build(deps): bump the go-deps group across 1 directory with 21 updates by dependabot[bot] · Pull Request #2117 · fluxcd/source-controller

dependabot · 2026-08-01T02:35:09Z

Bumps the go-deps group with 14 updates in the / directory:

Package	From	To
github.com/cyphar/filepath-securejoin	`0.6.1`	`0.7.0`
github.com/elazarl/goproxy	`1.8.4`	`1.8.5`
github.com/fluxcd/cli-utils	`1.2.1`	`1.2.2`
github.com/fluxcd/pkg/apis/event	`0.27.0`	`0.28.0`
github.com/fluxcd/pkg/apis/meta	`1.30.0`	`1.31.0`
github.com/fluxcd/pkg/artifact	`0.18.0`	`0.20.0`
github.com/fluxcd/pkg/auth	`0.54.0`	`0.56.0`
github.com/fluxcd/pkg/helmtestserver	`0.40.0`	`0.41.0`
github.com/fluxcd/pkg/runtime	`0.110.0`	`0.111.0`
github.com/go-git/go-billy/v5	`5.9.0`	`5.9.1`
github.com/minio/minio-go/v7	`7.2.0`	`7.2.1`
github.com/prometheus/client_golang	`1.23.2`	`1.24.1`
github.com/sigstore/cosign/v3	`3.0.6`	`3.1.2`
oras.land/oras-go/v2	`2.6.1`	`2.6.2`

Updates github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.7.0] - 2025-06-17

You talk of times of peace for all, and then prepare for war.

Changed

Update to cyphar.com/go-pathrs@0.2.5, which included a build-time API breakage that we needed to work around. The API of this library is unchanged by this, but users should make sure to update to v0.7.0 of filepath-securejoin if they use the libpathrs built tag and have update to libpathrs v0.2.5.

Commits

8096a95 VERSION: release v0.7.0
1324ccb merge #101 into cyphar/filepath-securejoin:main
dd8f0bb deps: bump to cyphar.com/go-pathrs@v0.2.5
c9a7725 gha: bump golangci-lint to v2.12
2e968bd Merge pull request #91 from cyphar/dependabot/github_actions/actions/download...
2879148 Merge pull request #90 from cyphar/dependabot/github_actions/actions/upload-a...
07b805b build(deps): bump actions/download-artifact from 6 to 7
8507844 build(deps): bump actions/upload-artifact from 5 to 6
daef0cf Merge pull request #89 from cyphar/dependabot/github_actions/actions/checkout-6
95f8ea4 build(deps): bump actions/checkout from 5 to 6
Additional commits viewable in compare view

Updates github.com/elazarl/goproxy from 1.8.4 to 1.8.5

Release notes

Sourced from github.com/elazarl/goproxy's releases.

v1.8.5

What's Changed

fix(https): coalesce the MITM response head into a single write by @shaharfreiman in elazarl/goproxy#787

Remove redundant certificate Leaf set starting from Go 1.23 by @ErikPelli in elazarl/goproxy#789

Fix headers overwrite when there are no trailers by @ErikPelli in elazarl/goproxy#791

New Contributors

@shaharfreiman made their first contribution in elazarl/goproxy#787

Full Changelog: elazarl/goproxy@v1.8.4...v1.8.5

Commits

d435b12 Fix headers overwrite when there are no trailers (#791)
5497631 Remove redundant certificate Leaf set starting from Go 1.23 (#789)
5ba11e8 fix(https): coalesce the MITM response head into a single write (#787)
See full diff in compare view

Updates github.com/fluxcd/cli-utils from 1.2.1 to 1.2.2

Release notes

Sourced from github.com/fluxcd/cli-utils's releases.

v1.2.2

What's Changed

Upgrade golang.org/x/net to v0.55.0 by @matheuscscp in fluxcd/cli-utils#36

Upgrade kubernetes to 1.36.2 by @matheuscscp in fluxcd/cli-utils#37

Full Changelog: fluxcd/cli-utils@v1.2.1...v1.2.2

Commits

5620149 Merge pull request #37 from fluxcd/upgrade-k8s-36.2
1e5951f Upgrade kubernetes to 1.36.2
94614cd Merge pull request #36 from fluxcd/upgrade-deps
e7fc06f Upgrade golang.org/x/net to v0.55.0
See full diff in compare view

