v2.56.6

Compare Source

🐛 Bug Fixes

#​4510 Fix a bug that -log-color doesn't work
#​4526 aqua gr: Fix a bug that win32 are excluded

v2.56.5

Compare Source

🐛 Bug Fixees

#​4495 Fix a bug that aqua gr's -cmd option doesn't work

This was a bug of v2.56.2 ~ v2.56.4. #​4450

v2.56.4

Compare Source

🐛 Bub Fixes

#​4484 #​4485 Prevent duplicate log field output

v2.56.3

Compare Source

🐛 Bug Fixes

#​4475 cp: Fix a bug that command arguments are ignored and always all commands are copied
#​4476 update-aqua: Fix a bug that a command argument is ignored and always the latest version is installed

Others

#​4471 Update sigstore/cosign to v3.0.4

v2.56.2

Compare Source

Refactoring

#​4448 Replace logrus with slog
#​4450 Use urfave/cli/v3 Destination pattern for flag values

v2.56.1

Compare Source

Fixes

#​4436 gr: Exclude eabihf

v2.56.0

Compare Source

Features

#​4422 Get pseudo-versions from Go Proxy if no tagged version exists @​gizmoguy

Fixes

#​4401 Add YAML tags @​Shion1305
#​4404 Update golangci-lint to v2.7.2, with lint fixes @​Shion1305

Dependency Updates

#​4402 Update goreleaser to v2.13.1
#​4405 Update anchore/syft to v1.38.2
#​4406 Update Cosign to v3.0.3
#​4420 Update expr to v1.17.7
#​4424 Update goccy/go-yaml to v1.19.1

v2.55.3

Compare Source

Bug Fixes

#​4393 gr: Fix the support of sigstore and sigstore.json file extensions

Refactoring

#​4369 Enable tagalign rule in golangci-lint @​Shion1305
#​4394 chore(deps): migrate to go.yaml.in/yaml @​scop

v2.55.2

Compare Source

Performance Improvement

#​4342 Skip packages that cannot provide the desired exe @​refi64

Others

#​4312 Update Go to 1.25.4

v2.55.1

Compare Source

🐛 Bug Fixes

#​4274 #​4276 exec: Fix the command name (args[0])

Dependency Updates

#​4220 #​4266 Update github.com/google/go-github/v74 to v76
#​4233 #​4251 #​4261 Update Go to 1.25.2

Others

Release Cosign Bundle file *.bundle

v2.55.0

Compare Source

Features

#​4195 #​4213 Support verifying the integrity of GitHub Releases

https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/verifying-the-integrity-of-a-release
https://aquaproj.github.io/docs/reference/security/github-immutable-release

v2.54.1

Compare Source

🐛 Bug Fixes

#​4182 Fix a bug of generate-registry command that arm64 is replaced to arm incorrectly

v2.54.0

Compare Source

Features

#​4173 ghtkn integration

https://aquaproj.github.io/docs/reference/security/ghtkn/

Now aqua can get a GitHub App User Access Token by ghtkn integration.
Stop risking token leaks - Use secure, short-lived GitHub tokens for local development.

Requirements

The ghtkn integration requires:

• Keyring

This feature doesn't depend on ghtkn CLI.

Limitation

The integration requires the user interaction when creating an access token via Device Flow, so it's unavailable in CI.

Set up

For more details, please see https://github.com/suzuki-shunsuke/ghtkn .

1. Create a GitHub App
2. Create a configuration file of ghtkn
3. Set the environment variable AQUA_GHTKN_ENABLED=true

export AQUA_GHTKN_ENABLED=true

Then aqua gets a user access token using ghtkn Go SDK when aqua calls GitHub APIs.

v2.53.11

Compare Source

Performance Improvement

#​4159 Update github.com/gdamore/tcell/v2 to reduce startup time @​refi64

Benchmark

$ git rev-parse HEAD
380a2334230ec9fd22adac3f4e137a4cf47d42b2

$ go version
go version go1.25.1 darwin/arm64

$ hyperfine --version
hyperfine 1.19.0

$ ls dist                         
aqua  aqua-25310

aqua.yaml

registries:
- type: standard
  ref: v4.408.0 # renovate: depName=aquaproj/aqua-registry
packages:
- name: suzuki-shunsuke/mkghtag@v0.1.11
- name: suzuki-shunsuke/cmdx@v2.0.2

$ hyperfine --warmup=20 -N 'dist/aqua'{-25310,}' exec -- mkghtag -version'
Benchmark 1: dist/aqua-25310 exec -- mkghtag -version
  Time (mean ± σ):      24.7 ms ±   1.3 ms    [User: 2.7 ms, System: 1.6 ms]
  Range (min … max):    23.5 ms …  29.6 ms    125 runs
 
  Warning: Statistical outliers were detected. Consider re-running this benchmark on a quiet system without any interferences from other programs. It might help to use the '--warmup' or '--prepare' options.
 
Benchmark 2: dist/aqua exec -- mkghtag -version
  Time (mean ± σ):      10.8 ms ±   1.4 ms    [User: 2.4 ms, System: 1.6 ms]
  Range (min … max):     9.2 ms …  17.1 ms    250 runs
 
Summary
  dist/aqua exec -- mkghtag -version ran
    2.30 ± 0.33 times faster than dist/aqua-25310 exec -- mkghtag -version

$ hyperfine --warmup=20 -N 'dist/aqua'{-25310,}' exec -- cmdx -v'         
Benchmark 1: dist/aqua-25310 exec -- cmdx -v
  Time (mean ± σ):      25.7 ms ±   1.3 ms    [User: 3.5 ms, System: 1.7 ms]
  Range (min … max):    24.5 ms …  31.7 ms    120 runs
 
  Warning: Statistical outliers were detected. Consider re-running this benchmark on a quiet system without any interferences from other programs. It might help to use the '--warmup' or '--prepare' options.
 
Benchmark 2: dist/aqua exec -- cmdx -v
  Time (mean ± σ):      11.2 ms ±   1.0 ms    [User: 3.1 ms, System: 1.6 ms]
  Range (min … max):    10.2 ms …  15.9 ms    253 runs
 
  Warning: Statistical outliers were detected. Consider re-running this benchmark on a quiet system without any interferences from other programs. It might help to use the '--warmup' or '--prepare' options.
 
Summary
  dist/aqua exec -- cmdx -v ran
    2.30 ± 0.24 times faster than dist/aqua-25310 exec -- cmdx -v

v2.53.10

Compare Source

🛡️ Starting from this release, Immutable Release is enabled!

#​4147 Update Go to v1.25.1
#​4145 Update aqua-proxy to v1.2.12

🐛 Bug Fixes

#​4140 Fix error messages

v2.53.9

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.8...v2.53.9

🐛 Bug Fixes

#​4064 Fix a bug that environment variables aren't passed to gh attestation verify

Others

#​4065 Update Go to v1.24.6
#​4065 Update aqua-proxy to v1.2.11

go1.24.6 (released 2025-08-06) includes security fixes to the database/sql and os/exec packages, as well as bug fixes to the runtime.
See the Go 1.24.6 milestone on our issue tracker for details.

v2.53.8

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.7...v2.53.8

🐛 Bug Fixes

#​4047 cp: Add missing .exe on Windows @​W1M0R

v2.53.7

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.6...v2.53.7

Fixes

#​4038 Fix a bug that it fails to verify GitHub Artifact Attestations on GitHub Enterprise Server @​yamoyamoto

v2.53.6

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.5...v2.53.6

🐛 Bug Fixes

#​4024 #​4025 Fix a bug that aqua works without registries' ref
#​4019 Set User-Agent to GitHub Release downloads @​yanolab

[!WARNING]
About #​4019 , unfortunately the bug is still remaining. But maybe #​4019 mitigates the bug to some extent.

v2.53.5

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.4...v2.53.5

#​4008 Fix Homebrew tap to remove the quarantine bit from the binary on a post install hook

v2.53.4

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.3...v2.53.4

#​3995 Add license files of Go and Go modules to released assets
#​3995 Release SBOM
#​3995 Update Go to 1.24.5
#​3996 Update aqua-proxy to v1.2.10