Update go modules (release-v0.5) (patch)

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/enterprise-contract/ec-cli	v0.5.128 -> v0.5.144
github.com/enterprise-contract/ec-cli	v0.5.123 -> v0.5.144
github.com/tektoncd/cli	v0.38.0 -> v0.38.2
oras.land/oras	v1.2.0 -> v1.2.3

---

Release Notes

enterprise-contract/ec-cli (github.com/enterprise-contract/ec-cli)

v0.5.144

Compare Source

v0.5.143

Compare Source

v0.5.136

Compare Source

v0.5.135

Compare Source

v0.5.134

Compare Source

v0.5.133

Compare Source

tektoncd/cli (github.com/tektoncd/cli)

v0.38.2

Compare Source

v0.38.2 Release 🎉

This is a bug fix release for CVEs GHSA-w32m-9786-jp63 on golang.org/x/net and GHSA-v778-237x-gjrc on golang.org/x/crypto.

ChangeLog 📋

Misc 🔨

• Bump golang.org/x/net from 0.30.0 to 0.33.0 #​2473
• Bump golang.org/x/crypto from 0.28.0 to 0.31.0 #​2447

v0.38.1

Compare Source

v0.38.1 Release 🎉

This is a bug fix release as tkn start was failing with tkn version v0.38.0 release and old(er) pipeline version. This release comes with Pipelines v0.62.3 and Triggers version v0.29.1

ChangeLog 📋

Misc 🔨

• Bump tektoncd/pipeline to v0.62.3 #​2392
• Bump github.com/tektoncd/triggers from 0.29.0 to 0.29.1 #​2394

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: module oras.land/[email protected] requires go >= 1.24.2; switching to go1.24.8
go: downloading go1.24.8 (linux/amd64)
go: download go1.24.8: golang.org/[email protected]: verifying module: checksum database disabled by GOSUMDB=off