Repository navigation
chore(deps): update dependency suzuki-shunsuke/ghcp to v1.16.1 - #535
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
renovate
Bot
force-pushed
the
renovate/suzuki-shunsuke-ghcp-1.x
branch
4 times, most recently
from
November 4, 2026 20:13
2760e8e to
b84f844
Compare
renovate
Bot
force-pushed
the
renovate/suzuki-shunsuke-ghcp-1.x
branch
from
November 5, 2026 05:12
b84f844 to
4f5f52b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.16.0→v1.16.1Release Notes
suzuki-shunsuke/ghcp
v1.16.1Compare Source
#1510 Update Go to v1.27.3
v1.16.0 was built with Go 1.23.2. This release is built with Go 1.27.3, and includes the security fixes of the Go releases between them.
Go 1.27.3 fixes CVE-2026-111943 in
crypto/x509. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised.Verifyfilters out chains containing those intermediates. The Go team highly recommends upgrading immediately.ghcp relies on
crypto/x509to verify the TLS certificate of the GitHub API, and that connection carries your access token. We recommend upgrading.#1297 #1412 golang.org/x/net is also updated from v0.23.0 to v0.55.0.
ref.
The ghcp binary itself isn't affected, but the release assets for verification have changed.
*.sigand*.pemaren't published anymore. Use*.sigstore.json(Sigstore bundle) insteadmultiple.intoto.jsonlisn't published anymore. Use Cosign, GitHub Artifact Attestations, or packslip insteadpackslip.sigstore.jsonis published. You can verify downloaded assets with packslip*.sbom.jsonare published, and the archives include the licenses of the dependencies (third_party_licenses)Bug Fixes
#1379 Update the branch when creating it conflicts
When ghcp committed to a branch it had just created, it could fail with
A ref named "refs/heads/..." already exists, because the GraphQL API didn't return the new branch yet. Now ghcp updates the branch instead of failing.Documentation
#527 Add how to verify downloaded assets
Dependency Updates
#1510 Update Go to v1.27.3
#531 #600 #637 #708 #726 #739 #784 #832 #876 #949 #1254 #1280 #1294 #1299 #1353 #1396 #1422 #1444 #1489 github.com/google/go-github/v93
#571 #665 #705 #754 #763 #825 #865 #1014 #1055 #1087 #1119 #1185 #1219 #1424 golang.org/x/oauth2 v0.37.0
#1297 #1412 golang.org/x/net v0.55.0
#632 #675 #714 #951 #1343 #1462 github.com/cenkalti/backoff/v7 v7.0.1
#731 #735 #997 #1000 #1117 github.com/spf13/cobra v1.10.2
#692 #938 #996 github.com/spf13/pflag v1.0.10
#986 github.com/google/wire v0.7.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.