Update dependency aquaproj/aqua to v2.59.1

[renovate]

This PR contains the following updates:

Package	Update	Change
aquaproj/aqua	minor	v2.53.3 → v2.59.1

---

Release Notes

aquaproj/aqua (aquaproj/aqua)

v2.59.1

Compare Source

Fixes

#​4865 gr: don't treat *.minisig as checksum files @​scop

v2.59.0

Compare Source

Features

#​4517 Get checksums from GitHub API Release Asset Digest

v2.58.1

Compare Source

Fixes

#​4786 checksum: Change the algorithm to sha256 when registry file isn't cached

v2.58.0

Compare Source

Features

#​4733 #​4742 #​4755 Add the variants override mechanism with libc detection

https://aquaproj.github.io/docs/reference/registry-config/overrides/#variants

#​4667 Refactor GitHub release attestations control naming @​scop

[!WARNING]
github_immutable_release was deprecated. Use github_release_attestations instead.

#​4634 Get a GitHub access token from AQUA_GITHUB_TOKEN and pass it to gh command if GH_TOKEN and GITHUB_TOKEN aren't set

Document

#​4729 Update edit URL in docusaurus configuration @​dsychin
#​4756 Add musl vs glibc section to registry style guide

v2.57.2

Compare Source

Fixes

#​4719 Fix jar support
#​4722 Map x86-64 to amd64
#​4688 Normalize CRLF line endings in checksum file parser

Documentation

#​4668 Deprecate signer-workflow @​scop
#​4663 JSON Schema: signer-workflow string format @​scop

v2.57.1

Compare Source

🐛 Bug Fixes

#​4659 Fix a bug that aqua update-checksum doesn't verify checksum files using tools like Cosign

v2.57.0

Compare Source

Features

#​4625 Support executing .jar

If aqua which returns a .jar file, aqua executes it by java -jar.
This requires java command.

Fixes

#​4629 Re-add env field to log

v2.56.7

Compare Source

Bug Fixes

#​4585 remove: fix a bug that -i doesn't work

Refactoring

#​4527 Refactor Checksum Verification

Document

#​4560 Fix typos and invalid links in documents @​kangetsu121

Dependency Updates

• chore(deps): update dependency anchore/syft to v1.42.1 in #​4576
• chore(deps): update dependency go to v1.26.0 in #​4550
• fix(deps): update module golang.org/x/sys to v0.41.0 in #​4545
• refactor: migrate to math/rand/v2 by @​scop in #​4547
• fix(deps): update module golang.org/x/oauth2 to v0.35.0 in #​4541
• fix(deps): update module github.com/expr-lang/expr to v1.17.8 in #​4564
• fix(deps): update module github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.2.2 in #​4574
• chore(deps): update dependency sigstore/cosign to v3.0.5 in #​4578
• fix(deps): update module github.com/google/go-github/v82 to v83 in #​4568
• chore: update aqua-proxy to v1.2.13 in #​4588

v2.56.6

Compare Source

🐛 Bug Fixes

#​4510 Fix a bug that -log-color doesn't work
#​4526 aqua gr: Fix a bug that win32 are excluded

v2.56.5

Compare Source

🐛 Bug Fixees

#​4495 Fix a bug that aqua gr's -cmd option doesn't work

This was a bug of v2.56.2 ~ v2.56.4. #​4450

v2.56.4

Compare Source

🐛 Bub Fixes

#​4484 #​4485 Prevent duplicate log field output

v2.56.3

Compare Source

🐛 Bug Fixes

#​4475 cp: Fix a bug that command arguments are ignored and always all commands are copied
#​4476 update-aqua: Fix a bug that a command argument is ignored and always the latest version is installed

Others

#​4471 Update sigstore/cosign to v3.0.4

v2.56.2

Compare Source

Refactoring

#​4448 Replace logrus with slog
#​4450 Use urfave/cli/v3 Destination pattern for flag values

v2.56.1

Compare Source

Fixes

#​4436 gr: Exclude eabihf

v2.56.0

Compare Source

Features

#​4422 Get pseudo-versions from Go Proxy if no tagged version exists @​gizmoguy

Fixes

#​4401 Add YAML tags @​Shion1305
#​4404 Update golangci-lint to v2.7.2, with lint fixes @​Shion1305

Dependency Updates

#​4402 Update goreleaser to v2.13.1
#​4405 Update anchore/syft to v1.38.2
#​4406 Update Cosign to v3.0.3
#​4420 Update expr to v1.17.7
#​4424 Update goccy/go-yaml to v1.19.1

v2.55.3

Compare Source

Bug Fixes

#​4393 gr: Fix the support of sigstore and sigstore.json file extensions

Refactoring

#​4369 Enable tagalign rule in golangci-lint @​Shion1305
#​4394 chore(deps): migrate to go.yaml.in/yaml @​scop

v2.55.2

Compare Source

Performance Improvement

#​4342 Skip packages that cannot provide the desired exe @​refi64

Others

#​4312 Update Go to 1.25.4

v2.55.1

Compare Source

🐛 Bug Fixes

#​4274 #​4276 exec: Fix the command name (args[0])

Dependency Updates

#​4220 #​4266 Update github.com/google/go-github/v74 to v76
#​4233 #​4251 #​4261 Update Go to 1.25.2

Others

Release Cosign Bundle file *.bundle

v2.55.0

Compare Source

Features

#​4195 #​4213 Support verifying the integrity of GitHub Releases

https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/verifying-the-integrity-of-a-release
https://aquaproj.github.io/docs/reference/security/github-immutable-release

v2.54.1

Compare Source

🐛 Bug Fixes

#​4182 Fix a bug of generate-registry command that arm64 is replaced to arm incorrectly

v2.54.0

Compare Source

Features

#​4173 ghtkn integration

https://aquaproj.github.io/docs/reference/security/ghtkn/

Now aqua can get a GitHub App User Access Token by ghtkn integration.
Stop risking token leaks - Use secure, short-lived GitHub tokens for local development.

