Skip to content

build(deps): bump the go-deps group across 1 directory with 7 updates #1947

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

build(deps): bump the go-deps group across 1 directory with 7 updates #1947

wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 1, 2025

Bumps the go-deps group with 6 updates in the / directory:

Package From To
github.com/cyphar/filepath-securejoin 0.6.0 0.6.1
github.com/fluxcd/pkg/runtime 0.90.0 0.91.0
github.com/go-git/go-git/v5 5.16.3 5.16.4
github.com/minio/minio-go/v7 7.0.95 7.0.97
github.com/sigstore/cosign/v2 2.5.2 2.6.1
golang.org/x/crypto 0.44.0 0.45.0

Updates github.com/cyphar/filepath-securejoin from 0.6.0 to 0.6.1

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.6.1] - 2025-11-19

At last up jumped the cunning spider, and fiercely held her fast.

Fixed

  • Our logic for deciding whether to use openat2(2) or fallback to an O_PATH resolver would cache the result to avoid doing needless test runs of openat2(2). However, this causes issues when pathrs-lite is being used by a program that applies new seccomp-bpf filters onto itself -- if the filter denies openat2(2) then we would return that error rather than falling back to the O_PATH resolver. To resolve this issue, we no longer cache the result if openat2(2) was successful, only if there was an error.
  • A file descriptor leak in our openat2 wrapper (when doing the necessary dup for RESOLVE_IN_ROOT) has been removed.

[0.5.2] - 2025-11-19

"Will you walk into my parlour?" said a spider to a fly.

Fixed

  • Our logic for deciding whether to use openat2(2) or fallback to an O_PATH resolver would cache the result to avoid doing needless test runs of openat2(2). However, this causes issues when pathrs-lite is being used by a program that applies new seccomp-bpf filters onto itself -- if the filter denies openat2(2) then we would return that error rather than falling back to the O_PATH resolver. To resolve this issue, we no longer cache the result if openat2(2) was successful, only if there was an error.
  • A file descriptor leak in our openat2 wrapper (when doing the necessary dup for RESOLVE_IN_ROOT) has been removed.
Commits
  • 9c4135b VERSION: release 0.6.1
  • d952bef merge v0.5.x branch into main
  • deb72a4 CHANGELOG: fix unreleased links
  • 336bf8f merge #87 into cyphar/filepath-securejoin:v0.5.x
  • 23c6e21 VERSION: back to development
  • 6311ca8 VERSION: release v0.5.2
  • 91da803 merge #86 into cyphar/filepath-securejoin:v0.5.x
  • 4dbce7c gopathrs: close the fd after dup in openat2
  • 1eaadd6 merge #85 into cyphar/filepath-securejoin:main
  • c1c2a53 gopathrs: close the fd after dup in openat2
  • Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/runtime from 0.90.0 to 0.91.0

Commits

Updates github.com/go-git/go-git/v5 from 5.16.3 to 5.16.4

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.16.4

What's Changed

Full Changelog: go-git/go-git@v5.16.3...v5.16.4

Commits
  • de8ecc3 Merge pull request #1743 from go-git/renovate/releases/v5.x-go-github.com-go-...
  • 3e752f0 build: Update module github.com/go-git/go-git/v5 to v5.13.0 [SECURITY]
  • 3a31754 Merge pull request #1741 from go-git/renovate/releases/v5.x-go-github.com-clo...
  • acc28f1 build: Update module github.com/cloudflare/circl to v1.6.1 [SECURITY]
  • 95f3880 Merge pull request #1742 from go-git/renovate/releases/v5.x-go-golang.org-x-n...
  • 329f926 build: Update module golang.org/x/net to v0.38.0 [SECURITY]
  • 399e04b Merge pull request #1734 from pjbgf/fix-ci
  • 2025eae build: test, Fix build on Windows.
  • fb6806f Merge pull request #1732 from swills/find-hash-panic-fix-backport
  • 382530f plumbing: format/idxfile, prevent panic
  • See full diff in compare view

Updates github.com/minio/minio-go/v7 from 7.0.95 to 7.0.97

Commits
  • 83bf4e2 Wrap brackets only for IPv6 address (#2176)
  • f14663f fix: putObjectMultipartStreamFromReadAt goroutine leak (#2170)
  • 6217ce2 Add ConfigName option to LDAP STS request (#2173)
  • 9207380 removed NodeHostname from InventoryJobStatus (#2172)
  • 785b638 update InventoryJobStatus field ExecutionTime from time.Duration to string (#...
  • a5f6380 Added fields to InventoryJobStatus (#2168)
  • f4c4350 update all missing docs
  • af6dc51 feat: add error reporting fields to InventoryJobStatus (#2164)
  • ec35de6 Add QOS API's (#2148)
  • ec103a7 add AGENTS.md and also updated API documentation
  • Additional commits viewable in compare view