Updates github.com/fluxcd/pkg/apis/event from 0.27.0 to 0.28.0

Commits

00782ed Merge pull request #917 from fluxcd/test-auth-providers
3976c50 [RFC-0010] Add tests for auth providers
182841a Merge pull request #916 from fluxcd/cache-op-label
1e41450 Introduce operation label for cache event metric
aa3cde9 Merge pull request #909 from fluxcd/auth-azure
9e0e8bc [RFC-0010] Add azure auth library
7eae091 Merge pull request #908 from fluxcd/auth-gcp
9f68942 Merge pull request #907 from fluxcd/auth-aws
bb7cb58 Merge pull request #906 from fluxcd/auth-core
45fbfee [RFC-0010] Add gcp auth library
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/apis/meta from 1.30.0 to 1.31.0

Commits

b98e2b0 Merge pull request #1251 from fluxcd/release-main
2dfcb7c Prepare for release
dd6b016 Merge pull request #1253 from fluxcd/upgrade-k8s-36.2
2d00796 Upgrade kubernetes to 1.36.2
827f6c3 Merge pull request #1249 from fluxcd/upgrade-go-git-providers
be6d462 Upgrade go-git-providers and go-github
023a357 Merge pull request #1248 from fluxcd/label-2.9
7e8856d Add backport label for Flux 2.9
ae10469 Merge pull request #1246 from fluxcd/ks-always-subst
2cd36cb kustomize: add tests for empty vars with strict sub and omitted without
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/artifact from 0.18.0 to 0.20.0

Commits

be8df7e Merge pull request #801 from fluxcd/k8s-1.31
76035f8 Update Helm to v3.15.4
3f5cf4c Build with Go 1.23
4b90241 Update dependencies to Kubernetes v1.31.0
0e61a3b Merge pull request #799 from fluxcd/dependabot/github_actions/ci-9f4b007c5b
6bf4bad build(deps): bump the ci group with 4 updates
968f190 Merge pull request #795 from fluxcd/dependabot/github_actions/ci-8fa51b1870
bce8cab build(deps): bump the ci group across 1 directory with 8 updates
7d033c1 Merge pull request #798 from fluxcd/cleanup-aws-nuke
e98ccfa workflow: Set aws-nuke region for cleanup
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/auth from 0.54.0 to 0.56.0

Commits

bf02f0a Merge pull request #1026 from fluxcd/storage-refactoring
e2dd3d1 artifact: Refactor storage package structure
ee36d78 Merge pull request #1025 from fluxcd/controller-runtime-v0.22.1
b5ab5b9 Prepare release
6ce90c6 Add the Artifact Management SDK to readme
e4f3937 Update controller-runtime to v0.22.1
9e2ac7d Merge pull request #1024 from fluxcd/dependabot/github_actions/ci-43e6514044
93ac531 build(deps): bump the ci group across 1 directory with 5 updates
24724be Merge pull request #1023 from fluxcd/runtime-env-vars
85cb1e2 runtime: Add environment variables
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/helmtestserver from 0.40.0 to 0.41.0

Commits

cde06a5 Merge pull request #1079 from fluxcd/kube-v0.35.0
21a1946 auth: Fix Azure auth test for China and US Gov clouds
125d607 Prepare for release
4f26e76 Update dependencies to Kubernetes v0.35.0
98667f8 Merge pull request #1069 from fluxcd/helm-4.1
2aea89f Upgrade Helm to v4.1.0
4895944 Merge pull request #1077 from fluxcd/ssa-custom-stage
8a98478 ssa: introduce custom apply stage
See full diff in compare view

Updates github.com/fluxcd/pkg/oci from 0.68.0 to 0.69.0

Commits

c8dd701 Merge pull request #1264 from fluxcd/release-main
8893563 Prepare for release
f604533 Merge pull request #1262 from fluxcd/fix-flux2-5986
49c22f0 oci: fix insecure not skipping tls verification
ce58928 Merge pull request #1256 from fluxcd/upgrade-gitlab
4ed1f12 git/internal/e2e: upgrade gitlab client to v2
e2882a1 Merge pull request #1260 from fluxcd/fix-flux2-5981
4ccc4a6 kustomize: load builtin schemas after reset
59c882f Revert "kustomize: support merging the input OpenAPI schemas with the built-i...
f739e0e Merge pull request #1258 from fluxcd/fix-flux2-5972
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/runtime from 0.110.0 to 0.111.0

Commits

b98e2b0 Merge pull request #1251 from fluxcd/release-main
2dfcb7c Prepare for release
dd6b016 Merge pull request #1253 from fluxcd/upgrade-k8s-36.2
2d00796 Upgrade kubernetes to 1.36.2
827f6c3 Merge pull request #1249 from fluxcd/upgrade-go-git-providers
be6d462 Upgrade go-git-providers and go-github
023a357 Merge pull request #1248 from fluxcd/label-2.9
7e8856d Add backport label for Flux 2.9
ae10469 Merge pull request #1246 from fluxcd/ks-always-subst
2cd36cb kustomize: add tests for empty vars with strict sub and omitted without
Additional commits viewable in compare view

Updates github.com/go-git/go-billy/v5 from 5.9.0 to 5.9.1

Release notes

Sourced from github.com/go-git/go-billy/v5's releases.

v5.9.1

What's Changed

build: Update module golang.org/x/net to v0.55.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-billy#216

build: Update module golang.org/x/text to v0.39.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-billy#230

build: Update module golang.org/x/net to v0.56.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-billy#229

Full Changelog: go-git/go-billy@v5.9.0...v5.9.1

Commits

19ea4dd Merge pull request #229 from go-git/renovate/releases/v5.x-go-golang.org-x-ne...
8923518 build: Update module golang.org/x/net to v0.56.0 [SECURITY]
306e011 Merge pull request #230 from go-git/renovate/releases/v5.x-go-golang.org-x-te...
6108d3a build: Update module golang.org/x/text to v0.39.0 [SECURITY]
f135070 Merge pull request #216 from go-git/renovate/releases/v5.x-go-golang.org-x-ne...
473e72c build: Update module golang.org/x/net to v0.55.0 [SECURITY]
See full diff in compare view

Updates github.com/minio/minio-go/v7 from 7.2.0 to 7.2.1

Commits

7e34713 feat: support in mc inventory for custom run schedule (#2244)
016d0fd feat: stream GetObjectAnnotation payload via io.ReadCloser (#2243)
6c51637 feat: stream PutObjectAnnotation payload via io.ReadSeeker (#2242)
07c682a feat: add object annotation client APIs (#2241)
53b504a fix: caching defer bug (#2237)
291e83f add new aws region ap-southeast-6 (#2234)
See full diff in compare view

Updates github.com/onsi/gomega from 1.41.0 to 1.42.1

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.42.1

1.42.1

Bump Dependencies

v1.42.0

1.42.0

Add a set of Claude skill as a marketplace plugin

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.42.1

Bump Dependencies

1.42.0

Add a set of Claude skill as a marketplace plugin

Commits

ced6c1c v1.42.1
2beb9fb v1.42.1 (full)
006cd2c bump al lthe things
35ca084 v1.42.0
d72697b v1.42.0 (full)
1f95d86 add a set of claude skills as a marketplace plugin
See full diff in compare view

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

v1.24.0 - 2026-07-20

Changes

[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862

[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051

[CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843

[CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850

[CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855

[FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942

[FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392

[FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902

[FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969

[FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925

[FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856

[FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896

[FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895

[FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890

[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860

[ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885

[BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961

[BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991

[BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005

[BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030

[BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971

[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889

[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917

[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0 by @dependabot[bot] in prometheus/client_golang#1839

build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 by @dependabot[bot] in prometheus/client_golang#1838

prometheus/collectors: use godoc link for runtime/metrics supported metrics by @xieyuschen in prometheus/client_golang#1844

Fix doc typo by @torrca in prometheus/client_golang#1849

Merge release-1.23 into main by @vesari in prometheus/client_golang#1851

build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the github-actions group by @dependabot[bot] in prometheus/client_golang#1852

Refactor LabelNames to return model.LabelNames type for consistency by @yshngg in prometheus/client_golang#1850

remote: simplified Store interface; renamed Handler to WriteHandler by @bwplotka in prometheus/client_golang#1855

feat(api/prometheus): add format_query endpoint for query formatting by @yshngg in prometheus/client_golang#1846

feat(api): add FormatQuery method to Prometheus v1 API by @yshngg in prometheus/client_golang#1856

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.1 / 2026-07-23

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

1.24.0 / 2026-07-20

[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862

[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051

[CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843

[CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850

[CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855

[FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942

[FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392

[FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902

[FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969

[FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925

[FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856

[FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896

[FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895

[FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890

[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860

[ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885

[BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961

[BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991

[BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005

[BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030

[BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971

[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889

[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917

[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

Commits

d6087ee release: cut v1.24.1 (#2076)
48dd383 Cut v1.24.0 (#2061)
a725305 Cut v1.24.0-rc.0 (#2058)
77c584f build(deps): update all Go dependencies in all go.mod files (#2059)
78262a7 feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather ca...
34e9a7f Merge pull request #2055 from prombot/repo_sync
43749bc Update common Prometheus files
de19217 examples: improve simple main.go example (#1999)
20355eb fix: correct typos in comments and test error messages (#2049)
4cd2d3a test: fix two flaky tests (darwin start_time regex, memstats HeapReleased dri...
Additional commits viewable in compare view

Updates github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.2

Release notes

Sourced from github.com/sigstore/cosign/v3's releases.

v3.1.2

This may be the last Cosign v3.1 release, as we finish deprecations and removing unused functionality. Soon we'll start work on Cosign v4 where we will remove things that are currently deprecated. We'll continue to support Cosign v3, with it's opt-in backwards compatibility, as described in our versioning policy.

If you haven't already, now is an excellent time to move to the bundle format that has been supported since Cosign v2.6.

We have received a ton of fixes over the past month from folks using Cosign in a variety of environments - thank you all!

Deprecations

816f2b6634821cefe6ceabbffdd5ff7ffc00d0a4 Deprecate --payload for sign and verify commands (#4991)

Features

5121398c0ae6f4444d8ffd10447d7b765184f304 docs: add OVHcloud KMS in available external plugins (#4962)

38f73bb8fd949fad71e7086bd122080b2d47ceeb Add insecure registry flag to ko publish in kind-verify-attestation workflow (#4970)

2e0749ac11c7326299f6af65ae6a3ab6a6750586 Deprecate --output-attestation (#4958)

2233166935e2940a530e5a740adc095f4ca4863d Add bundle inspect command (#4842)

Fixes

eb3bb86f712a1163591b6663bbc434afb6fad467 Guard against empty certificate PEM in mutate.Signature (#4998)

089731c31f750153e9d91ec248c990e3b1991c2b fix(download): Validate predicate type for new bundle format

d996ce12df6967bb5bf81e3244bfbbe1c2665f34 Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)

8ca5b2002f5cd43614c476665e2055e59392b59d Fix Makefile: fall back to "unknown" version info when built outside a git repo (#5000)

df78bf67985f09e431f88b69be5842b7d0f5f4eb fix(verify): skip identity validation for security keys (#5012)

aebdc3a232083841b9c957fbba6b80b41df8caad fix: include artifactType in OCI 1.1 signature referrer manifest

c0edaac063a90b1dcacdabc7fc23e6c6f8ade90d Allow attestation download to handle both bundle types (#4996)

a8642c7b8611d557b4a592e6b94b188bd9427d7c Fix panic in dockerfile verify on malformed FROM lines (#4979)

ef3e3b446a011852929a08f51095ecc67495bfe7 fix(release): restore signing-step auth and fail on image signing errors (#4978)

16ddbcf9040b75e2329f2436b65ba3ed340dac88 feat(signing-config): add --base-config flag to override services from base config (#4977)

f17f812494b558499d89a37a6c9161657d2371e9 fix: pass NewBundleFormat to KeyOpts in sign command (#4981)

6ef8d9d040a481e26e065349c292799615ea7e7b fix: ignore build stage references in dockerfile verify (#4961)

8dbdef561622178f453d64d83faa02b1744a19f7 fix: allow '=' in annotation values (#4957)

Cleanup

193d2153431f8bb0d945a4c1ee721872f73add67 Remove unused policy evaluation code (#4936)

0fc9811059a037c32599e133ec4cc9fead4f354e Remove unused signing code (#4918)

95dceda0e7ea0b8d1f1a1d2b9a98c9fb2a6e5b74 Remove unused OCI code (#4935)

b1dd2e9524daf7406b350cbbfa7f4cd7b8ea0973 Remove unused ephemeral signer (#4938)

Documentation

81841260820bdddef3ea65c6f0824caca0cf2715 feat: improve verify flag shell completions (#4965)

ed0efe8cb464c1bae4711f87b552b1f2e602c816 docs: fix Short style and add Example fields to piv-tool subcommands (#4942)

d41b86c63cfd2653c263962a9225691c5774c228 docs: add Example fields to env and bundle create commands (#4941)

8a7174a1d462b3bb5a2722c7e1cf3a24fd1d3896 docs: fix Short style and add Example fields to pkcs11-tool subcommands

Thanks to all contributors!

... (truncated)

Commits

193d215 Remove unused policy evaluation code (#4936)
eb3bb86 Guard against empty certificate PEM in mutate.Signature (#4998)
089731c fix(download): Validate predicate type for new bundle format
d996ce1 Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)
8ca5b20 Fix Makefile: fall back to "unknown" version info when built outside a git re...
df78bf6 fix(verify): skip identity validation for security keys (#5012)
ee51b53 chore(deps): bump golang in the all group across 1 directory (#4950)
aebdc3a fix: include artifactType in OCI 1.1 signature referrer manifest
816f2b6 Deprecate --payload for sign and verify commands (#4991)
c0edaac Allow attestation download to handle both bundle types (#4996)
Additional commits viewable in compare view

Updates github.com/sigstore/rekor from 1.5.2 to 1.5.3

Release notes

Sourced from github.com/sigstore/rekor's releases.

v1.5.3

Changelog

7d9dcffcc27c4912e7d17fc768db01aa2d5cf26c Changelog for v1.5.3 (#2871)

f230638c11a77e26bcef2bd2d502623527c23397 Use bytes.Equal for inclusion proof root hash comparison (#2861)

747226830b6888555f2ed195d65c592e85a5cfb1 return 499 if client disconnects instead of 500 (#2870)

792221be80dedadc9f41ae5975ac2b5b5d9a6921 build(deps): Bump google.golang.org/grpc from 1.80.0 to 1.82.0 (#2859)

912dda344477c9c2ce0782731553a8fc0b76c58d build(deps): Bump the all group across 1 directory with 7 updates (#2869)

0f9921df54391f4936eae6753a13cacb6e0d659a Change max upperbound on latency metrics (#2868)

322a3f2cd78f0ada4901f68c56e4a8bb86e0e609 build(deps): Bump golang from 87a41d2 to f96cc55 (#2855)

e997a8abe2f187b316bba229171b83d474136a90 build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 (#2857)

4444582076ed0bd3071ab5c1044426fdccf855c3 build(deps): Bump golang.org/x/net from 0.52.0 to 0.55.0 in /hack/tools (#2866)

f81061c497f66244d6f3f45b9f1c4b009defb6c4 Move fuzz into its own workflow (#2865)

1a2f3f22a7e4e0033411b587f792b09e17bbd56c build(deps): Bump google.com/cloudsdktool/google-cloud-cli (#2862)

cf8f143d98a2476d4b0bc476a4ceeec6032a5807 build(deps): Bump the all group with 2 updates (#2863)

4e6fd6005a6c006c3f0bc644df9bb9b1b0bd1128 build(deps): Bump the all group across 1 directory with 11 updates

088835b8916af4554020909b34d692b67cf583e6 build(deps): Bump golang in the all group across 1 directory

37eb42417790461684d34aa79f505f41dc9e95b7 build(deps): Bump the all group across 1 directory with 2 updates

bbc0f78d46da013db889a10947f57c47c9339952 build(deps): Bump google.com/cloudsdktool/google-cloud-cli

32e68681ada478a959d7786cbe7966e06197bff0 build(deps): Bump codecov/codecov-action from 6.0.1 to 7.0.0

400f8d54e79cf8438cdfaa4a21a23f72250d9152 build(deps): Bump github.com/go-openapi/loads from 0.23.3 to 0.24.0

a2d42d58996106e40ba7d163892a8cfe3797df6c build(deps): Bump github.com/redis/go-redis/v9 from 9.18.0 to 9.20.0

e1e207b3a3c7fd2d1391ac0e0e92d0d6b2c616f3 build(deps): Bump github.com/go-openapi/runtime from 0.29.4 to 0.32.2

128ebabceab62c82a4cc7308fb18ef476100fcf7 build(deps): Bump golang from 313faae to 2d6c802

6c9dd721e4500dc56b8bf3d70cf4af31ed058dbd build(deps): Bump golang.org/x/net from 0.53.0 to 0.55.0

65c104c47b03ca8f487464c417782452bfef8add build(deps): Bump the all group across 1 directory with 4 updates

6e4daae2da593cd88729e3de1d531c50cd8c5dee build(deps): Bump google.com/cloudsdktool/google-cloud-cli

adebc681c70eef419c71aa33f7ed8d85dddf878c update builder to use go1.26.3

Thanks for all contributors!

Changelog

Sourced from github.com/sigstore/rekor's changelog.

v1.5.3

Features

return 499 when clients disconnect instead of 500 (#2870)

Improvements

Change max upperbound on latency metrics (#2868)

Commits

7d9dcff Changelog for v1.5.3 (#2871)
f230638 Use bytes.Equal for inclusion proof root hash comparison (#2861)
7472268 return 499 if client disconnects instead of 500 (#2870)
792221b build(deps): Bump google.golang.org/grpc from 1.80.0 to 1.82.0 (#2859)
912dda3 build(deps): Bump the all group across 1 directory with 7 updates (#2869)
0f9921d Change max upperbound on latency metrics (#2868)
322a3f2 build(deps): Bump golang from 87a41d2 to f96cc55 (#2855)...
Description has been truncated

Bumps the go-deps group with 14 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) | `0.6.1` | `0.7.0` | | [github.com/elazarl/goproxy](https://github.com/elazarl/goproxy) | `1.8.4` | `1.8.5` | | [github.com/fluxcd/cli-utils](https://github.com/fluxcd/cli-utils) | `1.2.1` | `1.2.2` | | [github.com/fluxcd/pkg/apis/event](https://github.com/fluxcd/pkg) | `0.27.0` | `0.28.0` | | [github.com/fluxcd/pkg/apis/meta](https://github.com/fluxcd/pkg) | `1.30.0` | `1.31.0` | | [github.com/fluxcd/pkg/artifact](https://github.com/fluxcd/pkg) | `0.18.0` | `0.20.0` | | [github.com/fluxcd/pkg/auth](https://github.com/fluxcd/pkg) | `0.54.0` | `0.56.0` | | [github.com/fluxcd/pkg/helmtestserver](https://github.com/fluxcd/pkg) | `0.40.0` | `0.41.0` | | [github.com/fluxcd/pkg/runtime](https://github.com/fluxcd/pkg) | `0.110.0` | `0.111.0` | | [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy) | `5.9.0` | `5.9.1` | | [github.com/minio/minio-go/v7](https://github.com/minio/minio-go) | `7.2.0` | `7.2.1` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.2` | `1.24.1` | | [github.com/sigstore/cosign/v3](https://github.com/sigstore/cosign) | `3.0.6` | `3.1.2` | | [oras.land/oras-go/v2](https://github.com/oras-project/oras-go) | `2.6.1` | `2.6.2` | Updates `github.com/cyphar/filepath-securejoin` from 0.6.1 to 0.7.0 - [Release notes](https://github.com/cyphar/filepath-securejoin/releases) - [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md) - [Commits](cyphar/filepath-securejoin@v0.6.1...v0.7.0) Updates `github.com/elazarl/goproxy` from 1.8.4 to 1.8.5 - [Release notes](https://github.com/elazarl/goproxy/releases) - [Commits](elazarl/goproxy@v1.8.4...v1.8.5) Updates `github.com/fluxcd/cli-utils` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/fluxcd/cli-utils/releases) - [Commits](fluxcd/cli-utils@v1.2.1...v1.2.2) Updates `github.com/fluxcd/pkg/apis/event` from 0.27.0 to 0.28.0 - [Commits](fluxcd/pkg@git/v0.27.0...git/v0.28.0) Updates `github.com/fluxcd/pkg/apis/meta` from 1.30.0 to 1.31.0 - [Commits](fluxcd/pkg@apis/meta/v1.30.0...apis/meta/v1.31.0) Updates `github.com/fluxcd/pkg/artifact` from 0.18.0 to 0.20.0 - [Commits](fluxcd/pkg@git/v0.18.0...git/v0.20.0) Updates `github.com/fluxcd/pkg/auth` from 0.54.0 to 0.56.0 - [Commits](fluxcd/pkg@oci/v0.54.0...oci/v0.56.0) Updates `github.com/fluxcd/pkg/helmtestserver` from 0.40.0 to 0.41.0 - [Commits](fluxcd/pkg@git/v0.40.0...git/v0.41.0) Updates `github.com/fluxcd/pkg/oci` from 0.68.0 to 0.69.0 - [Commits](fluxcd/pkg@oci/v0.68.0...oci/v0.69.0) Updates `github.com/fluxcd/pkg/runtime` from 0.110.0 to 0.111.0 - [Commits](fluxcd/pkg@runtime/v0.110.0...runtime/v0.111.0) Updates `github.com/go-git/go-billy/v5` from 5.9.0 to 5.9.1 - [Release notes](https://github.com/go-git/go-billy/releases) - [Commits](go-git/go-billy@v5.9.0...v5.9.1) Updates `github.com/minio/minio-go/v7` from 7.2.0 to 7.2.1 - [Release notes](https://github.com/minio/minio-go/releases) - [Commits](minio/minio-go@v7.2.0...v7.2.1) Updates `github.com/onsi/gomega` from 1.41.0 to 1.42.1 - [Release notes](https://github.com/onsi/gomega/releases) - [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md) - [Commits](onsi/gomega@v1.41.0...v1.42.1) Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.1 