chore(deps): update dependency aquaproj/aqua to v2.40.0

[renovate]

This PR contains the following updates:

Package	Update	Change
aquaproj/aqua	minor	v2.39.1 -> v2.40.0

---

Release Notes

aquaproj/aqua (aquaproj/aqua)

v2.40.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.39.1...v2.40.0

Features

#​3363 Support getting package versions from external files

This release enables you to get package versions from external files.
This feature is useful when:

• Migrate any tool to aqua gradually
• Support aqua and other tools

This release adds some fields to aqua.yaml's packages.

• version_expr: An expr expression to read external files
• version_expr_prefix: A prefix of version

e.g.

packages:
- name: hashicorp/terraform
  version_expr: |
    "v" + readFile('.terraform-version')

  version_expr: |
    readJSON('version.json').version
  version_expr_prefix: cli-

  version_expr: |
    readYAML('version.yaml').version

version_expr is evaluated using expr.
The following custom functions are available.

• readFile("file path"): reads a file and returns a file content
• readJSON("file path"): read and unmarshal a JSON file and returns an object
• readYAML("file path"): read and unmarshal a YAML file and returns an object

⚠️ Constraint of version_expr

Allowing to read external files is potentially risky in terms of security.
Malicious users can try to read secret files and expose secrets via log using version_expr.
To prevent such a threat, we restrict the evaluation result of version_expr.
It must match with the regular expression ^v?\d+\.\d+(\.\d+)*[.-]?((alpha|beta|dev|rc)[.-]?)?\d*.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.