Skip to content

build(deps): bump the go-deps group with 10 updates #1900

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

build(deps): bump the go-deps group with 10 updates #1900

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 1, 2025

Bumps the go-deps group with 10 updates:

Package From To
github.com/cyphar/filepath-securejoin 0.4.1 0.5.0
github.com/fluxcd/pkg/runtime 0.84.0 0.86.0
github.com/minio/minio-go/v7 7.0.94 7.0.95
github.com/prometheus/client_golang 1.23.0 1.23.2
github.com/sigstore/cosign/v2 2.5.2 2.6.0
github.com/sigstore/sigstore 1.9.5 1.9.6-0.20250729224751-181c5d3339b3
golang.org/x/crypto 0.41.0 0.42.0
golang.org/x/oauth2 0.30.0 0.31.0
golang.org/x/sync 0.16.0 0.17.0
google.golang.org/api 0.248.0 0.251.0

Updates github.com/cyphar/filepath-securejoin from 0.4.1 to 0.5.0

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.5.0] - 2025-09-26

Let the past die. Kill it if you have to.

NOTE: With this release, some parts of github.com/cyphar/filepath-securejoin are now licensed under the Mozilla Public License (version 2). Please see COPYING.md as well as the the license header in each file for more details.

Breaking

  • The new API introduced in the [0.3.0][] release has been moved to a new subpackage called pathrs-lite. This was primarily done to better indicate the split between the new and old APIs, as well as indicate to users the purpose of this subpackage (it is a less complete version of [libpathrs][]).

    We have added some wrappers to the top-level package to ease the transition, but those are deprecated and will be removed in the next minor release of filepath-securejoin. Users should update their import paths.

    This new subpackage has also been relicensed under the Mozilla Public License (version 2), please see COPYING.md for more details.

Added

  • Most of the key bits the safe procfs API have now been exported and are available in github.com/cyphar/filepath-securejoin/pathrs-lite/procfs. At the moment this primarily consists of a new procfs.Handle API:

    • OpenProcRoot returns a new handle to /proc, endeavouring to make it safe if possible (subset=pid to protect against mistaken write attacks and leaks, as well as using fsopen(2) to avoid racing mount attacks).

      OpenUnsafeProcRoot returns a handle without attempting to create one with subset=pid, which makes it more dangerous to leak. Most users should use OpenProcRoot (even if you need to use ProcRoot as the base of an operation, as filepath-securejoin will internally open a handle when necessary).

    • The (*procfs.Handle).Open* family of methods lets you get a safe O_PATH handle to subpaths within /proc for certain subpaths.

      For OpenThreadSelf, the returned ProcThreadSelfCloser needs to be called after you completely finish using the handle (this is necessary because Go is multi-threaded and ProcThreadSelf references /proc/thread-self which may disappear if we do not runtime.LockOSThread -- ProcThreadSelfCloser is currently equivalent to runtime.UnlockOSThread).

      Note that you cannot open any procfs symlinks (most notably magic-links)

... (truncated)

Commits
  • bb9e81f VERSION: release 0.5.0
  • 17e58e1 CHANGELOG: minor updates
  • cc071b2 hack: properly test ./...
  • a1c1895 CHANGELOG: fix kernel version for open_tree(2)
  • 432c95e doc: minor godoc improvements
  • 90002f2 CHANGELOG: mention MPLv2 in pathrs-lite entry
  • 59fcb8b COPYING: fix reference to pathrs-lite internal pkgs
  • 43797e7 pathrs-lite: add Close to procfs wrapper
  • 2a0e2b6 pathrs-lite: move Reopen impl to internal/procfs
  • 3c5e239 *: update and improve godocs
  • Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/runtime from 0.84.0 to 0.86.0

Commits

Updates github.com/minio/minio-go/v7 from 7.0.94 to 7.0.95

Release notes

Sourced from github.com/minio/minio-go/v7's releases.

Bugfix Release

What's Changed

New Contributors

Full Changelog: minio/minio-go@v7.0.94...v7.0.95

Commits
  • bd91926 make sure to avoid closing the input reader (#2137)
  • 94f7e5e fix: DurationSeconds is a QueryValues not a Form data (#2128) (#2129)
  • 456f9b2 fix: explicitly use UTC for expiration field when marshaling PostPolicy (#2135)
  • beae4df setting multiple keys to trailer is not allowed
  • 6358be6 extend more missing headers for PartUploads (#2132)
  • bab3180 fix: missing append() API behavior (#2131)
  • 8a07725 set checksum headers requested properly (#2130)
  • 9b18e49 update all deps (#2125)
  • 68615a3 fix: prefix should use stringLike when new a bucketPolicy (2) (#2124)
  • 8eacd80 test: add test for PresignedPostPolicy with empty fileName (#2119)
  • Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.23.0 to 1.23.2

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.23.2 - 2025-09-05

This release is made to upgrade to prometheus/common v0.66.1, which drops the dependencies github.com/grafana/regexp and go.uber.org/atomic and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in replacement). There are no functional changes.

Full Changelog: prometheus/client_golang@v1.23.1...v1.23.2

v1.23.1 - 2025-09-04

This release is made to be compatible with a backwards incompatible API change in prometheus/common v0.66.0. There are no functional changes.

Full Changelog: prometheus/client_golang@v1.23.0...v1.23.1

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.23.2 / 2025-09-05

This release is made to upgrade to prometheus/common v0.66.1, which drops the dependencies github.com/grafana/regexp and go.uber.org/atomic and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in replacement). There are no functional changes.

1.23.1 / 2025-09-04

This release is made to be compatible with a backwards incompatible API change in prometheus/common v0.66.0. There are no functional changes.

Commits

Updates github.com/sigstore/cosign/v2 from 2.5.2 to 2.6.0

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.6.0 introduces a number of new features, including:

  • Signing an in-toto statement rather than Cosign constructing one from a predicate, along with verifying a statement's subject using a digest and digest algorithm rather than providing a file reference (#4306)
  • Uploading a signature and its verification material (a "bundle") as an OCI Image 1.1 referring artifact, completing #3927 (#4316)
  • Providing service URLs for signing and attesting using a SigningConfig. Note that this is required when using a Rekor v2 instance (#4319)

Example generation and verification of a signed in-toto statement:

cosign attest-blob --new-bundle-format=true --bundle="digest-key-test.sigstore.json" --key="cosign.key" --statement="../sigstore-go/examples/sigstore-go-signing/intoto.txt"
cosign verify-blob-attestation --bundle="digest-key-test.sigstore.json" --key=cosign.pub --type=unused --digest="b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9" --digestAlg="sha256"

Example container signing and verification using the new bundle format and referring artifacts:

cosign sign --new-bundle-format=true ghcr.io/user/alpine@sha256:a19367999603840546b8612572e338ec076c6d1f2fec61760a9e11410f546733
cosign verify --new-bundle-format=true ghcr.io/user/alpine@sha256:a19367999603840546b8612572e338ec076c6d1f2fec61760a9e11410f546733

Example usage of a signing config provided by the public good instance's TUF repository:

cosign sign-blob --use-signing-config --bundle sigstore.json README.md
cosign verify-blob --new-bundle-format --bundle sigstore.json --certificate-identity $EMAIL --certificate-oidc-issuer $ISSUER --use-signed-timestamps README.md

v2.6.0 leverages sigstore-go's signing and verification APIs gated behind these new flags. In an upcoming major release, we will be updating Cosign to default to producing and consuming bundles to align with all other Sigstore SDKs.

Features

  • Add to attest-blob the ability to supply a complete in-toto statement, and add to verify-blob-attestation the ability to verify with just a digest (#4306)
  • Have cosign sign support bundle format (#4316)
  • Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)
  • Add support for SigningConfig in sign/attest (#4371)
  • Support self-managed keys when signing with sigstore-go (#4368)
  • Don't require timestamps when verifying with a key (#4337)
  • Don't load content from TUF if trusted root path is specified (#4347)
  • Add a terminal spinner while signing with sigstore-go (#4402)
  • Require exclusively a SigningConfig or service URLs when signing (#4403)
  • Remove SHA256 assumption in sign-blob/verify-blob (#4050)
  • Bump sigstore-go, support alternative hash algorithms with keys (#4386)

Breaking API Changes

  • sign.SignerFromKeyOpts no longer generates a key. Instead, it returns whether or not the client needs to generate a key, and if so, clients should call sign.KeylessSigner. This allows clients to more easily manage key generation.

Bug Fixes

... (truncated)

Changelog

Sourced from github.com/sigstore/cosign/v2's changelog.

v2.6.0

v2.6.0 introduces a number of new features, including:

  • Signing an in-toto statement rather than Cosign constructing one from a predicate, along with verifying a statement's subject using a digest and digest algorithm rather than providing a file reference (#4306)
  • Uploading a signature and its verification material (a "bundle") as an OCI Image 1.1 referring artifact, completing #3927 (#4316)
  • Providing service URLs for signing and attesting using a SigningConfig. Note that this is required when using a Rekor v2 instance (#4319)

Example generation and verification of a signed in-toto statement:

cosign attest-blob --new-bundle-format=true --bundle="digest-key-test.sigstore.json" --key="cosign.key" --statement="../sigstore-go/examples/sigstore-go-signing/intoto.txt"
cosign verify-blob-attestation --bundle="digest-key-test.sigstore.json" --key=cosign.pub --type=unused --digest="b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9" --digestAlg="sha256"

Example container signing and verification using the new bundle format and referring artifacts:

cosign sign --new-bundle-format=true ghcr.io/user/alpine@sha256:a19367999603840546b8612572e338ec076c6d1f2fec61760a9e11410f546733
cosign verify --new-bundle-format=true ghcr.io/user/alpine@sha256:a19367999603840546b8612572e338ec076c6d1f2fec61760a9e11410f546733

Example usage of a signing config provided by the public good instance's TUF repository:

cosign sign-blob --use-signing-config --bundle sigstore.json README.md
cosign verify-blob --new-bundle-format --bundle sigstore.json --certificate-identity $EMAIL --certificate-oidc-issuer $ISSUER --use-signed-timestamps README.md

v2.6.0 leverages sigstore-go's signing and verification APIs gated behind these new flags. In an upcoming major release, we will be updating Cosign to default to producing and consuming bundles to align with all other Sigstore SDKs.

Features

  • Add to attest-blob the ability to supply a complete in-toto statement, and add to verify-blob-attestation the ability to verify with just a digest (#4306)
  • Have cosign sign support bundle format (#4316)
  • Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)
  • Add support for SigningConfig in sign/attest (#4371)
  • Support self-managed keys when signing with sigstore-go (#4368)
  • Don't require timestamps when verifying with a key (#4337)
  • Don't load content from TUF if trusted root path is specified (#4347)
  • Add a terminal spinner while signing with sigstore-go (#4402)
  • Require exclusively a SigningConfig or service URLs when signing (#4403)
  • Remove SHA256 assumption in sign-blob/verify-blob (#4050)
  • Bump sigstore-go, support alternative hash algorithms with keys (#4386)

Breaking API Changes

  • sign.SignerFromKeyOpts no longer generates a key. Instead, it returns whether or not the client needs to generate a key, and if so, clients should call sign.KeylessSigner. This allows clients to more easily manage key generation.

... (truncated)

Commits
  • 37fbfc7 Require exclusively a SigningConfig or service URLs when signing (#4403)
  • b1acaeb Add a terminal spinner while signing with sigstore-go (#4402)
  • 2581dfd chore(deps): bump the gomod group across 1 directory with 8 updates (#4401)
  • 11163ae Bump sigstore-go, support alternative hash algorithms with keys (#4386)
  • 153df46 chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.42.0 (#4391)
  • 1a1ee13 chore(deps): bump golang.org/x/oauth2 from 0.30.0 to 0.31.0 (#4393)
  • 8c7c09d chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4394)
  • a57176a chore(deps): bump golang.org/x/term from 0.34.0 to 0.35.0 (#4388)
  • 8e3dc33 chore(deps): bump the actions group with 4 updates (#4396)
  • f527319 chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 (#4392)
  • Additional commits viewable in compare view

Updates github.com/sigstore/sigstore from 1.9.5 to 1.9.6-0.20250729224751-181c5d3339b3

Commits

Updates golang.org/x/crypto from 0.41.0 to 0.42.0

Commits
  • 5307a0c go.mod: update golang.org/x dependencies
  • 9d77937 acme: include order problem in OrderError
  • 8f580de ssh: remove Go 1.24 build tag for ML-KEM kex
  • a4d1237 ssh/knownhosts: improve IPv6 support in Normalize
  • b8d8dae curve25519: include potential fips140=only error in panic message
  • f5a2eab ssh: use curve25519.X25519 instead of curve25519.ScalarMult
  • 44ecf3a all: upgrade go directive to at least 1.24.0 [generated]
  • See full diff in compare view

Updates golang.org/x/oauth2 from 0.30.0 to 0.31.0

Commits
  • 014cf77 all: upgrade go directive to at least 1.24.0 [generated]
  • 3c76ce5 endpoints: correct Naver OAuth2 endpoint URLs
  • See full diff in compare view

Updates golang.org/x/sync from 0.16.0 to 0.17.0

Commits
  • 04914c2 all: upgrade go directive to at least 1.24.0 [generated]
  • See full diff in compare view

Updates google.golang.org/api from 0.248.0 to 0.251.0

Release notes

Sourced from google.golang.org/api's releases.

v0.251.0

0.251.0 (2025-09-30)

Features

v0.250.0

0.250.0 (2025-09-25)

Features

v0.249.0

0.249.0 (2025-09-08)

Features

... (truncated)

Changelog

Sourced from google.golang.org/api's changelog.

0.251.0 (2025-09-30)

Features

0.250.0 (2025-09-25)

Features

0.249.0 (2025-09-08)

Features

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the go-deps group with 10 updates
2868fcb 
Bumps the go-deps group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) | `0.4.1` | `0.5.0` |
| [github.com/fluxcd/pkg/runtime](https://github.com/fluxcd/pkg) | `0.84.0` | `0.86.0` |
| [github.com/minio/minio-go/v7](https://github.com/minio/minio-go) | `7.0.94` | `7.0.95` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.0` | `1.23.2` |
| [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) | `2.5.2` | `2.6.0` |
| [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.9.5` | `1.9.6-0.20250729224751-181c5d3339b3` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.41.0` | `0.42.0` |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.30.0` | `0.31.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.16.0` | `0.17.0` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.248.0` | `0.251.0` |


Updates `github.com/cyphar/filepath-securejoin` from 0.4.1 to 0.5.0
- [Release notes](https://github.com/cyphar/filepath-securejoin/releases)
- [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md)
- [Commits](cyphar/filepath-securejoin@v0.4.1...v0.5.0)

Updates `github.com/fluxcd/pkg/runtime` from 0.84.0 to 0.86.0
- [Commits](fluxcd/pkg@runtime/v0.84.0...runtime/v0.86.0)

Updates `github.com/minio/minio-go/v7` from 7.0.94 to 7.0.95
- [Release notes](https://github.com/minio/minio-go/releases)
- [Commits](minio/minio-go@v7.0.94...v7.0.95)

Updates `github.com/prometheus/client_golang` from 1.23.0 to 1.23.2
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.23.0...v1.23.2)

Updates `github.com/sigstore/cosign/v2` from 2.5.2 to 2.6.0
- [Release notes](https://github.com/sigstore/cosign/releases)
- [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md)
- [Commits](sigstore/cosign@v2.5.2...v2.6.0)

Updates `github.com/sigstore/sigstore` from 1.9.5 to 1.9.6-0.20250729224751-181c5d3339b3
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](https://github.com/sigstore/sigstore/commits)

Updates `golang.org/x/crypto` from 0.41.0 to 0.42.0
- [Commits](golang/crypto@v0.41.0...v0.42.0)

Updates `golang.org/x/oauth2` from 0.30.0 to 0.31.0
- [Commits](golang/oauth2@v0.30.0...v0.31.0)

Updates `golang.org/x/sync` from 0.16.0 to 0.17.0
- [Commits](golang/sync@v0.16.0...v0.17.0)

Updates `google.golang.org/api` from 0.248.0 to 0.251.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.248.0...v0.251.0)

---
updated-dependencies:
- dependency-name: github.com/cyphar/filepath-securejoin
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/fluxcd/pkg/runtime
  dependency-version: 0.86.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/minio/minio-go/v7
  dependency-version: 7.0.95
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.23.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/sigstore/cosign/v2
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/sigstore/sigstore
  dependency-version: 1.9.6-0.20250729224751-181c5d3339b3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: golang.org/x/crypto
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/sync
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: google.golang.org/api
  dependency-version: 0.251.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency label Oct 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants