chore(deps): update module github.com/goreleaser/goreleaser to v1.26.1 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/goreleaser/goreleaser	v1.26.0 -> v1.26.1

GitHub Vulnerability Alerts

GHSA-f6mm-5fc7-3g3c

Summary

Since #​4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the go build output is non-empty, goreleaser leaks the environment.

PoC

• Create a Go project with dependencies, do not pull them yet (or run goreleaser later in a container, or delete $GOPATH/pkg).
• Make sure to have secrets set in the environment
• Make sure to not have go mod tidy in a before hook
• Run goreleaser release --clean
• Go prints lots of go: downloading ... lines, which triggers the "if output not empty, log it" line, which includes the environment.

Impact

Credentials and tokens are leaked.

---

Release Notes

goreleaser/goreleaser (github.com/goreleaser/goreleaser)

v1.26.1

Compare Source

Changelog

Security updates

• 19b94f6: sec: GHSA-f6mm-5fc7-3g3c (@​caarlos0)

Bug fixes

• 9cf3bbb: fix(build): do not print 'go: downloading' bits of go build output (#​4869) (@​caarlos0)
• e466507: fix(cmd): --draft should only override if set (@​caarlos0)
• c5204df: fix: close HTTP resp body to prevent resource leak (#​4857) (@​alexandear)
• 7e0155c: fix: disable logs on some commands (#​4865) (@​caarlos0)
• 6505654: fix: fix nolintlint issues (#​4854) (@​alexandear)
• 00a376c: refactor: remove unneeded in Go 1.22 loop var copy (#​4856) (@​alexandear)

Documentation updates

• ba7e915: docs: announce v1.26 (#​4851) (@​caarlos0)
• 2f56643: docs: update action docs (@​caarlos0)
• c148106: docs: update old Go website links (#​4855) (@​alexandear)

Build process updates

• c09c86c: build: disable appendAssign gocritic check (@​caarlos0)

Full Changelog: goreleaser/goreleaser@v1.26.0...v1.26.1

Helping out

This release is only possible thanks to all the support of some awesome people!

Want to be one of them?
You can sponsor, get a Pro License or contribute with code.

Where to go next?

• Find examples and commented usage of all options in our website.
• Reach out on Discord and Twitter!

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.