chore(deps): weekly safe aqua updates · 3 packages

[mendral-app]

Packages bumped

Package	Old	New	Released
aquaproj/aqua-registry	v4.530.0	v4.547.0	2026-08-02
casey/just	1.55.1	1.58.0	2026-08-03
cli/cli	v2.96.0	v2.97.0	2026-07-31

Per-package details

aquaproj/aqua-registry v4.530.0 → v4.547.0

• Metadata-only registry of tool definitions; purely additive new package entries and config updates.
• No impact: the registry enables aqua to resolve tools — no behavioral change to pinned versions.

casey/just 1.55.1 → 1.58.0

• 1.57.0: len() function, num_jobs(), --jobs option, [arg(min)]/[arg(max)] attributes. Stricter validation: forbids duplicate groups, option names beginning with -, empty choose() alphabet, duplicate function parameters.
• 1.58.0: [timestamp] recipe attribute with format argument. Accept multiple ,-separated values in --justfile-name. Formatting now surrounds interpolation expressions with spaces.
• Impact: This repo's Justfile uses none of the now-forbidden patterns. New features are additive. No breaking changes for well-formed justfiles.

cli/cli v2.96.0 → v2.97.0

• Security release (4 fixes):
  • GHSA-3m3g-3wcr-px46: Escape sequence injection in gh gist view, gh api, gh pr diff, etc.
  • GHSA-4fjg-2h4q-fwg3: URL path injection via unescaped variable path components.
  • GHSA-cg6r-mpgc-h9mm: Token exposure in gh auth status for github_pat_*/ghs_*/ghu_* formats.
  • GHSA-mm27-mwq9-fr5g: Attestation bypass in gh attestation verify due to unescaped regex metacharacters.
• Features: Project fields/items addressable by name, Grok skill host support.
• Impact: gh is used in the update-aqua-checksum workflow via gh api. Security hardening applies; no breaking behavioral changes.

Files modified

• aqua.yaml — version bumps for 3 packages (2 tools + registry ref)
• aqua-checksums.json — regenerated checksums for new versions

Skipped this ecosystem

Package	Reason
aquaproj/aqua	Content-pinned in setup-aqua/action.yaml; managed by limen convergence
golang/go	Open PR #3 bumps to go1.26.5
golang.org/x/vuln/cmd/govulncheck	Open PR #3 bumps to v1.6.0
golang.org/x/tools/cmd/deadcode	Open PR #3 bumps to v0.48.0
goreleaser/goreleaser	Open PR #3 bumps to v2.17.1
sigstore/cosign	Open PR #3 bumps to v3.1.2
farcloser/limen	v0.0.11 available; requires limen convergence (limen fix .) — mechanical bump, separate PR needed
koalaman/shellcheck	Already at latest (v0.11.0)
golangci/golangci-lint	Already at latest eligible (v2.12.2)
google/yamlfmt	Already at latest (v0.21.0)
lycheeverse/lychee	Already at latest stable (lychee-v0.24.2)
gotestyourself/gotestsum	Already at latest (v1.13.0)
jqlang/jq	Already at latest (jq-1.8.2)
mikefarah/yq	Already at latest (v4.53.3)
google/go-licenses	Already at latest (v2.0.1)
vbatts/git-validation	Already at latest (v1.2.2)
farcloser/godolint	No newer release available (v0.1.0)
goccy/go-graphviz/cmd/dot	Pseudo-version, intentionally pinned
actions/checkout	Already at latest (v7.0.1)
actions/create-github-app-token	Already at latest (v3.2.0)

---

Note

Created by Mendral. Tag @mendral-app with feedback or questions.

• View implementation session