Skip to content

chore: add upper camel case types#1881

Merged
jakobmoellerdev merged 29 commits intoopen-component-model:mainfrom
morri-son:add-upp-camel-case-types
Apr 16, 2026
Merged

chore: add upper camel case types#1881
jakobmoellerdev merged 29 commits intoopen-component-model:mainfrom
morri-son:add-upp-camel-case-types

Conversation

@morri-son
Copy link
Copy Markdown
Contributor

@morri-son morri-son commented Mar 25, 2026 •
edited
Loading

On-behalf-of: Gerald Morrison (SAP) gerald.morrison@sap.com

What this PR does / why we need it

Registers UpperCamelCase type names as additional aliases for all OCM access and input types, as part of aligning type notation to Kubernetes-style UpperCamelCase (open-component-model/ocm-project#962).

No behavior change: all existing lowerCamelCase and lower/v1 type strings continue to deserialize correctly. The new aliases allow components authored with the new open-component-model bindings (which emit UpperCamelCase/v1 as the primary type) to be read by this legacy CLI.

Access types:

  • ociBlob → alias OCIImageLayer / OCIImageLayer/v1
  • ociArtifact → alias OCIImage / OCIImage/v1 (already registered as LegacyType2 prior to this PR)
  • helm → alias Helm / Helm/v1
  • localBlob → alias LocalBlob / LocalBlob/v1
  • gitHub → alias GitHub / GitHub/v1
  • s3 → alias S3 / S3/v1 / S3/v2 (already registered via WithKindAliases prior to this PR)
  • npm → alias Npm / Npm/v1
  • wget → alias Wget / Wget/v1
  • git → alias Git / Git/v1alpha1
  • maven → alias Maven / Maven/v1

Input types (CLI):

  • dir → alias Dir
  • file → alias File
  • utf8 → alias UTF8
  • helm → alias Helm

Related

@morri-son morri-son added the kind/chore chore, maintenance, etc. label Mar 25, 2026
@github-actions github-actions Bot added component/ocm-cli OCM Command Line Interface size/s Small area/documentation Documentation related size/l Large labels Mar 25, 2026
@morri-son morri-son mentioned this pull request Mar 25, 2026
Merged
1 task
@morri-son morri-son linked an issue Apr 10, 2026 that may be closed by this pull request
align type notation for access and input open-component-model/ocm-project#962
Open
7 tasks
@morri-son morri-son marked this pull request as ready for review April 10, 2026 13:25
@morri-son morri-son requested a review from a team as a code owner April 10, 2026 13:25
@github-actions github-actions Bot removed the size/s Small label Apr 10, 2026
@jakobmoellerdev jakobmoellerdev enabled auto-merge (squash) April 10, 2026 13:43
@morri-son
Copy link
Copy Markdown
Contributor Author

morri-son commented Apr 10, 2026

@coderabbitai review

1 similar comment
@morri-son
Copy link
Copy Markdown
Contributor Author

morri-son commented Apr 10, 2026

@coderabbitai review

@morri-son morri-son mentioned this pull request Apr 13, 2026
Open
morri-son and others added 16 commits April 14, 2026 12:47
@morri-son @morrison-sap
chore: add wget example and cross-reference to ´ocm get credentials` …
2a36ad3 
…docs (open-component-model#1880)

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>

<!-- markdownlint-disable MD041 -->
#### What this PR does / why we need it
Adds cross reference from wget access method to credential mapping and
add an example for wget in ocmconfig.

#### Which issue(s) this PR is related to
Related to open-component-model#1821

Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Co-authored-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@morrison-sap
add upper camel case types
0018a3a 
On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@morrison-sap
regenerate docs
4fb0e13 
On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@dependabot @morrison-sap
chore(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to 5.17.1 (o…
c6bdf83 
…pen-component-model#1886)

Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git)
from 5.17.0 to 5.17.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.17.1</h2>
<h2>What's Changed</h2>
<ul>
<li>build: Update module github.com/cloudflare/circl to v1.6.3
[SECURITY] (releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/1930">go-git/go-git#1930</a></li>
<li>[v5] plumbing: format/index, Improve v4 entry name validation by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/1935">go-git/go-git#1935</a></li>
<li>[v5] plumbing: format/idxfile, Fix version and fanout checks by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/1937">go-git/go-git#1937</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1">https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-git/go-git/commit/5e23dfd02db92644dc4a3358ceb297fce875b772"><code>5e23dfd</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/1937">#1937</a>
from pjbgf/idx-v5</li>
<li><a
href="https://github.com/go-git/go-git/commit/6b38a326816b80f64c20cc0e6113958b65c05a1c"><code>6b38a32</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/1935">#1935</a>
from pjbgf/index-v5</li>
<li><a
href="https://github.com/go-git/go-git/commit/cd757fcb856a2dcc5fff6c110320a8ff62e99513"><code>cd757fc</code></a>
plumbing: format/idxfile, Fix version and fanout checks</li>
<li><a
href="https://github.com/go-git/go-git/commit/3ec0d70cb687ae1da5f4d18faa4229bd971a8710"><code>3ec0d70</code></a>
plumbing: format/index, Fix tree extension invalidated entry
parsing</li>
<li><a
href="https://github.com/go-git/go-git/commit/dbe10b6b425a2a4ea92a9d98e20cd68e15aede01"><code>dbe10b6</code></a>
plumbing: format/index, Align V2/V3 long name and V4 prefix encoding
with Git</li>
<li><a
href="https://github.com/go-git/go-git/commit/e9b65df44cb97faeba148b47523a362beaecddf9"><code>e9b65df</code></a>
plumbing: format/index, Improve v4 entry name validation</li>
<li><a
href="https://github.com/go-git/go-git/commit/adad18daabddee04c5a889f0230035e74bca32c0"><code>adad18d</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/1930">#1930</a>
from go-git/renovate/releases/v5.x-go-github.com-clo...</li>
<li><a
href="https://github.com/go-git/go-git/commit/29470bd1d862c6e902996b8e8ff8eb7a0515a9be"><code>29470bd</code></a>
build: Update module github.com/cloudflare/circl to v1.6.3
[SECURITY]</li>
<li>See full diff in <a
href="https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1">compare
view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.17.0&new-version=5.17.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-component-model/ocm/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@ocmbot @morrison-sap
chore: update 'flake.nix' (open-component-model#1889)
2670be8 
Update OCM CLI vendor hash (see:
.github/workflows/flake_vendorhash.yaml)

Co-authored-by: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@dependabot @morrison-sap
chore(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to 5.17.2 (o…
9361439 
…pen-component-model#1891)

Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git)
from 5.17.1 to 5.17.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.17.2</h2>
<h2>What's Changed</h2>
<ul>
<li>build: Update module github.com/go-git/go-git/v5 to v5.17.1
[SECURITY] (releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/1941">go-git/go-git#1941</a></li>
<li>dotgit: skip writing pack files that already exist on disk by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/1944">go-git/go-git#1944</a></li>
</ul>
<p>:warning: This release fixes a bug (<a
href="https://redirect.github.com/go-git/go-git/issues/1942">go-git/go-git#1942</a>)
that blocked some users from upgrading to <code>v5.17.1</code>. Thanks
<a href="https://github.com/pskrbasu"><code>@​pskrbasu</code></a> for
reporting it. 🙇</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-git/go-git/compare/v5.17.1...v5.17.2">https://github.com/go-git/go-git/compare/v5.17.1...v5.17.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-git/go-git/commit/45ae193b3a60aa8ec8a3e373f7265a7819473d5f"><code>45ae193</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/1944">#1944</a>
from go-git/fix-perms</li>
<li><a
href="https://github.com/go-git/go-git/commit/fda4f7464b597ff33d2dea1c026482a5e900037c"><code>fda4f74</code></a>
storage: filesystem/dotgit, Skip writing pack files that already exist
on disk</li>
<li><a
href="https://github.com/go-git/go-git/commit/2212dc7caeb2a389fe2129923811ef63f75a557a"><code>2212dc7</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/1941">#1941</a>
from go-git/renovate/releases/v5.x-go-github.com-go-...</li>
<li><a
href="https://github.com/go-git/go-git/commit/ebb2d7da7f5d5aebeaa0b5e13276d72d602c1ae3"><code>ebb2d7d</code></a>
build: Update module github.com/go-git/go-git/v5 to v5.17.1
[SECURITY]</li>
<li>See full diff in <a
href="https://github.com/go-git/go-git/compare/v5.17.1...v5.17.2">compare
view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.17.1&new-version=5.17.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-component-model/ocm/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@dependabot @morrison-sap
chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (o…
65b180b 
…pen-component-model#1892)

Bumps
[github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from
4.1.3 to 4.1.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-jose/go-jose/releases">github.com/go-jose/go-jose/v4's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.4</h2>
<h2>What's Changed</h2>
<p>Fixes Panic in JWE decryption. See <a
href="https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8">https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8</a></p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4">https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-jose/go-jose/commit/0e59876635f3dbf46d7b5e97b52bb75a3f96e7d9"><code>0e59876</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/go-jose/go-jose/commit/ddffdbcec8bdadea8e02a20bdf19239878228215"><code>ddffdbc</code></a>
Bump actions/checkout from 5 to 6 (<a
href="https://redirect.github.com/go-jose/go-jose/issues/213">#213</a>)</li>
<li>See full diff in <a
href="https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@dependabot @morrison-sap
chore(deps): bump the ci group across 1 directory with 5 updates (ope…
ce4beff 
…n-component-model#1893)

Bumps the ci group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/setup-go](https://github.com/actions/setup-go) | `6.3.0` |
`6.4.0` |
| [github/codeql-action](https://github.com/github/codeql-action) |
`4.34.1` | `4.35.1` |
| [docker/login-action](https://github.com/docker/login-action) |
`4.0.0` | `4.1.0` |
|
[DeterminateSystems/nix-installer-action](https://github.com/determinatesystems/nix-installer-action)
| `21` | `22` |
|
[sigstore/cosign-installer](https://github.com/sigstore/cosign-installer)
| `4.1.0` | `4.1.1` |

Updates `actions/setup-go` from 6.3.0 to 6.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-go/releases">actions/setup-go's
releases</a>.</em></p>
<blockquote>
<h2>v6.4.0</h2>
<h2>What's Changed</h2>
<h3>Enhancement</h3>
<ul>
<li>Add go-download-base-url input for custom Go distributions by <a
href="https://github.com/gdams"><code>@​gdams</code></a> in <a
href="https://redirect.github.com/actions/setup-go/pull/721">actions/setup-go#721</a></li>
</ul>
<h3>Dependency update</h3>
<ul>
<li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-go/pull/727">actions/setup-go#727</a></li>
</ul>
<h3>Documentation update</h3>
<ul>
<li>Rearrange README.md, add advanced-usage.md by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-go/pull/724">actions/setup-go#724</a></li>
<li>Fix Microsoft build of Go link by <a
href="https://github.com/gdams"><code>@​gdams</code></a> in <a
href="https://redirect.github.com/actions/setup-go/pull/734">actions/setup-go#734</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/gdams"><code>@​gdams</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-go/pull/721">actions/setup-go#721</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-go/compare/v6...v6.4.0">https://github.com/actions/setup-go/compare/v6...v6.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-go/commit/4a3601121dd01d1626a1e23e37211e3254c1c06c"><code>4a36011</code></a>
docs: fix Microsoft build of Go link (<a
href="https://redirect.github.com/actions/setup-go/issues/734">#734</a>)</li>
<li><a
href="https://github.com/actions/setup-go/commit/8f19afcc704763637be6b1718da0af52ca05785d"><code>8f19afc</code></a>
feat: add go-download-base-url input for custom Go distributions (<a
href="https://redirect.github.com/actions/setup-go/issues/721">#721</a>)</li>
<li><a
href="https://github.com/actions/setup-go/commit/27fdb267c15a8835f1ead03dfa07f89be2bb741a"><code>27fdb26</code></a>
Bump minimatch from 3.1.2 to 3.1.5 (<a
href="https://redirect.github.com/actions/setup-go/issues/727">#727</a>)</li>
<li><a
href="https://github.com/actions/setup-go/commit/def8c394e3ad351a79bc93815e4a585520fe993b"><code>def8c39</code></a>
Rearrange README.md, add advanced-usage.md (<a
href="https://redirect.github.com/actions/setup-go/issues/724">#724</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-go/compare/4b73464bb391d4059bd26b0524d20df3927bd417...4a3601121dd01d1626a1e23e37211e3254c1c06c">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action` from 4.34.1 to 4.35.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.35.1</h2>
<ul>
<li>Fix incorrect minimum required Git version for <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li>
</ul>
<h2>v4.35.0</h2>
<ul>
<li>Reduced the minimum Git version required for <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> from 2.38.0 to 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<ul>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li>
<li>Python analysis on GHES no longer extracts the standard library,
relying instead on models of the standard library. This should result in
significantly faster extraction and analysis times, while the effect on
alerts should be minimal. <a
href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li>
</ul>
<h2>4.35.1 - 27 Mar 2026</h2>
<ul>
<li>Fix incorrect minimum required Git version for <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li>
</ul>
<h2>4.35.0 - 27 Mar 2026</h2>
<ul>
<li>Reduced the minimum Git version required for <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> from 2.38.0 to 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li>
</ul>
<h2>4.34.1 - 20 Mar 2026</h2>
<ul>
<li>Downgrade default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a>
due to issues with a small percentage of Actions and JavaScript
analyses. <a
href="https://redirect.github.com/github/codeql-action/pull/3762">#3762</a></li>
</ul>
<h2>4.34.0 - 20 Mar 2026</h2>
<ul>
<li>Added an experimental change which disables TRAP caching when <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> is enabled, since improved incremental analysis
supersedes TRAP caching. This will improve performance and reduce
Actions cache usage. We expect to roll this change out to everyone in
March. <a
href="https://redirect.github.com/github/codeql-action/pull/3569">#3569</a></li>
<li>We are rolling out improved incremental analysis to C/C++ analyses
that use build mode <code>none</code>. We expect this rollout to be
complete by the end of April 2026. <a
href="https://redirect.github.com/github/codeql-action/pull/3584">#3584</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0">2.25.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3585">#3585</a></li>
</ul>
<h2>4.33.0 - 16 Mar 2026</h2>
<ul>
<li>
<p>Upcoming change: Starting April 2026, the CodeQL Action will skip
collecting file coverage information on pull requests to improve
analysis performance. File coverage information will still be computed
on non-PR analyses. Pull request analyses will log a warning about this
upcoming change. <a
href="https://redirect.github.com/github/codeql-action/pull/3562">#3562</a></p>
<p>To opt out of this change:</p>
<ul>
<li><strong>Repositories owned by an organization:</strong> Create a
custom repository property with the name
<code>github-codeql-file-coverage-on-prs</code> and the type
&quot;True/false&quot;, then set this property to <code>true</code> in
the repository's settings. For more information, see <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing
custom properties for repositories in your organization</a>.
Alternatively, if you are using an advanced setup workflow, you can set
the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable
to <code>true</code> in your workflow.</li>
<li><strong>User-owned repositories using default setup:</strong> Switch
to an advanced setup workflow and set the
<code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to
<code>true</code> in your workflow.</li>
<li><strong>User-owned repositories using advanced setup:</strong> Set
the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable
to <code>true</code> in your workflow.</li>
</ul>
</li>
<li>
<p>Fixed <a
href="https://redirect.github.com/github/codeql-action/issues/3555">a
bug</a> which caused the CodeQL Action to fail loading repository
properties if a &quot;Multi select&quot; repository property was
configured for the repository. <a
href="https://redirect.github.com/github/codeql-action/pull/3557">#3557</a></p>
</li>
<li>
<p>The CodeQL Action now loads <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">custom
repository properties</a> on GitHub Enterprise Server, enabling the
customization of features such as
<code>github-codeql-disable-overlay</code> that was previously only
available on GitHub.com. <a
href="https://redirect.github.com/github/codeql-action/pull/3559">#3559</a></p>
</li>
<li>
<p>Once <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private
package registries</a> can be configured with OIDC-based authentication
for organizations, the CodeQL Action will now be able to accept such
configurations. <a
href="https://redirect.github.com/github/codeql-action/pull/3563">#3563</a></p>
</li>
<li>
<p>Fixed the retry mechanism for database uploads. Previously this would
fail with the error &quot;Response body object should not be disturbed
or locked&quot;. <a
href="https://redirect.github.com/github/codeql-action/pull/3564">#3564</a></p>
</li>
<li>
<p>A warning is now emitted if the CodeQL Action detects a repository
property whose name suggests that it relates to the CodeQL Action, but
which is not one of the properties recognised by the current version of
the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3570">#3570</a></p>
</li>
</ul>
<h2>4.32.6 - 05 Mar 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3548">#3548</a></li>
</ul>
<h2>4.32.5 - 02 Mar 2026</h2>
<ul>
<li>Repositories owned by an organization can now set up the
<code>github-codeql-disable-overlay</code> custom repository property to
disable <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis for CodeQL</a>. First, create a custom repository
property with the name <code>github-codeql-disable-overlay</code> and
the type &quot;True/false&quot; in the organization's settings. Then in
the repository's settings, set this property to <code>true</code> to
disable improved incremental analysis. For more information, see <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing
custom properties for repositories in your organization</a>. This
feature is not yet available on GitHub Enterprise Server. <a
href="https://redirect.github.com/github/codeql-action/pull/3507">#3507</a></li>
<li>Added an experimental change so that when <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> fails on a runner — potentially due to
insufficient disk space — the failure is recorded in the Actions cache
so that subsequent runs will automatically skip improved incremental
analysis until something changes (e.g. a larger runner is provisioned or
a new CodeQL version is released). We expect to roll this change out to
everyone in March. <a
href="https://redirect.github.com/github/codeql-action/pull/3487">#3487</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/c10b8064de6f491fea524254123dbe5e09572f13"><code>c10b806</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3782">#3782</a>
from github/update-v4.35.1-d6d1743b8</li>
<li><a
href="https://github.com/github/codeql-action/commit/c5ffd0683786820677d054e3505e1c5bb4b8c227"><code>c5ffd06</code></a>
Update changelog for v4.35.1</li>
<li><a
href="https://github.com/github/codeql-action/commit/d6d1743b8ec7ecd94f78ad1ce4cb3d8d2ba58001"><code>d6d1743</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3781">#3781</a>
from github/henrymercer/update-git-minimum-version</li>
<li><a
href="https://github.com/github/codeql-action/commit/65d2efa7333ad65f97cc54be40f4cd18630f884c"><code>65d2efa</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/2437b20ab31021229573a66717323dd5c6ce9319"><code>2437b20</code></a>
Update minimum git version for overlay to 2.36.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/ea5f71947c021286c99f61cc426a10d715fe4434"><code>ea5f719</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3775">#3775</a>
from github/dependabot/npm_and_yarn/node-forge-1.4.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/45ceeea896ba2293e10982f871198d1950ee13d6"><code>45ceeea</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3777">#3777</a>
from github/mergeback/v4.35.0-to-main-b8bb9f28</li>
<li><a
href="https://github.com/github/codeql-action/commit/24448c98434f429f901d27db7ddae55eec5cc1c4"><code>24448c9</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/7c510606312e5c68ac8b27c009e5254f226f5dfa"><code>7c51060</code></a>
Update changelog and version after v4.35.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/b8bb9f28b8d3f992092362369c57161b755dea45"><code>b8bb9f2</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3776">#3776</a>
from github/update-v4.35.0-0078ad667</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/38697555549f1db7851b81482ff19f1fa5c4fedc...c10b8064de6f491fea524254123dbe5e09572f13">compare
view</a></li>
</ul>
</details>
<br />

Updates `docker/login-action` from 4.0.0 to 4.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.0</h2>
<ul>
<li>Fix scoped Docker Hub cleanup path when registry is omitted by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/945">docker/login-action#945</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1020.0 in <a
href="https://redirect.github.com/docker/login-action/pull/930">docker/login-action#930</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.77.0 to 0.86.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/932">docker/login-action#932</a>
<a
href="https://redirect.github.com/docker/login-action/pull/936">docker/login-action#936</a></li>
<li>Bump brace-expansion from 1.1.12 to 1.1.13 in <a
href="https://redirect.github.com/docker/login-action/pull/952">docker/login-action#952</a></li>
<li>Bump fast-xml-parser from 5.3.4 to 5.3.6 in <a
href="https://redirect.github.com/docker/login-action/pull/942">docker/login-action#942</a></li>
<li>Bump flatted from 3.3.3 to 3.4.2 in <a
href="https://redirect.github.com/docker/login-action/pull/944">docker/login-action#944</a></li>
<li>Bump glob from 10.3.12 to 10.5.0 in <a
href="https://redirect.github.com/docker/login-action/pull/940">docker/login-action#940</a></li>
<li>Bump handlebars from 4.7.8 to 4.7.9 in <a
href="https://redirect.github.com/docker/login-action/pull/949">docker/login-action#949</a></li>
<li>Bump http-proxy-agent and https-proxy-agent to 8.0.0 in <a
href="https://redirect.github.com/docker/login-action/pull/937">docker/login-action#937</a></li>
<li>Bump lodash from 4.17.23 to 4.18.1 in <a
href="https://redirect.github.com/docker/login-action/pull/958">docker/login-action#958</a></li>
<li>Bump minimatch from 3.1.2 to 3.1.5 in <a
href="https://redirect.github.com/docker/login-action/pull/941">docker/login-action#941</a></li>
<li>Bump picomatch from 4.0.3 to 4.0.4 in <a
href="https://redirect.github.com/docker/login-action/pull/948">docker/login-action#948</a></li>
<li>Bump undici from 6.23.0 to 6.24.1 in <a
href="https://redirect.github.com/docker/login-action/pull/938">docker/login-action#938</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.0.0...v4.1.0">https://github.com/docker/login-action/compare/v4.0.0...v4.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/4907a6ddec9925e35a0a9e82d7399ccc52663121"><code>4907a6d</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/930">#930</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...</li>
<li><a
href="https://github.com/docker/login-action/commit/1e233e691a8881d7f35ca7c2d5dfaaed80b39636"><code>1e233e6</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/6c24ead68057f18c30c808a431f0b85dc25663cb"><code>6c24ead</code></a>
build(deps): bump the aws-sdk-dependencies group with 2 updates</li>
<li><a
href="https://github.com/docker/login-action/commit/ee034d70944e3546349cd24295914f139342f1e6"><code>ee034d7</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/958">#958</a>
from docker/dependabot/npm_and_yarn/lodash-4.18.1</li>
<li><a
href="https://github.com/docker/login-action/commit/1527209db9734bd2352a2dc1a63d79c9aa5358bb"><code>1527209</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/937">#937</a>
from docker/dependabot/npm_and_yarn/proxy-agent-depen...</li>
<li><a
href="https://github.com/docker/login-action/commit/d39362aba4d72f8d9d93e0962119840690133e1b"><code>d39362a</code></a>
build(deps): bump lodash from 4.17.23 to 4.18.1</li>
<li><a
href="https://github.com/docker/login-action/commit/a6f092b568105cbb6d9deb7e55e0a4c5c1025fce"><code>a6f092b</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/60953f0bed2120ec69659d271fe18d34bc069779"><code>60953f0</code></a>
build(deps): bump the proxy-agent-dependencies group with 2 updates</li>
<li><a
href="https://github.com/docker/login-action/commit/62c688590fb4ab6c6e89a217ced0a7b2ddcf1340"><code>62c6885</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/936">#936</a>
from docker/dependabot/npm_and_yarn/docker/actions-to...</li>
<li><a
href="https://github.com/docker/login-action/commit/102c0e672992d2e992c89b6f4808d65a353b5a1a"><code>102c0e6</code></a>
chore: update generated content</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/b45d80f862d83dbcd57f89517bcf500b2ab88fb2...4907a6ddec9925e35a0a9e82d7399ccc52663121">compare
view</a></li>
</ul>
</details>
<br />

Updates `DeterminateSystems/nix-installer-action` from 21 to 22
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/determinatesystems/nix-installer-action/releases">DeterminateSystems/nix-installer-action's
releases</a>.</em></p>
<blockquote>
<h2>v22</h2>
<h2>What's Changed</h2>
<ul>
<li>Update <code>detsys-ts</code>: Merge pull request <a
href="https://redirect.github.com/determinatesystems/nix-installer-action/issues/116">#116</a>
from
DeterminateSystems/dependabot/github_actions/actions-deps-76468cb07f by
<a
href="https://github.com/detsys-pr-bot"><code>@​detsys-pr-bot</code></a>
in <a
href="https://redirect.github.com/DeterminateSystems/nix-installer-action/pull/211">DeterminateSystems/nix-installer-action#211</a></li>
<li>Update <code>detsys-ts</code>: Update main and types fields in
package.json (<a
href="https://redirect.github.com/determinatesystems/nix-installer-action/issues/119">#119</a>)
by <a
href="https://github.com/detsys-pr-bot"><code>@​detsys-pr-bot</code></a>
in <a
href="https://redirect.github.com/DeterminateSystems/nix-installer-action/pull/212">DeterminateSystems/nix-installer-action#212</a></li>
<li>Provide Determinate Nix vs. upstream Nix instructions by <a
href="https://github.com/lucperkins"><code>@​lucperkins</code></a> in <a
href="https://redirect.github.com/DeterminateSystems/nix-installer-action/pull/210">DeterminateSystems/nix-installer-action#210</a></li>
<li>Update <code>detsys-ts</code>: Merge pull request <a
href="https://redirect.github.com/determinatesystems/nix-installer-action/issues/126">#126</a>
from DeterminateSystems/dependabot/npm_and_yarn/npm-deps-939209f320 by
<a
href="https://github.com/detsys-pr-bot"><code>@​detsys-pr-bot</code></a>
in <a
href="https://redirect.github.com/DeterminateSystems/nix-installer-action/pull/220">DeterminateSystems/nix-installer-action#220</a></li>
<li>Add summary toggle option by <a
href="https://github.com/andre4ik3"><code>@​andre4ik3</code></a> in <a
href="https://redirect.github.com/DeterminateSystems/nix-installer-action/pull/217">DeterminateSystems/nix-installer-action#217</a></li>
<li>Tidy up the macos runner list by <a
href="https://github.com/grahamc"><code>@​grahamc</code></a> in <a
href="https://redirect.github.com/DeterminateSystems/nix-installer-action/pull/224">DeterminateSystems/nix-installer-action#224</a></li>
<li>Update <code>detsys-ts</code>: Bumps (<a
href="https://redirect.github.com/determinatesystems/nix-installer-action/issues/131">#131</a>)
by <a
href="https://github.com/detsys-pr-bot"><code>@​detsys-pr-bot</code></a>
in <a
href="https://redirect.github.com/DeterminateSystems/nix-installer-action/pull/223">DeterminateSystems/nix-installer-action#223</a></li>
<li>Update <code>detsys-ts</code>: Bump fast-xml-parser from 5.3.3 to
5.3.4 (<a
href="https://redirect.github.com/determinatesystems/nix-installer-action/issues/134">#134</a>)
by <a
href="https://github.com/detsys-pr-bot"><code>@​detsys-pr-bot</code></a>
in <a
href="https://redirect.github.com/DeterminateSystems/nix-installer-action/pull/228">DeterminateSystems/nix-installer-action#228</a></li>
<li>Update <code>detsys-ts</code>: Bump the npm-deps group across 1
directory with 9 updates (<a
href="https://redirect.github.com/determinatesystems/nix-installer-action/issues/138">#138</a>)
by <a
href="https://github.com/detsys-pr-bot"><code>@​detsys-pr-bot</code></a>
in <a
href="https://redirect.github.com/DeterminateSystems/nix-installer-action/pull/230">DeterminateSystems/nix-installer-action#230</a></li>
<li>Update <code>detsys-ts</code>: Bump fast-xml-parser from 5.3.4 to
5.3.6 (<a
href="https://redirect.github.com/determinatesystems/nix-installer-action/issues/140">#140</a>)
by <a
href="https://github.com/detsys-pr-bot"><code>@​detsys-pr-bot</code></a>
in <a
href="https://redirect.github.com/DeterminateSystems/nix-installer-action/pull/231">DeterminateSystems/nix-installer-action#231</a></li>
<li>Update <code>detsys-ts</code>: Fix default value for Action option
(<a
href="https://redirect.github.com/determinatesystems/nix-installer-action/issues/144">#144</a>)
by <a
href="https://github.com/detsys-pr-bot"><code>@​detsys-pr-bot</code></a>
in <a
href="https://redirect.github.com/DeterminateSystems/nix-installer-action/pull/233">DeterminateSystems/nix-installer-action#233</a></li>
<li>Update <code>detsys-ts</code>: unoptional timeout (<a
href="https://redirect.github.com/determinatesystems/nix-installer-action/issues/146">#146</a>)
by <a
href="https://github.com/detsys-pr-bot"><code>@​detsys-pr-bot</code></a>
in <a
href="https://redirect.github.com/DeterminateSystems/nix-installer-action/pull/235">DeterminateSystems/nix-installer-action#235</a></li>
<li>Attach build provenance by <a
href="https://github.com/grahamc"><code>@​grahamc</code></a> in <a
href="https://redirect.github.com/DeterminateSystems/nix-installer-action/pull/236">DeterminateSystems/nix-installer-action#236</a></li>
<li>Update <code>detsys-ts</code>: Drop the old schemas and integrate
the open PRs (<a
href="https://redirect.github.com/determinatesystems/nix-installer-action/issues/162">#162</a>)
by <a
href="https://github.com/detsys-pr-bot"><code>@​detsys-pr-bot</code></a>
in <a
href="https://redirect.github.com/DeterminateSystems/nix-installer-action/pull/238">DeterminateSystems/nix-installer-action#238</a></li>
<li>Update deps, go to node24 by <a
href="https://github.com/grahamc"><code>@​grahamc</code></a> in <a
href="https://redirect.github.com/DeterminateSystems/nix-installer-action/pull/239">DeterminateSystems/nix-installer-action#239</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/andre4ik3"><code>@​andre4ik3</code></a>
made their first contribution in <a
href="https://redirect.github.com/DeterminateSystems/nix-installer-action/pull/217">DeterminateSystems/nix-installer-action#217</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/DeterminateSystems/nix-installer-action/compare/v21...v22">https://github.com/DeterminateSystems/nix-installer-action/compare/v21...v22</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/DeterminateSystems/nix-installer-action/commit/ef8a148080ab6020fd15196c2084a2eea5ff2d25"><code>ef8a148</code></a>
Update deps, go to node24 (<a
href="https://redirect.github.com/determinatesystems/nix-installer-action/issues/239">#239</a>)</li>
<li><a
href="https://github.com/DeterminateSystems/nix-installer-action/commit/e02dcf858cd1ca353a03986f1f6dc39ff9aa5ba2"><code>e02dcf8</code></a>
Update <code>detsys-ts</code>: Drop the old schemas and integrate the
open PRs (<a
href="https://redirect.github.com/determinatesystems/nix-installer-action/issues/162">#162</a>)
(#...</li>
<li><a
href="https://github.com/DeterminateSystems/nix-installer-action/commit/9a59e15a74545c99a626ba594edcd0d02189e670"><code>9a59e15</code></a>
Attach build provenance (<a
href="https://redirect.github.com/determinatesystems/nix-installer-action/issues/236">#236</a>)</li>
<li><a
href="https://github.com/DeterminateSystems/nix-installer-action/commit/d96bc962e61b3049ce8128d03d57a1144fa96539"><code>d96bc96</code></a>
Update <code>detsys-ts</code> for: <code>unoptional timeout
([open-component-model#146](https://github.com/determinatesystems/nix-installer-action/issues/146))</code>
(`a621ba724bb21cc2907e525...</li>
<li><a
href="https://github.com/DeterminateSystems/nix-installer-action/commit/874a9842e1ba38da0fc8c32421672a81e9843295"><code>874a984</code></a>
Merge pull request <a
href="https://redirect.github.com/determinatesystems/nix-installer-action/issues/233">#233</a>
from detsys-pr-bot/detsys-ts-update-d0fa3dbd59ce2872d...</li>
<li><a
href="https://github.com/DeterminateSystems/nix-installer-action/commit/1ae25535ec10252a19af344ef0f648e9ecb1c506"><code>1ae2553</code></a>
Update <code>detsys-ts</code> for: <code>Fix default value for Action
option
([open-component-model#144](https://github.com/determinatesystems/nix-installer-action/issues/144))</code>
(`d0fa3d...</li>
<li><a
href="https://github.com/DeterminateSystems/nix-installer-action/commit/d9137d7b28da568ff80d73130b026d655de5508d"><code>d9137d7</code></a>
flake.lock: Update</li>
<li><a
href="https://github.com/DeterminateSystems/nix-installer-action/commit/95f009f8cba987d36d7e3396d29de81b2883654a"><code>95f009f</code></a>
Update <code>detsys-ts</code>: Bump fast-xml-parser from 5.3.4 to 5.3.6
(<a
href="https://redirect.github.com/determinatesystems/nix-installer-action/issues/140">#140</a>)
(<a
href="https://redirect.github.com/determinatesystems/nix-installer-action/issues/231">#231</a>)</li>
<li><a
href="https://github.com/DeterminateSystems/nix-installer-action/commit/86cbc893b3c44423bb3b27da33c306deba1e1ef4"><code>86cbc89</code></a>
Update <code>detsys-ts</code>: Bump the npm-deps group across 1
directory with 9 updates...</li>
<li><a
href="https://github.com/DeterminateSystems/nix-installer-action/commit/500e7f9345c8f2d9f4e9f553c820978e6761c66b"><code>500e7f9</code></a>
Update <code>detsys-ts</code> for: <code>Bump fast-xml-parser from 5.3.3
to 5.3.4
([open-component-model#134](https://github.com/determinatesystems/nix-installer-action/issues/134))</code>
(`1...</li>
<li>Additional commits viewable in <a
href="https://github.com/determinatesystems/nix-installer-action/compare/c5a866b6ab867e88becbed4467b93592bce69f8a...ef8a148080ab6020fd15196c2084a2eea5ff2d25">compare
view</a></li>
</ul>
</details>
<br />

Updates `sigstore/cosign-installer` from 4.1.0 to 4.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/cosign-installer/releases">sigstore/cosign-installer's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.1</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: update default cosign-release to v3.0.5 in <a
href="https://redirect.github.com/sigstore/cosign-installer/pull/223">sigstore/cosign-installer#223</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/sigstore/cosign-installer/compare/v4.1.0...v4.1.1">https://github.com/sigstore/cosign-installer/compare/v4.1.0...v4.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sigstore/cosign-installer/commit/cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003"><code>cad07c2</code></a>
chore: update default cosign-release to v3.0.5 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/223">#223</a>)</li>
<li>See full diff in <a
href="https://github.com/sigstore/cosign-installer/compare/ba7bc0a3fef59531c69a25acd34668d6d3fe6f22...cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@dependabot @morrison-sap
chore(deps): bump the go group across 1 directory with 11 updates (op…
4522606 
…en-component-model#1896)

