fix(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/download-artifact	action	digest	70fc10c → 484a0b5
actions/setup-go	action	digest	def8c39 → 4a36011
docker.io/library/golang	stage	patch	1.26.0 → 1.26.1
docker/build-push-action	action	major	v6.19.2 → v7.0.0
docker/login-action	action	major	v3.7.0 → v4.0.0
docker/setup-buildx-action	action	major	v3.12.0 → v4.0.0
github.com/cilium/ebpf	require	minor	v0.20.0 → v0.21.0
go	uses-with	patch	1.26.0 → 1.26.1
golang		patch	1.26.0 → 1.26.1
softprops/action-gh-release	action	minor	v2.5.0 → v2.6.1

---

Release Notes

docker/build-push-action (docker/build-push-action)

v7.0.0

Compare Source

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in #​1470
• Remove deprecated DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS envs by @​crazy-max in #​1473
• Remove legacy export-build tool support for build summary by @​crazy-max in #​1474
• Switch to ESM and update config/test wiring by @​crazy-max in #​1466
• Bump @​actions/core from 1.11.1 to 3.0.0 in #​1454
• Bump @​docker/actions-toolkit from 0.62.1 to 0.79.0 in #​1453 #​1472 #​1479
• Bump minimatch from 3.1.2 to 3.1.5 in #​1463

Full Changelog: docker/build-push-action@v6.19.2...v7.0.0

docker/login-action (docker/login-action)

v4.0.0

Compare Source

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in #​929
• Switch to ESM and update config/test wiring by @​crazy-max in #​927
• Bump @​actions/core from 1.11.1 to 3.0.0 in #​919
• Bump @​aws-sdk/client-ecr from 3.890.0 to 3.1000.0 in #​909 #​920
• Bump @​aws-sdk/client-ecr-public from 3.890.0 to 3.1000.0 in #​909 #​920
• Bump @​docker/actions-toolkit from 0.63.0 to 0.77.0 in #​910 #​928
• Bump @​isaacs/brace-expansion from 5.0.0 to 5.0.1 in #​921
• Bump js-yaml from 4.1.0 to 4.1.1 in #​901

Full Changelog: docker/login-action@v3.7.0...v4.0.0

docker/setup-buildx-action (docker/setup-buildx-action)

v4.0.0

Compare Source

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in #​483
• Remove deprecated inputs/outputs by @​crazy-max in #​464
• Switch to ESM and update config/test wiring by @​crazy-max in #​481
• Bump @​actions/core from 1.11.1 to 3.0.0 in #​475
• Bump @​docker/actions-toolkit from 0.63.0 to 0.79.0 in #​482 #​485
• Bump js-yaml from 4.1.0 to 4.1.1 in #​452
• Bump lodash from 4.17.21 to 4.17.23 in #​472
• Bump minimatch from 3.1.2 to 3.1.5 in #​480

Full Changelog: docker/setup-buildx-action@v3.12.0...v4.0.0

cilium/ebpf (github.com/cilium/ebpf)

v0.21.0: : Struct Ops, Weak Symbols and BTF deduplication

Compare Source

Hi, everyone! The Cilium project is proud to announce v0.21.0 of ebpf-go, our first major 2026 feature release. Please note that this version comes with a few breaking changes for XDP users that may require some intervention based on your use case, so please read the following section carefully before upgrading! We've also removed some long-deprecated APIs.

Breaking changes

XDP Attach Type

This release saw a change to the ELF parsing logic, specifically to XDP programs. Previously, XDP programs had their ProgramSpec.AttachType set to AttachNone. Prompted by upstream changes in Linux 6.18, XDP programs now come with an AttachXDP attach type. This change ensures compatibility with kernels going forward, as well as better interoperability with libbpf-based tools using shared PROG_ARRAY maps.

tl;dr: Linux 6.18 and later disallows mixing attach types within the same program array.

If your application uses a pinned program array, you may need to manually change the attach type of your XDP programs to AttachNone before they are loaded to ensure they can still be inserted into maps containing pre-upgrade programs.

The same goes for BPF links. If you're updating an XDP link created by an older version of ebpf-go, you need to ensure your XDP program is loaded with the same attach type the link was initially created with, or updating will fail with EINVAL.

For an example of how to deal with this change, here's the the Cilium PR that implemented logic to try both attach types when updating links.

Windows helper function rename

ebpf-for-windows was upgraded from 0.21.0 to v1.0.0-rc1. efW made breaking changes to the names of helper functions, our API has been updated to match:

• asm.WindowsFnMemcmp -> asm.WindowsFnMemcmpS
• asm.WindowsFnMemcpy -> asm.WindowsFnMemcpyS
• asm.WindowsFnMemmove -> asm.WindowsFnMemmoveS

New Features

• Struct ops — The ELF reader can now parse struct ops sections, building MapSpecs and resolving function-pointer members. link.AttachStructOps has been added to allow attaching a StructOpsMap as a link. A sched_ext example can be found here.
• Weak symbol & ELF linking — Programs and maps defined as weak symbols are now fully supported. The ELF reader performs per-symbol decoding for both ProgramSpec and MapSpec, meaning linked objects (produced via bpftool gen object) are now handled correctly.
• BTF type deduplication — btf.Builder can now deduplicate types while generating a BTF blob. Deduplication can be enabled by passing BuilderOptions to NewBuilder with the Deduplication field set to true.
• ProgramSpec.Compatible was added — ProgramSpec.Tag is now deprecated. The new ProgramSpec.Compatible method compares a loaded program's tag against both SHA-1 and SHA-256 hashes of the spec, ensuring correct behaviour across kernels — including kernel v6.18+, which switched to SHA-256 for program hashing.
• ProgramInfo improvements — The program name as reported by ProgramInfo.Name is now sourced from BTF func info when available to provide the full program name if it's longer than 15 bytes.
• LinkInfo improvements — Added a number of methods and types related to reading back link info.
• Reverse symbol lookup — Added Executable.Symbol to resolve addresses to a symbol and relative offset.
• Uprobe/kprobe link feature probing — HaveBPFLinkKprobeMulti, HaveBPFLinkUprobeMulti, and HaveBPFLinkKprobeSession are now exported from the features package, making it easier to probe for multi-attach support before loading programs.
• Program run batching — A new RunOptions.BatchSize option has been added to support batching when running programs.

Bug Fixes

• Allow weak kfuncs loading without CAP_SYS_ADMIN — Loading programs with weak kfuncs on kernels that don't have the kfunc no longer fails with "operation not permitted" when the caller lacks CAP_SYS_ADMIN. The permission error is now treated as "not found" for weak kfuncs.
• ELF reader nil panic — Fixed a panic that could occur when loading an ELF without BTF due to a nil extInfo pointer. Along with the fix, a suite of regression tests was added that exercises the core loader logic with non-BTF ELFs as well.
• QueryResult.HaveLinkInfo heuristic — The heuristic has been updated to check for at least one attached program with a non-zero link ID, fixing a false positive introduced by a kernel change that began populating the revision field for cgroup queries.
• Windows map/program count — Increased the default map and program count on Windows to reduce failures when loading collections with more maps than previously allocated.

More breaking changes

Deprecations

In this release we have removed a number of features which had been deprecated for a while.

• CollectionSpec.RewriteMaps - Pass CollectionOptions.MapReplacements when loading the Collection
  instead.
• CollectionSpec.RewriteConstants - Use CollectionSpec.Variables instead.
• NewLinkFromFD - Use NewFromFD instead.
• HaveProgType - Use HaveProgramType instead.
• IsUnreferencedSymbol - Use errors.Is(err, asm.ErrUnreferencedSymbol) instead.
• Instruction.RewriteMapPtr - Use Instruction.AssociateMap instead. If you cannot provide a Map, wrap an fd in a type implementing FDer.
• Instruction.Sym - Use Instruction.WithSymbol instead.
• Instruction.MapPtr - Use Instruction.Map instead.

Breaking changes to Memory, Variable and VariableSpec

• Memory.Size now returns an uint32 instead of an int
• Variable.Size now returns an uint32 instead of an uint64
• VariableSpec.MapName has been removed, use VariableSpec.SectionName instead.
• VariableSpec.Offset is no longer a method, and is now a field.
• VariableSpec.Size now returns an uint32 instead of a uint64.
• VariableSpec.Type is no longer a method, and is now a field.

