Announcing GoReleaser v2.16

Immutable releases, a new build target for Node.js, dockers_v2 graduating out of experimental, and the legacy brews config finally getting the boot.

Immutable releases

v2.16.0 is the first non-nightly GoReleaser release published under our new immutable releases policy. Once a tag is published, its bytes can never be replaced — pinning to v2.16.0 gives you the exact same artifacts forever.

Nightlies changed too: instead of overwriting a single moving nightly tag, each nightly run now creates its own immutable tag (e.g. v2.16.0-abc1234-nightly). The old nightly tag is frozen and will be deleted soon — if you’re still pulling it, switch to the new format. To keep the release list from growing forever, old nightly tags are periodically pruned.

If you use goreleaser-action (≥ v7.2.0), the new nightly tag format is handled for you — no config changes needed.

See the blog post for the background (supply-chain safety) and the full nightly transition details.

Node.js single-executable apps

GoReleaser can now build Node.js Single Executable Application (SEA) binaries via the new node builder!

This started as @vedantmgoyal9’s work in #6136 — thanks for getting the ball rolling.

A minimal example:

builds:
  - builder: node
    main: index.js
    targets:
      - linux-x64
      - darwin-arm64
      - win-x64

GoReleaser fetches the right Node.js distribution for each target and bundles your entrypoint into a single executable. By default it builds for darwin-arm64, darwin-x64, linux-arm64, linux-x64, win-arm64, and win-x64.

See the documentation for the full configuration reference, including custom Node binaries, hooks to bundle dependencies, and per-target environment variables. There’s also a working example repository to get you started.

Docker (v2) is no longer experimental

dockers_v2 is no longer marked as experimental — the experimental warning is gone, and the pipe is ready for production use.

It also picks up three improvements this release.

The Dockerfile is now parsed to expose .BaseImage and .BaseImageDigest template variables, which makes it trivial to set the standard OCI base-image labels:

dockers_v2:
  - images:
      - myuser/myimage
    labels:
      "org.opencontainers.image.base.name": "{{ .BaseImage }}"
      "org.opencontainers.image.base.digest": "{{ .BaseImageDigest }}"

The resulting artifact now carries the list of built platforms in extra.platforms, which custom publishers and other pipes can use to route the image correctly.

And finally, you can now run pre and post hooks around the actual docker buildx build invocation — handy for staging files into the build context, or for tagging/scanning the resulting image:

dockers_v2:
  - images:
      - myuser/myimage
    hooks:
      pre:
        - cmd: ./scripts/before-docker.sh
          dir: "{{ .ContextDir }}"
      post:
        - cmd: ./scripts/after-docker.sh {{ .Digest }}

Hooks get the resolved .Dockerfile, .Images, and .ContextDir, plus the final .Digest on post hooks.

See the documentation for more details.

brews is now fully deprecated

The legacy brews config — which generated hackyish Homebrew formulas that installed pre-compiled binaries — has been soft-deprecated since v2.10 and is now fully deprecated.

Migrate to homebrew_casks, which is the right tool for the job: it’s how Homebrew expects pre-compiled binaries to be distributed, and it gets all the new features (completion generation, post-install hooks, and so on).

See the deprecation notice for the migration guide.

A note on the v2.15.x patch series

If you skipped any of the v2.15.x patches, v2.15.3 in particular is worth calling out: it shipped a security fix that prevents secret leaks in logs and improves redaction, along with a large pass of panic guards and retry improvements across most pipes (Docker, GitHub, gomod, nfpm, Rust, SBOM, templates, and more).

If you’re on v2.15.0–v2.15.2, please upgrade.

Other updates

• archives: added xz format (thanks to Jared Allard)
• nightly: support templates in tag_name; defer tag templating to evaluation time; run scripts now resolve nightly tags correctly
• nix: support meta.mainProgram
• release: preserve prerelease state on publish; handle GitHub secondary rate limits; remove author lookup by email
• homebrew_casks: emit generate_completions_from_executable after postflight
• srpm: set format and extension on the artifact
• webhook and linkedin: error-handling improvements
• dependencies: Go 1.26.3
• pro/cloudsmith: upload Source RPMs; clearer error messages
• pro/gemfury: upload Source RPMs; include response body in errors
• pro/templates: new listExclude template function
• pro/sign: allow signing macOS .pkg files
• pro/nightly: keep .Tag populated; trim v prefix in version_template; preserve prerelease flag
• pro/npm: omit empty engines from package.json

Other news

• GoReleaser now has ~15.8k stars and 432 contributors! Thanks, everyone!
• You can follow release updates on our Telegram channel.
• We often discuss new features in our Discord server. Join the conversation!
• nFPM had new releases as well, check it out.

Download

You can install or upgrade using your favorite package manager, or see the full release notes and download the pre-compiled binaries from GitHub:

Install v2.16.0 (OSS) v2.16.0 (Pro)

Helping out

You can help by reporting issues, contributing features, documentation improvements, and bug fixes. You can also sponsor the project, or get a GoReleaser Pro license.

Get the Pro license Sponsor the project