chore(deps): update tools

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Update
github.com/golangci/golangci-lint/v2	v2.12.2 → v2.13.0					minor
kyverno/kyverno	v1.18.2 → v1.19.0					minor
mikefarah/yq	v4.53.3 → v4.53.6					patch

---

Release Notes

golangci/golangci-lint (github.com/golangci/golangci-lint/v2)

v2.13.0

Compare Source

Released on 2026-08-19

1. Enhancements
   • 🎉 go1.27 support
2. Bug fixes
   • fix: cache package facts
3. Linters new features or changes
   • dupword: from 0.1.7 to 0.1.8 (new option skip-raw-strings)
   • errcheck: from 1.10.0 to 1.20.0
   • exhaustruct_v5: from 4.0.0 to 5.0.2 (new configuration)
   • exhaustruct: deprecated and replaced by exhaustruct_v5
   • fatcontext: from 0.9.0 to 0.10.0 (new options: check-loops, check-function-literals)
   • goconst: add option `exclude-
   • goconst: from 1.10.0 to 1.11.0 (new option: ignore-map-keys)
   • gofumpt: from 0.9.2 to 0.11.0 (new options: extra.group-params, extra.clothe-returns, extra.balance-calls)
   • gomoddirectives: from 0.8.0 to 0.9.0 (new option: replace-allow-all)
   • gosec: from 2.26.1 to 2.27.1
   • govet-modernize: from 0.44.0 to 0.49.0 (fmtappendf is removed. New analyzers atomictypes, embedlit, errorsastype, importcomment, reflecttypeassert, slicesclip, and slicesbackward. waitgroup is renamed waitgroupgo)
   • iface: from 1.4.3 to 1.5.0 (new analyzer: unusedmethod)
   • noinlineerr: from 1.0.5 to 1.0.6
   • nonamedreturns: from 1.0.6 to 1.0.8 (new option: allow-unused-named-returns)
   • recvcheck: from 0.2.0 to 0.3.0 (new default exclusions) types`
   • unparam: from 2dd26e2 to 2dd26e2
4. Linters bug fixes
   • clickhouse-go-linter: from 1.2.0 to 1.2.1
   • errname: from 1.1.1 to 1.1.2
   • exhaustruct: from 5.0.2 to 5.0.3
   • funcorder: add missing Function field
   • ginkgolinter: from 0.23.0 to 0.23.1
   • gocheckcompilerdirectives: from 1.3.0 to 1.4.0
   • gocritic: from 0.14.3 to 0.14.4
   • gomoddirectives: add missing IgnoreForbidden field
   • iface: from 1.4.2 to 1.4.3
   • mirror: from 1.3.0 to 1.3.3
   • nilnil: from 1.1.1 to 1.1.2
   • protogetter: from 0.3.20 to 0.3.21

kyverno/kyverno (kyverno/kyverno)

v1.19.0

Compare Source

mikefarah/yq (mikefarah/yq)

v4.53.6

Compare Source

v4.53.4

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

Pull request overview

This PR updates pinned tool versions in the modules/tools Makefile module, keeping the repository’s toolchain current and ensuring the downloaded artifacts’ integrity checks remain valid.

Changes:

• Bump kyverno from v1.18.2 to v1.19.0.
• Bump yq from v4.53.3 to v4.53.6.
• Bump golangci-lint from v2.12.2 to v2.13.0, and update the corresponding Kyverno/YQ SHA256 sums for downloaded binaries.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wallrj-cyberark]

This is more than a routine bump: the golangci-lint part of it is required by the Go 1.27 upgrade in #704.

golangci-lint v2.12.2 cannot type-check code built against the Go 1.27 standard library, because math/rand/v2 now declares a generic method:

level=error msg="Running error: could not import math/rand/v2 (...): method must have no type parameters"

Rebuilding v2.12.2 with Go 1.27 does not help — it then panics inside staticcheck (buildir: package "poll": unexpected expr: *ast.KeyValueExpr, honnef.co/go/tools v0.7.0). v2.13.0 ships honnef.co/go/tools v0.8.0-rc.1 and lints cleanly; I confirmed 0 issues. in venctl, which vendors this module and is currently broken by the Go 1.27 bump.

I had raised the same bump manually as #705 and have closed it in favour of this one.

golangci-lint itself will be rebuilt everywhere once this merges, because the version, and therefore the cached path, changes. Go-built tools whose versions did not change are still served stale from a persisted download cache after a Go upgrade — a separate problem, addressed in #708.

[wallrj]

/approve
/lgtm

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: wallrj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [wallrj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment