v0.6.0

v0.6.0 (2026-07-26) — mostly a maintenance/cleanup release

• Swapped the process/port backend: replaced two dead libraries (go-ps, GOnetstat, both unmaintained since 2023) with gopsutil/v4. Same behavior, same YAML schema — just a healthier dependency underneath. Got proper test coverage for both while I was in there, since there wasn't any before.
• Two new resource fields riding on that swap: process.status and process.user (catch zombies or stuff running since 2023) with gopsutil/v4. Same behavior, same YAML schema — just a healthier dependency underneath. Got proper test coverage for both while I was in there, since there wasn't any before.
• Two new resource fields riding on that swap: process.status and process.user (catch zombies or stuff running as root), and port.pid (which process owns a listening socket). port.pid isn't auto-populated by goss add/discovery on purpose — PIDs churn on every restart, so baking one into a generated file would just be stale noise. Add it by hand if you actually want it checked.
• Found and fixed a real bug while adding port.pid: the matcher dispatcher had no case for that field's return type, so it would've silently failed every check with a cryptic "unknown method signature" error. Only caught it because I wrote a test that exercised the real dispatch path instead of stopping at a mock.
• Security/dependency hygiene: bumped x/crypto (a Trivy flag on an unused subpackage — not exploitable, just noise reduction with a script to keep it honest going forward) and x/text (this one's a real CVE fix, infinite loop on bad input). Pinned the Go toolchain to 1.26.5 to clear a stdlib TLS vuln flagged by govulncheck.
• Docs/branding: gave the project its own logo instead of the bare Krameff badge, fleshed out docs/index.md to actually link every doc page, and added a migration doc for anyone moving from upstream goss-org/goss.
• CI fix: docs-only PRs were triggering the full lint/coverage/integration matrix because the paths-ignore filter was missing on one trigger — now skips correctly.filter was missing on one trigger — now skips correctly.

Net effect: nothing changes for existing gossfiles, but you get three new optional fields, cleaner deps, and one dispatcher bug that never actually shipped broken

What's Changed

• Docs by @uk-bolly in https://github.com/krameff/goss/pull/24
• Bump github.com/prometheus/common from 0.69.0 to 0.70.0 by @dependabot[bot] in https://github.com/krameff/goss/pull/25
• Bump golang.org/x/sys from 0.46.0 to 0.47.0 by @dependabot[bot] in https://github.com/krameff/goss/pull/26
• Security/xcrypto by @uk-bolly in https://github.com/krameff/goss/pull/27
• Feat/gopsutil migration by @uk-bolly in https://github.com/krameff/goss/pull/28
• Bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in https://github.com/krameff/goss/pull/29
• Bump gopkg.in/yaml.v2 from 2.3.0 to 2.4.0 by @dependabot[bot] in https://github.com/krameff/goss/pull/30
• Bump mkdocs-material from 9.7.6 to 9.7.7 in /docs by @dependabot[bot] in https://github.com/krameff/goss/pull/31
• updated integrations tests to use regex to stop updated causing failures by @uk-bolly in https://github.com/krameff/goss/pull/38
• Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/krameff/goss/pull/32
• Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 by @dependabot[bot] in https://github.com/krameff/goss/pull/33
• Bump docker/login-action from 4.4.0 to 4.5.1 by @dependabot[bot] in https://github.com/krameff/goss/pull/34
• Bump DavidAnson/markdownlint-cli2-action from 24.0.0 to 24.1.0 by @dependabot[bot] in https://github.com/krameff/goss/pull/35
• Bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in https://github.com/krameff/goss/pull/37
• Docs update by @uk-bolly in https://github.com/krameff/goss/pull/40
• New release gopsutil adopted and fixes by @uk-bolly in https://github.com/krameff/goss/pull/39

Full Changelog: v0.5.0...v0.6.0

v0.5.0

Release Notes — First release since fork

This is the first release of krameff/goss, forked from goss-org/goss. Huge thank you to everyone whose issues and PRs are incorporated below.
This was created due to time constraints and very specific requirements asked of us. This will align fixes with the original fork where possible, but priorities maybe differ. Utilsing same semantic versioning style as the original to minimise issues for those who wish to use it.

Significant

• go 1.26
• gpg signed releases
• discovery and depends-on
• windows registry
• new build pipeline
• dependencies and versions updated to latest

NEW

• Discovery — run lightweight checks before the main suite and expose results as template variables, via --discover , inline discovery:, or --format discovery
  (goss-org/goss#784; thanks to @uk-bolly for raising the issue and @ekelali for the --vars + --format discovery pipeline suggestion)
• depends-on — declare test prerequisites on any resource; dependents are skipped (not failed) when a prerequisite fails
  (goss-org/goss#1043; thanks to @petkapou for raising the issue and @sshipway for the design feedback)
• registry resource — Windows registry validation (exists, value, type checks; five hives, six data types, native Go API)
  (goss-org/goss#1053; thanks to @Blankf)
• Windows service checks — implemented via PowerShell Get-Service (enabled, running, exists)
  (goss-org/goss#1017; thanks to @cthiel42)
• http resource: request-query-params — URL query parameters with proper encoding and duplicate-key support
  (goss-org/goss#1013; thanks to @riton)
• Multiple --vars files — merged in flag order, later files override; --vars-inline still applies last
  (goss-org/goss#1023; thanks to @Lirt for PR #1024)
• GoReleaser-based release pipeline — cross-platform archives, multi-arch container images with SBOMs
  (goss-org/goss#1052; thanks to @kgaughan)
• GPG-signed release checksums, with the public key published in the repo and documented setup for verifying a release
• linux/arm64, linux/ppc64le, and darwin/arm64 (Apple Silicon) platforms now supported in CI and release builds
• install.sh now supports s390x
  (goss-org/goss#1068)
• goss -v now shows build reference to distinguish from official goss release

FIXED

• HTTP checks now close response bodies after validation, preventing connection leaks and OOM under many concurrent HTTP tests
  (goss-org/goss#1058; thanks to @dukelion)
• File contents checks now report the actual file content on failure instead of a Go object reference
  (goss-org/goss#1055; thanks to @ckbaker10)
• have-patterns matcher now honours trailing regex flags (/i, /m, /s)
  (goss-org/goss#1057; thanks to @ckbaker10)
• port resource no longer silently discards netstat parse errors — a malformed line now fails the check explicitly instead of reporting the port as closed
• ContainElements matcher error messages restored to their clearer pre-iterator form for invalid inputs
  (goss-org/goss#1067; thanks to @kgaughan)
• CLI announce output, health-probe debug logging, and content-negotiation error handling no longer leak sensitive data (passwords, response bodies, raw headers) into logs

UPDATED

• CLI migrated from urfave/cli v1 to urfave/cli/v3, dropping legacy transitive dependencies
  (goss-org/goss#1060; thanks to @kgaughan)
• Error handling standardized on sentinel errors and %w wrapping, enabling errors.Is/errors.As for callers
  (goss-org/goss#1066; thanks to @kgaughan)
• Dependency and tooling refresh: golangci-lint v2, updated gomega and prometheus/common, Trivy action updates
  (goss-org/goss#1064; thanks to @kgaughan)
• Container images and Dockerfile simplified around GoReleaser-built binaries
• Docker base image bumped to Alpine 3.21 and Go to 1.26, resolving several CVEs
• Dependency scanning (govulncheck, Trivy) and CodeQL static analysis added to CI
• Continuous release verification: SECURITY.md and CODE_OF_CONDUCT.md added