Skip to content

build(deps): bump the go-deps group across 1 directory with 13 updates - #2163

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-90d4654193
Open

build(deps): bump the go-deps group across 1 directory with 13 updates#2163
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-90d4654193

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 18, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-deps group with 13 updates in the / directory:

Package From To
github.com/cyphar/filepath-securejoin 0.6.1 0.7.0
github.com/elazarl/goproxy 1.8.4 1.9.1
github.com/miekg/dns 1.1.72 1.1.73
github.com/minio/minio-go/v7 7.2.0 7.3.0
github.com/sigstore/cosign/v3 3.0.6 3.1.3
github.com/sigstore/rekor 1.5.2 1.5.3
github.com/sigstore/sigstore 1.10.8 1.10.10
github.com/sigstore/sigstore-go 1.2.0 1.2.2
github.com/sirupsen/logrus 1.9.4 1.10.2
golang.org/x/crypto 0.56.0 0.57.0
golang.org/x/sync 0.22.0 0.23.0
google.golang.org/api 0.297.0 0.298.0
oras.land/oras-go/v2 2.6.1 2.6.2

Updates github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0

Release notes

Sourced from github.com/cyphar/filepath-securejoin's releases.

v0.7.0 -- "You talk of times of peace for all, and then prepare for war."

Changed

  • Update to cyphar.com/go-pathrs@0.2.5, which included a build-time API breakage that we needed to work around. The API of this library is unchanged by this, but users should make sure to update to v0.7.0 of filepath-securejoin if they use the libpathrs built tag and have update to libpathrs v0.2.5.

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.7.0] - 2025-06-17

You talk of times of peace for all, and then prepare for war.

Changed

  • Update to cyphar.com/go-pathrs@0.2.5, which included a build-time API breakage that we needed to work around. The API of this library is unchanged by this, but users should make sure to update to v0.7.0 of filepath-securejoin if they use the libpathrs built tag and have update to libpathrs v0.2.5.
Commits
  • 8096a95 VERSION: release v0.7.0
  • 1324ccb merge #101 into cyphar/filepath-securejoin:main
  • dd8f0bb deps: bump to cyphar.com/go-pathrs@v0.2.5
  • c9a7725 gha: bump golangci-lint to v2.12
  • 2e968bd Merge pull request #91 from cyphar/dependabot/github_actions/actions/download...
  • 2879148 Merge pull request #90 from cyphar/dependabot/github_actions/actions/upload-a...
  • 07b805b build(deps): bump actions/download-artifact from 6 to 7
  • 8507844 build(deps): bump actions/upload-artifact from 5 to 6
  • daef0cf Merge pull request #89 from cyphar/dependabot/github_actions/actions/checkout-6
  • 95f8ea4 build(deps): bump actions/checkout from 5 to 6
  • Additional commits viewable in compare view

Updates github.com/elazarl/goproxy from 1.8.4 to 1.9.1

Release notes

Sourced from github.com/elazarl/goproxy's releases.

v1.9.1

What's Changed

New Contributors

Full Changelog: elazarl/goproxy@v1.9.0...v1.9.1

v1.9.0: HTTP/2 MITM Full Support

What's Changed

Full Changelog: elazarl/goproxy@v1.8.6...v1.9.0

Highlights & Acknowledgements

  • HTTP/2 MITM Support: This release introduces native support for inspecting and manipulating HTTP/2 traffic within GoProxy's MITM functionality. A special thanks to the team at @​LumiaSecurity (including @​omriza for the review) for supporting the development of these HTTP/2 MITM features and contributing to this major enhancement. Achieving full HTTP/2 MITM capability represents a huge milestone for GoProxy, taking our library to the next level for whoever needs it. To enable it, make sure that AllowHTTP2 is set to true in the proxy configuration.

⚠️ Possible Breaking Change

  • Previously there was an incomplete implementation of HTTP/2 inside the h2.go file, with an exported H2Transport struct. Probably no one was using it, but if you were, be careful that in this release it has been removed to create the full HTTP/2 MITM implementation.

v1.8.6

What's Changed

New Contributors

Full Changelog: elazarl/goproxy@v1.8.5...v1.8.6

v1.8.5

What's Changed

New Contributors

Full Changelog: elazarl/goproxy@v1.8.4...v1.8.5

Commits
  • e540bd6 fix(mitm): never frame bodiless responses as chunked (#797)
  • 2b17647 Echo client HTTP version in CONNECT tunnel reply (#802) (#804)
  • 4c85e93 Fix: normalize req.URL.Host in MITM by prioritizing inner Host header (#799)
  • 6225cd3 Use Go standard library to check port (#795)
  • 5e44068 HTTP/2 MITM Full Support (#785)
  • a4bf432 Stream MITM response bodies (#794)
  • 3f0ac0b Fix unexpected scheme edge case in MITM (#793)
  • d435b12 Fix headers overwrite when there are no trailers (#791)
  • 5497631 Remove redundant certificate Leaf set starting from Go 1.23 (#789)
  • 5ba11e8 fix(https): coalesce the MITM response head into a single write (#787)
  • See full diff in compare view

Updates github.com/miekg/dns from 1.1.72 to 1.1.73

Commits

Updates github.com/minio/minio-go/v7 from 7.2.0 to 7.3.0

Release notes

Sourced from github.com/minio/minio-go/v7's releases.

v7.3.0

What's Changed

New Contributors

Full Changelog: minio/minio-go@v7.2.1...v7.3.0

Commits
  • ce0e323 update lib version to v7.3.0
  • 2f55211 rdma: build against libs3rdma, and fix the size guard's off-by-one (#2283)
  • 1e3d492 feat: propagate caller context through credential providers (#2275)
  • e7b0801 Add AIStor Lifecycle Compression (#2281)
  • b15d168 build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#2280)
  • d1e1ecd fix: return delete-marker ObjectInfo from StatObject alongside the error (#2273)
  • f230068 fix: declare aws-chunked content encoding on streaming uploads (#2277)
  • 90530cf Add end-to-end checksum verification on GetObject (#2272)
  • a4c24f9 build(deps): bump the actions group with 2 updates (#2279)
  • 28bece5 rdma: reject buffers over the 4 GiB cuObject registration limit (#2278)
  • Additional commits viewable in compare view

Updates github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.3

Release notes

Sourced from github.com/sigstore/cosign/v3's releases.

v3.1.3

What's Changed

This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle.

Full Changelog: sigstore/cosign@v3.1.2...v3.1.3

v3.1.2

This may be the last Cosign v3.1 release, as we finish deprecations and removing unused functionality. Soon we'll start work on Cosign v4 where we will remove things that are currently deprecated. We'll continue to support Cosign v3, with it's opt-in backwards compatibility, as described in our versioning policy.

If you haven't already, now is an excellent time to move to the bundle format that has been supported since Cosign v2.6.

We have received a ton of fixes over the past month from folks using Cosign in a variety of environments - thank you all!

Deprecations

  • 816f2b6634821cefe6ceabbffdd5ff7ffc00d0a4 Deprecate --payload for sign and verify commands (#4991)

Features

  • 5121398c0ae6f4444d8ffd10447d7b765184f304 docs: add OVHcloud KMS in available external plugins (#4962)
  • 38f73bb8fd949fad71e7086bd122080b2d47ceeb Add insecure registry flag to ko publish in kind-verify-attestation workflow (#4970)
  • 2e0749ac11c7326299f6af65ae6a3ab6a6750586 Deprecate --output-attestation (#4958)
  • 2233166935e2940a530e5a740adc095f4ca4863d Add bundle inspect command (#4842)

Fixes

  • eb3bb86f712a1163591b6663bbc434afb6fad467 Guard against empty certificate PEM in mutate.Signature (#4998)
  • 089731c31f750153e9d91ec248c990e3b1991c2b fix(download): Validate predicate type for new bundle format
  • d996ce12df6967bb5bf81e3244bfbbe1c2665f34 Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)
  • 8ca5b2002f5cd43614c476665e2055e59392b59d Fix Makefile: fall back to "unknown" version info when built outside a git repo (#5000)
  • df78bf67985f09e431f88b69be5842b7d0f5f4eb fix(verify): skip identity validation for security keys (#5012)
  • aebdc3a232083841b9c957fbba6b80b41df8caad fix: include artifactType in OCI 1.1 signature referrer manifest
  • c0edaac063a90b1dcacdabc7fc23e6c6f8ade90d Allow attestation download to handle both bundle types (#4996)
  • a8642c7b8611d557b4a592e6b94b188bd9427d7c Fix panic in dockerfile verify on malformed FROM lines (#4979)
  • ef3e3b446a011852929a08f51095ecc67495bfe7 fix(release): restore signing-step auth and fail on image signing errors (#4978)
  • 16ddbcf9040b75e2329f2436b65ba3ed340dac88 feat(signing-config): add --base-config flag to override services from base config (#4977)
  • f17f812494b558499d89a37a6c9161657d2371e9 fix: pass NewBundleFormat to KeyOpts in sign command (#4981)
  • 6ef8d9d040a481e26e065349c292799615ea7e7b fix: ignore build stage references in dockerfile verify (#4961)
  • 8dbdef561622178f453d64d83faa02b1744a19f7 fix: allow '=' in annotation values (#4957)

Cleanup

... (truncated)

Commits
  • 11926fa Verification bypass via public key in legacy bundle (GHSA-fx35-mq7g-6g98) (#5...
  • 4d589ba fix(blob): compare file checksums case-insensitively (#5036)
  • 83d9ec8 fix: prevent shell completions for various options not taking filenames (#5032)
  • 0238975 test(inspect): replace mock TSA client usage with local timestamp response ge...
  • d6d86c2 Supporting OCI Signing with X.509 Certificate Chain (#4614)
  • a3ee83c fix(pkcs11key): return an error instead of panicking when no key pair matches...
  • d6857f2 Auto-detect default digest algorithm for public keys (#5019)
  • 193d215 Remove unused policy evaluation code (#4936)
  • eb3bb86 Guard against empty certificate PEM in mutate.Signature (#4998)
  • 089731c fix(download): Validate predicate type for new bundle format
  • Additional commits viewable in compare view

Updates github.com/sigstore/rekor from 1.5.2 to 1.5.3

Release notes

Sourced from github.com/sigstore/rekor's releases.

v1.5.3

Changelog

  • 7d9dcffcc27c4912e7d17fc768db01aa2d5cf26c Changelog for v1.5.3 (#2871)
  • f230638c11a77e26bcef2bd2d502623527c23397 Use bytes.Equal for inclusion proof root hash comparison (#2861)
  • 747226830b6888555f2ed195d65c592e85a5cfb1 return 499 if client disconnects instead of 500 (#2870)
  • 792221be80dedadc9f41ae5975ac2b5b5d9a6921 build(deps): Bump google.golang.org/grpc from 1.80.0 to 1.82.0 (#2859)
  • 912dda344477c9c2ce0782731553a8fc0b76c58d build(deps): Bump the all group across 1 directory with 7 updates (#2869)
  • 0f9921df54391f4936eae6753a13cacb6e0d659a Change max upperbound on latency metrics (#2868)
  • 322a3f2cd78f0ada4901f68c56e4a8bb86e0e609 build(deps): Bump golang from 87a41d2 to f96cc55 (#2855)
  • e997a8abe2f187b316bba229171b83d474136a90 build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 (#2857)
  • 4444582076ed0bd3071ab5c1044426fdccf855c3 build(deps): Bump golang.org/x/net from 0.52.0 to 0.55.0 in /hack/tools (#2866)
  • f81061c497f66244d6f3f45b9f1c4b009defb6c4 Move fuzz into its own workflow (#2865)
  • 1a2f3f22a7e4e0033411b587f792b09e17bbd56c build(deps): Bump google.com/cloudsdktool/google-cloud-cli (#2862)
  • cf8f143d98a2476d4b0bc476a4ceeec6032a5807 build(deps): Bump the all group with 2 updates (#2863)
  • 4e6fd6005a6c006c3f0bc644df9bb9b1b0bd1128 build(deps): Bump the all group across 1 directory with 11 updates
  • 088835b8916af4554020909b34d692b67cf583e6 build(deps): Bump golang in the all group across 1 directory
  • 37eb42417790461684d34aa79f505f41dc9e95b7 build(deps): Bump the all group across 1 directory with 2 updates
  • bbc0f78d46da013db889a10947f57c47c9339952 build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  • 32e68681ada478a959d7786cbe7966e06197bff0 build(deps): Bump codecov/codecov-action from 6.0.1 to 7.0.0
  • 400f8d54e79cf8438cdfaa4a21a23f72250d9152 build(deps): Bump github.com/go-openapi/loads from 0.23.3 to 0.24.0
  • a2d42d58996106e40ba7d163892a8cfe3797df6c build(deps): Bump github.com/redis/go-redis/v9 from 9.18.0 to 9.20.0
  • e1e207b3a3c7fd2d1391ac0e0e92d0d6b2c616f3 build(deps): Bump github.com/go-openapi/runtime from 0.29.4 to 0.32.2
  • 128ebabceab62c82a4cc7308fb18ef476100fcf7 build(deps): Bump golang from 313faae to 2d6c802
  • 6c9dd721e4500dc56b8bf3d70cf4af31ed058dbd build(deps): Bump golang.org/x/net from 0.53.0 to 0.55.0
  • 65c104c47b03ca8f487464c417782452bfef8add build(deps): Bump the all group across 1 directory with 4 updates
  • 6e4daae2da593cd88729e3de1d531c50cd8c5dee build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  • adebc681c70eef419c71aa33f7ed8d85dddf878c update builder to use go1.26.3

Thanks for all contributors!

Changelog

Sourced from github.com/sigstore/rekor's changelog.

v1.5.3

Features

  • return 499 when clients disconnect instead of 500 (#2870)

Improvements

  • Change max upperbound on latency metrics (#2868)
Commits
  • 7d9dcff Changelog for v1.5.3 (#2871)
  • f230638 Use bytes.Equal for inclusion proof root hash comparison (#2861)
  • 7472268 return 499 if client disconnects instead of 500 (#2870)
  • 792221b build(deps): Bump google.golang.org/grpc from 1.80.0 to 1.82.0 (#2859)
  • 912dda3 build(deps): Bump the all group across 1 directory with 7 updates (#2869)
  • 0f9921d Change max upperbound on latency metrics (#2868)
  • 322a3f2 build(deps): Bump golang from 87a41d2 to f96cc55 (#2855)
  • e997a8a build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 (#2857)
  • 4444582 build(deps): Bump golang.org/x/net from 0.52.0 to 0.55.0 in /hack/tools (#2866)
  • f81061c Move fuzz into its own workflow (#2865)
  • Additional commits viewable in compare view

Updates github.com/sigstore/sigstore from 1.10.8 to 1.10.10

Release notes

Sourced from github.com/sigstore/sigstore's releases.

v1.10.10

What's Changed

New Contributors

Full Changelog: sigstore/sigstore@v1.10.9...v1.10.10

v1.10.9

What's Changed

Note: sigstore/sigstore#2369 deprecates the TUF client. Use the TUF client from sigstore-go instead: https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf

Full Changelog: sigstore/sigstore@v1.10.8...v1.10.9

Commits
  • 49e21e5 build(deps): Bump github.com/google/go-containerregistry from 0.21.9 to 0.22....
  • eda3b60 build(deps): Bump the gomod group across 4 directories with 4 updates (#2413)
  • b3e2728 Adjust mldsa error handling (#2417)
  • bfbf63e Support for ML-DSA keys (#2416)
  • 538e3fa Bump go to 1.27 and fix linter and api issues (#2415)
  • e8841f5 build(deps): Bump hashicorp/vault in /test/e2e in the all group (#2412)
  • 5b3d739 Fix Azure KMS ECDSA signature verification (r||s ordering + padding) (#2410)
  • ba4de68 build(deps): Bump github.com/aws/aws-sdk-go-v2/config (#2406)
  • 1abcedd build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#2407)
  • d579148 build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms (#2404)
  • Additional commits viewable in compare view

Updates github.com/sigstore/sigstore-go from 1.2.0 to 1.2.2

Release notes

Sourced from github.com/sigstore/sigstore-go's releases.

v1.2.2

What's Changed

Full Changelog: sigstore/sigstore-go@v1.2.1...v1.2.2

v1.2.1

What's Changed

v1.2.1 resolves GHSA-wqqc-jjcq-vfxm.

