This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
Affected surfaces
Summary
AI summaryBroad release touches @caarlos0, Documentation updates, Bug fixes, and New Features.
Full changelog
Announcement
Read the official announcement: Announcing GoReleaser v2.17.
Changelog
New Features
- 31d427926bf91dede0f208d4b034c4b35dfb5507: feat(brew,cask,krew,nix,scoop,winget): default pull request branch name (#6685) (@caarlos0)
- e5f075b7a372541a1db505f3dc4015d1495714c5: feat(dockers/v2): retry build (@caarlos0)
- cd5f16b42e09c8b8994e7722e034fb79770d9273: feat(nfpm): support msix packages (#6647) (@umaidshahid and @caarlos0)
- 43be34a1cd33dc36fad9a2626251f29fa81eed61: feat(scm): allow a custom token on the release repository (#6689) (@caarlos0)
- 5ed70f2d19c85eb9589f0316073ef42930a78c3b: feat(winget): allow configuring the manifest locale (#6680) (@caarlos0)
- 6f7175a0ec98ecae6b00548922648da27c330716: feat: Allow GOARM softfloat and hardfloat (#6198) (@MDr164 and @caarlos0)
Security updates
- b985ca8dc6b231440d98ff5e018c7c40678f0baa: sec(deps): bump go-pkcs12 to v0.7.2 (GO-2026-5052) (#6683) (@caarlos0)
- 7c73b82e0822ebaded3b193e045ffb173befa58a: sec(deps): update golang.org/x/net (@caarlos0)
Bug fixes
- 7d602ff39b52b7edbdf3340dd548f1238ccd656b: fix(builders): reject empty target string (#6679) (@sueun-dev)
- 355d706ba6ee76a8dcabbc55902840376548d774: fix(client): skip merge-upstream when target repo is not a fork (#6646) (@jamessawle and @caarlos0)
- 944bbb2de2c80e04e03f3509a781c82a2bb312d1: fix(deps): drop dep on docker/docker (#6682) (@caarlos0)
- a85ce26032280f8cb4ba2f32cd5223176ecd86fb: fix(mcp): clean subfolder path (#6649) (@caarlos0)
- 99a71731d269c1f036b0caea92032ac0a1fdce8a: fix(nfpm): produce valid arch for Termux packages (#6668) (@bltavares and @caarlos0)
- 7200ec73ecf09b4266d4e7ae21464e51dade7ec0: fix(winget): default head branch to a versioned template (#6684) (@Sanjays2402)
- 6645820ffb384318c8486802cd7770f4f1646b4b: fix: return error when go.mod is unreadable in CheckGoModPipe (#6644) (@SebTardif)
Documentation updates
- da7ce304ee4e0dd4b7b7f42231727becd4d99278: docs(casks): fix private-repo example broken by Homebrew 5.1.14 (#6639) (@caarlos0)
- 09ebd035a7737f67816369cbdd6aff93656d93a7: docs(nfpm): note tilde ConventionalFileName (@caarlos0)
- ab7481ed082cbad81805823b9ffd911776e8bbc7: docs: doc authoring skill (@caarlos0)
- b945ca35c5515cfbb99f3162a738897334ac0c7c: docs: fix (@caarlos0)
- 7e87fd39b283119906598461860dcec6e51f99f4: docs: fix "lets" -> "let's" in quick-start guide (#6661) (@s3onghyun)
- 698dae55da5585136be0417502f2467edb213719: docs: fix typo in notarize.md (#6655) (@albertchae)
- f09c88738c004e4a1df8858064f368e1f1878b98: docs: good bye discord (@caarlos0)
- 2642319f753cde16df470c9da5c5f6124a50a681: docs: improve home (@caarlos0)
- 6b7710eb4a6b4fc181c21994e694130bc57a1a9b: docs: updates (@caarlos0)
Other work
- 2e6f200efaaf702d1008f37bc75fc28cdf3cdd0d: chore: auto-update generated files (#6662) (@goreleaserbot)
- 4bd4e386d2d260e5efb9cb962a727a3f28c718c7: chore: auto-update generated files (#6671) (@goreleaserbot)
- dcf5a6b3b48314ea07b14098bf55372b2d1fa984: chore: auto-update generated files (#6675) (@goreleaserbot)
- baf110d41e81f273070e2a092ae1bbac1c22bc6a: chore: auto-update generated files (#6688) (@goreleaserbot)
- 3fa8a94c5b57e0ae3bc7ea0b7f0a89d63afa666a: chore: godoc (@caarlos0)
Full Changelog: https://github.com/goreleaser/goreleaser/compare/v2.16.0...v2.17.0
Helping out
This release is only possible thanks to all the support of some awesome people!
Want to be one of them?
You can sponsor, get a Pro License or contribute with code.
Where to go next?
Security Fixes
- dep: go-pkcs12 bumped to v0.7.2 (GO-2026-5052)
- dep: golang.org/x/net updated
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]