Announcement

Read the official announcement: Announcing GoReleaser v2.20.

Changelog

Security updates

• 0b1b1ff: sec(git): redact URL credentials from diagnostics (#7294) (@caarlos0) (GHSA-7qv4-9g3j-wvq8)
• 9a037e1: sec(srpm): reject RPM macros in package versions (#7295) (@caarlos0) (GHSA-rjp9-h7gp-wr7q)
• fb9617b: sec: redact hook and chocolatey secrets from logs (#7293) (@caarlos0) (GHSA-gvxm-cvj4-qwvp)

Bug fixes

• 0946e5e: fix(aur): install every binary of the archive in the default package (#7284) (@lbarrosby)
• 79c8d68: fix(client): defer SSH private-key expansion until publishing (#7273) (@caarlos0)
• e46cd64: fix(docs): remove duplicate prebuilt redirects (@caarlos0)
• 5f422b1: fix(ko): accept '..' as main path (#7279) (@mrueg)
• a8f1c1e: fix(ko): prefer remote base images and don't cache failed lookups (#7275) (@mrueg)
• 3432e8d: fix(mcp): retry publish when package version is not yet visible (#7283) (@santhiprakash)
• 119f88f: refactor(ko): simplify template handling (#7277) (@mrueg)

Documentation updates

• 3286c23: docs: .ArtifactPath is not always an absolute path (#7289) (@ZainnQureshii)

Other work

• ed8efe6: chore: auto-update generated files (#7274) (@goreleaserbot)

Full Changelog: v2.20.0...v2.20.1

Helping out

This release is only possible thanks to all the support of some awesome people!

Want to be one of them?
You can sponsor, get a Pro License or contribute with code.

Where to go next?

• Find examples and commented usage of all options in our website.
• Reach out on Discord, Twitter, and Telegram!

Changelog

Security updates

• 0b1b1ff: sec(git): redact URL credentials from diagnostics (#7294)
• 9a037e1: sec(srpm): reject RPM macros in package versions (#7295)
• fb9617b: sec: redact hook and chocolatey secrets from logs (#7293)

Bug fixes

• 0946e5e: fix(aur): install every binary of the archive in the default package (#7284)
• 79c8d68: fix(client): defer SSH private-key expansion until publishing (#7273)
• e46cd64: fix(docs): remove duplicate prebuilt redirects
• 5f422b1: fix(ko): accept '..' as main path (#7279)
• a8f1c1e: fix(ko): prefer remote base images and don't cache failed lookups (#7275)
• 3432e8d: fix(mcp): retry publish when package version is not yet visible (#7283)
• 119f88f: refactor(ko): simplify template handling (#7277)

Documentation updates

• 3286c23: docs: .ArtifactPath is not always an absolute path (#7289)

Other work

• ed8efe6: chore: auto-update generated files (#7274)

Full Changelog: v2.20.0...v2.21.0-a8f1c1ec-nightly

Changelog

Security updates

• 0b1b1ff: sec(git): redact URL credentials from diagnostics (#7294)
• 9a037e1: sec(srpm): reject RPM macros in package versions (#7295)
• fb9617b: sec: redact hook and chocolatey secrets from logs (#7293)

Bug fixes

• 0946e5e: fix(aur): install every binary of the archive in the default package (#7284)
• 79c8d68: fix(client): defer SSH private-key expansion until publishing (#7273)
• e46cd64: fix(docs): remove duplicate prebuilt redirects
• 5f422b1: fix(ko): accept '..' as main path (#7279)
• a8f1c1e: fix(ko): prefer remote base images and don't cache failed lookups (#7275)
• 3432e8d: fix(mcp): retry publish when package version is not yet visible (#7283)
• 119f88f: refactor(ko): simplify template handling (#7277)

Documentation updates

• 3286c23: docs: .ArtifactPath is not always an absolute path (#7289)

Other work

• ed8efe6: chore: auto-update generated files (#7274)

Full Changelog: v2.20.0...v2.21.0-119f88f6-nightly

Changelog

Bug fixes

• e46cd64: fix(docs): remove duplicate prebuilt redirects
• 5f422b1: fix(ko): accept '..' as main path (#7279)

Other work

• ed8efe6: chore: auto-update generated files (#7274)

Full Changelog: v2.20.0...v2.21.0-2c336825-nightly

Changelog

Other work

• ed8efe6: chore: auto-update generated files (#7274)

Full Changelog: v2.20.0...v2.21.0-ed8efe6a-nightly

Announcement

Read the official announcement: Announcing GoReleaser v2.20.

Security

GoReleaser v2.20.0 fixes an issue that could write inline publishing SSH private keys in cleartext to dist/artifacts.json. Upgrade to v2.20.0 and revoke and replace any keys exposed through shared or uploaded release metadata.

See GHSA-9422-8p9m-393x for details.

Changelog

New Features

• e1176e6: feat(cask): render zap :not_required when no zap directives are set (#7253) (@SimonMiaou)
• afd8f84: feat(gitlab): add asset type selection (#7255) (@mavogel)
• b8f79e0: feat(ko): allow templates in platforms (#7233) (@mrueg and @caarlos0)
• 2e260e4: feat(winget): update manifest schema to latest (1.28.0) (#7242) (@abemedia)
• 4a1a1ae: feat: allow skipping the changelog with --skip=changelog (#7234) (@mrueg and @caarlos0)

Bug fixes

• 24ec0fd: fix(bluesky): do not add a link facet when there is no release URL (#7262) (@10kartik)
• bfa11d9: fix(nodedist): handle prerelease versions in generation (#7263) (@caarlos0)
• 3d5c3a2: fix(tmpl): escape backslashes in mdv2escape (#7261) (@10kartik)
• e39e2fe: refactor: move marshaljson methods to right place (@caarlos0)

Documentation updates

• 53e5668: docs: add --snapshot to quick start single-target builds (#7232) (@dcadolph)
• 3467d0f: docs: github app (#7271) (@caarlos0)
• 81042d3: docs: update Pro page copy (#7270) (@caarlos0)
• 2d9b4c9: docs: v2.19 announcement and docs (@caarlos0)

Other work

• 6ac2967: Merge commit from fork (@Divsonar and @caarlos0)
• 94bc193: chore: auto-update generated files (#7231) (@goreleaserbot)
• 538a99e: chore: auto-update generated files (#7254) (@goreleaserbot)
• 6e4f864: chore: auto-update generated files (#7264) (@goreleaserbot)
• 9b610a1: chore: auto-update generated files (#7266) (@goreleaserbot)
• 27f55a0: chore: lint (@caarlos0)

Full Changelog: v2.19.0...v2.20.0

Helping out

This release is only possible thanks to all the support of some awesome people!

Want to be one of them?
You can sponsor, get a Pro License or contribute with code.

Where to go next?

• Find examples and commented usage of all options in our website.
• Reach out on Discord, Twitter, and Telegram!

Changelog

New Features

• e1176e6: feat(cask): render zap :not_required when no zap directives are set (#7253)
• afd8f84: feat(gitlab): add asset type selection (#7255)
• 2e260e4: feat(winget): update manifest schema to latest (1.28.0) (#7242)
• 4a1a1ae: feat: allow skipping the changelog with --skip=changelog (#7234)

Bug fixes

• 24ec0fd: fix(bluesky): do not add a link facet when there is no release URL (#7262)
• bfa11d9: fix(nodedist): handle prerelease versions in generation (#7263)
• 3d5c3a2: fix(tmpl): escape backslashes in mdv2escape (#7261)

Documentation updates

• 53e5668: docs: add --snapshot to quick start single-target builds (#7232)
• 3467d0f: docs: github app (#7271)
• 81042d3: docs: update Pro page copy (#7270)
• 2d9b4c9: docs: v2.19 announcement and docs

Other work

• 94bc193: chore: auto-update generated files (#7231)
• 538a99e: chore: auto-update generated files (#7254)
• 6e4f864: chore: auto-update generated files (#7264)
• 9b610a1: chore: auto-update generated files (#7266)

Full Changelog: v2.19.0...v2.20.0-a0881564-nightly

Announcement

Read the official announcement: Announcing GoReleaser v2.19.

Changelog

New Features

• 35f2281: feat(archive): configure zstd compression level and window size (#7206) (@caarlos0)
• 4ebadf5: feat(cask): add hooks install_steps, deprecate raw Ruby hooks (#6873) (@caarlos0)
• f1e16bf: feat(ko): support linux_capabilities (#7225) (@mrueg and @caarlos0)
• 9926cef: feat(nix): drop the nix-hash dependency (#6824) (@caarlos0)
• 6386def: feat: graduate stable features out of experimental (#7126) (@caarlos0)

Security updates

• 6ade066: sec(deps): bump golang.org/x/ (#7201) (@caarlos0)
• b690fd8: sec: update to Go 1.27.3 (#7220) (@shaanmajid)

Bug fixes

• 09301ea: fix(archive): propagate tar read errors in Copy (#7194) (@Lzcwbcgs)
• 68e5e34: fix(cask): emit brew-valid casks when builds.ignore drops os/arch combos (#7218) (@Mihir-Rabari)
• e6c4afc: fix(deps): bump moby/sys/user to v0.4.1 (#7202) (@caarlos0)
• 713c236: fix(docker): select baseline CPU variants for Docker v2 platforms (#7189) (@zachary-satterly and @caarlos0)
• 26ffaba: fix(docker/v2): expand global ARG references when resolving the base image (#7203) (@LemonCondor and @caarlos0)
• 1b7b6a4: fix(git): redact credentials from http remote URLs too (#7191) (@Mihir-Rabari)
• 2d708ed: fix(ko): use actual ko version in SPDX SBOM creator (#7226) (@mrueg)
• 2279d65: fix: share HTTP client per upload config (#6919) (#7212) (@manish-9245 and @caarlos0)
• 0c3be49: fix: write cask completion stanzas in Homebrew's order (#7198) (@mustafaakcakaya)

Documentation updates

• d84a697: docs: fix broken cosign link in rust-zig blog post (#7228) (@jvS0uzx)

Other work

• ccaac66: chore: auto-update generated files (#7190) (@goreleaserbot)
• c96c314: chore: auto-update generated files (#7200) (@goreleaserbot)
• 4a71e1e: chore: auto-update generated files (#7204) (@goreleaserbot)
• b58a061: chore: auto-update generated files (#7223) (@goreleaserbot)
• a9fb415: chore: auto-update generated files (#7230) (@goreleaserbot)

Full Changelog: v2.18.3...v2.19.0

Helping out

This release is only possible thanks to all the support of some awesome people!

Want to be one of them?
You can sponsor, get a Pro License or contribute with code.

Where to go next?

• Find examples and commented usage of all options in our website.
• Reach out on Discord, Twitter, and Telegram!

Announcement

Read the official announcement: Announcing GoReleaser v2.18.

Changelog

Bug fixes

• 6f22aef: fix(announce): let webhook headers override the default headers (#7174) (@NitinKumar004)
• 16edc75: fix(aur,aursources): reject duplicate package names (#7171) (@hktitof)
• d396fca: fix(brew,cask): sort dependencies case-insensitively (#7186) (@caarlos0)
• b091543: fix(ci): restore linux build (#7175) (@caarlos0)
• 1942d44: fix(docker): preserve buildx metadata key in lint checks (#7187) (@caarlos0)
• 1a1adec: fix(docs): point nightly links to the current nightly release (#7155) (@caarlos0)
• 01e1d6f: fix(git): handle remote URLs with a trailing slash (#7170) (@00200200)
• ede6721: fix(github): explain upload redirects caused by a moved repository (#7179) (@MrBeldum)
• 3205096: fix: dockers_v2 reports the image config digest (#7181) (@Zak4sad)

Other work

• 048a586: chore: auto-update generated files (#7152) (@goreleaserbot)
• 827aa03: chore: auto-update generated files (#7159) (@goreleaserbot)
• ff8de3d: chore: auto-update generated files (#7165) (@goreleaserbot)
• 27ef66d: chore: auto-update generated files (#7166) (@goreleaserbot)
• a9d676f: chore: auto-update generated files (#7172) (@goreleaserbot)
• 38962f0: chore: auto-update generated files (#7183) (@goreleaserbot)

Full Changelog: v2.18.2...v2.18.3

Helping out

This release is only possible thanks to all the support of some awesome people!

Want to be one of them?
You can sponsor, get a Pro License or contribute with code.

Where to go next?

• Find examples and commented usage of all options in our website.
• Reach out on Discord, Twitter, and Telegram!

Announcement

Read the official announcement: Announcing GoReleaser v2.18.

Changelog

Security updates

• 8ec05d6: sec(builds): redact secrets from builder subprocess output (@caarlos0)

Bug fixes

• f285d13: fix(archive,sourcearchive,gio): backups, ZIP metadata, mtime and CPU variants (#7089) (@caarlos0)
• d4e9f25: fix(aur): several PKGBUILD and SRCINFO generation bugs (#7100) (@caarlos0)
• b428c4c: fix(aur): tell users how to fix a duplicate architecture (#7141) (@caarlos0)
• 2e991d2: fix(blob): KMS encryption limits and bucket lifetime on error (#7101) (@caarlos0)
• 7ba40dc: fix(blob): stream unencrypted uploads instead of buffering files (#7134) (@raviayadav and @caarlos0)
• 924f5eb: fix(brew,cask): formula escaping, token matching and binary stanzas (#7086) (@caarlos0)
• 7c77e11: fix(build): resolve dependent hook environment entries and hook dir templates (#7078) (@caarlos0)
• d22c274: fix(builder/go): give a single ellipsis main an exact output path (#7114) (@caarlos0)
• be63647: fix(builder/go): keep override env entries in a stable order (#7112) (@caarlos0)
• 4a635ab: fix(builder/go): register the generated C header after compiling (#7113) (@caarlos0)
• 34619ef: fix(builder/node,builder/bun): per-target SEA config, prebuild templates and target aliases (#7088) (@caarlos0)
• c87158e: fix(builder/rust,builder/zig): toolchain context and wrapped binary copying (#7080) (@caarlos0)
• 566bc69: fix(builder/uv,builder/poetry): match built artifact filenames (#7084) (@caarlos0)
• 13ebd4d: fix(builders,partial): canonical artifact architectures and target matching (#7083) (@caarlos0)
• e1d9f7f: fix(cmd): auto-snapshot ordering, schema error reporting and --output selection (#7103) (@caarlos0)
• 591a0b8: fix(cmd): correct check counting and init gitignore and failure handling (#7081) (@caarlos0)
• 4f4febf: fix(docker): a bare platform means the baseline CPU variant (#7148) (@caarlos0)
• 000ae78: fix(docker): keep arm64 minor variants above the v8 baseline (#7149) (@caarlos0)
• d2f775e: fix(docker): quote entrypoint paths and forward arguments verbatim (#7073) (@caarlos0)
• f2b3611: fix(docker): v1 wheel build IDs, push flags and empty manifests (#7077) (@caarlos0)
• ea7bc7a: fix(docker): v2 build context, annotations and ARM64 handling (#7095) (@caarlos0)
• a1f860f: fix(env,log): redact secrets across writes and honour force_token (#7104) (@caarlos0)
• 0d4fe16: fix(exec,publish): cancellation, empty commands, SRPM artifacts and upload URLs (#7093) (@caarlos0)
• eba5886: fix(flatpak,docker): quote install paths and respect project environment (#7085) (@caarlos0)
• a95c9a0: fix(git): force column.ui=never so tag output is not columnized (#7127) (@KR-Ravindra)
• 2d7ecb2: fix(git): tag not in the local repository is not an error (#7124) (@caarlos0)
• aebed26: fix(git,changelog): metadata quoting, dirty detection, key cleanup and mailmap (#7102) (@caarlos0)
• dce409c: fix(gitea,gitlab): pagination, subpath URLs, default branch, links and cancellation (#7097) (@caarlos0)
• 0348bfb: fix(github): UTF-8 safe truncation, draft reuse, asset replacement and token override (#7094) (@caarlos0)
• 0087e68: fix(github): honor short Retry-After delays (#7110) (@0jaspahwa)
• f45f629: fix(gomod): scope proxying to Go builds and validate the right module (#7096) (@caarlos0)
• cf292ef: fix(healthcheck): handle blank and space-containing signer commands (#7076) (@caarlos0)
• edd3fd0: fix(healthcheck): panic on dependency commands that are only shell syntax (#7106) (@caarlos0)
• 43c0c94: fix(ko): repository image names, digest ordering and signing references (#7079) (@caarlos0)
• 6ceb354: fix(mcp): support package transport URLs (#7090) (@caarlos0)
• acbfcf5: fix(nfpm): per-format Lintian overrides and colliding filenames (#7099) (@caarlos0)
• 752baca: fix(nix): formatter output, string escaping and post_install (#7082) (@caarlos0)
• 05ee35f: fix(nix): template the description only once (#7146) (@caarlos0)
• a3a8903: fix(project): evaluate name candidates lazily (#7111) (@0jaspahwa)
• 25a52e5: fix(sbom,sign): disambiguate every target variant in default names (#7144) (@caarlos0)
• c62e59f: fix(scripts): correct pre-commit hook exit status, quoting and restaging (#7074) (@caarlos0)
• e0418e8: fix(sign,sbom,universalbinary): universal binary signing, per-variant names and duplicate slices (#7091) (@caarlos0)
• 06bf150: fix(slack,smtp,config): cancellation, message escaping and block round-trips (#7092) (@caarlos0)
• cb8a445: fix(tmpl): deduplicate aggregate errors and stop mutating input (#7075) (@caarlos0)
• e99a557: fix(winget): do not allow multiple wingets with the same name (#7147) (@caarlos0)
• 52e4c58: fix(winget,krew): manifest validation and executable paths (#7087) (@caarlos0)
• b15ccce: fix: address regressions since v2.18.1 (#7107) (@caarlos0)
• ac548c1: refactor: simplify internal code and test setup (#7068) (@caarlos0)

Documentation updates

• 385916d: docs(builder/go): explain that ellipsis discovery uses the host context (#7115) (@caarlos0)
• e6d5fc5: docs: Add Kronk in USERS.md (#7151) (@gandarez)
• 4faacf5: docs: fix configuration examples and reference mismatches (#7066) (@caarlos0)

Other work

• 7d055fd: chore: auto-update generated files (#7070) (@goreleaserbot)
• 7748fa7: chore: auto-update generated files (#7123) (@goreleaserbot)
• 2ab3100: chore: auto-update generated files (#7129) (@goreleaserbot)
• 46d055b: chore: cc maintainer on winget pull requests (#7071) (@caarlos0)
• c3afaa0: chore: fix lint on main (#7105) (@caarlos0)
• 7c44449: chore: lint fixes (@caarlos0)

Full Changelog: v2.18.1...v2.18.2

Helping out

This release is only possible thanks to all the support of some awesome people!

Want to be one of them?
You can sponsor, get a Pro License or contribute with code.

Where to go next?

• Find examples and commented usage of all options in our website.
• Reach out on Discord, Twitter, and Telegram!