chore(deps): update all non-major dependencies

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/main.yml

@@ -23,12 +23,12 @@ jobs:
 
  steps:
  - name: Install Go
- uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+ uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
  with:
  go-version: 1.20.x
 
  - name: Checkout code
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+ uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
  with:
  ref: ${{ github.head_ref }}
  fetch-depth: 0 # otherwise, there would be errors pushing refs to the destination repository.

.github/workflows/release.yaml

@@ -16,11 +16,11 @@ jobs:
  runs-on: ubuntu-latest
  steps:
  - name: Checkout
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+ uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
  with:
  fetch-depth: 0
  - name: Set up Go
- uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+ uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
  with:
  go-version: 1.20
  - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
@@ -31,10 +31,10 @@ jobs:
  key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
  restore-keys: |
  ${{ runner.os }}-go-
- - uses: sigstore/cosign-installer@9e9de2292db7abb3f51b7f4808d98f0d347a8919 # v3.0.2
- - uses: anchore/sbom-action/download-syft@422cb34a0f8b599678c41b21163ea6088edb2624 # v0.14.1
+ - uses: sigstore/cosign-installer@dd6b2e2b610a11fd73dd187a43d57cc1394e35f9 # v3.0.5
+ - uses: anchore/sbom-action/download-syft@78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1 # v0.14.3
  - name: Run GoReleaser
- uses: goreleaser/goreleaser-action@f82d6c1c344bcacabba2c841718984797f664a6b # v4.2.0
+ uses: goreleaser/goreleaser-action@336e29918d653399e599bfca99fadc1d7ffbc9f7 # v4.3.0
  with:
  # TODO(brumhard): set back to latest after issue is fixed
  # https://github.com/goreleaser/goreleaser/issues/3573

.github/workflows/semgrep.yml

@@ -14,7 +14,7 @@ jobs:
  name: Scan
  runs-on: ubuntu-latest
  steps:
- - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+ - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
  - uses: returntocorp/semgrep-action@v1
  with:
  config: >- # more at semgrep.dev/explore
@@ -23,7 +23,7 @@ jobs:
 
  # Upload findings to GitHub Advanced Security Dashboard [step 2/2]
  - name: Upload SARIF file for GitHub Advanced Security Dashboard
- uses: github/codeql-action/upload-sarif@7df0ce34898d659f95c0c4a09eaa8d4e32ee64db # v2.2.12
+ uses: github/codeql-action/upload-sarif@f6e388ebf0efc915c6c5b165b019ee61a6746a38 # v2.20.1
  with:
  sarif_file: semgrep.sarif
  if: always()

.github/workflows/tag_release.yaml

@@ -12,7 +12,7 @@ jobs:
  runs-on: ubuntu-latest
  steps:
  - name: Checkout
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+ uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
  # using a PAT is necessary to trigger the release workflow
  # see https://github.com/orgs/community/discussions/25702
  with:

go.mod

@@ -5,41 +5,44 @@ go 1.20
 require (
  github.com/Masterminds/semver/v3 v3.2.1
  github.com/Masterminds/sprig/v3 v3.2.3
- github.com/golangci/golangci-lint v1.52.2
+ github.com/golangci/golangci-lint v1.53.3
  github.com/google/go-github/v51 v51.0.0
  github.com/muesli/termenv v0.15.1
  github.com/pkg/errors v0.9.1
  github.com/spf13/cobra v1.7.0
- github.com/stretchr/testify v1.8.2
- golang.org/x/vuln v0.0.0-20230414205624-d3666e3e8dbb
+ github.com/stretchr/testify v1.8.4
+ golang.org/x/vuln v0.1.0
  gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
  4d63.com/gocheckcompilerdirectives v1.2.1 // indirect
  4d63.com/gochecknoglobals v0.2.1 // indirect
+ github.com/4meepo/tagalign v1.2.2 // indirect
  github.com/Abirdcfly/dupword v0.0.11 // indirect
- github.com/Antonboom/errname v0.1.9 // indirect
- github.com/Antonboom/nilnil v0.1.3 // indirect
- github.com/BurntSushi/toml v1.2.1 // indirect
+ github.com/Antonboom/errname v0.1.10 // indirect
+ github.com/Antonboom/nilnil v0.1.5 // indirect
+ github.com/BurntSushi/toml v1.3.2 // indirect
  github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 // indirect
  github.com/GaijinEntertainment/go-exhaustruct/v2 v2.3.0 // indirect
  github.com/Masterminds/goutils v1.1.1 // indirect
  github.com/Masterminds/semver v1.5.0 // indirect
- github.com/OpenPeeDeeP/depguard v1.1.1 // indirect
+ github.com/OpenPeeDeeP/depguard/v2 v2.1.0 // indirect
  github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8 // indirect
+ github.com/alexkohler/nakedret/v2 v2.0.2 // indirect
  github.com/alexkohler/prealloc v1.0.0 // indirect
  github.com/alingse/asasalint v0.0.11 // indirect
- github.com/ashanbrown/forbidigo v1.5.1 // indirect
+ github.com/ashanbrown/forbidigo v1.5.3 // indirect
  github.com/ashanbrown/makezero v1.1.1 // indirect
  github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
  github.com/beorn7/perks v1.0.1 // indirect
- github.com/bkielbasa/cyclop v1.2.0 // indirect
+ github.com/bkielbasa/cyclop v1.2.1 // indirect
  github.com/blizzy78/varnamelen v0.8.0 // indirect
  github.com/bombsimon/wsl/v3 v3.4.0 // indirect
  github.com/breml/bidichk v0.2.4 // indirect
  github.com/breml/errchkjson v0.3.1 // indirect
- github.com/butuzov/ireturn v0.1.1 // indirect
+ github.com/butuzov/ireturn v0.2.0 // indirect
+ github.com/butuzov/mirror v1.1.0 // indirect
  github.com/cespare/xxhash/v2 v2.1.2 // indirect
  github.com/charithe/durationcheck v0.0.10 // indirect
  github.com/chavacava/garif v0.0.0-20230227094218-b8c73b2037b8 // indirect
@@ -55,7 +58,7 @@ require (
  github.com/firefart/nonamedreturns v1.0.4 // indirect
  github.com/fsnotify/fsnotify v1.5.4 // indirect
  github.com/fzipp/gocyclo v0.6.0 // indirect
- github.com/go-critic/go-critic v0.7.0 // indirect
+ github.com/go-critic/go-critic v0.8.1 // indirect
  github.com/go-toolsmith/astcast v1.1.0 // indirect
  github.com/go-toolsmith/astcopy v1.1.0 // indirect
  github.com/go-toolsmith/astequal v1.1.0 // indirect
@@ -79,7 +82,7 @@ require (
  github.com/google/go-cmp v0.5.9 // indirect
  github.com/google/go-querystring v1.1.0 // indirect
  github.com/google/uuid v1.3.0 // indirect
- github.com/gordonklaus/ineffassign v0.0.0-20230107090616-13ace0543b28 // indirect
+ github.com/gordonklaus/ineffassign v0.0.0-20230610083614-0e73809eb601 // indirect
  github.com/gostaticanalysis/analysisutil v0.7.1 // indirect
  github.com/gostaticanalysis/comment v1.4.2 // indirect
  github.com/gostaticanalysis/forcetypeassert v0.1.0 // indirect
@@ -96,15 +99,14 @@ require (
  github.com/jingyugao/rowserrcheck v1.1.1 // indirect
  github.com/jirfag/go-printf-func-name v0.0.0-20200119135958-7558a9eaa5af // indirect
  github.com/julz/importas v0.1.0 // indirect
- github.com/junk1tm/musttag v0.5.0 // indirect
  github.com/kisielk/errcheck v1.6.3 // indirect
  github.com/kisielk/gotool v1.0.0 // indirect
  github.com/kkHAIKE/contextcheck v1.1.4 // indirect
  github.com/kulti/thelper v0.6.3 // indirect
- github.com/kunwardeep/paralleltest v1.0.6 // indirect
+ github.com/kunwardeep/paralleltest v1.0.7 // indirect
  github.com/kyoh86/exportloopref v0.1.11 // indirect
  github.com/ldez/gomoddirectives v0.2.3 // indirect
- github.com/ldez/tagliatelle v0.4.0 // indirect
+ github.com/ldez/tagliatelle v0.5.0 // indirect
  github.com/leonklingele/grouper v1.1.1 // indirect
  github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
  github.com/lufeee/execinquery v1.2.1 // indirect
@@ -117,22 +119,22 @@ require (
  github.com/mattn/go-runewidth v0.0.14 // indirect
  github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
  github.com/mbilski/exhaustivestruct v1.2.0 // indirect
- github.com/mgechev/revive v1.3.1 // indirect
+ github.com/mgechev/revive v1.3.2 // indirect
  github.com/mitchellh/copystructure v1.2.0 // indirect
  github.com/mitchellh/go-homedir v1.1.0 // indirect
  github.com/mitchellh/mapstructure v1.5.0 // indirect
  github.com/mitchellh/reflectwalk v1.0.2 // indirect
  github.com/moricho/tparallel v0.3.1 // indirect
  github.com/nakabonne/nestif v0.3.1 // indirect
  github.com/nbutton23/zxcvbn-go v0.0.0-20210217022336-fa2cb2858354 // indirect
- github.com/nishanths/exhaustive v0.9.5 // indirect
+ github.com/nishanths/exhaustive v0.11.0 // indirect
  github.com/nishanths/predeclared v0.2.2 // indirect
- github.com/nunnatsa/ginkgolinter v0.9.0 // indirect
+ github.com/nunnatsa/ginkgolinter v0.12.1 // indirect
  github.com/olekukonko/tablewriter v0.0.5 // indirect
  github.com/pelletier/go-toml v1.9.5 // indirect
  github.com/pelletier/go-toml/v2 v2.0.5 // indirect
  github.com/pmezard/go-difflib v1.0.0 // indirect
- github.com/polyfloyd/go-errorlint v1.4.0 // indirect
+ github.com/polyfloyd/go-errorlint v1.4.2 // indirect
  github.com/prometheus/client_golang v1.12.1 // indirect
  github.com/prometheus/client_model v0.2.0 // indirect
  github.com/prometheus/common v0.32.1 // indirect
@@ -147,11 +149,11 @@ require (
  github.com/sanposhiho/wastedassign/v2 v2.0.7 // indirect
  github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
  github.com/sashamelentyev/usestdlibvars v1.23.0 // indirect
- github.com/securego/gosec/v2 v2.15.0 // indirect
+ github.com/securego/gosec/v2 v2.16.0 // indirect
  github.com/shazow/go-diff v0.0.0-20160112020656-b6b7b6733b8c // indirect
  github.com/shopspring/decimal v1.2.0 // indirect
- github.com/sirupsen/logrus v1.9.0 // indirect
- github.com/sivchari/containedctx v1.0.2 // indirect
+ github.com/sirupsen/logrus v1.9.3 // indirect
+ github.com/sivchari/containedctx v1.0.3 // indirect
  github.com/sivchari/nosnakecase v1.7.0 // indirect
  github.com/sivchari/tenv v1.7.1 // indirect
  github.com/sonatard/noctx v0.0.2 // indirect
@@ -168,35 +170,38 @@ require (
  github.com/t-yuki/gocover-cobertura v0.0.0-20180217150009-aaee18c8195c // indirect
  github.com/tdakkota/asciicheck v0.2.0 // indirect
  github.com/tetafro/godot v1.4.11 // indirect
- github.com/timakin/bodyclose v0.0.0-20221125081123-e39cf3fc478e // indirect
+ github.com/timakin/bodyclose v0.0.0-20230421092635-574207250966 // indirect
  github.com/timonwong/loggercheck v0.9.4 // indirect
  github.com/tomarrell/wrapcheck/v2 v2.8.1 // indirect
  github.com/tommy-muehle/go-mnd/v2 v2.5.1 // indirect
  github.com/ultraware/funlen v0.0.3 // indirect
  github.com/ultraware/whitespace v0.0.5 // indirect
  github.com/uudashr/gocognit v1.0.6 // indirect
+ github.com/xen0n/gosmopolitan v1.2.1 // indirect
  github.com/yagipy/maintidx v1.0.0 // indirect
  github.com/yeya24/promlinter v0.2.0 // indirect
+ github.com/ykadowak/zerologlint v0.1.2 // indirect
  gitlab.com/bosi/decorder v0.2.3 // indirect
+ go.tmz.dev/musttag v0.7.0 // indirect
  go.uber.org/atomic v1.7.0 // indirect
  go.uber.org/multierr v1.6.0 // indirect
  go.uber.org/zap v1.24.0 // indirect
- golang.org/x/crypto v0.7.0 // indirect
- golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
+ golang.org/x/crypto v0.9.0 // indirect
+ golang.org/x/exp v0.0.0-20230510235704-dd950f8aeaea // indirect
  golang.org/x/exp/typeparams v0.0.0-20230224173230-c95f2b4c22f2 // indirect
- golang.org/x/mod v0.9.0 // indirect
- golang.org/x/net v0.8.0 // indirect
+ golang.org/x/mod v0.10.0 // indirect
+ golang.org/x/net v0.10.0 // indirect
  golang.org/x/oauth2 v0.6.0 // indirect
- golang.org/x/sync v0.1.0 // indirect
- golang.org/x/sys v0.6.0 // indirect
- golang.org/x/text v0.8.0 // indirect
- golang.org/x/tools v0.7.0 // indirect
+ golang.org/x/sync v0.2.0 // indirect
+ golang.org/x/sys v0.8.0 // indirect
+ golang.org/x/text v0.9.0 // indirect
+ golang.org/x/tools v0.9.3 // indirect
  google.golang.org/appengine v1.6.7 // indirect
  google.golang.org/protobuf v1.28.0 // indirect
  gopkg.in/ini.v1 v1.67.0 // indirect
  gopkg.in/yaml.v2 v2.4.0 // indirect
  honnef.co/go/tools v0.4.3 // indirect
- mvdan.cc/gofumpt v0.4.0 // indirect
+ mvdan.cc/gofumpt v0.5.0 // indirect
  mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed // indirect
  mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b // indirect
  mvdan.cc/unparam v0.0.0-20230312165513-e84e2d14e3b8 // indirect