Bumps the go group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) |
`1.41.4` | `1.41.5` |
|
[github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2)
| `1.32.12` | `1.32.14` |
|
[github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager](https://github.com/aws/aws-sdk-go-v2)
| `0.1.10` | `0.1.14` |
|
[github.com/aws/aws-sdk-go-v2/service/ecr](https://github.com/aws/aws-sdk-go-v2)
| `1.56.1` | `1.56.2` |
| [github.com/docker/cli](https://github.com/docker/cli) |
`29.3.0+incompatible` | `29.3.1+incompatible` |
| [github.com/moby/moby/api](https://github.com/moby/moby) | `1.54.0` |
`1.54.1` |
| [github.com/moby/moby/client](https://github.com/moby/moby) | `0.3.0`
| `0.4.0` |
| [github.com/sigstore/cosign/v3](https://github.com/sigstore/cosign) |
`3.0.5` | `3.0.6` |

Updates `github.com/aws/aws-sdk-go-v2` from 1.41.4 to 1.41.5
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/90650dd22735ab68f6089ae5c39b6614286ae9ec"><code>90650dd</code></a>
Release 2026-03-26</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/dd88818bee7d632a8b9da6e2c78ef92e23c94c62"><code>dd88818</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/b662c50138bd393927871b46e84ee3483377f5be"><code>b662c50</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/500a9cb3522a0e71d798d7079ff5856b23c2cac1"><code>500a9cb</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/6221102f763bd65d7e403fa62c3a1e3d39e24dc6"><code>6221102</code></a>
fix stale skew and delayed skew healing (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3359">#3359</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/0a39373433a121800bc68efa743a7486eb07aa3f"><code>0a39373</code></a>
fix order of generated event header handlers (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3361">#3361</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/098f3898271e2eaaf8a92e38d1d928fb018805a6"><code>098f389</code></a>
Only generate resolveAccountID when it's required (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3360">#3360</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/6ebab66428e97db0ee252fea042d56b1313cb9f6"><code>6ebab66</code></a>
Release 2026-03-25</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/b2ec3beebb986a5e74e50d0c105119d84e1e934e"><code>b2ec3be</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/abc126f6b35bfe2f77e2505f6d04f8ceced971ee"><code>abc126f</code></a>
Update API model</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/v1.41.4...v1.41.5">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.12 to 1.32.14
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/d15107640a5073c5ce53dc395210858e316d5e82"><code>d151076</code></a>
Release 2026-04-02</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e33c9a9f67577e2dd5fcd3b15b9a8a2e83683f53"><code>e33c9a9</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e06655901c88ef90432f41a7b9c92b33b4537c75"><code>e066559</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/a635ee4303d8cac381be8788519a1a8bba5ccf12"><code>a635ee4</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/9074b3ddace9c195f00993c8ae509bc8977a6c4c"><code>9074b3d</code></a>
Release 2026-04-01</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/f6ad4c082d3a1995b9add26af4eb7553b13df252"><code>f6ad4c0</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/12a971a61d5226cd72102c66b188ae4968cb9b81"><code>12a971a</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/8bd8eee331c2fa1553e57d18d5dbbf1dc83820fc"><code>8bd8eee</code></a>
chore: add additional text to CONTRIBUTING.md (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3372">#3372</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e4deb657ddb9c5d8ac36c335391aafb19034e9de"><code>e4deb65</code></a>
Release 2026-03-31</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/1f758f207351302f9f4e1a2aa4c255a75d81446b"><code>1f758f2</code></a>
Regenerated Clients</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/config/v1.32.12...config/v1.32.14">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.19.12 to
1.19.14
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/d15107640a5073c5ce53dc395210858e316d5e82"><code>d151076</code></a>
Release 2026-04-02</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e33c9a9f67577e2dd5fcd3b15b9a8a2e83683f53"><code>e33c9a9</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e06655901c88ef90432f41a7b9c92b33b4537c75"><code>e066559</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/a635ee4303d8cac381be8788519a1a8bba5ccf12"><code>a635ee4</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/9074b3ddace9c195f00993c8ae509bc8977a6c4c"><code>9074b3d</code></a>
Release 2026-04-01</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/f6ad4c082d3a1995b9add26af4eb7553b13df252"><code>f6ad4c0</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/12a971a61d5226cd72102c66b188ae4968cb9b81"><code>12a971a</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/8bd8eee331c2fa1553e57d18d5dbbf1dc83820fc"><code>8bd8eee</code></a>
chore: add additional text to CONTRIBUTING.md (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3372">#3372</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e4deb657ddb9c5d8ac36c335391aafb19034e9de"><code>e4deb65</code></a>
Release 2026-03-31</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/1f758f207351302f9f4e1a2aa4c255a75d81446b"><code>1f758f2</code></a>
Regenerated Clients</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/service/sqs/v1.19.12...credentials/v1.19.14">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager` from
0.1.10 to 0.1.14
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/d15107640a5073c5ce53dc395210858e316d5e82"><code>d151076</code></a>
Release 2026-04-02</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e33c9a9f67577e2dd5fcd3b15b9a8a2e83683f53"><code>e33c9a9</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e06655901c88ef90432f41a7b9c92b33b4537c75"><code>e066559</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/a635ee4303d8cac381be8788519a1a8bba5ccf12"><code>a635ee4</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/9074b3ddace9c195f00993c8ae509bc8977a6c4c"><code>9074b3d</code></a>
Release 2026-04-01</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/f6ad4c082d3a1995b9add26af4eb7553b13df252"><code>f6ad4c0</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/12a971a61d5226cd72102c66b188ae4968cb9b81"><code>12a971a</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/8bd8eee331c2fa1553e57d18d5dbbf1dc83820fc"><code>8bd8eee</code></a>
chore: add additional text to CONTRIBUTING.md (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3372">#3372</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e4deb657ddb9c5d8ac36c335391aafb19034e9de"><code>e4deb65</code></a>
Release 2026-03-31</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/1f758f207351302f9f4e1a2aa4c255a75d81446b"><code>1f758f2</code></a>
Regenerated Clients</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/feature/s3/transfermanager/v0.1.10...feature/s3/transfermanager/v0.1.14">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/aws/aws-sdk-go-v2/service/ecr` from 1.56.1 to 1.56.2
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/5a964704cb2640ed57a74b9b37a53dcda7b6b7dd"><code>5a96470</code></a>
Release 2024-12-19</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/653aa807b912e104f5e1e84e0510b4dffd76c751"><code>653aa80</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/d02b239e896c5791e295c9a30a5281f56a8f7c39"><code>d02b239</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/698d709c21bc7922489aaba8c8207c9d7253c2fe"><code>698d709</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/885de40869f9bcee29ad11d60967aa0f1b571d46"><code>885de40</code></a>
Fix improper use of Printf-style functions (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/2934">#2934</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/858298a55393392fb161c5bd0ae3b9c5251996bf"><code>858298a</code></a>
Release 2024-12-18</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/f58264af808a255782999422056bccb06552dcbd"><code>f58264a</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/df31082d87044a000a1524dbb654651f32713e10"><code>df31082</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/346690ed8f5b974ab26532aa93d5fa92a58d3571"><code>346690e</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/45154546e09b48505c8798f7e5f3846ee1e0453a"><code>4515454</code></a>
Release 2024-12-17</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.56.1...service/ssm/v1.56.2">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.97.1 to 1.98.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e4deb657ddb9c5d8ac36c335391aafb19034e9de"><code>e4deb65</code></a>
Release 2026-03-31</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/1f758f207351302f9f4e1a2aa4c255a75d81446b"><code>1f758f2</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/ba7e432545fa3203d98f593b2aceaba66c02db7a"><code>ba7e432</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/607cb0afad6e6a655a356be54f9fdec5cc558a80"><code>607cb0a</code></a>
Release 2026-03-30</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/a44005fd4a2e2b7308c0346da970890757aaeda5"><code>a44005f</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/dbbd8465f03f1931d85d38af45f18362cbc4c469"><code>dbbd846</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/5b5c3f960e98cf024a8b7d6a6a8f0a1452e028fa"><code>5b5c3f9</code></a>
Revert &quot;drop service/internal/benchmark (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3368">#3368</a>)&quot;
(<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3369">#3369</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/7ca3f9d52a718e4be3a78be0d05e6437ae362e20"><code>7ca3f9d</code></a>
drop service/internal/benchmark (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3368">#3368</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/338088bc3ce801d773863578da6a0a835d6012af"><code>338088b</code></a>
Release 2026-03-27</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/f0e5f3dc09ddb548bccfc11b297229839516bff9"><code>f0e5f3d</code></a>
Regenerated Clients</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.97.1...service/s3/v1.98.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/docker/cli` from 29.3.0+incompatible to
29.3.1+incompatible
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/cli/commit/c2be9ccfc3cf0b4c4c4f0a3d5c91dd759ab21256"><code>c2be9cc</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/cli/issues/6887">#6887</a> from
thaJeztah/29.x_backport_pin_actions</li>
<li><a
href="https://github.com/docker/cli/commit/0da6a5121f81387dc7eeba18f928c7e6f3d5cd9d"><code>0da6a51</code></a>
ci: pin actions to digests</li>
<li><a
href="https://github.com/docker/cli/commit/6b3ca8fc04d2c5615735f87c41b98d331a0d9fe7"><code>6b3ca8f</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/cli/issues/6884">#6884</a> from
thaJeztah/29.x_backport_missing_buildtags</li>
<li><a
href="https://github.com/docker/cli/commit/f47603c2903fcf5c7e7d8734e5bbc0ecdc04efaf"><code>f47603c</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/cli/issues/6885">#6885</a> from
thaJeztah/29.x_backport_update_actions</li>
<li><a
href="https://github.com/docker/cli/commit/9709c8fe08f902f0aa41ffffaa00085ab39aecd8"><code>9709c8f</code></a>
build(deps): bump docker/metadata-action from 5 to 6</li>
<li><a
href="https://github.com/docker/cli/commit/af45a23fa9a06cb282294054d213b9b0fbae1ac7"><code>af45a23</code></a>
build(deps): bump docker/bake-action from 6 to 7</li>
<li><a
href="https://github.com/docker/cli/commit/bc97f5ac196f4633ffe360cfa2ab831e94dfc6f8"><code>bc97f5a</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/cli/issues/6883">#6883</a> from
thaJeztah/29.x_backport_update_go1.25.8</li>
<li><a
href="https://github.com/docker/cli/commit/6d71967120b4cdbb556211c7a2514c42dcb2e582"><code>6d71967</code></a>
cli/command: add missing &quot;go:build&quot; comments</li>
<li><a
href="https://github.com/docker/cli/commit/9b51892b8061ff03e91e8aad41e86cad21057272"><code>9b51892</code></a>
update to go1.25.8</li>
<li>See full diff in <a
href="https://github.com/docker/cli/compare/v29.3.0...v29.3.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/moby/moby/api` from 1.54.0 to 1.54.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/moby/moby/releases">github.com/moby/moby/api's
releases</a>.</em></p>
<blockquote>
<h2>api/v1.54.1</h2>
<h3>Changelog</h3>
<ul>
<li>api/types/network: add <code>Port.Port()</code> method to return the
port-number as a string. <a
href="https://redirect.github.com/moby/moby/pull/52165">moby/moby#52165</a></li>
<li>api, client: add //go:fix inline directives to deprecated functions.
<a
href="https://redirect.github.com/moby/moby/pull/52178">moby/moby#52178</a></li>
<li>api, client: go.mod: remove patch version. <a
href="https://redirect.github.com/moby/moby/pull/52174">moby/moby#52174</a></li>
<li>api/types/network: fix handling of unmapped ports (ephemeral ports).
<a
href="https://redirect.github.com/moby/moby/pull/52288">moby/moby#52288</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/moby/moby/compare/api/v1.54.0...api/v1.54.1">https://github.com/moby/moby/compare/api/v1.54.0...api/v1.54.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/moby/moby/commit/a3d12a24d680d2dccc18ff222ba560f8fef98279"><code>a3d12a2</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/52293">#52293</a>
from vvoland/dropreplace</li>
<li><a
href="https://github.com/moby/moby/commit/f1b420bf02b98fb5d19459ca7302cfc8f8a91fd2"><code>f1b420b</code></a>
Drop replace rules</li>
<li><a
href="https://github.com/moby/moby/commit/ef0a1e449505837fa27d00fcdb2a2e249bb9edc9"><code>ef0a1e4</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/52277">#52277</a>
from nvsahana/fix-typos-comments</li>
<li><a
href="https://github.com/moby/moby/commit/4436298e51b09725ccd11717ef51415222ef840b"><code>4436298</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/52172">#52172</a>
from Wang-squirrel/dev_1</li>
<li><a
href="https://github.com/moby/moby/commit/e39d2cd99caa9fadc7166253bab4f65cf0146a7e"><code>e39d2cd</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/52291">#52291</a>
from thaJeztah/update_authors_mailmap</li>
<li><a
href="https://github.com/moby/moby/commit/359ce1ca44238b67613d97a263a608308ce526c2"><code>359ce1c</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/52290">#52290</a>
from thaJeztah/client_flip_args</li>
<li><a
href="https://github.com/moby/moby/commit/07a5e924ce0a1ae7f376b2932355e0a2c62c71b3"><code>07a5e92</code></a>
Fix typos and misspellings in comments, tests, and docs</li>
<li><a
href="https://github.com/moby/moby/commit/c4937534f1c790e83af16cefb37573265494cd64"><code>c493753</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/52170">#52170</a>
from thaJeztah/no_mod</li>
<li><a
href="https://github.com/moby/moby/commit/6604bd0ddc7a44b6a597ac1a190b06faffd1344c"><code>6604bd0</code></a>
update AUTHORS and .mailmap</li>
<li><a
href="https://github.com/moby/moby/commit/88b79accf33a00c44cdfc3ffc6d04f8880957104"><code>88b79ac</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/52075">#52075</a>
from htoyoda18/fix/swarm-event-handling</li>
<li>Additional commits viewable in <a
href="https://github.com/moby/moby/compare/api/v1.54.0...api/v1.54.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/moby/moby/client` from 0.3.0 to 0.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/moby/moby/releases">github.com/moby/moby/client's
releases</a>.</em></p>
<blockquote>
<h2>client/v0.4.0</h2>
<h2>v0.4.0</h2>
<h3>Bug fixes and enhancements</h3>
<ul>
<li>api, client: add <code>//go:fix inline</code> directives to
deprecated functions to help automatically migrating using <code>go
fix</code>. <a
href="https://redirect.github.com/moby/moby/pull/52178">moby/moby#52178</a></li>
<li>client/pkg/jsonmessage: add <code>DisplayStream</code> and
<code>DisplayMessages</code> utils. <a
href="https://redirect.github.com/moby/moby/pull/52273">moby/moby#52273</a></li>
<li>client/pkg/jsonmessage: use functional options for display funcs. <a
href="https://redirect.github.com/moby/moby/pull/52285">moby/moby#52285</a></li>
<li>client: prevent panic when passing <code>nil</code> Opts to
<code>client.New</code>. <a
href="https://redirect.github.com/moby/moby/pull/52184">moby/moby#52184</a></li>
<li>client: the client now sets a default User-Agent if none was set, to
prevent Go's default (<code>Go-http-client/1.1</code>) from being used.
<a
href="https://redirect.github.com/moby/moby/pull/52167">moby/moby#52167</a></li>
<li>Fix <code>/system/df</code> reporting in-use images as reclaimable.
<a
href="https://redirect.github.com/moby/moby/pull/51778">moby/moby#51778</a></li>
<li>Go SDK: client.WithHTTPHeaders now detects if duplicate headers are
set, and produces an error. Previously, duplicate errors would be
randomized, resulting in undefined behavior. <a
href="https://redirect.github.com/moby/moby/pull/52204">moby/moby#52204</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/moby/moby/compare/client/v0.3.0...client/v0.4.0">https://github.com/moby/moby/compare/client/v0.3.0...client/v0.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/moby/moby/blob/v0.4.0/CHANGELOG.md">github.com/moby/moby/client's
changelog</a>.</em></p>
<blockquote>
<h2>0.4.0 (2013-06-03)</h2>
<ul>
<li>Introducing Builder: 'docker build' builds a container, layer by
layer, from a source repository containing a Dockerfile</li>
<li>Introducing Remote API: control Docker programmatically using a
simple HTTP/json API</li>
</ul>
<ul>
<li>Runtime: various reliability and usability improvements</li>
</ul>
<h2>0.3.4 (2013-05-30)</h2>
<ul>
<li>Builder: 'docker build' builds a container, layer by layer, from a
source repository containing a Dockerfile</li>
<li>Builder: 'docker build -t FOO' applies the tag FOO to the newly
built container.</li>
<li>Runtime: interactive TTYs correctly handle window resize</li>
</ul>
<ul>
<li>Runtime: fix how configuration is merged between layers</li>
</ul>
<ul>
<li>Remote API: split stdout and stderr on 'docker run'</li>
<li>Remote API: optionally listen on a different IP and port (use at
your own risk)</li>
</ul>
<ul>
<li>Documentation: improved install instructions.</li>
</ul>
<h2>0.3.3 (2013-05-23)</h2>
<ul>
<li>Registry: Fix push regression</li>
<li>Various bugfixes</li>
</ul>
<h2>0.3.2 (2013-05-09)</h2>
<ul>
<li>Runtime: Store the actual archive on commit</li>
<li>Registry: Improve the checksum process</li>
<li>Registry: Use the size to have a good progress bar while
pushing</li>
<li>Registry: Use the actual archive if it exists in order to speed up
the push</li>
</ul>
<ul>
<li>Registry: Fix error 400 on push</li>
</ul>
<h2>0.3.1 (2013-05-08)</h2>
<ul>
<li>Builder: Implement the autorun capability within docker builder</li>
<li>Builder: Add caching to docker builder</li>
<li>Builder: Add support for docker builder with native API as top level
command</li>
<li>Runtime: Add go version to debug infos</li>
<li>Builder: Implement ENV within docker builder</li>
<li>Registry: Add docker search top level command in order to search a
repository</li>
<li>Images: output graph of images to dot (graphviz)</li>
<li>Documentation: new introduction and high-level overview</li>
<li>Documentation: Add the documentation for docker builder</li>
<li>Website: new high-level overview</li>
</ul>
<ul>
<li>Makefile: Swap &quot;go get&quot; for &quot;go get -d&quot;,
especially to compile on go1.1rc</li>
<li>Images: fix ByParent function</li>
<li>Builder: Check the command existance prior create and add Unit tests
for the case</li>
<li>Registry: Fix pull for official images with specific tag</li>
<li>Registry: Fix issue when login in with a different user and trying
to push</li>
<li>Documentation: CSS fix for docker documentation to make REST API
docs look better.</li>
<li>Documentation: Fixed CouchDB example page header mistake</li>
<li>Documentation: fixed README formatting</li>
</ul>
<ul>
<li>Registry: Improve checksum - async calculation</li>
<li>Runtime: kernel version - don't show the dash if flavor is
empty</li>
<li>Documentation: updated <a
href="http://www.docker.io">www.docker.io</a> website.</li>
<li>Builder: use any whitespaces instead of tabs</li>
<li>Packaging: packaging ubuntu; issue <a
href="https://redirect.github.com/moby/moby/issues/510">#510</a>: Use
goland-stable PPA package to build docker</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/moby/moby/commit/a8ae398bf52e97148ee7bd0d5868de2e15bd297f"><code>a8ae398</code></a>
Bumped version to 0.4.0</li>
<li><a
href="https://github.com/moby/moby/commit/7a4408f608a6500cc784801616eb8c034b052e04"><code>7a4408f</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/794">#794</a> from
dotcloud/780-diff-fix2</li>
<li><a
href="https://github.com/moby/moby/commit/854039b6ba9c707af07f9966b39150ce23150920"><code>854039b</code></a>
remove TrimLeft as it's go1.1</li>
<li><a
href="https://github.com/moby/moby/commit/070923b14f734fe14bec4f0a4cd406f0101671d3"><code>070923b</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/792">#792</a> from
dotcloud/780-diff-fix</li>
<li><a
href="https://github.com/moby/moby/commit/71b1657e8d22b6dfa0a426f6244c6a3101f66bc4"><code>71b1657</code></a>
added test</li>
<li><a
href="https://github.com/moby/moby/commit/1bafe9da26c9f4671dbdf54f4a45956dd01f1d7d"><code>1bafe9d</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/793">#793</a> from
dotcloud/774-remove_login_check_on_pull-fix</li>
<li><a
href="https://github.com/moby/moby/commit/1ce4ba6c9f381f7931615644675b0cad33e74492"><code>1ce4ba6</code></a>
remove check on login</li>
<li><a
href="https://github.com/moby/moby/commit/2b1b3c1270c41a1c4c71ba2be9f33af68ea22861"><code>2b1b3c1</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/784">#784</a> from
dotcloud/remove_cgo_dependency</li>
<li><a
href="https://github.com/moby/moby/commit/8243f2510e0ff0af8df18bf0febab819529106d4"><code>8243f25</code></a>
Update test to reflect new ApiInfo struct</li>
<li><a
href="https://github.com/moby/moby/commit/0443cc351d1202063c79a4de5497878f9a9e674e"><code>0443cc3</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/772">#772</a> from
dotcloud/improve_version_info_cmds</li>
<li>Additional commits viewable in <a
href="https://github.com/moby/moby/compare/v0.3.0...v0.4.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/sigstore/cosign/v3` from 3.0.5 to 3.0.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.0.6</h2>
<h2>Changelog</h2>
<p>v3.0.6 resolves <a
href="https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6">GHSA-w6c6-c85g-mmv6</a>.
This release also adds support for signing with OpenBao-managed
keys.</p>
<ul>
<li>f1ad3ee952313be5d74a49d67ba0aa8d0d5e351f Fix DSSE predicate check
(GHSA-w6c6-c85g-mmv6) (<a
href="https://redirect.github.com/sigstore/cosign/issues/4801">#4801</a>)</li>
<li>a09afa97480a0a4a20ad6314600598b7bddc8c0c Handle whitespace-only
certificate annotation (<a
href="https://redirect.github.com/sigstore/cosign/issues/4760">#4760</a>)</li>
<li>5a38a6d3368f0286ef214c3fd81388c99b3444b8 fix(sign): closing
SignerVerifier too early when signing with a security key (<a
href="https://redirect.github.com/sigstore/cosign/issues/4761">#4761</a>)</li>
<li>2290a593c9f5b300322b83e1f2a632953aeb840c Disallow
--new-bundle-format and --rfc3161-timestamp (<a
href="https://redirect.github.com/sigstore/cosign/issues/4762">#4762</a>)</li>
<li>36f40082f3c507e131cb9d926b75b36606160483 support managed keys in
conformance testing (<a
href="https://redirect.github.com/sigstore/cosign/issues/4728">#4728</a>)</li>
<li>3274cf98c6a2c2fc12618edfa26612e8a071820a Add support for GCE
metadata server env var (<a
href="https://redirect.github.com/sigstore/cosign/issues/4732">#4732</a>)</li>
<li>2e9754aa80a54fe7062a63debe12ae2b11b87e5a fix: preserve per-layer
annotations in WriteAttestationsReferrer (<a
href="https://redirect.github.com/sigstore/cosign/issues/4709">#4709</a>)</li>
<li>dece2753067e2da18c5e0a0060e0de59fedee0b0 Fix parsing of in-toto for
string predicates</li>
<li>bd4f0fde48c16d2c55ad82acf34166a39be262a8 Mark batch of flags for
deprecation (<a
href="https://redirect.github.com/sigstore/cosign/issues/4698">#4698</a>)</li>
<li>9b259ff6b690c0f0844893016cd23c2c250124f2 disallow key and cert
identity being used together during verification (<a
href="https://redirect.github.com/sigstore/cosign/issues/4636">#4636</a>)</li>
<li>95eb1c3155b7ad11cc443c5a26f37eeede244e66 support key creation in
GitLab group (<a
href="https://redirect.github.com/sigstore/cosign/issues/4704">#4704</a>)</li>
</ul>
<h3>Thanks to all contributors!</h3>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sigstore/cosign/commit/f1ad3ee952313be5d74a49d67ba0aa8d0d5e351f"><code>f1ad3ee</code></a>
Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (<a
href="https://redirect.github.com/sigstore/cosign/issues/4801">#4801</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/2b396bdfc8668e37debe77449fc1dc707a74696e"><code>2b396bd</code></a>
chore(deps): bump gitlab.com/gitlab-org/api/client-go (<a
href="https://redirect.github.com/sigstore/cosign/issues/4757">#4757</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/eb5b1477ef826298abfd57afdbfba746d965e7fb"><code>eb5b147</code></a>
chore(deps): bump the gomod group across 1 directory with 18 updates (<a
href="https://redirect.github.com/sigstore/cosign/issues/4789">#4789</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/fb66c28fbad8238f5980c54188d0f500f1ab6e36"><code>fb66c28</code></a>
fix(deps): CVE-2026-2303 / CVE-2026-2303 (<a
href="https://redirect.github.com/sigstore/cosign/issues/4764">#4764</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/f3d74d48873468c33dfadf45132295972a0cf888"><code>f3d74d4</code></a>
Fix 'the' typo in copyright name (<a
href="https://redirect.github.com/sigstore/cosign/issues/4788">#4788</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/f4766a94d2f905398c73dc6b6e1df9c3c97a4984"><code>f4766a9</code></a>
chore(deps): bump the actions group across 1 directory with 5 updates
(<a
href="https://redirect.github.com/sigstore/cosign/issues/4784">#4784</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/4c9ba21b465b07ed03da06ebb7a5ef3e4e5913fc"><code>4c9ba21</code></a>
chore(deps): bump chainguard-dev/actions in the actions group (<a
href="https://redirect.github.com/sigstore/cosign/issues/4772">#4772</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/af30fe6fa838cd1f29f5ee03a90dcb781f0f3872"><code>af30fe6</code></a>
chore(deps): bump
github.com/awslabs/amazon-ecr-credential-helper/ecr-login</li>
<li><a
href="https://github.com/sigstore/cosign/commit/92084d8343055629221f1b955ae204d79bd02994"><code>92084d8</code></a>
chore(deps): bump cuelang.org/go from 0.15.4 to 0.16.0</li>
<li><a
href="https://github.com/sigstore/cosign/commit/43a96828396604e51f1b7b261f8d8dcf84c9abb1"><code>43a9682</code></a>
chore(deps): bump github.com/open-policy-agent/opa from 1.13.2 to
1.14.1</li>
<li>Additional commits viewable in <a
href="https://github.com/sigstore/cosign/compare/v3.0.5...v3.0.6">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/sigstore/sigstore` from 1.10.4 to 1.10.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/sigstore/releases">github.com/sigstore/sigstore's
releases</a>.</em></p>
<blockquote>
<h2>v1.10.5</h2>
<h2>What's Changed</h2>
<ul>
<li>(kms/hashivault): add openbao support in <a
href="https://redirect.github.com/sigstore/sigstore/pull/2303">sigstore/sigstore#2303</a></li>
<li>Fix typo in RSA PSS 4096 signature identifier in <a
href="https://redirect.github.com/sigstore/sigstore/pull/2270">sigstore/sigstore#2270</a></li>
<li>fix: eliminate usage of text/template in <a
href="https://redirect.github.com/sigstore/sigstore/pull/2288">sigstore/sigstore#2288</a></li>
<li>chore: mention openbao being supported as well (<a
href="https://redirect.github.com/sigstore/sigstore/issues/2303">#2303</a>)
in <a
href="https://redirect.github.com/sigstore/sigstore/pull/2313">sigstore/sigstore#2313</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/sigstore/sigstore/compare/v1.10.4...v1.10.5">https://github.com/sigstore/sigstore/compare/v1.10.4...v1.10.5</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sigstore/sigstore/commit/c90de3e0ff9589400dbbee639d3180b3c5ee96b6"><code>c90de3e</code></a>
chore: mention openbao being supported as well (<a
href="https://redirect.github.com/sigstore/sigstore/issues/2313">#2313</a>)
(<a
href="https://redirect.github.com/sigstore/sigstore/issues/2313">#2313</a>)</li>
<li><a
href="https://github.com/sigstore/sigstore/commit/b377f8f4c65ce587cba26d795dda4b48827bacb2"><code>b377f8f</code></a>
chore: Project-wide linting (<a
href="https://redirect.github.com/sigstore/sigstore/issues/2310">#2310</a>)</li>
<li><a
href="https://github.com/sigstore/sigstore/commit/295d6565c1b8f8ccfd3edad0b02261a8ad2fb165"><code>295d656</code></a>
build(deps): Bump the all group across 1 directory with 3 updates (<a
href="https://redirect.github.com/sigstore/sigstore/issues/2296">#2296</a>)</li>
<li><a
href="https://github.com/sigstore/sigstore/commit/c73103207d9c5dc8271d0c431f5b863785a016e1"><code>c731032</code></a>
(kms/hashivault): add openbao support (<a
href="https://redirect.github.com/sigstore/sigstore/issues/2303">#2303</a>)</li>
<li><a
href="https://github.com/sigstore/sigstore/commit/b56c8664d026358a77a52f88832759047eba7e85"><code>b56c866</code></a>
fix: eliminate usage of text/template (<a
href="https://redirect.github.com/sigstore/sigstore/issues/2288">#2288</a>)</li>
<li><a
href="https://github.com/sigstore/sigstore/commit/1d8faff85795ce7679df89a6d78afcc0b0185aa9"><code>1d8faff</code></a>
build(deps): Bump github.com/aws/aws-sdk-go-v2/config (<a
href="https://redirect.github.com/sigstore/sigstore/issues/2286">#2286</a>)</li>
<li><a
href="https://github.com/sigstore/sigstore/commit/4ac5776a42894e62e8e39cea5fcf1a4f5e295880"><code>4ac5776</code></a>
build(deps): Bump github.com/letsencrypt/boulder (<a
href="https://redirect.github.com/sigstore/sigstore/issues/2282">#2282</a>)</li>
<li><a
href="https://github.com/sigstore/sigstore/commit/36276e88ed3ba5b8769ce9d323ef8f9efb51156e"><code>36276e8</code></a>
build(deps): Bump golang.org/x/crypto from 0.44.0 to 0.47.0 (<a
href="https://redirect.github.com/sigstore/sigstore/issues/2258">#2258</a>)</li>
<li><a
href="https://github.com/sigstore/sigstore/commit/59887c9383c9348c1c49627e7fb2177231873487"><code>59887c9</code></a>
build(deps): Bump the all group across 1 directory with 2 updates (<a
href="https://redirect.github.com/sigstore/sigstore/issues/2278">#2278</a>)</li>
<li><a
href="https://github.com/sigstore/sigstore/commit/1e854038e1ef28f8c5c247cb03755d3e1df5ebff"><code>1e85403</code></a>
build(deps): Bump dexidp/dex in /test/e2e in the all group (<a
href="https://redirect.github.com/sigstore/sigstore/issues/2279">#2279</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/sigstore/sigstore/compare/v1.10.4...v1.10.5">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@ocmbot @morrison-sap
chore: update 'flake.nix' (open-component-model#1895)
719a7e1 
Update OCM CLI vendor hash (see:
.github/workflows/flake_vendorhash.yaml)

Co-authored-by: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@frewilhelm @morrison-sap
chore(deps): migrate github.com/containers/image (open-component-mode…
73db3de 
…l#1898)

<!-- markdownlint-disable MD041 -->
#### What this PR does / why we need it

`github.com/containers/image` is no longer maintained because it was
moved to the monorepository
https://github.com/containers/container-libs. Hence, we migrate to the
recommended import path `go.podman.io/image/v5`.

#### Which issue(s) this PR is related to

Fixes open-component-model#1897

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@ocmbot @morrison-sap
chore: update 'flake.nix' (open-component-model#1899)
84a3bfb 
Update OCM CLI vendor hash (see:
.github/workflows/flake_vendorhash.yaml)

Co-authored-by: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@ocmbot @morrison-sap
chore: bump VERSION to 0.41.0-dev (open-component-model#1900)
ce605fc 
Update OCM Version to 0.41.0-dev

This makes sure that the branch contains the next valid version.

This is a minor bump, the next release will be a new minor version and
signals opening of the development branch for new features.

Co-authored-by: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@dependabot @morrison-sap
chore(deps): bump go.opentelemetry.io/otel/sdk from 1.41.0 to 1.43.0 (o…
6e6b534 
…pen-component-model#1902)

Bumps
[go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go)
from 1.41.0 to 1.43.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>[1.43.0/0.65.0/0.19.0] 2026-04-02</h2>
<h3>Added</h3>
<ul>
<li>Add <code>IsRandom</code> and <code>WithRandom</code> on
<code>TraceFlags</code>, and <code>IsRandom</code> on
<code>SpanContext</code> in <code>go.opentelemetry.io/otel/trace</code>
for <a
href="https://www.w3.org/TR/trace-context-2/#random-trace-id-flag">W3C
Trace Context Level 2 Random Trace ID Flag</a> support. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8012">#8012</a>)</li>
<li>Add service detection with <code>WithService</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7642">#7642</a>)</li>
<li>Add <code>DefaultWithContext</code> and
<code>EnvironmentWithContext</code> in
<code>go.opentelemetry.io/otel/sdk/resource</code> to support plumbing
<code>context.Context</code> through default and environment detectors.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8051">#8051</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Support attributes with empty value (<code>attribute.EMPTY</code>)
in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Add support for per-series start time tracking for cumulative
metrics in <code>go.opentelemetry.io/otel/sdk/metric</code>.
Set <code>OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true</code> to enable.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8060">#8060</a>)</li>
<li>Add <code>WithCardinalityLimitSelector</code> for metric reader for
configuring cardinality limits specific to the instrument kind. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7855">#7855</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Introduce the <code>EMPTY</code> Type in
<code>go.opentelemetry.io/otel/attribute</code> to reflect that an empty
value is now a valid value, with <code>INVALID</code> remaining as a
deprecated alias of <code>EMPTY</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
<li>Improve slice handling in
<code>go.opentelemetry.io/otel/attribute</code> to optimize short slice
values with fixed-size fast paths. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8039">#8039</a>)</li>
<li>Improve performance of span metric recording in
<code>go.opentelemetry.io/otel/sdk/trace</code> by returning early if
self-observability is not enabled. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8067">#8067</a>)</li>
<li>Improve formatting of metric data diffs in
<code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8073">#8073</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>INVALID</code> in
<code>go.opentelemetry.io/otel/attribute</code>. Use <code>EMPTY</code>
instead. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Return spec-compliant <code>TraceIdRatioBased</code> description.
This is a breaking behavioral change, but it is necessary to
make the implementation <a
href="https://opentelemetry.io/docs/specs/otel/trace/sdk/#traceidratiobased">spec-compliant</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8027">#8027</a>)</li>
<li>Fix a race condition in
<code>go.opentelemetry.io/otel/sdk/metric</code> where the lastvalue
aggregation could collect the value 0 even when no zero-value
measurements were recorded. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8056">#8056</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li>Limit HTTP response body to 4 MiB in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to mitigate excessive memory usage caused by a misconfigured or
malicious server.
Responses exceeding the limit are treated as non-retryable errors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li><code>WithHostID</code> detector in
<code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for
<code>kenv</code> command on BSD. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>
to correctly handle HTTP2 GOAWAY frame. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li>
</ul>
<h2>[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/otel/semconv/v1.40.0</code> package.
The package contains semantic conventions from the <code>v1.40.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.40.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.39.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7985">#7985</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/9276201a64b623606e3eaa0d61ae8ee6d62756c0"><code>9276201</code></a>
Release v1.43.0 / v0.65.0 / v0.19.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8128">#8128</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/61b8c9466c4e6b17e69b622279fe9b63fb15c89a"><code>61b8c94</code></a>
chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8131">#8131</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/97a086e82ffe01502f4c620e9c447efa229e2a23"><code>97a086e</code></a>
chore(deps): update github.com/golangci/dupl digest to c99c5cf (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8122">#8122</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/5e363de517dba6db62736b2f5cdef0e0929b4cd0"><code>5e363de</code></a>
limit response body size for OTLP HTTP exporters (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/35214b60138eac8dec97a2d2b851d8c8471680c7"><code>35214b6</code></a>
Use an absolute path when calling bsd kenv (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/290024ceaf695f9cdbf29a0c6731a317d92bc361"><code>290024c</code></a>
fix(deps): update module google.golang.org/grpc to v1.80.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8121">#8121</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/e70658e098033d6bb5ec1b399de16bbb2642f6dc"><code>e70658e</code></a>
fix: support getBody in otelploghttp (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/4afe468e3b4859c949a1c1e8d92684d43d86ef8a"><code>4afe468</code></a>
fix(deps): update googleapis to 9d38bb4 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8117">#8117</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/b9ca729776309e3c08fe700c131797a3b4d10634"><code>b9ca729</code></a>
chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8115">#8115</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/69472ec56cb7674d55ca2e2bcb04dea73228ab79"><code>69472ec</code></a>
chore(deps): update fossas/fossa-action action to v1.9.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8118">#8118</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.41.0...v1.43.0">compare
view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/otel/sdk&package-manager=go_modules&previous-version=1.41.0&new-version=1.43.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-component-model/ocm/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@ocmbot @morrison-sap
chore: update 'flake.nix' (open-component-model#1903)
7b8cfda 
Update OCM CLI vendor hash (see:
.github/workflows/flake_vendorhash.yaml)

Co-authored-by: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@dependabot @morrison-sap
chore(deps): bump codelytv/pr-size-labeler from 1.10.3 to 1.10.4 in t…
4b0c330 
…he ci group (open-component-model#1904)

Bumps the ci group with 1 update:
[codelytv/pr-size-labeler](https://github.com/codelytv/pr-size-labeler).

Updates `codelytv/pr-size-labeler` from 1.10.3 to 1.10.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/codelytv/pr-size-labeler/releases">codelytv/pr-size-labeler's
releases</a>.</em></p>
<blockquote>
<h2>v1.10.4</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: avoid accumulating PR size labeler related labels by <a
href="https://github.com/alexisribot"><code>@​alexisribot</code></a> in
<a
href="https://redirect.github.com/CodelyTV/pr-size-labeler/pull/97">CodelyTV/pr-size-labeler#97</a>
solving <a
href="https://redirect.github.com/CodelyTV/pr-size-labeler/issues/96">CodelyTV/pr-size-labeler#96</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/manishprivet"><code>@​manishprivet</code></a>
made their first contribution in <a
href="https://redirect.github.com/CodelyTV/pr-size-labeler/pull/97">CodelyTV/pr-size-labeler#97</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/CodelyTV/pr-size-labeler/compare/v1.10.3...v1.10.4">https://github.com/CodelyTV/pr-size-labeler/compare/v1.10.3...v1.10.4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/CodelyTV/pr-size-labeler/commit/095a41fca88b8764fd9e008ad269bcdb82bb38b9"><code>095a41f</code></a>
fix: avoid accumulating PR size labeler related labels (<a
href="https://redirect.github.com/codelytv/pr-size-labeler/issues/97">#97</a>)</li>
<li>See full diff in <a
href="https://github.com/codelytv/pr-size-labeler/compare/4ec67706cd878fbc1c8db0a5dcd28b6bb412e85a...095a41fca88b8764fd9e008ad269bcdb82bb38b9">compare
view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=codelytv/pr-size-labeler&package-manager=github_actions&previous-version=1.10.3&new-version=1.10.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
dependabot Bot added 4 commits April 14, 2026 12:47
@dependabot @morrison-sap
chore(deps): bump helm.sh/helm/v4 from 4.1.3 to 4.1.4 (open-component…
bc16e55 
…-model#1908)

Bumps [helm.sh/helm/v4](https://github.com/helm/helm) from 4.1.3 to
4.1.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/helm/helm/releases">helm.sh/helm/v4's
releases</a>.</em></p>
<blockquote>
<p>Helm v4.1.4 is a security fix patch release. Users are encouraged to
upgrade for the best experience.</p>
<p>The community keeps growing, and we'd love to see you there!</p>
<ul>
<li>Join the discussion in <a
href="https://kubernetes.slack.com">Kubernetes Slack</a>:
<ul>
<li>for questions and just to hang out</li>
<li>for discussing PRs, code, and bugs</li>
</ul>
</li>
<li>Hang out at the Public Developer Call: Thursday, 9:30 Pacific via <a
href="https://zoom.us/j/696660622">Zoom</a></li>
<li>Test, debug, and contribute charts: <a
href="https://artifacthub.io/packages/search?kind=0">ArtifactHub/packages</a></li>
</ul>
<h2>Security fixes</h2>
<ul>
<li><a
href="https://github.com/helm/helm/security/advisories/GHSA-hr2v-4r36-88hr">GHSA-hr2v-4r36-88hr
</a> Helm Chart extraction output directory collapse via
<code>Chart.yaml</code> name dot-segment</li>
<li><a
href="https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7">GHSA-q5jf-9vfq-h4h7</a>
Plugin verification fails open when <code>.prov</code> is missing,
allowing unsigned plugin install</li>
<li><a
href="https://github.com/helm/helm/security/advisories/GHSA-vmx8-mqv2-9gmg">GHSA-vmx8-mqv2-9gmg</a>
Path traversal in plugin metadata version enables arbitrary file write
outside Helm plugin directory</li>
</ul>
<p>A big thank you to the reporters of these issues (<a
href="https://github.com/maru1009"><code>@​maru1009</code></a>, <a
href="https://github.com/1seal"><code>@​1seal</code></a>).</p>
<h2>Installation and Upgrading</h2>
<p>Download Helm v4.1.4. The common platform binaries are here:</p>
<ul>
<li><a href="https://get.helm.sh/helm-v4.1.4-darwin-amd64.tar.gz">MacOS
amd64</a> (<a
href="https://get.helm.sh/helm-v4.1.4-darwin-amd64.tar.gz.sha256sum">checksum</a>
/ abf09c8503ad1d8ef76d3737a058c3456a998aae5f5966fce4bb3031aeb1654e)</li>
<li><a href="https://get.helm.sh/helm-v4.1.4-darwin-arm64.tar.gz">MacOS
arm64</a> (<a
href="https://get.helm.sh/helm-v4.1.4-darwin-arm64.tar.gz.sha256sum">checksum</a>
/ 7c2eca678e8001fa863cdf8cbf6ac1b3799f9404a89eb55c08260ef5732e658d)</li>
<li><a href="https://get.helm.sh/helm-v4.1.4-linux-amd64.tar.gz">Linux
amd64</a> (<a
href="https://get.helm.sh/helm-v4.1.4-linux-amd64.tar.gz.sha256sum">checksum</a>
/ 70b2c30a19da4db264dfd68c8a3664e05093a361cefd89572ffb36f8abfa3d09)</li>
<li><a href="https://get.helm.sh/helm-v4.1.4-linux-arm.tar.gz">Linux
arm</a> (<a
href="https://get.helm.sh/helm-v4.1.4-linux-arm.tar.gz.sha256sum">checksum</a>
/ c4a7d37032379cc7e82c9c76487d1041b193c9a0fbb4b8f3790230899b830a4f)</li>
<li><a href="https://get.helm.sh/helm-v4.1.4-linux-arm64.tar.gz">Linux
arm64</a> (<a
href="https://get.helm.sh/helm-v4.1.4-linux-arm64.tar.gz.sha256sum">checksum</a>
/ 13d03672be289045d2ff00e4e345d61de1c6f21c1257a45955a30e8ae036d8f1)</li>
<li><a href="https://get.helm.sh/helm-v4.1.4-linux-386.tar.gz">Linux
i386</a> (<a
href="https://get.helm.sh/helm-v4.1.4-linux-386.tar.gz.sha256sum">checksum</a>
/ 3e9bcefb85293854367bea931d669bb742974bbd978b3960df921ed129ff40f9)</li>
<li><a href="https://get.helm.sh/helm-v4.1.4-linux-ppc64le.tar.gz">Linux
ppc64le</a> (<a
href="https://get.helm.sh/helm-v4.1.4-linux-ppc64le.tar.gz.sha256sum">checksum</a>
/ 35a48f5db5c655b4471b37be75e76bfb2b23fc8a95d0fa2f0f344f0694336358)</li>
<li><a href="https://get.helm.sh/helm-v4.1.4-linux-s390x.tar.gz">Linux
s390x</a> (<a
href="https://get.helm.sh/helm-v4.1.4-linux-s390x.tar.gz.sha256sum">checksum</a>
/ c5653d0b3687f008dc48f80219906b574af3b623ddc114f92383327299ad935e)</li>
<li><a href="https://get.helm.sh/helm-v4.1.4-linux-riscv64.tar.gz">Linux
riscv64</a> (<a
href="https://get.helm.sh/helm-v4.1.4-linux-riscv64.tar.gz.sha256sum">checksum</a>
/ 9d747ed5761a6a5c15aa7ad108b65aee917d8e33448690e83a6451b6a48748e6)</li>
<li><a href="https://get.helm.sh/helm-v4.1.4-windows-amd64.zip">Windows
amd64</a> (<a
href="https://get.helm.sh/helm-v4.1.4-windows-amd64.zip.sha256sum">checksum</a>
/ bd60f567f667631a2c9b698dfabe5e3cd52eaaf4264163c0a9cae566db8560e8)</li>
<li><a href="https://get.helm.sh/helm-v4.1.4-windows-arm64.zip">Windows
arm64</a> (<a
href="https://get.helm.sh/helm-v4.1.4-windows-arm64.zip.sha256sum">checksum</a>
/ d0a651026da4a26b28bdfc3d455ce3dfacbc267182dc2225c2172b1dcc549643)</li>
</ul>
<p>The <a href="https://helm.sh/docs/intro/quickstart/">Quickstart
Guide</a> will get you going from there. For <strong>upgrade
instructions</strong> or detailed installation notes, check the <a
href="https://helm.sh/docs/intro/install/">install guide</a>. You can
also use a <a
href="https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4">script
to install</a> on any system with <code>bash</code>.</p>
<h2>What's Next</h2>
<ul>
<li>4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be
on April 8, 2026</li>
<li>4.2.0 and 3.21.0 are the next minor (feature) releases and will be
on May 13, 2026</li>
</ul>
<h2>Changelog</h2>
<ul>
<li>fix: Plugin missing provenance bypass
05fa37973dc9e42b76e1d2883494c87174b6074f (George Jenkins)</li>
<li>fix: Chart dot-name path bug
4e7994d4467182f535b6797c94b5b0e994a91436 (George Jenkins)</li>
<li>ignore error plugin loads (cli, getter)
25819432bf87ac0b54f0d3fa54982add2cac609e (George Jenkins)</li>
<li>fix: Plugin version path traversal
36c8539e99bc42d7aef9b87d136254662d04f027 (George Jenkins)</li>
<li>fix: pin codeql-action/upload-sarif to commit SHA in scorecards
workflow c61e0860ec797330a4c26a78dde7020cdc6743b1 (Terry Howe)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f"><code>05fa379</code></a>
fix: Plugin missing provenance bypass</li>
<li><a
href="https://github.com/helm/helm/commit/4e7994d4467182f535b6797c94b5b0e994a91436"><code>4e7994d</code></a>
fix: Chart dot-name path bug</li>
<li><a
href="https://github.com/helm/helm/commit/25819432bf87ac0b54f0d3fa54982add2cac609e"><code>2581943</code></a>
ignore error plugin loads (cli, getter)</li>
<li><a
href="https://github.com/helm/helm/commit/36c8539e99bc42d7aef9b87d136254662d04f027"><code>36c8539</code></a>
fix: Plugin version path traversal</li>
<li><a
href="https://github.com/helm/helm/commit/c61e0860ec797330a4c26a78dde7020cdc6743b1"><code>c61e086</code></a>
fix: pin codeql-action/upload-sarif to commit SHA in scorecards
workflow</li>
<li>See full diff in <a
href="https://github.com/helm/helm/compare/v4.1.3...v4.1.4">compare
view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=helm.sh/helm/v4&package-manager=go_modules&previous-version=4.1.3&new-version=4.1.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-component-model/ocm/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@dependabot @morrison-sap
chore(deps): bump the go group with 9 updates (open-component-model#1909
8efdd44 
)

Bumps the go group with 9 updates:

| Package | From | To |
| --- | --- | --- |
|
[github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager](https://github.com/aws/aws-sdk-go-v2)
| `0.1.14` | `0.1.15` |
|
[github.com/aws/aws-sdk-go-v2/service/ecr](https://github.com/aws/aws-sdk-go-v2)
| `1.56.2` | `1.57.0` |
|
[github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2)
| `1.98.0` | `1.99.0` |
| [github.com/docker/cli](https://github.com/docker/cli) |
`29.3.1+incompatible` | `29.4.0+incompatible` |
|
[github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go)
| `0.41.0` | `0.42.0` |
|
[github.com/testcontainers/testcontainers-go/modules/registry](https://github.com/testcontainers/testcontainers-go)
| `0.41.0` | `0.42.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.49.0` |
`0.50.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.52.0` |
`0.53.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.35.0` |
`0.36.0` |

Updates `github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager` from
0.1.14 to 0.1.15
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/159f4d23fd3150aa3b14c231c434f46f42b72c2a"><code>159f4d2</code></a>
Release 2026-04-07</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/50223dc5168c2eb6316a108f23a7fd0803afba76"><code>50223dc</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/af25337605d0de4dc7f4141c6b1627ec31254415"><code>af25337</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/277dc017b3b8ea944865ffb901eea3bf82121f5d"><code>277dc01</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/22bc35ca5a2af77140a47680f80873b4d61b6551"><code>22bc35c</code></a>
Release 2026-04-06</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/9a35fedd65d0cdad42281199a7659146234893a1"><code>9a35fed</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/867b085ecb8579affb591d0e98bbe362376ce911"><code>867b085</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/61d367c87617dbe79f6cb8fe8809d09ce949d2fa"><code>61d367c</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/8560a07e8b7ed78b0962b6df18050500a32705e7"><code>8560a07</code></a>
Release 2026-04-03</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/a5aafdff76b34debb6940077fc4377ed80d24805"><code>a5aafdf</code></a>
Regenerated Clients</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/feature/s3/transfermanager/v0.1.14...feature/s3/transfermanager/v0.1.15">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/aws/aws-sdk-go-v2/service/ecr` from 1.56.2 to 1.57.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/7c25c211744bdcff47a7203a7a894b1241f9da50"><code>7c25c21</code></a>
Release 2024-06-26</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/b374423feaf0b04f01c7624b10915871e589b8a1"><code>b374423</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/923f54ea6016e1c70ad45ba0854e7361a72c3ba6"><code>923f54e</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/5f3bdfcf190150f62a7a07a03bc32d9c58a68f2e"><code>5f3bdfc</code></a>
track changes for string_array endpoint parameters (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/2699">#2699</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/2b4498c633741e24ff4930313610096601dc4036"><code>2b4498c</code></a>
Release 2024-06-25</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/332d372bb946f0d50cae58f9401b9c1244e4b818"><code>332d372</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/9397b8d8c05eb1528910ba81881797e7c0e53d17"><code>9397b8d</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/674e1e4412ce44325902125c935ce124d0bfaf4f"><code>674e1e4</code></a>
Release 2024-06-24</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/406eeb4367bab3ac49b75fbd2d842186e961f4f0"><code>406eeb4</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/17bd894f3c3842d21d5963bc23213397557c3105"><code>17bd894</code></a>
Update endpoints model</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/service/ssm/v1.56.2...service/s3/v1.57.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.98.0 to 1.99.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/159f4d23fd3150aa3b14c231c434f46f42b72c2a"><code>159f4d2</code></a>
Release 2026-04-07</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/50223dc5168c2eb6316a108f23a7fd0803afba76"><code>50223dc</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/af25337605d0de4dc7f4141c6b1627ec31254415"><code>af25337</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/277dc017b3b8ea944865ffb901eea3bf82121f5d"><code>277dc01</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/22bc35ca5a2af77140a47680f80873b4d61b6551"><code>22bc35c</code></a>
Release 2026-04-06</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/9a35fedd65d0cdad42281199a7659146234893a1"><code>9a35fed</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/867b085ecb8579affb591d0e98bbe362376ce911"><code>867b085</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/61d367c87617dbe79f6cb8fe8809d09ce949d2fa"><code>61d367c</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/8560a07e8b7ed78b0962b6df18050500a32705e7"><code>8560a07</code></a>
Release 2026-04-03</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/a5aafdff76b34debb6940077fc4377ed80d24805"><code>a5aafdf</code></a>
Regenerated Clients</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.98.0...service/s3/v1.99.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/docker/cli` from 29.3.1+incompatible to
29.4.0+incompatible
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/cli/commit/9d7ad9ff180b43ae5577d048a7bac1159ce7bacf"><code>9d7ad9f</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/cli/issues/6911">#6911</a> from
thaJeztah/bump_modules</li>
<li><a
href="https://github.com/docker/cli/commit/c88681f8d89a9dd1f24f7bbd4df947aed2e4faf3"><code>c88681f</code></a>
vendor: moby/api v1.54.1, moby/client v0.4.0</li>
<li><a
href="https://github.com/docker/cli/commit/84b884f383a427627ea2c40c1a31905cd958384f"><code>84b884f</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/cli/issues/6909">#6909</a> from
thaJeztah/update_authors_mailmap</li>
<li><a
href="https://github.com/docker/cli/commit/d6169a5ea986d888d0e8c51c9c891d774aa7657b"><code>d6169a5</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/cli/issues/6910">#6910</a> from
thaJeztah/update_version</li>
<li><a
href="https://github.com/docker/cli/commit/5ddc1553ae6d435203f40f7bf622062df246071a"><code>5ddc155</code></a>
bump version to v29.4.0-dev</li>
<li><a
href="https://github.com/docker/cli/commit/a347d9e103f0be3170dc18d0ec77e788c7fe9749"><code>a347d9e</code></a>
update AUTHORS and .mailmap</li>
<li><a
href="https://github.com/docker/cli/commit/699b029b57bc31f2a0c5ecff00f89493b2448047"><code>699b029</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/cli/issues/6908">#6908</a> from
thaJeztah/bump_runewidth</li>
<li><a
href="https://github.com/docker/cli/commit/512607a39638c961cff762c3239b3d1127e25e16"><code>512607a</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/cli/issues/6889">#6889</a> from
YoanWai/docs/prune-filter-behavior</li>
<li><a
href="https://github.com/docker/cli/commit/5fca671ef4110b2bebce70be06a1d41241933871"><code>5fca671</code></a>
vendor: github.com/mattn/go-runewidth v0.0.22</li>
<li><a
href="https://github.com/docker/cli/commit/753b10228f353c3a8cd90e7e0292ee732798e8d5"><code>753b102</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/cli/issues/6893">#6893</a> from
thaJeztah/bump_moby</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/cli/compare/v29.3.1...v29.4.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/testcontainers/testcontainers-go` from 0.41.0 to
0.42.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/testcontainers/testcontainers-go/releases">github.com/testcontainers/testcontainers-go's
releases</a>.</em></p>
<blockquote>
<h2>v0.42.0</h2>
<h1>What's Changed</h1>
<h2>⚠️ Breaking Changes</h2>
<ul>
<li>chore!: migrate to moby modules (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3591">#3591</a>)
<a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a></li>
</ul>
<h2>🔒 Security</h2>
<ul>
<li>chore(deps): bump moby/client v0.4.0, moby/api v1.54.1 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3634">#3634</a>)
<a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a></li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li>fix: return an error when docker host cannot be retrieved (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3613">#3613</a>)
<a href="https://github.com/ash2k"><code>@​ash2k</code></a></li>
</ul>
<h2>🧹 Housekeeping</h2>
<ul>
<li>chore: gitignore Gas Town agent artifacts (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3633">#3633</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>fix(usage-metrics): include last release in the legend pop over (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3630">#3630</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>chore: update usage metrics (2026-04) (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3621">#3621</a>)
@<a
href="https://github.com/apps/github-actions">github-actions[bot]</a></li>
<li>fix(usage-metrics): order of actions matters (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3623">#3623</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>fix(usage-metrics): reduce rate-limit cascade errors (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3622">#3622</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>fix(usage-metrics): replace the per-version inline retry with a
multi-pass approach (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3620">#3620</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
</ul>
<h2>📦 Dependency updates</h2>
<ul>
<li>chore(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from
1.28.0 to 1.43.0 in /modules/grafana-lgtm (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3639">#3639</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from
1.42.0 to 1.43.0 in /modules/compose (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3641">#3641</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from
1.42.0 to 1.43.0 in /modules/compose (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3645">#3645</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump mkdocs-include-markdown-plugin from 7.2.1 to 7.2.2
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3626">#3626</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
1.51.2 to 1.97.3 in /modules/localstack (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3638">#3638</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from
1.41.0 to 1.43.0 in /modules/grafana-lgtm (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3643">#3643</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump go.opentelemetry.io/otel/sdk from 1.41.0 to 1.43.0
in /modules/milvus (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3644">#3644</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore: update to Go 1.25.9, 1.26.9 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3647">#3647</a>)
<a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a></li>
<li>chore(deps): bump bump github.com/klauspost/compress v1.18.5,
github.com/docker/compose v5.1.2 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3646">#3646</a>)
<a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a></li>
<li>chore(deps): bump moby/client v0.4.0, moby/api v1.54.1 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3634">#3634</a>)
<a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a></li>
<li>chore(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3629">#3629</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump github.com/moby/patternmatcher from 0.6.0 to 0.6.1
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3628">#3628</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.2 to
4.26.3 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3627">#3627</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>fix(localstack): accept community-archive as a valid tag (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3601">#3601</a>)
<a
href="https://github.com/johnduhart"><code>@​johnduhart</code></a></li>
<li>chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
in /modules/gcloud (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3632">#3632</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3625">#3625</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump pygments from 2.19.2 to 2.20.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3615">#3615</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump google.golang.org/grpc from 1.67.0 to 1.79.3 in
/modules/milvus (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3612">#3612</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump google.golang.org/grpc from 1.67.0 to 1.79.3 in
/modules/etcd (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3611">#3611</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 in
/modules/ollama (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3610">#3610</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump google.golang.org/grpc from 1.67.0 to 1.79.3 in
/modules/pinecone (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3609">#3609</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump google.golang.org/grpc from 1.67.0 to 1.79.3 in
/modules/couchbase (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3608">#3608</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump requests from 2.32.4 to 2.33.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3604">#3604</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 in
/modules/meilisearch (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3607">#3607</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump github.com/moby/buildkit from 0.27.1 to 0.28.1 in
/modules/compose (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3605">#3605</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/6e584183e1623fb83a78db902462eb9ee255327b"><code>6e58418</code></a>
chore: use new version (v0.42.0) in modules and examples</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/f713dc0c78c37558ed13c985f5ed15101a6cba08"><code>f713dc0</code></a>
chore(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetr...</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/300827abcec0b6e2d8c10c8360d335f29962f701"><code>300827a</code></a>
chore(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetr...</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/7a15ac1b7214c0bc5cb14c31a979a166ac5c088c"><code>7a15ac1</code></a>
chore(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptrace...</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/5bae3d2aa7281a71d1c24b5f8bde1391e2e8dfcb"><code>5bae3d2</code></a>
fix: return an error when docker host cannot be retrieved (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3613">#3613</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/fc19484a8ae088b714a9e9d7d9bba2ae383e3e69"><code>fc19484</code></a>
chore(deps): bump mkdocs-include-markdown-plugin from 7.2.1 to 7.2.2 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3626">#3626</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/95bdc0c4a0b368564f052bd7a533f055adab694a"><code>95bdc0c</code></a>
chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3638">#3638</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/75aa22665b03ec8d597341575001d71ff693f1fc"><code>75aa226</code></a>
chore(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptrace...</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/2f59938fb9ce365d974fe21a426ffffe7231caca"><code>2f59938</code></a>
chore(deps): bump go.opentelemetry.io/otel/sdk in /modules/milvus (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3644">#3644</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/580abf68d44021bc7e54f8655a2fb66578205527"><code>580abf6</code></a>
chore: update to Go 1.25.9, 1.26.9 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3647">#3647</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/testcontainers/testcontainers-go/compare/v0.41.0...v0.42.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/testcontainers/testcontainers-go/modules/registry`
from 0.41.0 to 0.42.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/testcontainers/testcontainers-go/releases">github.com/testcontainers/testcontainers-go/modules/registry's
releases</a>.</em></p>
<blockquote>
<h2>v0.42.0</h2>
<h1>What's Changed</h1>
<h2>⚠️ Breaking Changes</h2>
<ul>
<li>chore!: migrate to moby modules (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3591">#3591</a>)
<a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a></li>
</ul>
<h2>🔒 Security</h2>
<ul>
<li>chore(deps): bump moby/client v0.4.0, moby/api v1.54.1 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3634">#3634</a>)
<a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a></li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li>fix: return an error when docker host cannot be retrieved (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3613">#3613</a>)
<a href="https://github.com/ash2k"><code>@​ash2k</code></a></li>
</ul>
<h2>🧹 Housekeeping</h2>
<ul>
<li>chore: gitignore Gas Town agent artifacts (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3633">#3633</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>fix(usage-metrics): include last release in the legend pop over (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3630">#3630</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>chore: update usage metrics (2026-04) (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3621">#3621</a>)
@<a
href="https://github.com/apps/github-actions">github-actions[bot]</a></li>
<li>fix(usage-metrics): order of actions matters (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3623">#3623</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>fix(usage-metrics): reduce rate-limit cascade errors (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3622">#3622</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>fix(usage-metrics): replace the per-version inline retry with a
multi-pass approach (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3620">#3620</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
</ul>
<h2>📦 Dependency updates</h2>
<ul>
<li>chore(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from
1.28.0 to 1.43.0 in /modules/grafana-lgtm (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3639">#3639</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from
1.42.0 to 1.43.0 in /modules/compose (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3641">#3641</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from
1.42.0 to 1.43.0 in /modules/compose (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3645">#3645</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump mkdocs-include-markdown-plugin from 7.2.1 to 7.2.2
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3626">#3626</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from
1.51.2 to 1.97.3 in /modules/localstack (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3638">#3638</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from
1.41.0 to 1.43.0 in /modules/grafana-lgtm (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3643">#3643</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump go.opentelemetry.io/otel/sdk from 1.41.0 to 1.43.0
in /modules/milvus (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3644">#3644</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore: update to Go 1.25.9, 1.26.9 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3647">#3647</a>)
<a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a></li>
<li>chore(deps): bump bump github.com/klauspost/compress v1.18.5,
github.com/docker/compose v5.1.2 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3646">#3646</a>)
<a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a></li>
<li>chore(deps): bump moby/client v0.4.0, moby/api v1.54.1 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3634">#3634</a>)
<a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a></li>
<li>chore(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3629">#3629</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump github.com/moby/patternmatcher from 0.6.0 to 0.6.1
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3628">#3628</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.2 to
4.26.3 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3627">#3627</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>fix(localstack): accept community-archive as a valid tag (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3601">#3601</a>)
<a
href="https://github.com/johnduhart"><code>@​johnduhart</code></a></li>
<li>chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
in /modules/gcloud (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3632">#3632</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3625">#3625</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump pygments from 2.19.2 to 2.20.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3615">#3615</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump google.golang.org/grpc from 1.67.0 to 1.79.3 in
/modules/milvus (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3612">#3612</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump google.golang.org/grpc from 1.67.0 to 1.79.3 in
/modules/etcd (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3611">#3611</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 in
/modules/ollama (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3610">#3610</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump google.golang.org/grpc from 1.67.0 to 1.79.3 in
/modules/pinecone (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3609">#3609</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump google.golang.org/grpc from 1.67.0 to 1.79.3 in
/modules/couchbase (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3608">#3608</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump requests from 2.32.4 to 2.33.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3604">#3604</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 in
/modules/meilisearch (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3607">#3607</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump github.com/moby/buildkit from 0.27.1 to 0.28.1 in
/modules/compose (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3605">#3605</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/6e584183e1623fb83a78db902462eb9ee255327b"><code>6e58418</code></a>
chore: use new version (v0.42.0) in modules and examples</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/f713dc0c78c37558ed13c985f5ed15101a6cba08"><code>f713dc0</code></a>
chore(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetr...</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/300827abcec0b6e2d8c10c8360d335f29962f701"><code>300827a</code></a>
chore(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetr...</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/7a15ac1b7214c0bc5cb14c31a979a166ac5c088c"><code>7a15ac1</code></a>
chore(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptrace...</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/5bae3d2aa7281a71d1c24b5f8bde1391e2e8dfcb"><code>5bae3d2</code></a>
fix: return an error when docker host cannot be retrieved (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3613">#3613</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/fc19484a8ae088b714a9e9d7d9bba2ae383e3e69"><code>fc19484</code></a>
chore(deps): bump mkdocs-include-markdown-plugin from 7.2.1 to 7.2.2 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3626">#3626</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/95bdc0c4a0b368564f052bd7a533f055adab694a"><code>95bdc0c</code></a>
chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3638">#3638</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/75aa22665b03ec8d597341575001d71ff693f1fc"><code>75aa226</code></a>
chore(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptrace...</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/2f59938fb9ce365d974fe21a426ffffe7231caca"><code>2f59938</code></a>
chore(deps): bump go.opentelemetry.io/otel/sdk in /modules/milvus (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3644">#3644</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/580abf68d44021bc7e54f8655a2fb66578205527"><code>580abf6</code></a>
chore: update to Go 1.25.9, 1.26.9 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3647">#3647</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/testcontainers/testcontainers-go/compare/v0.41.0...v0.42.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/crypto` from 0.49.0 to 0.50.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/crypto/commit/03ca0dcccbd37ba6be80adf74dde8d78a4d72817"><code>03ca0dc</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/crypto/commit/8400f4a938077a7a7817ab7d163d148e371b320b"><code>8400f4a</code></a>
ssh: respect signer's algorithm preference in
pickSignatureAlgorithm</li>
<li><a
href="https://github.com/golang/crypto/commit/81c6cb34a8fc386ed53293cd79e3c0c232ee7366"><code>81c6cb3</code></a>
ssh: swap cbcMinPaddingSize to cbcMinPacketSize to get encLength</li>
<li>See full diff in <a
href="https://github.com/golang/crypto/compare/v0.49.0...v0.50.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/net` from 0.52.0 to 0.53.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/net/commit/a8d1fc14d9e33e1f6842ab78a0127d42cd8fff44"><code>a8d1fc1</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/net/commit/056ac742146af742aa760d690269c02fa238cc7a"><code>056ac74</code></a>
quic: avoid depending on golang.org/x/sys/unix</li>
<li><a
href="https://github.com/golang/net/commit/c85f61116e47b1523036c3005f8b2923b661eb64"><code>c85f611</code></a>
http3: add http3 package for testing in std</li>
<li><a
href="https://github.com/golang/net/commit/805fc81a196b95c3c00f02e135ffb8a8d5582bdf"><code>805fc81</code></a>
http2: add transport API tests</li>
<li><a
href="https://github.com/golang/net/commit/e63b894ab3cd38a1d05396530dccde7ffa3f68d0"><code>e63b894</code></a>
http2: support testing via net/http.Transport.RoundTrip</li>
<li><a
href="https://github.com/golang/net/commit/9ee1e484e5aab0d95b3babbc6f1384d03f4f9e22"><code>9ee1e48</code></a>
http2/hpack: prevent HeaderField from escaping during encoding</li>
<li><a
href="https://github.com/golang/net/commit/1e71bd86e4a302b4e731bc06da6eb51679c7bd49"><code>1e71bd8</code></a>
http2: prevent hanging Transport due to bad SETTINGS frame</li>
<li><a
href="https://github.com/golang/net/commit/7bca15042b9d2bda1402cb42232a9c6ddbae6212"><code>7bca150</code></a>
internal/http3: respect net/http Server Shutdown context when shutting
down</li>
<li><a
href="https://github.com/golang/net/commit/44c41bee5028537e64410b1583e8ae329ceac284"><code>44c41be</code></a>
internal/http3: prevent server from holding mutex when sleeping during
shutdown</li>
<li><a
href="https://github.com/golang/net/commit/228a67a374710bff77fc490e7f538b317c34e247"><code>228a67a</code></a>
internal/http3: add CloseIdleConnections support in transport</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/net/compare/v0.52.0...v0.53.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/text` from 0.35.0 to 0.36.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/text/commit/8577a70117e110160c45f32af0e0df84eef844f7"><code>8577a70</code></a>
go.mod: update golang.org/x dependencies</li>
<li>See full diff in <a
href="https://github.com/golang/text/compare/v0.35.0...v0.36.0">compare
view</a></li>
</ul>
</details>
<br />

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@dependabot @morrison-sap
chore(deps): bump github.com/fluxcd/cli-utils from 0.37.2-flux.1 to 1…
c85bee1 
….0.0 (open-component-model#1910)

Bumps [github.com/fluxcd/cli-utils](https://github.com/fluxcd/cli-utils)
from 0.37.2-flux.1 to 1.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fluxcd/cli-utils/releases">github.com/fluxcd/cli-utils's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>⚠️ Breaking change: Reduce the project scope to <code>kstatus</code>
only by <a
href="https://github.com/stefanprodan"><code>@​stefanprodan</code></a>
in <a
href="https://redirect.github.com/fluxcd/cli-utils/pull/27">fluxcd/cli-utils#27</a></li>
<li>Update controller-runtime to v0.23.3 by <a
href="https://github.com/stefanprodan"><code>@​stefanprodan</code></a>
in <a
href="https://redirect.github.com/fluxcd/cli-utils/pull/28">fluxcd/cli-utils#28</a></li>
<li>ci: Setup dependabot and govulncheck by <a
href="https://github.com/stefanprodan"><code>@​stefanprodan</code></a>
in <a
href="https://redirect.github.com/fluxcd/cli-utils/pull/29">fluxcd/cli-utils#29</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/fluxcd/cli-utils/compare/v0.38.0-flux.1...v1.0.0">https://github.com/fluxcd/cli-utils/compare/v0.38.0-flux.1...v1.0.0</a></p>
<h2>v0.38.0-flux.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update readme to document the fork by <a
href="https://github.com/stefanprodan"><code>@​stefanprodan</code></a>
in <a
href="https://redirect.github.com/fluxcd/cli-utils/pull/24">fluxcd/cli-utils#24</a></li>
<li>Trigger tests on PRs by <a
href="https://github.com/matheuscscp"><code>@​matheuscscp</code></a> in
<a
href="https://redirect.github.com/fluxcd/cli-utils/pull/25">fluxcd/cli-utils#25</a></li>
<li>fix: async status computation in watcher to prevent multi-minute
delays by <a
href="https://github.com/mapleeit"><code>@​mapleeit</code></a> in <a
href="https://redirect.github.com/fluxcd/cli-utils/pull/20">fluxcd/cli-utils#20</a></li>
<li>Update to Kubernetes v1.35.3 by <a
href="https://github.com/stefanprodan"><code>@​stefanprodan</code></a>
in <a
href="https://redirect.github.com/fluxcd/cli-utils/pull/26">fluxcd/cli-utils#26</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/fluxcd/cli-utils/commits/v0.38.0-flux.1">https://github.com/fluxcd/cli-utils/commits/v0.38.0-flux.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fluxcd/cli-utils/commit/e2a56bca75c26593719f342b61572b046a453fbc"><code>e2a56bc</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/cli-utils/issues/29">#29</a>
from fluxcd/ci-scan</li>
<li><a
href="https://github.com/fluxcd/cli-utils/commit/bc30a9fb157a1667b3ab801a2e795b07bab567ba"><code>bc30a9f</code></a>
ci: Update actions with dependabot</li>
<li><a
href="https://github.com/fluxcd/cli-utils/commit/4eb153e1f94033cda343dba45d55b512ca158554"><code>4eb153e</code></a>
ci: Run govulncheck weekly</li>
<li><a
href="https://github.com/fluxcd/cli-utils/commit/d9baa70f27e6d0334d9f0e2a9dd4d691e116dc51"><code>d9baa70</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/cli-utils/issues/28">#28</a>
from fluxcd/controller-runtime-v0.23.3</li>
<li><a
href="https://github.com/fluxcd/cli-utils/commit/dc8ab9e1f4b96131da5a2ba556006c4c9caccd56"><code>dc8ab9e</code></a>
Update controller-runtime to v0.23.3</li>
<li><a
href="https://github.com/fluxcd/cli-utils/commit/dfed73eb473046cb1a84224b43c7950bdaaf7a67"><code>dfed73e</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/cli-utils/issues/27">#27</a>
from fluxcd/prune-utils</li>
<li><a
href="https://github.com/fluxcd/cli-utils/commit/f88cf83089e5e9014cadbfe94da072c4e3e9b8a3"><code>f88cf83</code></a>
Add Flux DCO and Code of Conduct</li>
<li><a
href="https://github.com/fluxcd/cli-utils/commit/13f26400b148b6e880c74181c1f68559381a582d"><code>13f2640</code></a>
Refactor testing and CI</li>
<li><a
href="https://github.com/fluxcd/cli-utils/commit/42cbfec9993a45fc6fb3eb616c5d99116a2a9be1"><code>42cbfec</code></a>
Remove non-kstatus packages</li>
<li><a
href="https://github.com/fluxcd/cli-utils/commit/a158db541d8ab837d7d66f8554dd5c10b671ed80"><code>a158db5</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/cli-utils/issues/26">#26</a>
from fluxcd/k8s-1.35.3</li>
<li>Additional commits viewable in <a
href="https://github.com/fluxcd/cli-utils/compare/v0.37.2-flux.1...v1.0.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@dependabot @morrison-sap
chore(deps): bump the ci group with 4 updates (open-component-model#1911
79701e9 
)

Bumps the ci group with 4 updates:
[actions/upload-artifact](https://github.com/actions/upload-artifact),
[actions/create-github-app-token](https://github.com/actions/create-github-app-token),
[peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request)
and
[docker/build-push-action](https://github.com/docker/build-push-action).

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update the readme with direct upload details by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/795">actions/upload-artifact#795</a></li>
<li>Readme: bump all the example versions to v7 by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/796">actions/upload-artifact#796</a></li>
<li>Include changes in typespec/ts-http-runtime 0.3.5 by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/797">actions/upload-artifact#797</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v7...v7.0.1">https://github.com/actions/upload-artifact/compare/v7...v7.0.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"><code>043fb46</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/797">#797</a>
from actions/yacaovsnc/update-dependency</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94"><code>634250c</code></a>
Include changes in typespec/ts-http-runtime 0.3.5</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8"><code>e454baa</code></a>
Readme: bump all the example versions to v7 (<a
href="https://redirect.github.com/actions/upload-artifact/issues/796">#796</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e"><code>74fad66</code></a>
Update the readme with direct upload details (<a
href="https://redirect.github.com/actions/upload-artifact/issues/795">#795</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/create-github-app-token` from 3.0.0 to 3.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/create-github-app-token/releases">actions/create-github-app-token's
releases</a>.</em></p>
<blockquote>
<h2>v3.1.1</h2>
<h2><a
href="https://github.com/actions/create-github-app-token/compare/v3.1.0...v3.1.1">3.1.1</a>
(2026-04-11)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>improve error message when app identifier is empty (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/362">#362</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/07e2b760664f080c40eec4eacf7477256582db36">07e2b76</a>),
closes <a
href="https://redirect.github.com/actions/create-github-app-token/issues/249">#249</a></li>
</ul>
<h2>v3.1.0</h2>
<h1><a
href="https://github.com/actions/create-github-app-token/compare/v3.0.0...v3.1.0">3.1.0</a>
(2026-04-11)</h1>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> bump p-retry from 7.1.1 to 8.0.0 (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/357">#357</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/3bbe07d928e2d6c30bf3e37c6b89edbc4045facf">3bbe07d</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>add <code>client-id</code> input and deprecate <code>app-id</code>
(<a
href="https://redirect.github.com/actions/create-github-app-token/issues/353">#353</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/e6bd4e6970172bed9fe138b2eaf4cbffa4cca8f9">e6bd4e6</a>)</li>
<li>update permission inputs (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/358">#358</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/076e9480ca6e9633bff412d05eff0fc2f1e7d2be">076e948</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/create-github-app-token/commit/1b10c78c7865c340bc4f6099eb2f838309f1e8c3"><code>1b10c78</code></a>
build(release): 3.1.1 [skip ci]</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/07e2b760664f080c40eec4eacf7477256582db36"><code>07e2b76</code></a>
fix: improve error message when app identifier is empty (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/362">#362</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/ea0121618bb39abc1cff180c258978a02d4e04fd"><code>ea01216</code></a>
ci: remove publish-immutable-action workflow (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/361">#361</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/7bd03711494f032dfa3be3558f7dc8787b0be333"><code>7bd0371</code></a>
build(release): 3.1.0 [skip ci]</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/e6bd4e6970172bed9fe138b2eaf4cbffa4cca8f9"><code>e6bd4e6</code></a>
feat: add <code>client-id</code> input and deprecate <code>app-id</code>
(<a
href="https://redirect.github.com/actions/create-github-app-token/issues/353">#353</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/076e9480ca6e9633bff412d05eff0fc2f1e7d2be"><code>076e948</code></a>
feat: update permission inputs (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/358">#358</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/3bbe07d928e2d6c30bf3e37c6b89edbc4045facf"><code>3bbe07d</code></a>
fix(deps): bump p-retry from 7.1.1 to 8.0.0 (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/357">#357</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/28a99e369c23d11dbaf8e9ff29e577c7129aaa6c"><code>28a99e3</code></a>
build(deps-dev): bump c8 from 10.1.3 to 11.0.0</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/4df50600ef5eaf70cb3514fbb1716e183ec4b25d"><code>4df5060</code></a>
build(deps-dev): bump open-cli from 8.0.0 to 9.0.0</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/4843c538d99b70fef283d0c8a7e12a8f4c9a7b70"><code>4843c53</code></a>
build(deps-dev): bump the development-dependencies group with 3
updates</li>
<li>See full diff in <a
href="https://github.com/actions/create-github-app-token/compare/f8d387b68d61c58ab83c6c016672934102569859...1b10c78c7865c340bc4f6099eb2f838309f1e8c3">compare
view</a></li>
</ul>
</details>
<br />

Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/peter-evans/create-pull-request/releases">peter-evans/create-pull-request's
releases</a>.</em></p>
<blockquote>
<h2>Create Pull Request v8.1.1</h2>
<h2>What's Changed</h2>
<ul>
<li>build(deps-dev): bump the npm group with 2 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4305">peter-evans/create-pull-request#4305</a></li>
<li>build(deps): bump minimatch by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4311">peter-evans/create-pull-request#4311</a></li>
<li>build(deps): bump the github-actions group with 2 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4316">peter-evans/create-pull-request#4316</a></li>
<li>build(deps): bump <code>@​tootallnate/once</code> and
jest-environment-jsdom by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4323">peter-evans/create-pull-request#4323</a></li>
<li>build(deps-dev): bump undici from 6.23.0 to 6.24.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4328">peter-evans/create-pull-request#4328</a></li>
<li>build(deps-dev): bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4334">peter-evans/create-pull-request#4334</a></li>
<li>build(deps): bump picomatch by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4339">peter-evans/create-pull-request#4339</a></li>
<li>build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4344">peter-evans/create-pull-request#4344</a></li>
<li>build(deps-dev): bump the npm group with 3 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4349">peter-evans/create-pull-request#4349</a></li>
<li>fix: retry post-creation API calls on 422 eventual consistency
errors by <a
href="https://github.com/peter-evans"><code>@​peter-evans</code></a> in
<a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/4356">peter-evans/create-pull-request#4356</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/peter-evans/create-pull-request/compare/v8.1.0...v8.1.1">https://github.com/peter-evans/create-pull-request/compare/v8.1.0...v8.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/5f6978faf089d4d20b00c7766989d076bb2fc7f1"><code>5f6978f</code></a>
fix: retry post-creation API calls on 422 eventual consistency errors
(<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4356">#4356</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/d32e88dac789dcc7906e7d26f69f24116fa9c97d"><code>d32e88d</code></a>
build(deps-dev): bump the npm group with 3 updates (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4349">#4349</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/8170bccad11c0df62542c04dcaefe36d342dfd39"><code>8170bcc</code></a>
build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4344">#4344</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/00418193b417f888dbf1d993c5c0d31d27fdc7de"><code>0041819</code></a>
build(deps): bump picomatch (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4339">#4339</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/b993918c8536b6d44706130734d5456879762b27"><code>b993918</code></a>
build(deps-dev): bump flatted from 3.3.1 to 3.4.2 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4334">#4334</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/36d7c8468b48f9c2f8f29e260e82f10d4b90d2bd"><code>36d7c84</code></a>
build(deps-dev): bump undici from 6.23.0 to 6.24.0 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4328">#4328</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/a45d1fb447fcaf601166e405fd4f335cde1a8aa8"><code>a45d1fb</code></a>
build(deps): bump <code>@​tootallnate/once</code> and
jest-environment-jsdom (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4323">#4323</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/3499eb61835cc0015c0b786e203d74b1e8f55e43"><code>3499eb6</code></a>
build(deps): bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4316">#4316</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/3f3b473b8c148f5a7520efb4d1f9a70eea3d9d1f"><code>3f3b473</code></a>
build(deps): bump minimatch (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4311">#4311</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/6699836a213cf8b28c4f0408a404a6ac79d4458a"><code>6699836</code></a>
build(deps-dev): bump the npm group with 2 updates (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/4305">#4305</a>)</li>
<li>See full diff in <a
href="https://github.com/peter-evans/create-pull-request/compare/c0f553fe549906ede9cf27b5156039d195d2ece0...5f6978faf089d4d20b00c7766989d076bb2fc7f1">compare
view</a></li>
</ul>
</details>
<br />

Updates `docker/build-push-action` from 7.0.0 to 7.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/build-push-action/releases">docker/build-push-action's
releases</a>.</em></p>
<blockquote>
<h2>v7.1.0</h2>
<ul>
<li>Git context <a
href="https://docs.docker.com/build/concepts/context/#url-queries">query
format</a> support by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/build-push-action/pull/1505">docker/build-push-action#1505</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.79.0 to 0.87.0 by
<a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in
<a
href="https://redirect.github.com/docker/build-push-action/pull/1505">docker/build-push-action#1505</a></li>
<li>Bump brace-expansion from 1.1.12 to 1.1.13 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1500">docker/build-push-action#1500</a></li>
<li>Bump fast-xml-parser from 5.4.2 to 5.5.7 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1489">docker/build-push-action#1489</a></li>
<li>Bump flatted from 3.3.3 to 3.4.2 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1491">docker/build-push-action#1491</a></li>
<li>Bump glob from 10.3.12 to 10.5.0 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1490">docker/build-push-action#1490</a></li>
<li>Bump handlebars from 4.7.8 to 4.7.9 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1497">docker/build-push-action#1497</a></li>
<li>Bump lodash from 4.17.23 to 4.18.1 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1510">docker/build-push-action#1510</a></li>
<li>Bump picomatch from 4.0.3 to 4.0.4 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1496">docker/build-push-action#1496</a></li>
<li>Bump undici from 6.23.0 to 6.24.1 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1486">docker/build-push-action#1486</a></li>
<li>Bump vite from 7.3.1 to 7.3.2 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1509">docker/build-push-action#1509</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v7.0.0...v7.1.0">https://github.com/docker/build-push-action/compare/v7.0.0...v7.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/build-push-action/commit/bcafcacb16a39f128d818304e6c9c0c18556b85f"><code>bcafcac</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1509">#1509</a>
from docker/dependabot/npm_and_yarn/vite-7.3.2</li>
<li><a
href="https://github.com/docker/build-push-action/commit/18e62f1158d9c45a4a84a58a6828d21f8ed3644b"><code>18e62f1</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1510">#1510</a>
from docker/dependabot/npm_and_yarn/lodash-4.18.1</li>
<li><a
href="https://github.com/docker/build-push-action/commit/46580d2c9d43b0888270cb6fa90956e483de56fc"><code>46580d2</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/build-push-action/commit/3f80b252ca2331f6ec3e890f4346b5506ee1dc81"><code>3f80b25</code></a>
chore(deps): Bump lodash from 4.17.23 to 4.18.1</li>
<li><a
href="https://github.com/docker/build-push-action/commit/efeec9557c40a646afe433e39a1e94ca689103f0"><code>efeec95</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1505">#1505</a>
from crazy-max/refactor-git-context</li>
<li><a
href="https://github.com/docker/build-push-action/commit/ddf04b08eb12882258ed936fea4a2806754ff349"><code>ddf04b0</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1511">#1511</a>
from docker/dependabot/github_actions/crazy-max-dot-...</li>
<li><a
href="https://github.com/docker/build-push-action/commit/db08d97a08e4a0d15f85d1c4e64dfd5f88cbe1a9"><code>db08d97</code></a>
chore(deps): Bump the crazy-max-dot-github group with 2 updates</li>
<li><a
href="https://github.com/docker/build-push-action/commit/ef1fb9688fc3626d0fd5e462f502cbbdc6456feb"><code>ef1fb96</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1508">#1508</a>
from docker/dependabot/github_actions/docker/login-a...</li>
<li><a
href="https://github.com/docker/build-push-action/commit/2d8f2a1a378a5c302dcd7b2b4326cefa24180bb1"><code>2d8f2a1</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/build-push-action/commit/919ac7bd7d1aa8cb13fe4de76545abea8d8b5ed2"><code>919ac7b</code></a>
fix test since secrets are not written to temp path anymore</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/build-push-action/compare/d08e5c354a6adb9ed34480a06d141179aa583294...bcafcacb16a39f128d818304e6c9c0c18556b85f">compare
view</a></li>
</ul>
</details>
<br />

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@morri-son morri-son force-pushed the add-upp-camel-case-types branch from 0f8f4c8 to 79701e9 Compare April 14, 2026 10:48
@github-actions github-actions Bot added component/github-actions Changes on GitHub Actions or within `.github/` directory kind/skip-release-notes Pull request will not appear in release notes kind/dependency dependency update, etc. labels Apr 14, 2026
@morrison-sap
chore: resolve go.mod/go.sum merge conflicts from upstream
47c2465 
Accept upstream dependency updates (toxiproxy, containerd v2, etc.)
Branch has no dependency changes of its own.

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@morri-son
Copy link
Copy Markdown
Contributor Author

morri-son commented Apr 14, 2026

@coderabbitai review

jakobmoellerdev
jakobmoellerdev reviewed Apr 14, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@jakobmoellerdev jakobmoellerdev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@fabianburth please take another look before we merge

morrison-sap and others added 2 commits April 14, 2026 21:31
@morrison-sap
Merge remote-tracking branch 'upstream/main' into add-upp-camel-case-…
ed5a79d 
…types

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@matthiasbruns
Merge branch 'main' into add-upp-camel-case-types
18abe21
matthiasbruns
matthiasbruns reviewed Apr 16, 2026
View reviewed changes
Comment thread cmds/ocm/commands/ocmcmds/common/inputs/types/directory/type.go
Skarlso
Skarlso previously approved these changes Apr 16, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@Skarlso Skarlso left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@fabianburth as well ping from previous ping. :D

@dependabot @morrison-sap
chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 in the c…
3c90c07 
…i group (open-component-model#1919)

Bumps the ci group with 1 update:
[github/codeql-action](https://github.com/github/codeql-action).

Updates `github/codeql-action` from 4.35.1 to 4.35.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.35.2</h2>
<ul>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable is deprecated and will be removed in May 2026. If you are
affected by this, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li>
<li>Python analysis on GHES no longer extracts the standard library,
relying instead on models of the standard library. This should result in
significantly faster extraction and analysis times, while the effect on
alerts should be minimal. <a
href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li>
<li>Fixed a bug in the validation of OIDC configurations for private
registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.35.2 - 15 Apr 2026</h2>
<ul>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable is deprecated and will be removed in May 2026. If you are
affected by this, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li>
<li>Python analysis on GHES no longer extracts the standard library,
relying instead on models of the standard library. This should result in
significantly faster extraction and analysis times, while the effect on
alerts should be minimal. <a
href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li>
<li>Fixed a bug in the validation of OIDC configurations for private
registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li>
</ul>
<h2>4.35.1 - 27 Mar 2026</h2>
<ul>
<li>Fix incorrect minimum required Git version for <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li>
</ul>
<h2>4.35.0 - 27 Mar 2026</h2>
<ul>
<li>Reduced the minimum Git version required for <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> from 2.38.0 to 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li>
</ul>
<h2>4.34.1 - 20 Mar 2026</h2>
<ul>
<li>Downgrade default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a>
due to issues with a small percentage of Actions and JavaScript
analyses. <a
href="https://redirect.github.com/github/codeql-action/pull/3762">#3762</a></li>
</ul>
<h2>4.34.0 - 20 Mar 2026</h2>
<ul>
<li>Added an experimental change which disables TRAP caching when <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> is enabled, since improved incremental analysis
supersedes TRAP caching. This will improve performance and reduce
Actions cache usage. We expect to roll this change out to everyone in
March. <a
href="https://redirect.github.com/github/codeql-action/pull/3569">#3569</a></li>
<li>We are rolling out improved incremental analysis to C/C++ analyses
that use build mode <code>none</code>. We expect this rollout to be
complete by the end of April 2026. <a
href="https://redirect.github.com/github/codeql-action/pull/3584">#3584</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0">2.25.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3585">#3585</a></li>
</ul>
<h2>4.33.0 - 16 Mar 2026</h2>
<ul>
<li>
<p>Upcoming change: Starting April 2026, the CodeQL Action will skip
collecting file coverage information on pull requests to improve
analysis performance. File coverage information will still be computed
on non-PR analyses. Pull request analyses will log a warning about this
upcoming change. <a
href="https://redirect.github.com/github/codeql-action/pull/3562">#3562</a></p>
<p>To opt out of this change:</p>
<ul>
<li><strong>Repositories owned by an organization:</strong> Create a
custom repository property with the name
<code>github-codeql-file-coverage-on-prs</code> and the type
&quot;True/false&quot;, then set this property to <code>true</code> in
the repository's settings. For more information, see <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing
custom properties for repositories in your organization</a>.
Alternatively, if you are using an advanced setup workflow, you can set
the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable
to <code>true</code> in your workflow.</li>
<li><strong>User-owned repositories using default setup:</strong> Switch
to an advanced setup workflow and set the
<code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to
<code>true</code> in your workflow.</li>
<li><strong>User-owned repositories using advanced setup:</strong> Set
the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable
to <code>true</code> in your workflow.</li>
</ul>
</li>
<li>
<p>Fixed <a
href="https://redirect.github.com/github/codeql-action/issues/3555">a
bug</a> which caused the CodeQL Action to fail loading repository
properties if a &quot;Multi select&quot; repository property was
configured for the repository. <a
href="https://redirect.github.com/github/codeql-action/pull/3557">#3557</a></p>
</li>
<li>
<p>The CodeQL Action now loads <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">custom
repository properties</a> on GitHub Enterprise Server, enabling the
customization of features such as
<code>github-codeql-disable-overlay</code> that was previously only
available on GitHub.com. <a
href="https://redirect.github.com/github/codeql-action/pull/3559">#3559</a></p>
</li>
<li>
<p>Once <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private
package registries</a> can be configured with OIDC-based authentication
for organizations, the CodeQL Action will now be able to accept such
configurations. <a
href="https://redirect.github.com/github/codeql-action/pull/3563">#3563</a></p>
</li>
<li>
<p>Fixed the retry mechanism for database uploads. Previously this would
fail with the error &quot;Response body object should not be disturbed
or locked&quot;. <a
href="https://redirect.github.com/github/codeql-action/pull/3564">#3564</a></p>
</li>
<li>
<p>A warning is now emitted if the CodeQL Action detects a repository
property whose name suggests that it relates to the CodeQL Action, but
which is not one of the properties recognised by the current version of
the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3570">#3570</a></p>
</li>
</ul>
<h2>4.32.6 - 05 Mar 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/95e58e9a2cdfd71adc6e0353d5c52f41a045d225"><code>95e58e9</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3824">#3824</a>
from github/update-v4.35.2-d2e135a73</li>
<li><a
href="https://github.com/github/codeql-action/commit/6f31bfe060e817d81e938dbec767969d20031e25"><code>6f31bfe</code></a>
Update changelog for v4.35.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/d2e135a73a39154e3a231aeb49163c4661c5b8b1"><code>d2e135a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3823">#3823</a>
from github/update-bundle/codeql-bundle-v2.25.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/60abb65df09fcf213c398e064c8a80db1f15cdaf"><code>60abb65</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/5a0a562209255e956ad8aafcee303294e64eefa2"><code>5a0a562</code></a>
Update default bundle to codeql-bundle-v2.25.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/65216971a11ded447a6b76263d5a144519e5eee1"><code>6521697</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3820">#3820</a>
from github/dependabot/github_actions/dot-github/wor...</li>
<li><a
href="https://github.com/github/codeql-action/commit/3c45af2dd258e1623af1898da5c86545b514e028"><code>3c45af2</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3821">#3821</a>
from github/dependabot/npm_and_yarn/npm-minor-345b93...</li>
<li><a
href="https://github.com/github/codeql-action/commit/f1c339364c12f922998186ed897e45e3b4ae8874"><code>f1c3393</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/1024fc496c87e944a93e98d8cf2c09e2c7602a30"><code>1024fc4</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/9dd4cfed96030ccdfe1af4daf7a7964322704fed"><code>9dd4cfe</code></a>
Bump the npm-minor group across 1 directory with 6 updates</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...95e58e9a2cdfd71adc6e0353d5c52f41a045d225">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=4.35.1&new-version=4.35.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@morrison-sap
Merge remote-tracking branch 'upstream/main' into add-upp-camel-case-…
39a488d 
…types

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@jakobmoellerdev jakobmoellerdev merged commit df29bb3 into open-component-model:main Apr 16, 2026
24 checks passed
morri-son pushed a commit to morri-son/ocm that referenced this pull request Apr 17, 2026
@morrison-sap
feat: add UpperCamelCase aliases for remaining access and input types
5c9834a 
Add UpperCamelCase type aliases for all access methods and input types
that were missing after open-component-model#1881. This completes the type notation alignment
per ocm-project#962 and ocm-spec#141.

Access methods: GitHub/v1, NPM/v1, Wget/v1, Git/v1alpha1, Maven/v1
Input types: Git, Maven, NPM, Wget, Binary, Docker, DockerMulti, Spiff, OCIArtifact

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@morri-son morri-son mentioned this pull request Apr 17, 2026
Merged
morri-son pushed a commit to morri-son/ocm that referenced this pull request Apr 17, 2026
@morrison-sap
feat: add UpperCamelCase aliases for remaining access and input types
da019a7 
Add UpperCamelCase type aliases for all access methods and input types
that were missing after open-component-model#1881. This completes the type notation alignment
per ocm-project#962 and ocm-spec#141.

Access methods: GitHub/v1, NPM/v1, Wget/v1, Git/v1alpha1, Maven/v1
Input types: Git, Maven, NPM, Wget, Binary, Docker, DockerMulti, Spiff, OCIArtifact

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
morri-son pushed a commit to morri-son/ocm that referenced this pull request Apr 17, 2026
@morrison-sap
feat: add UpperCamelCase aliases for remaining access and input types
ec8e323 
Add UpperCamelCase type aliases for all access methods and input types
that were missing after open-component-model#1881. This completes the type notation alignment
per ocm-project#962 and ocm-spec#141.

Access methods: GitHub/v1, NPM/v1, Wget/v1, Git/v1alpha1, Maven/v1
Input types: Git, Maven, NPM, Wget, Binary, Docker, DockerMulti, Spiff, OCIArtifact

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
morri-son pushed a commit to morri-son/ocm that referenced this pull request Apr 17, 2026
@morrison-sap
fix: address review feedback — revert Is() changes, deduplicate input…
d491b20 
… type docs

- Revert Is() changes in github/method.go and wget/method.go to match
  open-component-model#1881 pattern (don't touch existing functions)
- Register UPPER_TYPE input types without usage text to avoid duplicate
  entries in generated reference docs (all 8: dir, file, git, helm,
  maven, npm, utf8, wget)
- Regenerate docs/reference/ — removes ~1000 lines of duplicated content

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
morri-son pushed a commit to morri-son/ocm that referenced this pull request Apr 21, 2026
@morrison-sap
feat: add UpperCamelCase aliases for remaining access and input types
0658e9e 
Add UpperCamelCase type aliases for all access methods and input types
that were missing after open-component-model#1881. This completes the type notation alignment
per ocm-project#962 and ocm-spec#141.

Access methods: GitHub/v1, NPM/v1, Wget/v1, Git/v1alpha1, Maven/v1
Input types: Git, Maven, NPM, Wget, Binary, Docker, DockerMulti, Spiff, OCIArtifact

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
morri-son pushed a commit to morri-son/ocm that referenced this pull request Apr 21, 2026
@morrison-sap
fix: address review feedback — revert Is() changes, deduplicate input…
c2b1b9f 
… type docs

- Revert Is() changes in github/method.go and wget/method.go to match
  open-component-model#1881 pattern (don't touch existing functions)
- Register UPPER_TYPE input types without usage text to avoid duplicate
  entries in generated reference docs (all 8: dir, file, git, helm,
  maven, npm, utf8, wget)
- Regenerate docs/reference/ — removes ~1000 lines of duplicated content

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
morri-son added a commit that referenced this pull request Apr 21, 2026
@morri-son @morrison-sap
feat: add UpperCamelCase aliases for remaining access and input types (…
f5af619 
…#1920)

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>

<!-- markdownlint-disable MD041 -->
#### What this PR does / why we need it

Completes the UpperCamelCase type alias registration started in #1881.
That PR covered helm, localBlob, ociBlob (access) and dir, file, helm,
utf8 (input) but missed several access methods and input types.

This PR adds UpperCamelCase aliases for all remaining types:

**Access methods:**
- `gitHub` → alias `GitHub` / `GitHub/v1`
- `npm` → alias `NPM` / `NPM/v1`
- `wget` → alias `Wget` / `Wget/v1`
- `git` → alias `Git` / `Git/v1alpha1`
- `maven` → alias `Maven` / `Maven/v1`

**Input types (CLI):**
- `git` → alias `Git`
- `maven` → alias `Maven`
- `npm` → alias `NPM`
- `wget` → alias `Wget`

No behavior change: all existing lowercase type strings continue to
work. The new aliases ensure components authored with the new
`open-component-model` monorepo bindings (which emit UpperCamelCase as
primary) can be read by this legacy CLI.

Note: `NPM` follows the acronym convention used by `OCIImage`, `UTF8`,
etc.

**Documentation:**
UpperCamelCase aliases are registered with empty usage text, so they are
excluded from `--help` output and generated reference docs. A preamble
note was added to the input type documentation stating that
UpperCamelCase type names are aliases — check the corresponding
lowercase entry for full documentation.

#### Related
- open-component-model/ocm-project#962
- open-component-model/open-component-model#2057
- ocm-spec PR: open-component-model/ocm-spec#141
- Predecessor: #1881

---------

Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Co-authored-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
morri-son added a commit to open-component-model/open-component-model that referenced this pull request Apr 21, 2026
@morri-son @morrison-sap
feat: register UpperCamelCase as primary type for input types (skip l…
7756429 
…ocalBlob so far) (#2057)

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>

<!-- markdownlint-disable MD041 -->
## Summary
Register UpperCamelCase forms as the primary (default) serialization
type for all input types, consistent with the existing convention used
by access OCIImage/v1, Helm/v1 etc.

## Changes:
- Input types: File/v1 (was file/v1), Dir/v1 (was dir/v1), UTF8/v1 (was
utf8/v1), Helm/v1 (was helm/v1)

**The localBlob/v1 access type IS NOT touched in the PR.**, but already
prepared (including updating all tests using the new types) in [this
branch](https://github.com/morri-son/open-component-model/tree/align-type-notation-for-acces-and-input).

Lowercase forms remain registered as backward-compatible aliases so
existing component descriptors and constructors continue to work.

Adds named constants (Type, LegacyType) to each spec package following
the pattern already established by access type packages. Also adds Type
constants for OCIImage, OCIImageLayer, and Helm access types where
hardcoded strings were previously used in schema registrations.

## Which issue(s) this PR fixes
Usage: Fixes
open-component-model/ocm-project#962

## Dependencies
Tests for type casing have been split off to PR
#2071
to get the CI test not failing.

## Related
- ocm-spec: open-component-model/ocm-spec#141
- ocm v1: open-component-model/ocm#1881
- ocm-website:
#2244

## Verification

- [x] I have tested the changes locally by running `ocm`

---------

Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Co-authored-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
ocmbot2 Bot pushed a commit to morri-son/open-component-model that referenced this pull request Apr 21, 2026
@github-actions
feat: register UpperCamelCase as primary type for input types (skip l…
47c4ac4 
…ocalBlob so far) (open-component-model#2057)

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>

<!-- markdownlint-disable MD041 -->
## Summary
Register UpperCamelCase forms as the primary (default) serialization
type for all input types, consistent with the existing convention used
by access OCIImage/v1, Helm/v1 etc.

## Changes:
- Input types: File/v1 (was file/v1), Dir/v1 (was dir/v1), UTF8/v1 (was
utf8/v1), Helm/v1 (was helm/v1)

**The localBlob/v1 access type IS NOT touched in the PR.**, but already
prepared (including updating all tests using the new types) in [this
branch](https://github.com/morri-son/open-component-model/tree/align-type-notation-for-acces-and-input).

Lowercase forms remain registered as backward-compatible aliases so
existing component descriptors and constructors continue to work.

Adds named constants (Type, LegacyType) to each spec package following
the pattern already established by access type packages. Also adds Type
constants for OCIImage, OCIImageLayer, and Helm access types where
hardcoded strings were previously used in schema registrations.

## Which issue(s) this PR fixes
Usage: Fixes
open-component-model/ocm-project#962

## Dependencies
Tests for type casing have been split off to PR
open-component-model#2071
to get the CI test not failing.

## Related
- ocm-spec: open-component-model/ocm-spec#141
- ocm v1: open-component-model/ocm#1881
- ocm-website:
open-component-model#2244

## Verification

- [x] I have tested the changes locally by running `ocm`

---------

Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Co-authored-by: Gerald Morrison (SAP) <gerald.morrison@sap.com> 7756429
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jakobmoellerdev jakobmoellerdev jakobmoellerdev left review comments

@matthiasbruns matthiasbruns matthiasbruns approved these changes

@Skarlso Skarlso Skarlso left review comments

Assignees

No one assigned

Labels

area/documentation Documentation related component/github-actions Changes on GitHub Actions or within `.github/` directory component/ocm-cli OCM Command Line Interface kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. kind/skip-release-notes Pull request will not appear in release notes size/l Large

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

align type notation for access and input

6 participants

@morri-son @Skarlso @matthiasbruns @jakobmoellerdev @morrison-sap @frewilhelm