8000 Bump the gomod group across 1 directory with 5 updates by dependabot[bot] · Pull Request #665 · sigstore/gitsign · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Bump the gomod group across 1 directory with 5 updates #665

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Apr 15, 2025
Merged

Bump the gomod group across 1 directory with 5 updates #665

merged 2 commits into from
Apr 15, 2025

Conversation

dependabot[bot]
Copy link
Contributor
@dependabot dependabot bot commented on behalf of github Apr 14, 2025

Bumps the gomod group with 3 updates in the / directory: github.com/sigstore/protobuf-specs, github.com/sigstore/rekor and github.com/sigstore/sigstore.

Updates github.com/sigstore/protobuf-specs from 0.4.0 to 0.4.1

Changelog

Sourced from github.com/sigstore/protobuf-specs's changelog.

0.4.1

Changed

  • Updated SigningConfig to specify API versions and validity periods (#539)
  • Added deprecated, but still in use, algorithms for ECDSA P384 and P512 using SHA256 (#572)
Commits
  • 9581010 protos/PublicKeyDetails: add compatibility algorithms using SHA256 (#572)
  • 44b9830 build(deps): bump quote from 1.0.38 to 1.0.40 in /gen/pb-rust (#580)
  • e5bccce build(deps): bump syn from 2.0.98 to 2.0.100 in /gen/pb-rust (#581)
  • ed1f69d build(deps): bump prost from 0.13.4 to 0.13.5 in /gen/pb-rust (#584)
  • 3629838 build(deps): bump serde_json from 1.0.139 to 1.0.140 in /gen/pb-rust (#583)
  • a9885b2 build(deps): bump anyhow from 1.0.96 to 1.0.97 in /gen/pb-rust (#582)
  • 7e4a1ad Update Dockerfile.protobuf to 29.4 (#571)
  • bf91edb minor zizmor fixes to specify permissions (#570)
  • 01c386e build(deps): bump gradle/actions from 4.3.0 to 4.3.1 (#567)
  • 793836f build(deps): bump ruby/setup-ruby from 1.227.0 to 1.229.0 (#569)
  • Additional commits viewable in compare view

Updates github.com/sigstore/rekor from 1.3.9 to 1.3.10

Release notes

Sourced from github.com/sigstore/rekor's releases.

v1.3.10

Note that Rekor v1 is in maintenance mode as we are actively developing its successor, Rekor v2, designed to be easy to maintain and cheaper to operate. See the README for more information.

Features

  • Added --client-signing-algorithms flag (#1974)

Fixes / Misc

  • emit unpopulated values when marshalling (#2438)
  • pkg/api: better logs when algorithm registry rejects a key (#2429)
  • chore: improve mysql readiness checks (#2397)

Thanks for all contributors!

Changelog

Sourced from github.com/sigstore/rekor's changelog.

v1.3.10

Note that Rekor v1 is in maintenance mode as we are actively developing its successor, Rekor v2, designed to be easy to maintain and cheaper to operate.. See the README for more information.

Features

  • Added --client-signing-algorithms flag (#1974)

Fixes / Misc

  • emit unpopulated values when marshalling (#2438)
  • pkg/api: better logs when algorithm registry rejects a key (#2429)
  • chore: improve mysql readiness checks (#2397)

Contributors

  • Bob Callaway
  • cangqiaoyuzhuo
  • Carlos Tadeu Panato Junior
  • cpanato
  • Hayden B
  • Praful Khanduri
  • Ramon Petgrave
  • Riccardo Schirone
  • rubyisrust
  • Sascha Grunert
Commits
  • 4118a64 emit unpopulated values when marshalling (#2438)
  • 7de4a80 build(deps): Bump github/codeql-acti 8000 on in the all group (#2430)
  • 8f8fb19 Bump all deps (#2435)
  • 7b74193 pkg/api: better logs when algorithm registry rejects a key (#2429)
  • 5bda6f9 build(deps): Bump golang from 1.24.1 to 1.24.2 in the all group (#2432)
  • 43c9d2b build(deps): Bump google.com/cloudsdktool/google-cloud-cli (#2433)
  • 30c2d4e increase timeouts for docker compose script (#2428)
  • 2674953 build(deps): Bump golang from fa145a3 to 52ff1b3 (#2419)
  • be62621 build(deps): Bump the all group with 3 updates (#2424)
  • 6b2458f build(deps): Bump github/codeql-action in the all group (#2422)
  • Additional commits viewable in compare view

