chore(deps): update dependency aquaproj/aqua to v2.63.0

[renovate]

This PR contains the following updates:

Package	Update	Change
aquaproj/aqua	minor	v2.62.3 → v2.63.0

---

Release Notes

aquaproj/aqua (aquaproj/aqua)

v2.63.0

Compare Source

Security

Fix a path traversal vulnerability GHSA-286g-rf2x-cv99.
When a package archive contained a GNU sparse file, aqua re-extracted the whole archive with the host tar, applying none of its own path or symlink containment. On hosts whose tar follows symlinks during extraction (e.g. BusyBox tar), a crafted archive could plant a symlink escaping the install directory and write a regular file through it. aqua now keeps the system tar out of the install directory: it validates the sparse member names, extracts them into a staging directory, and moves each to its verified destination itself.

Features

#​5117 Create timestamp files as group writable and document read only $AQUA_ROOT_DIR
#​5115 Support AQUA_DISABLE_TRACKING to disable the tracking of last used date times

Fixes

#​5237 Skip minisign verification if the host platform doesn't support minisign
#​5188 Ignore incomplete release assets in aqua gr
#​5178 Support files[].src in go_install packages
#​5171 Extract 7z archives that use the ARM64 filter
#​5161 signer_workflow is a literal path, not a regex

Others

#​5239 Fix Dockerfile build failure caused by a stale apt package index

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.