Update dependency aquaproj/aqua to v2.55.0

[renovate]

This PR contains the following updates:

Package	Update	Change
aquaproj/aqua	minor	v2.53.3 -> v2.55.0

---

Release Notes

aquaproj/aqua (aquaproj/aqua)

v2.55.0

Compare Source

Features

#​4195 #​4213 Support verifying the integrity of GitHub Releases

https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/verifying-the-integrity-of-a-release
https://aquaproj.github.io/docs/reference/security/github-immutable-release

v2.54.1

Compare Source

🐛 Bug Fixes

#​4182 Fix a bug of generate-registry command that arm64 is replaced to arm incorrectly

v2.54.0

Compare Source

Features

#​4173 ghtkn integration

https://aquaproj.github.io/docs/reference/security/ghtkn/

Now aqua can get a GitHub App User Access Token by ghtkn integration.
Stop risking token leaks - Use secure, short-lived GitHub tokens for local development.

Requirements

The ghtkn integration requires:

• Keyring

This feature doesn't depend on ghtkn CLI.

Limitation

The integration requires the user interaction when creating an access token via Device Flow, so it's unavailable in CI.

Set up

For more details, please see https://github.com/suzuki-shunsuke/ghtkn .

1. Create a GitHub App
2. Create a configuration file of ghtkn
3. Set the environment variable AQUA_GHTKN_ENABLED=true

export AQUA_GHTKN_ENABLED=true

Then aqua gets a user access token using ghtkn Go SDK when aqua calls GitHub APIs.

v2.53.11

Compare Source

Performance Improvement

#​4159 Update github.com/gdamore/tcell/v2 to reduce startup time @​refi64

Benchmark

$ git rev-parse HEAD
380a2334230ec9fd22adac3f4e137a4cf47d42b2

$ go version
go version go1.25.1 darwin/arm64

$ hyperfine --version
hyperfine 1.19.0

$ ls dist                         
aqua  aqua-25310

aqua.yaml

registries:
- type: standard
  ref: v4.408.0 # renovate: depName=aquaproj/aqua-registry
packages:
- name: suzuki-shunsuke/[email protected]
- name: suzuki-shunsuke/[email protected]

$ hyperfine --warmup=20 -N 'dist/aqua'{-25310,}' exec -- mkghtag -version'
Benchmark 1: dist/aqua-25310 exec -- mkghtag -version
  Time (mean ± σ):      24.7 ms ±   1.3 ms    [User: 2.7 ms, System: 1.6 ms]
  Range (min … max):    23.5 ms …  29.6 ms    125 runs
 
  Warning: Statistical outliers were detected. Consider re-running this benchmark on a quiet system without any interferences from other programs. It might help to use the '--warmup' or '--prepare' options.
 
Benchmark 2: dist/aqua exec -- mkghtag -version
  Time (mean ± σ):      10.8 ms ±   1.4 ms    [User: 2.4 ms, System: 1.6 ms]
  Range (min … max):     9.2 ms …  17.1 ms    250 runs
 
Summary
  dist/aqua exec -- mkghtag -version ran
    2.30 ± 0.33 times faster than dist/aqua-25310 exec -- mkghtag -version

$ hyperfine --warmup=20 -N 'dist/aqua'{-25310,}' exec -- cmdx -v'         
Benchmark 1: dist/aqua-25310 exec -- cmdx -v
  Time (mean ± σ):      25.7 ms ±   1.3 ms    [User: 3.5 ms, System: 1.7 ms]
  Range (min … max):    24.5 ms …  31.7 ms    120 runs
 
  Warning: Statistical outliers were detected. Consider re-running this benchmark on a quiet system without any interferences from other programs. It might help to use the '--warmup' or '--prepare' options.
 
Benchmark 2: dist/aqua exec -- cmdx -v
  Time (mean ± σ):      11.2 ms ±   1.0 ms    [User: 3.1 ms, System: 1.6 ms]
  Range (min … max):    10.2 ms …  15.9 ms    253 runs
 
  Warning: Statistical outliers were detected. Consider re-running this benchmark on a quiet system without any interferences from other programs. It might help to use the '--warmup' or '--prepare' options.
 
Summary
  dist/aqua exec -- cmdx -v ran
    2.30 ± 0.24 times faster than dist/aqua-25310 exec -- cmdx -v

v2.53.10

Compare Source

🛡️ Starting from this release, Immutable Release is enabled!

#​4147 Update Go to v1.25.1
#​4145 Update aqua-proxy to v1.2.12

🐛 Bug Fixes

#​4140 Fix error messages

v2.53.9

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.8...v2.53.9

🐛 Bug Fixes

#​4064 Fix a bug that environment variables aren't passed to gh attestation verify

Others

#​4065 Update Go to v1.24.6
#​4065 Update aqua-proxy to v1.2.11

go1.24.6 (released 2025-08-06) includes security fixes to the database/sql and os/exec packages, as well as bug fixes to the runtime.
See the Go 1.24.6 milestone on our issue tracker for details.

v2.53.8

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.7...v2.53.8

🐛 Bug Fixes

#​4047 cp: Add missing .exe on Windows @​W1M0R

v2.53.7

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.6...v2.53.7

Fixes

#​4038 Fix a bug that it fails to verify GitHub Artifact Attestations on GitHub Enterprise Server @​yamoyamoto

v2.53.6

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.5...v2.53.6

🐛 Bug Fixes

#​4024 #​4025 Fix a bug that aqua works without registries' ref
#​4019 Set User-Agent to GitHub Release downloads @​yanolab

[!WARNING]
About #​4019 , unfortunately the bug is still remaining. But maybe #​4019 mitigates the bug to some extent.

v2.53.5

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.4...v2.53.5

#​4008 Fix Homebrew tap to remove the quarantine bit from the binary on a post install hook

v2.53.4

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.53.3...v2.53.4

#​3995 Add license files of Go and Go modules to released assets
#​3995 Release SBOM
#​3995 Update Go to 1.24.5
#​3996 Update aqua-proxy to v1.2.10

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.