GoReleaser v2.20.0 fixes an issue that could write inline publishing SSH private keys in cleartext to dist/artifacts.json. Upgrade to v2.20.0 and revoke and replace any keys exposed through shared or uploaded release metadata.
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [goreleaser/goreleaser](https://github.com/goreleaser/goreleaser) | | minor | `v2.19.0` → `v2.20.2` |
| [goreleaser/goreleaser](https://github.com/goreleaser/goreleaser) | uses-with | minor | `v2.19.0` → `v2.20.2` |
---
### Release Notes
<details>
<summary>goreleaser/goreleaser (goreleaser/goreleaser)</summary>
### [`v2.20.2`](https://github.com/goreleaser/goreleaser/releases/tag/v2.20.2)
[Compare Source](https://github.com/goreleaser/goreleaser/compare/v2.20.1...v2.20.2)
##### Announcement
Read the official announcement: [Announcing GoReleaser v2.20](https://goreleaser.com/blog/goreleaser-v2.20/).
##### Changelog
##### Security updates
- [`84f5ed6`](https://github.com/goreleaser/goreleaser/commit/84f5ed6689a1a2b4112f1085d96cf6a6ddb11a5e): sec: redact Git publication and SBOM credentials ([#​7303](https://github.com/goreleaser/goreleaser/issues/7303)) ([@​caarlos0](https://github.com/caarlos0))
##### Bug fixes
- [`b6d7c4e`](https://github.com/goreleaser/goreleaser/commit/b6d7c4e4cb095d80c903b1ce66f02db69597cff0): fix(checksums): do not fail split checksums without artifacts ([#​7306](https://github.com/goreleaser/goreleaser/issues/7306)) ([@​David-Uka](https://github.com/David-Uka))
- [`2a662ce`](https://github.com/goreleaser/goreleaser/commit/2a662ce09e733ca040ddc3029c428becef4b273d): fix(redact): avoid empty writes for buffered secret prefixes ([#​7301](https://github.com/goreleaser/goreleaser/issues/7301)) ([@​David-Uka](https://github.com/David-Uka) and [@​caarlos0](https://github.com/caarlos0))
- [`89fdc40`](https://github.com/goreleaser/goreleaser/commit/89fdc4036bb6133a08518369bf1ce760281c5dab): fix(telegram): use an HTML-escaped default message with parse\_mode HTML ([#​7285](https://github.com/goreleaser/goreleaser/issues/7285)) ([@​pcbeingused333](https://github.com/pcbeingused333) and [@​caarlos0](https://github.com/caarlos0))
##### Other work
- [`fb18621`](https://github.com/goreleaser/goreleaser/commit/fb186216f22b0dce0c9e95ee190a15dc5734afc5): chore(deps): update Go to 1.27.4 ([#​7296](https://github.com/goreleaser/goreleaser/issues/7296)) ([@​caarlos0](https://github.com/caarlos0))
- [`33e4013`](https://github.com/goreleaser/goreleaser/commit/33e401312a58d063e6e086dc54737db10d83a0bf): chore: auto-update generated files ([#​7297](https://github.com/goreleaser/goreleaser/issues/7297)) ([@​goreleaserbot](https://github.com/goreleaserbot))
- [`6eedb82`](https://github.com/goreleaser/goreleaser/commit/6eedb82fdcb9f6a40d7e065e4c249ac2bc00f50b): chore: auto-update generated files ([#​7302](https://github.com/goreleaser/goreleaser/issues/7302)) ([@​goreleaser](https://github.com/goreleaser)\[bot])
**Full Changelog**: <https://github.com/goreleaser/goreleaser/compare/v2.20.1...v2.20.2>
##### Helping out
This release is only possible thanks to **all** the support of some **awesome people**!
Want to be one of them?
You can [sponsor](https://goreleaser.com/sponsors/), get a [Pro License](https://goreleaser.com/pro) or [contribute with code](https://goreleaser.com/contributing).
##### Where to go next?
- Find examples and commented usage of all options in our [website](https://goreleaser.com/intro/).