Updates github.com/sigstore/sigstore from 1.9.1 to 1.9.3

Release notes

Sourced from github.com/sigstore/sigstore's releases.

v1.9.3

What's Changed

New Contributors

Full Changelog: sigstore/sigstore@v1.9.2...v1.9.3

v1.9.2

What's Changed

New Contributors

Full Changelog: sigstore/sigstore@v1.9.1...v1.9.2

Commits
  • 1e63a21 add proto hash algorithm to registry (#2048)
  • 404e5b5 Bump deps (#2047)
  • 0a5d37c build(deps): Bump the gomod group across 1 directory with 2 updates (#2046)
  • a14c5f0 build(deps): Bump actions/dependency-review-action in the all group (#2044)
  • e842090 pkg/signature: add P384/P521 compatibility algo to algorithm registry (#2037)
  • ac746e0 Update linter to v2 (#2041)
  • 9e5a36c change how we copy keys (#2036)
  • 8489e15 build(deps): Bump google.golang.org/api in /pkg/signature/kms/gcp (#2028)
  • d2fa167 build(deps): Bump the all group across 1 directory with 3 updates (#2032)
  • 77973f8 build(deps): Bump golang.org/x/net in /pkg/signature/kms/azure (#2034)
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.36.0 to 0.37.0

Commits
  • 959f8f3 go.mod: update golang.org/x dependencies
  • 769bcd6 ssh: use the configured rand in kex init
  • d0a798f cryptobyte: fix typo 'octects' into 'octets' for asn1.go
  • acbcbef acme: remove unnecessary []byte conversion
  • 376eb14 x509roots: support constrained roots
  • b369b72 crypto/internal/poly1305: implement function update in assembly on loong64
  • 6b853fb ssh/knownhosts: check more than one key
  • See full diff in compare view

Updates google.golang.org/protobuf from 1.36.5 to 1.36.6

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the gomod group across 1 directory with 5 updates
cc83171 
Bumps the gomod group with 3 updates in the / directory: [github.com/sigstore/protobuf-specs](https://github.com/sigstore/protobuf-specs), [github.com/sigstore/rekor](https://github.com/sigstore/rekor) and [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore).


Updates `github.com/sigstore/protobuf-specs` from 0.4.0 to 0.4.1
- [Release notes](https://github.com/sigstore/protobuf-specs/releases)
- [Changelog](https://github.com/sigstore/protobuf-specs/blob/main/CHANGELOG.md)
- [Commits](sigstore/protobuf-specs@v0.4.0...v0.4.1)

Updates `github.com/sigstore/rekor` from 1.3.9 to 1.3.10
- [Release notes](https://github.com/sigstore/rekor/releases)
- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)
- [Commits](sigstore/rekor@v1.3.9...v1.3.10)

Updates `github.com/sigstore/sigstore` from 1.9.1 to 1.9.3
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.9.1...v1.9.3)

Updates `golang.org/x/crypto` from 0.36.0 to 0.37.0
- [Commits](golang/crypto@v0.36.0...v0.37.0)

Updates `google.golang.org/protobuf` from 1.36.5 to 1.36.6

---
updated-dependencies:
- dependency-name: github.com/sigstore/protobuf-specs
  dependency-version: 0.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/sigstore/rekor
  dependency-version: 1.3.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/sigstore/sigstore
  dependency-version: 1.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: golang.org/x/crypto
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Apr 14, 2025
@adityasaky
Bump sigstore-go to v0.7.2
6f5e509 
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
@wlynch wlynch merged commit bd7dbe5 into main Apr 15, 2025
9 checks passed
@wlynch wlynch deleted the dependabot/go_modules/gomod-fe3786a0f3 branch April 15, 2025 15:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@wlynch wlynch wlynch approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file go Pull requests that update Go code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@wlynch @adityasaky
0