Requirements

The ghtkn integration requires:

• Keyring

This feature doesn't depend on ghtkn CLI.

Limitation

The integration requires the user interaction when creating an access token via Device Flow, so it's unavailable in CI.

Set up

For more details, please see https://github.com/suzuki-shunsuke/ghtkn .

1. Create a GitHub App
2. Create a configuration file of ghtkn
3. Set the environment variable AQUA_GHTKN_ENABLED=true

export AQUA_GHTKN_ENABLED=true

Then aqua gets a user access token using ghtkn Go SDK when aqua calls GitHub APIs.

v2.53.11

Compare Source

Performance Improvement

#​4159 Update github.com/gdamore/tcell/v2 to reduce startup time @​refi64

Benchmark

$ git rev-parse HEAD
380a2334230ec9fd22adac3f4e137a4cf47d42b2

$ go version
go version go1.25.1 darwin/arm64

$ hyperfine --version
hyperfine 1.19.0

$ ls dist                         
aqua  aqua-25310

aqua.yaml

registries:
- type: standard
  ref: v4.408.0 # renovate: depName=aquaproj/aqua-registry
packages:
- name: suzuki-shunsuke/mkghtag@v0.1.11
- name: suzuki-shunsuke/cmdx@v2.0.2

$ hyperfine --warmup=20 -N 'dist/aqua'{-25310,}' exec -- mkghtag -version'
Benchmark 1: dist/aqua-25310 exec -- mkghtag -version
  Time (mean ± σ):      24.7 ms ±   1.3 ms    [User: 2.7 ms, System: 1.6 ms]
  Range (min … max):    23.5 ms …  29.6 ms    125 runs
 
  Warning: Statistical outliers were detected. Consider re-running this benchmark on a quiet system without any interferences from other programs. It might help to use the '--warmup' or '--prepare' options.
 
Benchmark 2: dist/aqua exec -- mkghtag -version
  Time (mean ± σ):      10.8 ms ±   1.4 ms    [User: 2.4 ms, System: 1.6 ms]
  Range (min … max):     9.2 ms …  17.1 ms    250 runs
 
Summary
  dist/aqua exec -- mkghtag -version ran
    2.30 ± 0.33 times faster than dist/aqua-25310 exec -- mkghtag -version

$ hyperfine --warmup=20 -N 'dist/aqua'{-25310,}' exec -- cmdx -v'         
Benchmark 1: dist/aqua-25310 exec -- cmdx -v
  Time (mean ± σ):      25.7 ms ±   1.3 ms    [User: 3.5 ms, System: 1.7 ms]
  Range (min … max):    24.5 ms …  31.7 ms    120 runs
 
  Warning: Statistical outliers were detected. Consider re-running this benchmark on a quiet system without any interferences from other programs. It might help to use the '--warmup' or '--prepare' options.
 
Benchmark 2: dist/aqua exec -- cmdx -v
  Time (mean ± σ):      11.2 ms ±   1.0 ms    [User: 3.1 ms, System: 1.6 ms]
  Range (min … max):    10.2 ms …  15.9 ms    253 runs
 
  Warning: Statistical outliers were detected. Consider re-running this benchmark on a quiet system without any interferences from other programs. It might help to use the '--warmup' or '--prepare' options.
 
Summary
  dist/aqua exec -- cmdx -v ran
    2.30 ± 0.24 times faster than dist/aqua-25310 exec -- cmdx -v

v2.53.10

Compare Source

🛡️ Starting from this release, Immutable Release is enabled!

#​4147 Update Go to v1.25.1
#​4145 Update aqua-proxy to v1.2.12

🐛 Bug Fixes

#​4140 Fix error messages

v2.53.9

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.8...v2.53.9

🐛 Bug Fixes

#​4064 Fix a bug that environment variables aren't passed to gh attestation verify

Others

#​4065 Update Go to v1.24.6
#​4065 Update aqua-proxy to v1.2.11

go1.24.6 (released 2025-08-06) includes security fixes to the database/sql and os/exec packages, as well as bug fixes to the runtime.
See the Go 1.24.6 milestone on our issue tracker for details.

v2.53.8

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.7...v2.53.8

🐛 Bug Fixes

#​4047 cp: Add missing .exe on Windows @​W1M0R

v2.53.7

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.6...v2.53.7

Fixes

#​4038 Fix a bug that it fails to verify GitHub Artifact Attestations on GitHub Enterprise Server @​yamoyamoto

v2.53.6

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.5...v2.53.6

🐛 Bug Fixes

#​4024 #​4025 Fix a bug that aqua works without registries' ref
#​4019 Set User-Agent to GitHub Release downloads @​yanolab

[!WARNING]
About #​4019 , unfortunately the bug is still remaining. But maybe #​4019 mitigates the bug to some extent.

v2.53.5

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.4...v2.53.5

#​4008 Fix Homebrew tap to remove the quarantine bit from the binary on a post install hook

v2.53.4

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.3...v2.53.4

#​3995 Add license files of Go and Go modules to released assets
#​3995 Release SBOM
#​3995 Update Go to 1.24.5
#​3996 Update aqua-proxy to v1.2.10

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.