() in pattern constraint keys by @​mvdan in 50a0a5e
• internal/core/adt: fix structural cycle hang with braced selectors by @​mvdan in 36702fd
• cmd/cue: add and unskip tests for invalid task type errors by @​mvdan in db4afc1
• internal/core/dep: fix stack overflow on recursive definitions in dep analysis by @​mvdan in 0b49a54
• internal/core/dep,internal/core/export: fix stack overflow on recursive definitions by @​mvdan in d0e2ab6
• tools/flow: skip phantom tasks from eliminated conditional branches by @​mvdan in 7fb912e
• encoding/gocode: fix test by @​rogpeppe in 98ca6e3
• internal/core: remove import path to instance mapping by @​rogpeppe in b3d9ffc
• doc/spec: use "custom errors" instead of "user errors" by @​myitcv in baf8302
• internal/ci: explicitly set contents permission by @​myitcv in 7cde504
• lsp/eval: Add support for try-clauses and optional path components by @​cuematthew in 62de631
• cue/testdata: update stats for comprehensions/try.txtar by @​mvdan in 20c1149
• internal/core/adt: implement try expressions by @​mpvl in f2e8299
• cue/build: integrate identifier resolution into Complete by @​mpvl in 1aeb33e
• lsp/fscache: ignore ASTs which have no absolute positions by @​cuematthew in 2585b3b
• cue/ast,cue/ast/astutil: add NewPredeclared and IsPredeclared for builtin references by @​mpvl in 8405422
• internal/core/adt: fix else clause duplication in comprehension field splitting by @​mvdan in 40356ab
• cue/load: improve error for major-only version packages outside a module by @​mvdan in 7675369
• cmd/cue/cmd: add test coverage for absolute packages with cue cmd by @​mvdan in f5e266a
• encoding/yaml: add support for YAML tags via @yaml(,tag) attribute by @​jonas-meyer in b1a58bd
• internal/astinternal: omit ILLEGAL tokens in debug print by @​mpvl in 23736eb
• cue: clarify that Schema is only useful for Value.Subsume by @​mvdan in bb18d7b
• lsp/cache: expand completion range of fields in json for double-quotes by @​cuematthew in b1c63da
• all: start using "else" in comprehensions by @​mvdan in 3f2f654
• tweak Claude's allow and deny settings further by @​mvdan in ef6bb80
• internal/ci: disable checkout persist-credentials by default by @​myitcv in 069eac9
• cue/load: do not load non-CUE directories as instances by @​rogpeppe in a4d2a6f
• cue/load: add test case for non-package directories by @​rogpeppe in 028411e
• cmd/cue: deflake cue_after test by @​rogpeppe in 4504db0
• all: use reflect.TypeAssert in three more places by @​mvdan in 58cbd0c
• cue/internal: Make ToFile optionally preserve StructLits by @​cuematthew in ec3e289
• all: re-apply go fix -any=false ./... after Go version bump by @​mvdan in 8579c46
• lsp/cache: completions must not return null items list by @​cuematthew in 75ee97a
• internal/core/export: fix panic in relPathLength for BinaryExpr by @​mvdan in 788eeed
• tools/fix: use ast.Predeclared to avoid shadowing in value alias conversion by @​mvdan in 08a7ec3
• cue/ast,cue/ast/astutil: add Predeclared sentinel for builtin references by @​mvdan in 42cc85f
• tools/fix: add tests for value alias conversion when "self" is in scope by @​mvdan in 3dacb0c
• cue/ast/astutil: fix false positive in label expression check for let clauses by @​mvdan in a93bcc1
• cmd/cue/cmd: add failing test for issue #​4202 by @​mvdan in 0a4a11a
• internal/core/export: avoid let name collisions with dependency fields by @​mvdan in f2b697a
• internal/core/export: add failing test for issue #​4221 by @​mvdan in b690442
• internal/core/adt: fix undefined field in comprehension with structural cycle by @​mvdan in 225a1c4
• cue/testdata: add regression test for issue #​4203 by @​mvdan in e3eb948
• internal/core/adt: fix panic in memory reclamation by @​mvdan in 355d6fd
• internal/core/adt: add else clause to comprehensions by @​mpvl in 9e2dec3
• _scripts: add OpenSpec support for AI-assisted development by @​mpvl in 6a78eff
• lsp/eval: fix field-value aliases by @​cuematthew in 29d8be4
• lsp/eval: add test to show bad behaviour of aliases by @​cuematthew in 3e6bee7
• internal/core/export: fix hidden identifier renaming in for clauses by @​mvdan in 2fea4bc
• internal/core/export: add failing test for issue #​4254 by @​mvdan in c53993e
• cue/errors: avoid duplicate path in error list formatting by @​mvdan in 487c072
• pkg/list/testdata: add regression test for issue #​4171 by @​mvdan in e977cfa
• internal/lsp: implement ConvertFromStruct code action by @​cuematthew in f68f686
• internal/ci: bump actions/checkout and cue.dev/x/githubactions by @​mvdan in f4d1d5a
• lsp/server: force-load all packages for completions within embedded files by @​cuematthew in 5eb5ed9
• pkg/tools/http: remove valueMu mutex from http.Serve by @​mpvl in 95ba1d2
• internal/core/runtime: add lock protection to loaded map by @​mpvl in 6451728
• internal/core/adt: fix race condition in Vertex.Default() by @​mpvl in 854a5b7
• internal/core/adt: use thread-safe WeakMap for regexp caching by @​mpvl in c7797c1
• pkg/tools/http: experimental implementation of http.Serve by @​mpvl in 0badd6d
• golps/protocol: introduce DocumentURI.Path method by @​cuematthew in f04e0fb
• gopls/protocol: rename DocumentURI.Path to DocumentURI.FilePath by @​cuematthew in d8eca4a
• lsp/eval: process field attributes and specialise queries for embeds by @​cuematthew in eb192c6
• internal/lsp: model embedded files as packages by @​cuematthew in fa8946f
• lsp/fscache: read json and yaml files as CUE by @​cuematthew in 6825394
• lsp/cache: rework package dirtying and reloading by @​cuematthew in 22fff24
• internal/lsp: FileEvaluatorForURI returns lsp/cache.File by @​cuematthew in dbf3293
• lsp/eval: change eval constructor to take Config struct by [@​cuem

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: module cuelang.org/go@v0.16.0 requires go >= 1.25.0; switching to go1.25.7
go: downloading github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af
go: downloading golang.org/x/net v0.51.0
go: downloading github.com/enterprise-contract/go-containerregistry v0.20.3-0.20250120083621-7be5271048b1
go: downloading github.com/olekukonko/tablewriter v1.1.0
go: downloading sigs.k8s.io/release-utils v0.12.2
go: downloading github.com/sigstore/rekor v1.4.3
go: downloading github.com/google/cel-go v0.26.0
go: downloading github.com/cespare/xxhash v1.1.0
go: downloading github.com/mattn/go-runewidth v0.0.16
go: downloading github.com/olekukonko/ll v0.0.9
go: downloading github.com/lestrrat-go/jwx v1.2.29
go: downloading go.opentelemetry.io/otel/sdk v1.38.0
go: downloading go.opentelemetry.io/otel v1.38.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0
go: downloading go.opentelemetry.io/otel/trace v1.38.0
go: downloading github.com/vektah/gqlparser v1.2.0
go: downloading github.com/go-openapi/errors v0.22.4
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20251029180050-ab9386a59fda
go: downloading google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9
go: downloading cel.dev/expr v0.24.0
go: downloading github.com/go-openapi/jsonreference v0.21.3
go: downloading github.com/rivo/uniseg v0.4.7
go: downloading go.opentelemetry.io/otel/metric v1.38.0
go: downloading github.com/containerd/containerd v1.7.29
go: downloading github.com/containerd/containerd/v2 v2.2.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0
go: downloading github.com/dgraph-io/badger/v4 v4.8.0
go: downloading go.opentelemetry.io/proto/otlp v1.7.1
go: downloading cloud.google.com/go/storage v1.56.0
go: downloading google.golang.org/api v0.257.0
go: downloading github.com/go-openapi/jsonpointer v0.22.1
go: downloading github.com/go-openapi/spec v0.22.1
go: downloading github.com/go-chi/chi/v5 v5.2.3
go: downloading github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3
go: downloading github.com/stoewer/go-strcase v1.3.0
go: downloading github.com/dgraph-io/ristretto v0.1.1
go: downloading github.com/huandu/go-sqlbuilder v1.38.1
go: downloading gopkg.in/ini.v1 v1.67.0
go: downloading cloud.google.com/go/auth v0.17.0
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0
go: downloading github.com/googleapis/gax-go/v2 v2.15.0
go: downloading go.opentelemetry.io/otel/sdk/metric v1.38.0
go: downloading cloud.google.com/go/monitoring v1.24.2
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.7
go: downloading github.com/envoyproxy/go-control-plane v0.13.5-0.20251024222203-75eaa193e329
go: github.com/muhammadmuzzammil1998/jsonc@v1.0.0 used for two different module paths (github.com/muhammadmuzzammil1998/jsonc and muzzammil.xyz/jsonc)

File name: tools/go.sum

Command failed: go get -t ./...
go: module github.com/open-policy-agent/conftest@v0.66.0 requires go >= 1.25.3; switching to go1.25.7
go: downloading oras.land/oras-go v1.2.6
go: github.com/muhammadmuzzammil1998/jsonc@v1.0.0 used for two different module paths (github.com/muhammadmuzzammil1998/jsonc and muzzammil.xyz/jsonc)