Updates github.com/sigstore/cosign/v2 from 2.5.2 to 2.6.1

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.6.1

Changelog

  • 634fabe54f9fbbab55d821a83ba93b2d25bdba5f Bump sigstore-go, move conformance back to tagged release
  • c5545eda23d770180880c245bf0d8f78c354ecc4 Partially populate the output of cosign verify when working with new bundles (#4416)
  • e191024a636883b4e6b7de8db2f5cfb85a1fcd0c bump go builder to use 1.25.1 and cosign (#4417)

Thanks to all contributors!

v2.6.0 introduces a number of new features, including:

  • Signing an in-toto statement rather than Cosign constructing one from a predicate, along with verifying a statement's subject using a digest and digest algorithm rather than providing a file reference (#4306)
  • Uploading a signature and its verification material (a "bundle") as an OCI Image 1.1 referring artifact, completing #3927 (#4316)
  • Providing service URLs for signing and attesting using a SigningConfig. Note that this is required when using a Rekor v2 instance (#4319)

Example generation and verification of a signed in-toto statement:

cosign attest-blob --new-bundle-format=true --bundle="digest-key-test.sigstore.json" --key="cosign.key" --statement="../sigstore-go/examples/sigstore-go-signing/intoto.txt"
cosign verify-blob-attestation --bundle="digest-key-test.sigstore.json" --key=cosign.pub --type=unused --digest="b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9" --digestAlg="sha256"

Example container signing and verification using the new bundle format and referring artifacts:

cosign sign --new-bundle-format=true ghcr.io/user/alpine@sha256:a19367999603840546b8612572e338ec076c6d1f2fec61760a9e11410f546733
cosign verify --new-bundle-format=true ghcr.io/user/alpine@sha256:a19367999603840546b8612572e338ec076c6d1f2fec61760a9e11410f546733

Example usage of a signing config provided by the public good instance's TUF repository:

cosign sign-blob --use-signing-config --bundle sigstore.json README.md
cosign verify-blob --new-bundle-format --bundle sigstore.json --certificate-identity $EMAIL --certificate-oidc-issuer $ISSUER --use-signed-timestamps README.md

v2.6.0 leverages sigstore-go's signing and verification APIs gated behind these new flags. In an upcoming major release, we will be updating Cosign to default to producing and consuming bundles to align with all other Sigstore SDKs.

Features

  • Add to attest-blob the ability to supply a complete in-toto statement, and add to verify-blob-attestation the ability to verify with just a digest (#4306)
  • Have cosign sign support bundle format (#4316)
  • Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)
  • Add support for SigningConfig in sign/attest (#4371)
  • Support self-managed keys when signing with sigstore-go (#4368)
  • Don't require timestamps when verifying with a key (#4337)
  • Don't load content from TUF if trusted root path is specified (#4347)
  • Add a terminal spinner while signing with sigstore-go (#4402)

... (truncated)

Changelog

Sourced from github.com/sigstore/cosign/v2's changelog.

v2.6.1

Bug Fixes

  • Partially populate the output of cosign verify when working with new bundles (#4416)
  • Bump sigstore-go, move conformance back to tagged release (#4426)

v2.6.0

v2.6.0 introduces a number of new features, including:

  • Signing an in-toto statement rather than Cosign constructing one from a predicate, along with verifying a statement's subject using a digest and digest algorithm rather than providing a file reference (#4306)
  • Uploading a signature and its verification material (a "bundle") as an OCI Image 1.1 referring artifact, completing #3927 (#4316)
  • Providing service URLs for signing and attesting using a SigningConfig. Note that this is required when using a Rekor v2 instance (#4319)

Example generation and verification of a signed in-toto statement:

cosign attest-blob --new-bundle-format=true --bundle="digest-key-test.sigstore.json" --key="cosign.key" --statement="../sigstore-go/examples/sigstore-go-signing/intoto.txt"
cosign verify-blob-attestation --bundle="digest-key-test.sigstore.json" --key=cosign.pub --type=unused --digest="b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9" --digestAlg="sha256"

Example container signing and verification using the new bundle format and referring artifacts:

cosign sign --new-bundle-format=true ghcr.io/user/alpine@sha256:a19367999603840546b8612572e338ec076c6d1f2fec61760a9e11410f546733
cosign verify --new-bundle-format=true ghcr.io/user/alpine@sha256:a19367999603840546b8612572e338ec076c6d1f2fec61760a9e11410f546733

Example usage of a signing config provided by the public good instance's TUF repository:

cosign sign-blob --use-signing-config --bundle sigstore.json README.md
cosign verify-blob --new-bundle-format --bundle sigstore.json --certificate-identity $EMAIL --certificate-oidc-issuer $ISSUER --use-signed-timestamps README.md

v2.6.0 leverages sigstore-go's signing and verification APIs gated behind these new flags. In an upcoming major release, we will be updating Cosign to default to producing and consuming bundles to align with all other Sigstore SDKs.

Features

  • Add to attest-blob the ability to supply a complete in-toto statement, and add to verify-blob-attestation the ability to verify with just a digest (#4306)
  • Have cosign sign support bundle format (#4316)
  • Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)
  • Add support for SigningConfig in sign/attest (#4371)
  • Support self-managed keys when signing with sigstore-go (#4368)
  • Don't require timestamps when verifying with a key (#4337)
  • Don't load content from TUF if trusted root path is specified (#4347)
  • Add a terminal spinner while signing with sigstore-go (#4402)
  • Require exclusively a SigningConfig or service URLs when signing (#4403)

... (truncated)

Commits
  • 634fabe Bump sigstore-go, move conformance back to tagged release
  • c5545ed Partially populate the output of cosign verify when working with new bundles ...
  • e191024 bump go builder to use 1.25.1 and cosign (#4417)
  • 37fbfc7 Require exclusively a SigningConfig or service URLs when signing (#4403)
  • b1acaeb Add a terminal spinner while signing with sigstore-go (#4402)
  • 2581dfd chore(deps): bump the gomod group across 1 directory with 8 updates (#4401)
  • 11163ae Bump sigstore-go, support alternative hash algorithms with keys (#4386)
  • 153df46 chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.42.0 (#4391)
  • 1a1ee13 chore(deps): bump golang.org/x/oauth2 from 0.30.0 to 0.31.0 (#4393)
  • 8c7c09d chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4394)
  • Additional commits viewable in compare view

Updates github.com/sigstore/sigstore from 1.9.5 to 1.9.6-0.20250729224751-181c5d3339b3

Commits

Updates golang.org/x/crypto from 0.44.0 to 0.45.0

Commits
  • 4e0068c go.mod: update golang.org/x dependencies
  • e79546e ssh: curb GSSAPI DoS risk by limiting number of specified OIDs
  • f91f7a7 ssh/agent: prevent panic on malformed constraint
  • 2df4153 acme/autocert: let automatic renewal work with short lifetime certs
  • bcf6a84 acme: pass context to request
  • b4f2b62 ssh: fix error message on unsupported cipher
  • 79ec3a5 ssh: allow to bind to a hostname in remote forwarding
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the go-deps group across 1 directory with 7 updates
1a55c3b 
Bumps the go-deps group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) | `0.6.0` | `0.6.1` |
| [github.com/fluxcd/pkg/runtime](https://github.com/fluxcd/pkg) | `0.90.0` | `0.91.0` |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.16.3` | `5.16.4` |
| [github.com/minio/minio-go/v7](https://github.com/minio/minio-go) | `7.0.95` | `7.0.97` |
| [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) | `2.5.2` | `2.6.1` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.44.0` | `0.45.0` |



Updates `github.com/cyphar/filepath-securejoin` from 0.6.0 to 0.6.1
- [Release notes](https://github.com/cyphar/filepath-securejoin/releases)
- [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md)
- [Commits](cyphar/filepath-securejoin@v0.6.0...v0.6.1)

Updates `github.com/fluxcd/pkg/runtime` from 0.90.0 to 0.91.0
- [Commits](fluxcd/pkg@runtime/v0.90.0...runtime/v0.91.0)

Updates `github.com/go-git/go-git/v5` from 5.16.3 to 5.16.4
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](go-git/go-git@v5.16.3...v5.16.4)

Updates `github.com/minio/minio-go/v7` from 7.0.95 to 7.0.97
- [Release notes](https://github.com/minio/minio-go/releases)
- [Commits](minio/minio-go@v7.0.95...v7.0.97)

Updates `github.com/sigstore/cosign/v2` from 2.5.2 to 2.6.1
- [Release notes](https://github.com/sigstore/cosign/releases)
- [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md)
- [Commits](sigstore/cosign@v2.5.2...v2.6.1)

Updates `github.com/sigstore/sigstore` from 1.9.5 to 1.9.6-0.20250729224751-181c5d3339b3
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](https://github.com/sigstore/sigstore/commits)

Updates `golang.org/x/crypto` from 0.44.0 to 0.45.0
- [Commits](golang/crypto@v0.44.0...v0.45.0)

---
updated-dependencies:
- dependency-name: github.com/cyphar/filepath-securejoin
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/fluxcd/pkg/runtime
  dependency-version: 0.91.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.16.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/minio/minio-go/v7
  dependency-version: 7.0.97
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/sigstore/cosign/v2
  dependency-version: 2.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/sigstore/sigstore
  dependency-version: 1.9.6-0.20250729224751-181c5d3339b3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency label Dec 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant