Announcing GoReleaser v2.19

A polish release: configurable Zstandard compression, declarative Homebrew cask hooks, Nix publishing without Nix installed, and six builders that are no longer experimental.

Zstandard compression settings

tar.zst and tzst archives can now set the compression level and the window size:

archives:
  - formats: [tar.zst]
    zstd:
      level: best
      window_size: 27

level accepts fastest, default, better, and best. window_size is the log2 of the window size in bytes, from 10 to 29. A larger window can improve compression when the archive holds binaries with shared code, at the cost of more memory and time. If you omit the settings, nothing changes.

The settings also apply to meta archives and format overrides.

See the documentation for more details.

Homebrew cask hooks with install_steps

Homebrew deprecated the preflight, postflight, uninstall_preflight, and uninstall_postflight stanzas, so every generated cask that used a hook printed a deprecation warning to your users.

The replacement stanzas don’t accept arbitrary Ruby: they use Homebrew’s declarative install steps. GoReleaser can’t translate a Ruby hook into them, so there are new options instead:

homebrew_casks:
  - name: myapp
    hooks:
      post:
        install_steps: |
          on_macos do
            run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "{{ .StagedPath }}/myapp"]
          end

pre and post both accept install_steps and uninstall_steps. The raw Ruby install and uninstall options are deprecated; if you set both, the _steps option wins.

See the documentation for more details.

Nix without Nix

Publishing a Nix package used to require nix-hash in your $PATH, and the whole pipe was skipped when it was missing, which is a surprising failure for a package manager you may not otherwise use.

GoReleaser now computes the hash itself, so you don’t need Nix installed to publish to a Nix repository. There is nothing to configure.

See the documentation for more details.

Stable builders

The Zig, Rust, Bun, Deno, UV, and Poetry builders are no longer experimental, and GoReleaser doesn’t print the experimental warning for them anymore. The smartsemver tag sort is stable too.

The MCP registry publisher, the Node.js SEA builder, and nFPM’s msix stay experimental for now.

See the documentation for more details.

ko Linux capabilities

ko entries can now set Linux capabilities on the binary inside the image:

kos:
  - repositories:
      - ghcr.io/myuser/myapp
    linux_capabilities:
      - net_bind_service

It accepts the same values as Docker’s --cap-add. Setting it disables ko’s layer cache for that image.

Thanks to Manuel Rüger for contributing this.

See the documentation for more details.

Fixes since v2.18

Between v2.18 and now, the v2.18.1, v2.18.2, and v2.18.3 patch releases shipped fixes worth knowing about:

• security: secrets are redacted from builder subprocess output
• blob: unencrypted uploads are streamed instead of buffering whole files, thanks to Ravi Yadav; KMS encryption limits and bucket lifetime on error are fixed
• docker: a bare platform means the baseline CPU variant, and arm64 minor variants stay above the v8 baseline
• builds: fixes for the Go, Rust, Zig, Node, Bun, UV, and Poetry builders, including canonical artifact architectures and target matching
• archive: stripped binary paths are reported correctly, thanks to Davi Castello Branco Tavares de Oliveira; ZIP metadata, mtime, and CPU variants are fixed
• aur: several PKGBUILD and .SRCINFO generation bugs, and duplicate package names are now rejected

Other updates

• archive: tar read errors are propagated when copying
• homebrew: emit valid casks when builds.ignore drops os/arch combinations; write completion stanzas in Homebrew’s order
• docker: select baseline CPU variants for Docker v2 platforms; expand global ARG references when resolving the base image
• git: redact credentials from HTTP remote URLs too
• ko: use the actual ko version in the SPDX SBOM creator
• upload: share the HTTP client per upload config
• security: update to Go 1.27.3 and bump golang.org/x/ dependencies
• dependencies: bump moby/sys/user to v0.4.1
• pro/changelog: AI changelog fixes — Ollama uses the OpenAI-compatible API, the tag field is the supported one, provider defaults are updated, and responses are validated and assembled
• pro/schema: fix a duplicate schema ID between File and ExtraFile

Other news

• GoReleaser now has ~16.1k stars and 508 contributors! Thanks, everyone!
• You can follow release updates on our Telegram channel.
• nFPM had new releases as well, check it out.

Download

You can install or upgrade using your favorite package manager, or see the full release notes and download the pre-compiled binaries from GitHub:

Install v2.19.0 (OSS) v2.19.0 (Pro)

Helping out

You can help by reporting issues, contributing features, documentation improvements, and bug fixes. You can also sponsor the project, or get a GoReleaser Pro license.

Get the Pro license Sponsor the project