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.1/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.23.2...v1.24.1) Updates `github.com/sigstore/cosign/v3` from 3.0.6 to 3.1.2 - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](sigstore/cosign@v3.0.6...v3.1.2) Updates `github.com/sigstore/rekor` from 1.5.2 to 1.5.3 - [Release notes](https://github.com/sigstore/rekor/releases) - [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md) - [Commits](sigstore/rekor@v1.5.2...v1.5.3) Updates `github.com/sigstore/sigstore-go` from 1.2.0 to 1.2.1 - [Release notes](https://github.com/sigstore/sigstore-go/releases) - [Commits](sigstore/sigstore-go@v1.2.0...v1.2.1) Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0 - [Commits](golang/crypto@v0.53.0...v0.54.0) Updates `golang.org/x/sync` from 0.21.0 to 0.22.0 - [Commits](golang/sync@v0.21.0...v0.22.0) Updates `google.golang.org/api` from 0.283.0 to 0.284.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.283.0...v0.284.0) Updates `oras.land/oras-go/v2` from 2.6.1 to 2.6.2 - [Release notes](https://github.com/oras-project/oras-go/releases) - [Changelog](https://github.com/oras-project/oras-go/blob/main/RELEASES.md) - [Commits](oras-project/oras-go@v2.6.1...v2.6.2) --- updated-dependencies: - dependency-name: github.com/cyphar/filepath-securejoin dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/elazarl/goproxy dependency-version: 1.8.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/fluxcd/cli-utils dependency-version: 1.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/apis/event dependency-version: 0.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/apis/meta dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/artifact dependency-version: 0.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/auth dependency-version: 0.56.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/helmtestserver dependency-version: 0.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/oci dependency-version: 0.69.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/runtime dependency-version: 0.111.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/go-git/go-billy/v5 dependency-version: 5.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/minio/minio-go/v7 dependency-version: 7.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/onsi/gomega dependency-version: 1.42.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/prometheus/client_golang dependency-version: 1.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/sigstore/cosign/v3 dependency-version: 3.1.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/sigstore/rekor dependency-version: 1.5.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/sigstore/sigstore-go dependency-version: 1.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/sync dependency-version: 0.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: google.golang.org/api dependency-version: 0.284.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: oras.land/oras-go/v2 dependency-version: 2.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies Pull requests that update a dependency label Aug 1, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the go-deps group across 1 directory with 21 updates - #2117

build(deps): bump the go-deps group across 1 directory with 21 updates#2117
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-fd5876e923

dependabot Bot commented on behalf of github Aug 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 1, 2026

[0.7.0] - 2025-06-17

Changed

v1.8.5

What's Changed

New Contributors

v1.2.2

What's Changed

v5.9.1

What's Changed

v1.42.1

1.42.1

v1.42.0

1.42.0

1.42.1

1.42.0

v1.24.1 / 2026-07-23

What's Changed

v1.24.0 - 2026-07-20

Changes

1.24.1 / 2026-07-23

1.24.0 / 2026-07-20

v3.1.2

Deprecations

Features

Fixes

Cleanup

Documentation

Thanks to all contributors!

v1.5.3

Changelog

Thanks for all contributors!

v1.5.3

Features

Improvements

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants