chore(deps): update dependency aquaproj/aqua to v2.62.0

[renovate]

This PR contains the following updates:

Package	Update	Change
aquaproj/aqua	minor	v2.56.4 → v2.62.0

---

Release Notes

aquaproj/aqua (aquaproj/aqua)

v2.62.0

Compare Source

Features

#​5024 Embed fallback X.509 roots to support sandboxed environments

Fixes

#​5018 More signature related filename extension exclusions @​scop
#​5025 Extract packages into a temp dir and rename atomically

Documentation

#​5023 Add a guide to use aqua with Claude Code's sandbox

v2.61.0

Compare Source

Features

#​5002 unarchive: Fall back to the system tar for GNU sparse tarballs
#​4971 genrate-registry: Prefer .sha512 > .sha256 > .sha1 > .md5 @​scop

v2.60.2

Compare Source

Improvements

Update ghtkn-go-sdk to v0.4.1

• Disable the automatic device flow by default
• Support min_expiration and backend.type in the configuration file
• Add app names to error messages

🐛 Bug Fixes

#​4990 #​4992 unarchive: allow benign symlinks that point outside the extraction directory
#​4974 help: make the help message consistent

Refactoring

#​4958 Remove more GitHub release attestation support remnants @​scop

Documentation

#​4967 Checksum pattern extraction from first capturing group @​scop

v2.60.1

Compare Source

⚠️ Security Fixes

d5b02b2 fix(unarchive): prevent archive extraction from writing outside the destination
For more details, please see the security advisory.

⚠️ Release Asset Naming Convention for Cosign Was Changed

• *.sig and *.pem files are no longer included in the release assets
• *.bundle files are renamed to *.sigstore.json

Fixes

#​4938 Remove GitHub Release Attestation verification

v2.60.0

Compare Source

Features

#​4894 Update ghtkn-go-sdk to v0.3.0 to support new features suche as backends and disabling device flow

New Contributors

• @​mehm8128 made their first contribution in #​4875
• @​shuuji3 made their first contribution in #​4887

v2.59.1

Compare Source

Fixes

#​4865 gr: don't treat *.minisig as checksum files @​scop

v2.59.0

Compare Source

Features

#​4517 Get checksums from GitHub API Release Asset Digest

v2.58.1

Compare Source

Fixes

#​4786 checksum: Change the algorithm to sha256 when registry file isn't cached

v2.58.0

Compare Source

Features

#​4733 #​4742 #​4755 Add the variants override mechanism with libc detection

https://aquaproj.github.io/docs/reference/registry-config/overrides/#variants

#​4667 Refactor GitHub release attestations control naming @​scop

[!WARNING]
github_immutable_release was deprecated. Use github_release_attestations instead.

#​4634 Get a GitHub access token from AQUA_GITHUB_TOKEN and pass it to gh command if GH_TOKEN and GITHUB_TOKEN aren't set

Document

#​4729 Update edit URL in docusaurus configuration @​dsychin
#​4756 Add musl vs glibc section to registry style guide

v2.57.2

Compare Source

Fixes

#​4719 Fix jar support
#​4722 Map x86-64 to amd64
#​4688 Normalize CRLF line endings in checksum file parser

Documentation

#​4668 Deprecate signer-workflow @​scop
#​4663 JSON Schema: signer-workflow string format @​scop

v2.57.1

Compare Source

🐛 Bug Fixes

#​4659 Fix a bug that aqua update-checksum doesn't verify checksum files using tools like Cosign

v2.57.0

Compare Source

Features

#​4625 Support executing .jar

If aqua which returns a .jar file, aqua executes it by java -jar.
This requires java command.

Fixes

#​4629 Re-add env field to log

v2.56.7

Compare Source

Bug Fixes

#​4585 remove: fix a bug that -i doesn't work

Refactoring

#​4527 Refactor Checksum Verification

Document

#​4560 Fix typos and invalid links in documents @​kangetsu121

Dependency Updates

• chore(deps): update dependency anchore/syft to v1.42.1 in #​4576
• chore(deps): update dependency go to v1.26.0 in #​4550
• fix(deps): update module golang.org/x/sys to v0.41.0 in #​4545
• refactor: migrate to math/rand/v2 by @​scop in #​4547
• fix(deps): update module golang.org/x/oauth2 to v0.35.0 in #​4541
• fix(deps): update module github.com/expr-lang/expr to v1.17.8 in #​4564
• fix(deps): update module github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.2.2 in #​4574
• chore(deps): update dependency sigstore/cosign to v3.0.5 in #​4578
• fix(deps): update module github.com/google/go-github/v82 to v83 in #​4568
• chore: update aqua-proxy to v1.2.13 in #​4588

v2.56.6

Compare Source

🐛 Bug Fixes

#​4510 Fix a bug that -log-color doesn't work
#​4526 aqua gr: Fix a bug that win32 are excluded

v2.56.5

Compare Source

🐛 Bug Fixes

#​4495 Fix a bug that aqua gr's -cmd option doesn't work

This was a bug of v2.56.2 ~ v2.56.4. #​4450

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 09:00 AM and 09:59 PM, only on Sunday and Saturday (* 9-21 * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.