Announcing GoReleaser v2.20

GoReleaser v2.20 fixes a security issue that could expose inline SSH private keys in release metadata. It also adds conditional ko platforms, better grouping of GitLab release assets, and a Homebrew cask cleanup declaration.

Security fix: SSH private keys in release metadata

If you supplied an inline SSH private key for publishing package manifests, including through an environment-variable template, GoReleaser could write that key in cleartext to dist/artifacts.json.

Anyone with access to that file could recover the key and use its permissions on the destination Git repository. This matters if you uploaded or shared your dist/ directory, for example as a CI artifact.

GoReleaser v2.20 excludes private keys from JSON output. Upgrade before your next release. If you shared metadata containing a key, revoke and replace that key, and remove the exposed copies.

See GHSA-9422-8p9m-393x for details.

ko platform templates

kos.platforms now accepts templates, so you can select image platforms based on the release:

kos:
  - repositories:
      - ghcr.io/myuser/myapp
    platforms:
      - linux/amd64
      - "{{ if not .Prerelease }}linux/arm64{{ end }}"

This builds both platforms for stable releases and only linux/amd64 for prereleases. Empty platforms are ignored; if none remain, the image is skipped.

Thanks to Manuel Rüger for contributing this.

See the documentation for more details.

GitLab release asset types

GitLab groups release assets by link type. GoReleaser now marks archives, binaries, Linux packages, and other package-like artifacts as package. Checksums, signatures, SBOMs, and other supporting files stay under other.

This applies to GitLab releases without a new setting:

release:
  gitlab:
    owner: mygroup
    name: myapp

Thanks to Manuel Vogel-Johnson for contributing this.

See the documentation for more details.

Homebrew casks without extra cleanup

When a cask has no zap directives, GoReleaser now writes zap :not_required to declare that no extra cleanup is needed:

homebrew_casks:
  - name: myapp
    repository:
      owner: myuser
      name: homebrew-tap

Existing zap directives are unchanged. The generated zap :not_required stanza requires Homebrew 7.0.11 or later.

Thanks to Simon Lacroix for contributing this.

See the documentation for more details.

Other updates

• changelog: skip changelog generation with --skip=changelog
• winget: update the manifest schema to 1.28.0
• templates: escape backslashes in mdv2escape
• bluesky: do not add a link facet when there is no release URL

Other news

• GoReleaser now has ~16.1k stars and 512 contributors! Thanks, everyone!
• Join the conversation on Discord.
• You can follow release updates on our Telegram channel.

Download

You can install or upgrade using your favorite package manager, or see the full release notes and download the pre-compiled binaries from GitHub:

Install v2.20.0 (OSS) v2.20.0 (Pro)

Helping out

You can help by reporting issues, contributing features, documentation improvements, and bug fixes. You can also sponsor the project, or get a GoReleaser Pro license.

Get the Pro license Sponsor the project