- Reach out on [Discord](https://discord.gg/RGEBtg8vQ6), [Twitter](https://twitter.com/goreleaser), and [Telegram](https://t.me/goreleasernews)!
<a href="https://goreleaser.com"><img src="https://raw.githubusercontent.com/goreleaser/artwork/master/opencollective-header.png" with="100%" alt="GoReleaser logo"></a>
### [`v2.20.1`](https://github.com/goreleaser/goreleaser/releases/tag/v2.20.1)
[Compare Source](https://github.com/goreleaser/goreleaser/compare/v2.20.0...v2.20.1)
##### Announcement
Read the official announcement: [Announcing GoReleaser v2.20](https://goreleaser.com/blog/goreleaser-v2.20/).
##### Changelog
##### Security updates
- [`0b1b1ff`](https://github.com/goreleaser/goreleaser/commit/0b1b1fff41ab7113cdb6858ac45a1cf7f9bebc92): sec(git): redact URL credentials from diagnostics ([#​7294](https://github.com/goreleaser/goreleaser/issues/7294)) ([@​caarlos0](https://github.com/caarlos0)) ([GHSA-7qv4-9g3j-wvq8](https://github.com/goreleaser/goreleaser/security/advisories/GHSA-7qv4-9g3j-wvq8))
- [`9a037e1`](https://github.com/goreleaser/goreleaser/commit/9a037e1fd427402b52c117f0de38614972b909bb): sec(srpm): reject RPM macros in package versions ([#​7295](https://github.com/goreleaser/goreleaser/issues/7295)) ([@​caarlos0](https://github.com/caarlos0)) ([GHSA-rjp9-h7gp-wr7q](https://github.com/goreleaser/goreleaser/security/advisories/GHSA-rjp9-h7gp-wr7q))
- [`fb9617b`](https://github.com/goreleaser/goreleaser/commit/fb9617b200efc33bb7fa63b5a2c005949fc5d566): sec: redact hook and chocolatey secrets from logs ([#​7293](https://github.com/goreleaser/goreleaser/issues/7293)) ([@​caarlos0](https://github.com/caarlos0)) ([GHSA-gvxm-cvj4-qwvp](https://github.com/goreleaser/goreleaser/security/advisories/GHSA-gvxm-cvj4-qwvp))
##### Bug fixes
- [`0946e5e`](https://github.com/goreleaser/goreleaser/commit/0946e5ed0111de64e577d16f6802e755c956e366): fix(aur): install every binary of the archive in the default package ([#​7284](https://github.com/goreleaser/goreleaser/issues/7284)) ([@​lbarrosby](https://github.com/lbarrosby))
- [`79c8d68`](https://github.com/goreleaser/goreleaser/commit/79c8d685b968bb083c73c2ed72ac8ede54d2192d): fix(client): defer SSH private-key expansion until publishing ([#​7273](https://github.com/goreleaser/goreleaser/issues/7273)) ([@​caarlos0](https://github.com/caarlos0))
- [`e46cd64`](https://github.com/goreleaser/goreleaser/commit/e46cd64808b1fde7d770b2ec64b80f052560c943): fix(docs): remove duplicate prebuilt redirects ([@​caarlos0](https://github.com/caarlos0))
- [`5f422b1`](https://github.com/goreleaser/goreleaser/commit/5f422b18d5245cbece678da34eefdb542e0a08f6): fix(ko): accept '..' as main path ([#​7279](https://github.com/goreleaser/goreleaser/issues/7279)) ([@​mrueg](https://github.com/mrueg))
- [`a8f1c1e`](https://github.com/goreleaser/goreleaser/commit/a8f1c1ec8f3991588f8c41abf22eb5c80aeb740c): fix(ko): prefer remote base images and don't cache failed lookups ([#​7275](https://github.com/goreleaser/goreleaser/issues/7275)) ([@​mrueg](https://github.com/mrueg))
- [`3432e8d`](https://github.com/goreleaser/goreleaser/commit/3432e8d530ceeabf38edf26b5399006baad9f4e2): fix(mcp): retry publish when package version is not yet visible ([#​7283](https://github.com/goreleaser/goreleaser/issues/7283)) ([@​santhiprakash](https://github.com/santhiprakash))
- [`119f88f`](https://github.com/goreleaser/goreleaser/commit/119f88f695dc34e4b6f04c34e22005955d5675f8): refactor(ko): simplify template handling ([#​7277](https://github.com/goreleaser/goreleaser/issues/7277)) ([@​mrueg](https://github.com/mrueg))
##### Documentation updates
- [`3286c23`](https://github.com/goreleaser/goreleaser/commit/3286c23e755afa57959c32dda751a8b169736d97): docs: .ArtifactPath is not always an absolute path ([#​7289](https://github.com/goreleaser/goreleaser/issues/7289)) ([@​ZainnQureshii](https://github.com/ZainnQureshii))
##### Other work
- [`ed8efe6`](https://github.com/goreleaser/goreleaser/commit/ed8efe6a52def7b44443e0779021c3439b24ca5b): chore: auto-update generated files ([#​7274](https://github.com/goreleaser/goreleaser/issues/7274)) ([@​goreleaserbot](https://github.com/goreleaserbot))
**Full Changelog**: <https://github.com/goreleaser/goreleaser/compare/v2.20.0...v2.20.1>
##### Helping out
This release is only possible thanks to **all** the support of some **awesome people**!
Want to be one of them?
You can [sponsor](https://goreleaser.com/sponsors/), get a [Pro License](https://goreleaser.com/pro) or [contribute with code](https://goreleaser.com/contributing).
##### Where to go next?
- Find examples and commented usage of all options in our [website](https://goreleaser.com/intro/).
- Reach out on [Discord](https://discord.gg/RGEBtg8vQ6), [Twitter](https://twitter.com/goreleaser), and [Telegram](https://t.me/goreleasernews)!
<a href="https://goreleaser.com"><img src="https://raw.githubusercontent.com/goreleaser/artwork/master/opencollective-header.png" with="100%" alt="GoReleaser logo"></a>
### [`v2.20.0`](https://github.com/goreleaser/goreleaser/releases/tag/v2.20.0)
[Compare Source](https://github.com/goreleaser/goreleaser/compare/v2.19.0...v2.20.0)
#### Announcement
Read the official announcement: [Announcing GoReleaser v2.20](https://goreleaser.com/blog/goreleaser-v2.20/).
#### Security
GoReleaser v2.20.0 fixes an issue that could write inline publishing SSH private keys in cleartext to `dist/artifacts.json`. Upgrade to v2.20.0 and revoke and replace any keys exposed through shared or uploaded release metadata.
See [GHSA-9422-8p9m-393x](https://github.com/goreleaser/goreleaser/security/advisories/GHSA-9422-8p9m-393x) for details.
#### Changelog
##### New Features
- [`e1176e6`](https://github.com/goreleaser/goreleaser/commit/e1176e6189ddc4136161a2d00efa0ce0bd43b6a7): feat(cask): render `zap :not_required` when no zap directives are set ([#​7253](https://github.com/goreleaser/goreleaser/issues/7253)) ([@​SimonMiaou](https://github.com/SimonMiaou))
- [`afd8f84`](https://github.com/goreleaser/goreleaser/commit/afd8f84e21e5a26d8dcc215b9e94c2433d6c4bff): feat(gitlab): add asset type selection ([#​7255](https://github.com/goreleaser/goreleaser/issues/7255)) ([@​mavogel](https://github.com/mavogel))
- [`b8f79e0`](https://github.com/goreleaser/goreleaser/commit/b8f79e0399c46895220e8479e24d599576b563a8): feat(ko): allow templates in platforms ([#​7233](https://github.com/goreleaser/goreleaser/issues/7233)) ([@​mrueg](https://github.com/mrueg) and [@​caarlos0](https://github.com/caarlos0))
- [`2e260e4`](https://github.com/goreleaser/goreleaser/commit/2e260e4af35c00e0ad41e479c3830f9cfe858e36): feat(winget): update manifest schema to latest (1.28.0) ([#​7242](https://github.com/goreleaser/goreleaser/issues/7242)) ([@​abemedia](https://github.com/abemedia))
- [`4a1a1ae`](https://github.com/goreleaser/goreleaser/commit/4a1a1aecad78b7de77879e6b5e3809b578db000b): feat: allow skipping the changelog with --skip=changelog ([#​7234](https://github.com/goreleaser/goreleaser/issues/7234)) ([@​mrueg](https://github.com/mrueg) and [@​caarlos0](https://github.com/caarlos0))
##### Bug fixes
- [`24ec0fd`](https://github.com/goreleaser/goreleaser/commit/24ec0fd478872716fa2665eafa3380191240359a): fix(bluesky): do not add a link facet when there is no release URL ([#​7262](https://github.com/goreleaser/goreleaser/issues/7262)) ([@​10kartik](https://github.com/10kartik))
- [`bfa11d9`](https://github.com/goreleaser/goreleaser/commit/bfa11d921eabfe07480012b5e8d8c5a40f566508): fix(nodedist): handle prerelease versions in generation ([#​7263](https://github.com/goreleaser/goreleaser/issues/7263)) ([@​caarlos0](https://github.com/caarlos0))
- [`3d5c3a2`](https://github.com/goreleaser/goreleaser/commit/3d5c3a2efe1544b8f7d24a8c2ed10dab45b89a61): fix(tmpl): escape backslashes in mdv2escape ([#​7261](https://github.com/goreleaser/goreleaser/issues/7261)) ([@​10kartik](https://github.com/10kartik))
- [`e39e2fe`](https://github.com/goreleaser/goreleaser/commit/e39e2fe8b3b57b589bf89d2e8e1916012846434e): refactor: move marshaljson methods to right place ([@​caarlos0](https://github.com/caarlos0))
##### Documentation updates
- [`53e5668`](https://github.com/goreleaser/goreleaser/commit/53e5668e405484ca6df9d189edd3a4be47097a63): docs: add --snapshot to quick start single-target builds ([#​7232](https://github.com/goreleaser/goreleaser/issues/7232)) ([@​dcadolph](https://github.com/dcadolph))
- [`3467d0f`](https://github.com/goreleaser/goreleaser/commit/3467d0fee89e5a99d1a12ab9204361bfbbd03896): docs: github app ([#​7271](https://github.com/goreleaser/goreleaser/issues/7271)) ([@​caarlos0](https://github.com/caarlos0))
- [`81042d3`](https://github.com/goreleaser/goreleaser/commit/81042d32245657ba3e5c29215fa3adbb716bb35d): docs: update Pro page copy ([#​7270](https://github.com/goreleaser/goreleaser/issues/7270)) ([@​caarlos0](https://github.com/caarlos0))
- [`2d9b4c9`](https://github.com/goreleaser/goreleaser/commit/2d9b4c9ae3a1998975f89be160346255bbdbfbfe): docs: v2.19 announcement and docs ([@​caarlos0](https://github.com/caarlos0))
##### Other work
- [`6ac2967`](https://github.com/goreleaser/goreleaser/commit/6ac29673ac708d7f5a95b37639ff6ad6b8e1c835): Merge commit from fork ([@​Divsonar](https://github.com/Divsonar) and [@​caarlos0](https://github.com/caarlos0))
- [`94bc193`](https://github.com/goreleaser/goreleaser/commit/94bc1931912b5e25d40ba44aa6172584eef9af7b): chore: auto-update generated files ([#​7231](https://github.com/goreleaser/goreleaser/issues/7231)) ([@​goreleaserbot](https://github.com/goreleaserbot))
- [`538a99e`](https://github.com/goreleaser/goreleaser/commit/538a99ed8f8283ed4b47f7f5ba2ab59df049cd64): chore: auto-update generated files ([#​7254](https://github.com/goreleaser/goreleaser/issues/7254)) ([@​goreleaserbot](https://github.com/goreleaserbot))
- [`6e4f864`](https://github.com/goreleaser/goreleaser/commit/6e4f864373b19007d2bda3ae091721d82750f6fc): chore: auto-update generated files ([#​7264](https://github.com/goreleaser/goreleaser/issues/7264)) ([@​goreleaserbot](https://github.com/goreleaserbot))
- [`9b610a1`](https://github.com/goreleaser/goreleaser/commit/9b610a1a2a394c3480edb96ae437eff042695b94): chore: auto-update generated files ([#​7266](https://github.com/goreleaser/goreleaser/issues/7266)) ([@​goreleaserbot](https://github.com/goreleaserbot))
- [`27f55a0`](https://github.com/goreleaser/goreleaser/commit/27f55a04b7c7446612267346c110659bd59f4fbb): chore: lint ([@​caarlos0](https://github.com/caarlos0))
**Full Changelog**: <https://github.com/goreleaser/goreleaser/compare/v2.19.0...v2.20.0>
#### Helping out
This release is only possible thanks to **all** the support of some **awesome people**!
Want to be one of them?
You can [sponsor](https://goreleaser.com/sponsors/), get a [Pro License](https://goreleaser.com/pro) or [contribute with code](https://goreleaser.com/contributing).
#### Where to go next?
- Find examples and commented usage of all options in our [website](https://goreleaser.com/intro/).
- Reach out on [Discord](https://discord.gg/RGEBtg8vQ6), [Twitter](https://twitter.com/goreleaser), and [Telegram](https://t.me/goreleasernews)!
<a href="https://goreleaser.com"><img src="https://raw.githubusercontent.com/goreleaser/artwork/master/opencollective-header.png" with="100%" alt="GoReleaser logo"></a>
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTYuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjExNi4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbInJlbm92YXRlL2F1dG9tZXJnZSIsInJlbm92YXRlL2dpdGh1Yi1hY3Rpb24iXX0=-->
CSRBot
scheduled this pull request to auto merge when all checks succeed 2026-11-09 18:38:11 +01:00
CSRBot
changed title from chore(deps): update dependency goreleaser/goreleaser to v2.20.0 to chore(deps): update dependency goreleaser/goreleaser to v2.20.12026-11-11 03:12:20 +01:00
CSRBot
changed title from chore(deps): update dependency goreleaser/goreleaser to v2.20.1 to chore(deps): update dependency goreleaser/goreleaser to v2.20.22026-11-12 18:02:55 +01:00
CSRBot
merged commit 6d7b252f21 into master2026-11-12 18:13:43 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
v2.19.0→v2.20.2v2.19.0→v2.20.2Release Notes
goreleaser/goreleaser (goreleaser/goreleaser)
v2.20.2Compare Source
Announcement
Read the official announcement: Announcing GoReleaser v2.20.
Changelog
Security updates
84f5ed6: sec: redact Git publication and SBOM credentials (#7303) (@caarlos0)Bug fixes
b6d7c4e: fix(checksums): do not fail split checksums without artifacts (#7306) (@David-Uka)2a662ce: fix(redact): avoid empty writes for buffered secret prefixes (#7301) (@David-Uka and @caarlos0)89fdc40: fix(telegram): use an HTML-escaped default message with parse_mode HTML (#7285) (@pcbeingused333 and @caarlos0)Other work
fb18621: chore(deps): update Go to 1.27.4 (#7296) (@caarlos0)33e4013: chore: auto-update generated files (#7297) (@goreleaserbot)6eedb82: chore: auto-update generated files (#7302) (@goreleaser[bot])Full Changelog: https://github.com/goreleaser/goreleaser/compare/v2.20.1...v2.20.2
Helping out
This release is only possible thanks to all the support of some awesome people!
Want to be one of them?
You can sponsor, get a Pro License or contribute with code.
Where to go next?
v2.20.1Compare Source
Announcement
Read the official announcement: Announcing GoReleaser v2.20.
Changelog
Security updates
0b1b1ff: sec(git): redact URL credentials from diagnostics (#7294) (@caarlos0) (GHSA-7qv4-9g3j-wvq8)9a037e1: sec(srpm): reject RPM macros in package versions (#7295) (@caarlos0) (GHSA-rjp9-h7gp-wr7q)fb9617b: sec: redact hook and chocolatey secrets from logs (#7293) (@caarlos0) (GHSA-gvxm-cvj4-qwvp)Bug fixes
0946e5e: fix(aur): install every binary of the archive in the default package (#7284) (@lbarrosby)79c8d68: fix(client): defer SSH private-key expansion until publishing (#7273) (@caarlos0)e46cd64: fix(docs): remove duplicate prebuilt redirects (@caarlos0)5f422b1: fix(ko): accept '..' as main path (#7279) (@mrueg)a8f1c1e: fix(ko): prefer remote base images and don't cache failed lookups (#7275) (@mrueg)3432e8d: fix(mcp): retry publish when package version is not yet visible (#7283) (@santhiprakash)119f88f: refactor(ko): simplify template handling (#7277) (@mrueg)Documentation updates
3286c23: docs: .ArtifactPath is not always an absolute path (#7289) (@ZainnQureshii)Other work
ed8efe6: chore: auto-update generated files (#7274) (@goreleaserbot)Full Changelog: https://github.com/goreleaser/goreleaser/compare/v2.20.0...v2.20.1
Helping out
This release is only possible thanks to all the support of some awesome people!
Want to be one of them?
You can sponsor, get a Pro License or contribute with code.
Where to go next?
v2.20.0Compare Source
Announcement
Read the official announcement: Announcing GoReleaser v2.20.
Security
GoReleaser v2.20.0 fixes an issue that could write inline publishing SSH private keys in cleartext to
dist/artifacts.json. Upgrade to v2.20.0 and revoke and replace any keys exposed through shared or uploaded release metadata.See GHSA-9422-8p9m-393x for details.
Changelog
New Features
e1176e6: feat(cask): renderzap :not_requiredwhen no zap directives are set (#7253) (@SimonMiaou)afd8f84: feat(gitlab): add asset type selection (#7255) (@mavogel)b8f79e0: feat(ko): allow templates in platforms (#7233) (@mrueg and @caarlos0)2e260e4: feat(winget): update manifest schema to latest (1.28.0) (#7242) (@abemedia)4a1a1ae: feat: allow skipping the changelog with --skip=changelog (#7234) (@mrueg and @caarlos0)Bug fixes
24ec0fd: fix(bluesky): do not add a link facet when there is no release URL (#7262) (@10kartik)bfa11d9: fix(nodedist): handle prerelease versions in generation (#7263) (@caarlos0)3d5c3a2: fix(tmpl): escape backslashes in mdv2escape (#7261) (@10kartik)e39e2fe: refactor: move marshaljson methods to right place (@caarlos0)Documentation updates
53e5668: docs: add --snapshot to quick start single-target builds (#7232) (@dcadolph)3467d0f: docs: github app (#7271) (@caarlos0)81042d3: docs: update Pro page copy (#7270) (@caarlos0)2d9b4c9: docs: v2.19 announcement and docs (@caarlos0)Other work
6ac2967: Merge commit from fork (@Divsonar and @caarlos0)94bc193: chore: auto-update generated files (#7231) (@goreleaserbot)538a99e: chore: auto-update generated files (#7254) (@goreleaserbot)6e4f864: chore: auto-update generated files (#7264) (@goreleaserbot)9b610a1: chore: auto-update generated files (#7266) (@goreleaserbot)27f55a0: chore: lint (@caarlos0)Full Changelog: https://github.com/goreleaser/goreleaser/compare/v2.19.0...v2.20.0
Helping out
This release is only possible thanks to all the support of some awesome people!
Want to be one of them?
You can sponsor, get a Pro License or contribute with code.
Where to go next?
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Mend Renovate CLI.
chore(deps): update dependency goreleaser/goreleaser to v2.20.0to chore(deps): update dependency goreleaser/goreleaser to v2.20.147feb2aa91tob55329a845chore(deps): update dependency goreleaser/goreleaser to v2.20.1to chore(deps): update dependency goreleaser/goreleaser to v2.20.2