Breaking changes to link info

• KprobeInfo.Address has been changed from a method into a field.
• KprobeInfo.Missed has been changed from a method into a field.
• KprobeMultiInfo.AddressCount has been removed, use len(KprobeMultiInfo.Address) instead.
• KprobeMultiInfo.Flags has been changed from a method into a field.
• KprobeMultiInfo.Missed has been changed from a method into a field.
• NetNsInfo.NetnsIno was renamed to NetNsInfo.NetnsInode
• NetfilterInfo.Hooknum has been renamed to NetfilterInfo.Hook and changed from an uint32 to a NetfilterInetHook
• NetfilterInfo.Pf has been renamed to NetfilterInfo.ProtocolFamily and changed from an uint32 to a NetfilterProtocolFamily
• TracingInfo.TargetObjId has been renamed to NetfilterInfo.TargetObjectId

Breaking changes to BTF API

We exported methods and types from the btf package. This allowed us to directly assign BTF func info, line info and CO-RE relocations to instructions from outside of the btf package, making some methods unneeded and thus got removed.

• ExtInfos.Assign has been removed, use WithFuncMetadata, Instruction.WithSource, and WithCORERelocationMetadata instead.
• AssignMetadataToInstructions has been removed, use WithFuncMetadata, Instruction.WithSource, and WithCORERelocationMetadata instead.
• CORERelocationInfos was renamed to CORERelocationOffsets.
• NewBuilder now takes an additional BuilderOptions. This can be left nil.

What's Changed

• elf_reader: add struct_ops support by @​shun159 in #​1869
• link: use PlatformPrefix in TestKprobeMultiProgramCall by @​lmb in #​1890
• link: change QueryResult.HaveLinkInfo heuristic by @​ti-mo in #​1892
• link: add StructOpsMap support by @​shun159 in #​1844
• windows: Increase default map count in call to ebpf_object_load_native_by_fds by @​ExceptionalHandler in #​1887
• examples: Add a minimal sched_ext example by @​shun159 in #​1895
• ci: use tagged efW releases by @​lmb in #​1899
• feat: read full program name from function info by @​secDre4mer in #​1889
• Improve handling of external dependencies by @​lmb in #​1897
• examples: Do not override imported namespace with variable by @​isodude in #​1901
• Add codeowner for windows specific code by @​lmb in #​1893
• fix: splitting the modification and the return statement by @​yrpang in #​1909
• features: export link features by @​ajwerner in #​1906
• Deprecate All The Things by @​ti-mo in #​1894
• deps: use github.com mirror of linux-stable by @​lmb in #​1912
• ci: update efW to 1.0.0-rc2 by @​lmb in #​1911
• Allow callers to create VariableSpecs by @​lmb in #​1882
• feat: support program run batching with new BatchSize option by @​takehaya in #​1914
• btf/testdata: Update vmlinux and btf_testmod to latest by @​dylandreimerink in #​1928
• test: Separate the netns for netkitanchor by @​Jack-R-lantern in #​1913
• Update CI kernel to v6.18 and fix tests by @​dylandreimerink in #​1933
• Deprecate ProgramSpec.Tag, and introduce ProgramSpec.Compatible by @​dylandreimerink in #​1932
• fix(elf): set attach_type to BPF_XDP for XDP section by @​chantra in #​1919
• elf: drop legacy non-libbpf xdp* and seccomp attach types by @​ti-mo in #​1934
• btf: Add type deduplication by @​dylandreimerink in #​1903
• uprobe: only verify ELF if required by @​RonFed in #​1938
• ringbuf: add poller and eventRing interfaces by @​HueCodes in #​1945
• feat: more link inspection support by @​secDre4mer in #​1896
• btf/testdata: Update vmlinux blob by @​dylandreimerink in #​1954
• Support BPF object linking by @​dylandreimerink in #​1942
• elf_reader: add tests for ELF objects without BTF by @​puwun in #​1939
• Allow loading weak kfuncs without CAP_SYS_ADMIN by @​dylandreimerink in #​1950

New Contributors

• @​ExceptionalHandler made their first contribution in #​1887
• @​secDre4mer made their first contribution in #​1889
• @​isodude made their first contribution in #​1901
• @​yrpang made their first contribution in #​1909
• @​ajwerner made their first contribution in #​1906
• @​takehaya made their first contribution in #​1914
• @​Jack-R-lantern made their first contribution in #​1913
• @​chantra made their first contribution in #​1919
• @​HueCodes made their first contribution in #​1945
• @​puwun made their first contribution in #​1939

