Skip to content

Bump all dependencies except dev-tunnels - #11203

Merged
williammartin merged 1 commit into
trunkfrom
wm/bump-deps
Jul 2, 2025
Merged

Bump all dependencies except dev-tunnels#11203
williammartin merged 1 commit into
trunkfrom
wm/bump-deps

Conversation

@williammartin

@williammartin williammartin commented Jul 2, 2025 •
edited
Loading

Copy link
Copy Markdown
Member

Description

This PR bumps all our go dependencies to their latest release except for dev-tunnels which I will do in a follow up due to:

  • Having breaking changes
  • Requiring separate review from the codespaces team

Reviewer Notes

I have run the acceptance tests and though there were failures, I do not believe they were related to any dependency bumps here. All unit tests pass.

I have gone through the release notes for each of our direct dependencies and did not find any obvious points of interest positive or negative.

github-advanced-security[bot]
github-advanced-security AI found potential problems Jul 2, 2025
View reviewed changes
Comment thread third-party/github.com/letsencrypt/boulder/observer/probers/tls/tls.go
Config: &tls.Config{
// Set InsecureSkipVerify to skip the default validation we are
// replacing. This will not disable VerifyConnection.
InsecureSkipVerify: true,

Check failure

Code scanning / CodeQL

Disabled TLS certificate check

InsecureSkipVerify should not be used in production code.

Copilot Autofix

AI over 1 year ago

To address the issue, we will remove the InsecureSkipVerify: true setting and ensure that the custom VerifyConnection function is used for certificate validation. This change will prevent the default validation from being disabled while still allowing the custom validation logic to operate as intended. The fix involves modifying the tls.Config initialization to exclude the InsecureSkipVerify field.

Suggested changeset 1
third-party/github.com/letsencrypt/boulder/observer/probers/tls/tls.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/third-party/github.com/letsencrypt/boulder/observer/probers/tls/tls.go b/third-party/github.com/letsencrypt/boulder/observer/probers/tls/tls.go
--- a/third-party/github.com/letsencrypt/boulder/observer/probers/tls/tls.go
+++ b/third-party/github.com/letsencrypt/boulder/observer/probers/tls/tls.go
@@ -166,5 +166,2 @@
 		Config: &tls.Config{
-			// Set InsecureSkipVerify to skip the default validation we are
-			// replacing. This will not disable VerifyConnection.
-			InsecureSkipVerify: true,
 			VerifyConnection: func(cs tls.ConnectionState) error {
EOF
@@ -166,5 +166,2 @@
Config: &tls.Config{
// Set InsecureSkipVerify to skip the default validation we are
// replacing. This will not disable VerifyConnection.
InsecureSkipVerify: true,
VerifyConnection: func(cs tls.ConnectionState) error {
Copilot is powered by AI and may make mistakes. Always verify output.
Comment thread third-party/github.com/letsencrypt/boulder/observer/probers/tls/tls.go
Config: &tls.Config{
// Set InsecureSkipVerify to skip the default validation we are
// replacing. This will not disable VerifyConnection.
InsecureSkipVerify: true,

Check failure

Code scanning / CodeQL

Disabled TLS certificate check

InsecureSkipVerify should not be used in production code.

Copilot Autofix

AI over 1 year ago

To fix the issue, we need to remove the InsecureSkipVerify: true setting and ensure that the custom VerifyConnection function works alongside the default TLS validation. This can be achieved by setting InsecureSkipVerify: false (or omitting it entirely, as false is the default value) and retaining the VerifyConnection function for additional validation. This approach ensures that the default system trust store is used for certificate validation, while still allowing the custom logic to perform additional checks.

Suggested changeset 1
third-party/github.com/letsencrypt/boulder/observer/probers/tls/tls.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/third-party/github.com/letsencrypt/boulder/observer/probers/tls/tls.go b/third-party/github.com/letsencrypt/boulder/observer/probers/tls/tls.go
--- a/third-party/github.com/letsencrypt/boulder/observer/probers/tls/tls.go
+++ b/third-party/github.com/letsencrypt/boulder/observer/probers/tls/tls.go
@@ -229,5 +229,3 @@
 		Config: &tls.Config{
-			// Set InsecureSkipVerify to skip the default validation we are
-			// replacing. This will not disable VerifyConnection.
-			InsecureSkipVerify: true,
+			// Enable default validation alongside custom VerifyConnection logic.
 			VerifyConnection: func(cs tls.ConnectionState) error {
EOF
@@ -229,5 +229,3 @@
Config: &tls.Config{
// Set InsecureSkipVerify to skip the default validation we are
// replacing. This will not disable VerifyConnection.
InsecureSkipVerify: true,
// Enable default validation alongside custom VerifyConnection logic.
VerifyConnection: func(cs tls.ConnectionState) error {
Copilot is powered by AI and may make mistakes. Always verify output.
Comment thread third-party/github.com/letsencrypt/boulder/test/chall-test-srv/mockdns.go

srv.challSrv.AddDNSARecord(request.Host, request.Addresses)
srv.log.Printf("Added response for DNS A queries to %q : %s\n",
request.Host, strings.Join(request.Addresses, ", "))

Check failure

Code scanning / CodeQL

Log entries created from user input

This log entry depends on a [user-provided value](1).

Copilot Autofix

AI over 1 year ago

To fix the issue, we need to sanitize the request.Addresses field before logging it. Specifically:

  1. Remove any newline (\n) or carriage return (\r) characters from each address in the request.Addresses slice.
  2. Ensure that the sanitized addresses are used in the log entry.

This can be achieved by iterating over the request.Addresses slice, sanitizing each address using strings.ReplaceAll, and then joining the sanitized addresses for logging.

Suggested changeset 1
third-party/github.com/letsencrypt/boulder/test/chall-test-srv/mockdns.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/third-party/github.com/letsencrypt/boulder/test/chall-test-srv/mockdns.go b/third-party/github.com/letsencrypt/boulder/test/chall-test-srv/mockdns.go
--- a/third-party/github.com/letsencrypt/boulder/test/chall-test-srv/mockdns.go
+++ b/third-party/github.com/letsencrypt/boulder/test/chall-test-srv/mockdns.go
@@ -94,4 +94,9 @@
 	srv.challSrv.AddDNSARecord(request.Host, request.Addresses)
+	// Sanitize addresses to remove newline and carriage return characters
+	sanitizedAddresses := make([]string, len(request.Addresses))
+	for i, addr := range request.Addresses {
+		sanitizedAddresses[i] = strings.ReplaceAll(strings.ReplaceAll(addr, "\n", ""), "\r", "")
+	}
 	srv.log.Printf("Added response for DNS A queries to %q : %s\n",
-		request.Host, strings.Join(request.Addresses, ", "))
+		request.Host, strings.Join(sanitizedAddresses, ", "))
 	w.WriteHeader(http.StatusOK)
EOF
@@ -94,4 +94,9 @@
srv.challSrv.AddDNSARecord(request.Host, request.Addresses)
// Sanitize addresses to remove newline and carriage return characters
sanitizedAddresses := make([]string, len(request.Addresses))
for i, addr := range request.Addresses {
sanitizedAddresses[i] = strings.ReplaceAll(strings.ReplaceAll(addr, "\n", ""), "\r", "")
}
srv.log.Printf("Added response for DNS A queries to %q : %s\n",
request.Host, strings.Join(request.Addresses, ", "))
request.Host, strings.Join(sanitizedAddresses, ", "))
w.WriteHeader(http.StatusOK)
Copilot is powered by AI and may make mistakes. Always verify output.
Comment thread third-party/github.com/letsencrypt/boulder/test/chall-test-srv/mockdns.go

srv.challSrv.AddDNSAAAARecord(request.Host, request.Addresses)
srv.log.Printf("Added response for DNS AAAA queries to %q : %s\n",
request.Host, strings.Join(request.Addresses, ", "))

Check failure

Code scanning / CodeQL

Log entries created from user input

This log entry depends on a [user-provided value](1).

Copilot Autofix

AI over 1 year ago

To fix the issue, we need to sanitize the user-provided input (request.Addresses) before logging it. Specifically:

  1. Remove any newline (\n) or carriage return (\r) characters from each string in the request.Addresses array to prevent log forgery.
  2. Use strings.ReplaceAll to perform the sanitization for each string in the array.
  3. Replace the unsanitized strings.Join(request.Addresses, ", ") with a sanitized version.

The changes will be made in the addDNSAAAARecord function in the third-party/github.com/letsencrypt/boulder/test/chall-test-srv/mockdns.go file.

Suggested changeset 1
third-party/github.com/letsencrypt/boulder/test/chall-test-srv/mockdns.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/third-party/github.com/letsencrypt/boulder/test/chall-test-srv/mockdns.go b/third-party/github.com/letsencrypt/boulder/test/chall-test-srv/mockdns.go
--- a/third-party/github.com/letsencrypt/boulder/test/chall-test-srv/mockdns.go
+++ b/third-party/github.com/letsencrypt/boulder/test/chall-test-srv/mockdns.go
@@ -152,4 +152,11 @@
 	srv.challSrv.AddDNSAAAARecord(request.Host, request.Addresses)
+	// Sanitize user-provided addresses to prevent log forgery
+	sanitizedAddresses := make([]string, len(request.Addresses))
+	for i, addr := range request.Addresses {
+		sanitizedAddr := strings.ReplaceAll(addr, "\n", "")
+		sanitizedAddr = strings.ReplaceAll(sanitizedAddr, "\r", "")
+		sanitizedAddresses[i] = sanitizedAddr
+	}
 	srv.log.Printf("Added response for DNS AAAA queries to %q : %s\n",
-		request.Host, strings.Join(request.Addresses, ", "))
+		request.Host, strings.Join(sanitizedAddresses, ", "))
 	w.WriteHeader(http.StatusOK)
EOF
@@ -152,4 +152,11 @@
srv.challSrv.AddDNSAAAARecord(request.Host, request.Addresses)
// Sanitize user-provided addresses to prevent log forgery
sanitizedAddresses := make([]string, len(request.Addresses))
for i, addr := range request.Addresses {
sanitizedAddr := strings.ReplaceAll(addr, "\n", "")
sanitizedAddr = strings.ReplaceAll(sanitizedAddr, "\r", "")
sanitizedAddresses[i] = sanitizedAddr
}
srv.log.Printf("Added response for DNS AAAA queries to %q : %s\n",
request.Host, strings.Join(request.Addresses, ", "))
request.Host, strings.Join(sanitizedAddresses, ", "))
w.WriteHeader(http.StatusOK)
Copilot is powered by AI and may make mistakes. Always verify output.
Comment thread third-party/github.com/letsencrypt/boulder/va/tlsalpn.go
NextProtos: []string{ACMETLS1Protocol},
ServerName: serverName,
// We expect a self-signed challenge certificate, do not verify it here.
InsecureSkipVerify: true,

Check failure

Code scanning / CodeQL

Disabled TLS certificate check

InsecureSkipVerify should not be used in production code.

Copilot Autofix

AI over 1 year ago

To fix the issue, we will replace the InsecureSkipVerify: true setting with a custom certificate verification function. This function will validate the certificate against specific criteria, such as checking for a known self-signed certificate or a specific certificate fingerprint. This approach maintains security while accommodating the use of self-signed certificates.

The changes will involve:

  1. Defining a custom certificate verification function.
  2. Updating the tls.Config to use this function via the VerifyPeerCertificate field.
  3. Ensuring the custom verification logic is robust and meets the application's requirements.
Suggested changeset 1
third-party/github.com/letsencrypt/boulder/va/tlsalpn.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/third-party/github.com/letsencrypt/boulder/va/tlsalpn.go b/third-party/github.com/letsencrypt/boulder/va/tlsalpn.go
--- a/third-party/github.com/letsencrypt/boulder/va/tlsalpn.go
+++ b/third-party/github.com/letsencrypt/boulder/va/tlsalpn.go
@@ -169,4 +169,19 @@
 		ServerName: serverName,
-		// We expect a self-signed challenge certificate, do not verify it here.
-		InsecureSkipVerify: true,
+		// We expect a self-signed challenge certificate, verify it using a custom function.
+		VerifyPeerCertificate: func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
+			if len(rawCerts) == 0 {
+				return errors.New("no certificates presented")
+			}
+			cert, err := x509.ParseCertificate(rawCerts[0])
+			if err != nil {
+				return fmt.Errorf("failed to parse certificate: %v", err)
+			}
+			// Add custom verification logic here, e.g., check for a specific fingerprint.
+			expectedFingerprint := "your_expected_fingerprint_here"
+			actualFingerprint := sha256.Sum256(cert.Raw)
+			if hex.EncodeToString(actualFingerprint[:]) != expectedFingerprint {
+				return errors.New("certificate fingerprint mismatch")
+			}
+			return nil
+		},
 	}}
EOF
@@ -169,4 +169,19 @@
ServerName: serverName,
// We expect a self-signed challenge certificate, do not verify it here.
InsecureSkipVerify: true,
// We expect a self-signed challenge certificate, verify it using a custom function.
VerifyPeerCertificate: func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
if len(rawCerts) == 0 {
return errors.New("no certificates presented")
}
cert, err := x509.ParseCertificate(rawCerts[0])
if err != nil {
return fmt.Errorf("failed to parse certificate: %v", err)
}
// Add custom verification logic here, e.g., check for a specific fingerprint.
expectedFingerprint := "your_expected_fingerprint_here"
actualFingerprint := sha256.Sum256(cert.Raw)
if hex.EncodeToString(actualFingerprint[:]) != expectedFingerprint {
return errors.New("certificate fingerprint mismatch")
}
return nil
},
}}
Copilot is powered by AI and may make mistakes. Always verify output.
@williammartin
williammartin marked this pull request as ready for review July 2, 2025 13:14
@williammartin
williammartin requested a review from a team as a code owner July 2, 2025 13:14
@williammartin
williammartin requested a review from andyfeller July 2, 2025 13:14
andyfeller
andyfeller approved these changes Jul 2, 2025
View reviewed changes

@andyfeller andyfeller left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good! Thanks for the booster shot 😆

@williammartin
williammartin merged commit 4c47bad into trunk Jul 2, 2025
@williammartin
williammartin deleted the wm/bump-deps branch July 2, 2025 14:35
This was referenced Jul 2, 2025
Closed
Closed
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Jul 27, 2025
ECG Bot @tmeijn
build(deps): update cli/cli to v2.76.1
16504a4 
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [cli/cli](https://github.com/cli/cli) | minor | `v2.74.2` -> `v2.76.1` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>cli/cli (cli/cli)</summary>

### [`v2.76.1`](https://github.com/cli/cli/releases/tag/v2.76.1): GitHub CLI 2.76.1

[Compare Source](cli/cli@v2.76.0...v2.76.1)

#### `gh pr create` regression fix

This release fixes a regression introduced in `v2.76.0` where organization teams were retrieved outside of intentional use cases.  This caused problems for GitHub Enterprise Server users using the GitHub Actions automatic token that does not have access to organization teams.

For more information, see cli/cli#11360

#### What's Changed

##### 🐛 Fixes

- Fix: `gh pr create`, only fetch teams when reviewers contain a team  by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#11361

##### 📚 Docs & Chores

- add tenancy aware for san matcher by [@&#8203;ejahnGithub](https://github.com/ejahnGithub) in cli/cli#11261
- Run Lint and Tests on `push` to `trunk` branch by [@&#8203;andyfeller](https://github.com/andyfeller) in cli/cli#11325
- update ownership of pkg/cmd/release/shared/ by [@&#8203;ejahnGithub](https://github.com/ejahnGithub) in cli/cli#11326
- Automate spam issue detection by [@&#8203;babakks](https://github.com/babakks) in cli/cli#11316
- Improve `api` `--preview` docs by [@&#8203;jsoref](https://github.com/jsoref) in cli/cli#11274
- Incorporate govulncheck into workflows by [@&#8203;andyfeller](https://github.com/andyfeller) in cli/cli#11332
- chore(deps): bump advanced-security/filter-sarif from 1.0.0 to 1.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in cli/cli#11298
- chore(deps): bump github.com/sigstore/sigstore-go from 1.0.0 to 1.1.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in cli/cli#11307

**Full Changelog**: cli/cli@v2.76.0...v2.76.1

### [`v2.76.0`](https://github.com/cli/cli/releases/tag/v2.76.0): GitHub CLI 2.76.0

[Compare Source](cli/cli@v2.75.1...v2.76.0)

#### :copilot: Copilot Coding Agent Support

GitHub Copilot Pro+ and Copilot Enterprise subscribers can now assign issues to GitHub Copilot during issue creation using:

- Command-line flag: `gh issue create --assignee @&#8203;copilot`
- Launching web browser: `gh issue create --assignee @&#8203;copilot --web`
- Or interactively selecting `Copilot (AI)` as assignee in `gh issue create` metadata

For more details, refer to [the full changelog post for Copilot coding agent](https://github.blog/changelog/2025-05-19-github-copilot-coding-agent-in-public-preview/).

#### What's Changed

##### ✨ Features

- Assign Copilot during `gh issue create` by [@&#8203;andyfeller](https://github.com/andyfeller) in cli/cli#11279
- Display immutable field in `release view` command by [@&#8203;bdehamer](https://github.com/bdehamer) in cli/cli#11251

##### 🐛 Fixes

- FIX: Do not fetch logs for skipped jobs by [@&#8203;babakks](https://github.com/babakks) in cli/cli#11312
- Transform `extension` and `filename` qualifiers into `path` qualifier for web code search by [@&#8203;samcoe](https://github.com/samcoe) in cli/cli#11211

##### 📚 Docs & Chores

- FIX: Workflow does not contain permissions by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#11322
- Add automated feature request response workflow by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#11299

**Full Changelog**: cli/cli@v2.75.1...v2.76.0

### [`v2.75.1`](https://github.com/cli/cli/releases/tag/v2.75.1): GitHub CLI 2.75.1

[Compare Source](cli/cli@v2.75.0...v2.75.1)

#### What's Changed

##### 🐛 Fixes

- Ensure hostnames are visible in CLI website by [@&#8203;andyfeller](https://github.com/andyfeller) in cli/cli#11295
- Revert "Fix: `gh pr create` prioritize `--title` and `--body` over `--fill` when `--web` is present" by [@&#8203;andyfeller](https://github.com/andyfeller) in cli/cli#11300

##### 📚 Docs & Chores

- Ensure go directive is always .0 version in bump by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#11259
- Minor (1-word) documentation typo in generated `~/.config/gh/config.yml` by [@&#8203;kurahaupo](https://github.com/kurahaupo) in cli/cli#11246
- Automate closing of stale issues by [@&#8203;babakks](https://github.com/babakks) in cli/cli#11268
- Filter the `third-party/` folder out of CodeQL results by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#11278
- Exclude `third-party` source from golangci-lint by [@&#8203;andyfeller](https://github.com/andyfeller) in cli/cli#11293

##### :dependabot: Dependencies

- Bump Go to 1.24.5 by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in cli/cli#11255
- chore(deps): bump github.com/sigstore/protobuf-specs from 0.4.3 to 0.5.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in cli/cli#11263
- chore(deps): bump golang.org/x/term from 0.32.0 to 0.33.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in cli/cli#11266
- chore(deps): bump golang.org/x/sync from 0.15.0 to 0.16.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in cli/cli#11264
- chore(deps): bump golang.org/x/text from 0.26.0 to 0.27.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in cli/cli#11265
- chore(deps): bump golang.org/x/crypto from 0.39.0 to 0.40.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in cli/cli#11275

#### New Contributors

- [@&#8203;kurahaupo](https://github.com/kurahaupo) made their first contribution in cli/cli#11246
- [@&#8203;github-actions](https://github.com/github-actions)\[bot] made their first contribution in cli/cli#11255

**Full Changelog**: cli/cli@v2.75.0...v2.75.1

### [`v2.75.0`](https://github.com/cli/cli/releases/tag/v2.75.0): GitHub CLI 2.75.0

[Compare Source](cli/cli@v2.74.2...v2.75.0)

#### What's Changed

##### ✨ Features

- init release verify subcommands  by [@&#8203;ejahnGithub](https://github.com/ejahnGithub) in cli/cli#11018
- Embed Windows resources (VERSIONINFO) during build by [@&#8203;babakks](https://github.com/babakks) in cli/cli#11048
- Support `--no-repos-selected` on `gh secret set` by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#11217

##### 🐛 Fixes

- Fix: `gh pr create` prioritize `--title` and `--body` over `--fill` when `--web` is present by [@&#8203;dankrzeminski32](https://github.com/dankrzeminski32) in cli/cli#10547
- fix: get token for active user instead of blank if possible by [@&#8203;anuraaga](https://github.com/anuraaga) in cli/cli#11038
- Use Actions API to retrieve job run logs as a fallback mechanism  by [@&#8203;babakks](https://github.com/babakks) in cli/cli#11172
- Fix query object state mutation during pagination by [@&#8203;babakks](https://github.com/babakks) in cli/cli#11244
- Handle `HTTP 404` when deleting remote branch in `pr merge` by [@&#8203;babakks](https://github.com/babakks) in cli/cli#11234

##### 📚 Docs & Chores

- chore: fix function name by [@&#8203;jinjingroad](https://github.com/jinjingroad) in cli/cli#11149
- chore: update Go version to 1.24 in devcontainer configuration and docs by [@&#8203;tMinamiii](https://github.com/tMinamiii) in cli/cli#11158
- Ensure lint workflow checks whether 3rd party license and code is up to date by [@&#8203;andyfeller](https://github.com/andyfeller) in cli/cli#11047
- docs: install\_linux.md: add Solus linux install instructions by [@&#8203;chax](https://github.com/chax) in cli/cli#10823
- Fix missing newline in install\_linux.md by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#11160
- Ensure automation uses pinned go-licenses version by [@&#8203;andyfeller](https://github.com/andyfeller) in cli/cli#11161
- Add `workflow_dispatch` support to MR Help Wanted check by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#11179
- Remove unused `GH_TOKEN` env variable from workflow by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#11190
- Add workflow to automate go version bumping by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#11189
- Fix inconsistent use of tabs and spaces by [@&#8203;Stefan-Heimersheim](https://github.com/Stefan-Heimersheim) in cli/cli#11194
- Decouple arg parsing from MR finder by [@&#8203;babakks](https://github.com/babakks) in cli/cli#11192
- docs: consistently use `apt` in installation instructions by [@&#8203;tklauser](https://github.com/tklauser) in cli/cli#11216
- Ensure bump go script has git user configured by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#11229
- Inject token into bump-go workflow by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#11233
- Reinstating Primer Style CLI content within `cli/cli` repository by [@&#8203;andyfeller](https://github.com/andyfeller) in cli/cli#11060
- Add setup-go to bump-go workflow by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#11237
- Ensure GoReleaser does not break on Mac OS and Linux when skipping Windows `.rsyso` generation script by [@&#8203;andyfeller](https://github.com/andyfeller) in cli/cli#11257

##### :dependabot: Dependencies

- Bump all dependencies except dev-tunnels by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#11203
- Update microsoft dev-tunnels to v0.1.13 by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#11205
- Consume dependabot minor versions for go modules by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#11213

#### New Contributors

- [@&#8203;jinjingroad](https://github.com/jinjingroad) made their first contribution in cli/cli#11149
- [@&#8203;tMinamiii](https://github.com/tMinamiii) made their first contribution in cli/cli#11158
- [@&#8203;chax](https://github.com/chax) made their first contribution in cli/cli#10823
- [@&#8203;dankrzeminski32](https://github.com/dankrzeminski32) made their first contribution in cli/cli#10547
- [@&#8203;anuraaga](https://github.com/anuraaga) made their first contribution in cli/cli#11038
- [@&#8203;Stefan-Heimersheim](https://github.com/Stefan-Heimersheim) made their first contribution in cli/cli#11194

**Full Changelog**: cli/cli@v2.74.2...v2.75.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC42Mi4xIiwidXBkYXRlZEluVmVyIjoiNDAuNjIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiUmVub3ZhdGUgQm90Il19-->
@andyfeller andyfeller mentioned this pull request Nov 3, 2025
Closed

This branch was previously deployed

1 inactive deployment
cli-automation — 96956da8 Deployed Jul 2, 2025 by williammartin
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@andyfeller andyfeller andyfeller approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@williammartin williammartin

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@williammartin @andyfeller @github-advanced-security