Full Changelog: cilium/ebpf@v0.20.0...v0.21.0

actions/go-versions (go)

v1.26.1: 1.26.1

Compare Source

Go 1.26.1

softprops/action-gh-release (softprops/action-gh-release)

v2.6.1

Compare Source

2.6.1 is a patch release focused on restoring linked discussion thread creation when
discussion_category_name is set. It fixes #764, where the draft-first publish flow
stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

• fix: preserve discussion category on publish by @​chenrui333 in #​765

v2.6.0

Compare Source

2.6.0 is a minor release centered on previous_tag support for generate_release_notes,
which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range.
It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync,
a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where
GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Exciting New Features 🎉

• feat: support previous_tag for generate_release_notes by @​pocesar in #​372

Bug fixes 🐛

• fix: recover concurrent asset metadata 404s by @​chenrui333 in #​760

Other Changes 🔄

• docs: clarify reused draft release behavior by @​chenrui333 in #​759
• docs: clarify working_directory input by @​chenrui333 in #​761
• ci: verify dist bundle freshness by @​chenrui333 in #​762
• fix: clarify immutable prerelease uploads by @​chenrui333 in #​763

v2.5.3

Compare Source

2.5.3 is a patch release focused on the remaining path-handling and release-selection bugs uncovered after 2.5.2.
It fixes #639, #571, #280, #614, #311, #403, and #368.
It also adds documentation clarifications for #541, #645, #542, #393, and #411,
where the current behavior is either usage-sensitive or constrained by GitHub platform limits rather than an action-side runtime bug.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

• fix: prefer token input over GITHUB_TOKEN by @​chenrui333 in #​751
• fix: clean up duplicate drafts after canonicalization by @​chenrui333 in #​753
• fix: support Windows-style file globs by @​chenrui333 in #​754
• fix: normalize refs-tag inputs by @​chenrui333 in #​755
• fix: expand tilde file paths by @​chenrui333 in #​756

Other Changes 🔄

• docs: clarify token precedence by @​chenrui333 in #​752
• docs: clarify GitHub release limits by @​chenrui333 in #​758
• documentation clarifications for empty-token handling, preserve_order, and special-character asset filename behavior

Full Changelog: softprops/action-gh-release@v2...v2.5.3

v2.5.2

Compare Source

2.5.2 is a patch release focused on the remaining release-creation and prerelease regressions in the 2.5.x bug-fix cycle.
It fixes #705, fixes #708, fixes #740, fixes #741, and fixes #722.
Regression testing covers the shared-tag race, prerelease event behavior, dotfile asset labels,
same-filename concurrent uploads, and blocked-tag cleanup behavior.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

• fix: canonicalize releases after concurrent create by @​chenrui333 in #​746
• fix: preserve prereleased events for prereleases by @​chenrui333 in #​748
• fix: restore dotfile asset labels by @​chenrui333 in #​749
• fix: handle upload already_exists races across workflows by @​api2062 in #​745
• fix: clean up orphan drafts when tag creation is blocked by @​chenrui333 in #​750

New Contributors

• @​api2062 made their first contribution in #​745

Full Changelog: softprops/action-gh-release@v2...v2.5.2

v2.5.1

Compare Source

2.5.1 is a patch release focused on regressions introduced in 2.5.0 and on release lookup reliability.
It fixes #713, addresses #703, and fixes #724. Regression testing shows that
current master no longer reproduces the finalize-race behavior reported in #704 and #709.

What's Changed

Bug fixes 🐛

• fix: fetch correct asset URL after finalization; test; some refactoring by @​pzhlkj6612 in #​738
• fix: release marked as 'latest' despite make_latest: false by @​Boshen in #​715
• fix: use getReleaseByTag API instead of iterating all releases by @​kim-em in #​725

Other Changes 🔄

• dependency updates, including the ESM/runtime compatibility refresh in #​731

New Contributors

• @​autarch made their first contribution in #​716
• @​pzhlkj6612 made their first contribution in #​738
• @​Boshen made their first contribution in #​715
• @​kim-em made their first contribution in #​725

Full Changelog: softprops/action-gh-release@v2...v2.5.1

---

Configuration

📅 Schedule: Branch creation - "on friday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.