Full Changelog: sigstore/sigstore-go@v1.2.0...v1.2.1

Commits
  • 55aa624 Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 (#655)
  • 2eb9560 Bump the minor-patch group across 1 directory with 2 updates (#656)
  • cbf26e4 Support Verification in sigstore/cosign with X.509 Certificate Chain (#581)
  • 8a3361c Bump go-tuf to v2.4.2 (#652)
  • d6ec891 Bump the minor-patch group across 2 directories with 7 updates (#651)
  • 945a0aa Bump actions/setup-go from 6.4.0 to 6.5.0 (#650)
  • 13a15e1 Bump actions/checkout from 6.0.3 to 7.0.0 (#648)
  • c95d7f4 Update workflows to use Actions network firewall (#646)
  • a2a84a6 Update cert identity verify functions to ensure some criteria is specified (#...
  • 4594ab4 Check signature time against public key validity window (#642)
  • Additional commits viewable in compare view

Updates github.com/sirupsen/logrus from 1.9.4 to 1.10.2

Release notes

Sourced from github.com/sirupsen/logrus's releases.

v1.10.2

Logrus v1.10.2

This is a small maintenance release that updates github.com/stretchr/testify to v1.12.1, removing the legacy gopkg.in/yaml.v3 dependency from Logrus' dependency graph. There are no functional changes in this release.

Dependency Changes

  • update github.com/stretchr/testify to v1.12.1

Full Changelog: sirupsen/logrus@v1.10.1...v1.10.2

v1.10.1

Logrus v1.10.1

This patch release fixes two issues in field formatting and handling:

  • Fix a regression introduced in v1.10.0 where TextFormatter could panic when formatting nil or panicking error and fmt.Stringer values.
  • Allow function-backed values implementing error to be used with WithError, WithField, and WithFields.

Dependency Changes

  • update github.com/stretchr/testify to v1.12.0

Full Changelog: sirupsen/logrus@v1.10.0...v1.10.1

v1.10.0

Logrus v1.10.0

This release focuses on substantial performance improvements, concurrency correctness, and better interoperability with modern Go logging APIs.

🚀 Performance

Major improvements across TextFormatter, entry handling, and common logger paths:

  • ~17% lower geomean runtime across the benchmark suite
  • ~27% higher geomean formatter throughput
  • Common enabled logging paths are ~30–44% faster
  • WithError is ~40% faster
  • Chained fields are ~46% faster
  • TextFormatter paths are up to ~40% faster
  • Allocation counts are reduced by ~25–74% across measured TextFormatter cases, with the largest reductions in colored output

The improvements also show up in complete logger paths:

  • Logger + TextFormatter is ~31% faster, with ~24% fewer allocations
  • Logger + JSONFormatter is ~21% faster, with ~10% fewer allocations

... (truncated)

Changelog

Sourced from github.com/sirupsen/logrus's changelog.

1.10.2

Changed:

  • Update github.com/stretchr/testify to v1.12.1, removing the legacy gopkg.in/yaml.v3 dependency.

1.10.1

Fixes:

  • Fix a regression introduced in v1.10.0 where TextFormatter could panic when formatting nil or panicking error and fmt.Stringer values.
  • Allow function-backed implementations of error as field values.

1.10.0

Fixes:

  • Fix reentrant logging deadlocks in formatter paths.
  • Fix race conditions in formatter and entry handling.
  • Fix generic Log, Logf, Logln, and LogFn methods unexpectedly panicking when called with PanicLevel. Use the corresponding Panic methods when panic behavior is desired.
  • Improve concurrency safety around formatter and hook access.

Features:

  • Add slog hook for forwarding Logrus entries to log/slog.
  • Add slog.Handler for forwarding log/slog records to a Logrus logger, including levels, fields, groups, context, time, and optional caller reporting. The hook and handler can also be combined to help migrate between Logrus and log/slog.
  • Add minimal, composable logging interfaces for each log level. This enables consumers to depend on narrower interfaces, making it easier to substitute or adapt logging implementations.
  • Allow Entry.Caller to be set explicitly and preserve it across derived entries, enabling custom caller detection without Logrus overwriting caller information when ReportCaller is enabled.

Changed:

  • Raise minimum supported Go version to 1.23.
  • TextFormatter now renders []byte values as raw/quoted strings instead of slice-of-ints.
  • TextFormatter now uses distinct dimmed colors for debug and trace output.
  • TextFormatter now automatically enables colors on Windows terminals with ANSI support, matching the behavior on other platforms.
  • Entry.HasCaller is now deprecated in favor of checking Entry.Caller directly.
  • Deprecated MutexWrap, which was unintentionally exposed as public API. It remains available as an alias for compatibility but should not be used

... (truncated)

Commits
  • 6d6a132 Merge pull request #1586 from thaJeztah/prepare_v1.10.2
  • 4f94653 update changelog for v1.10.2
  • 87434bb Merge pull request #1585 from thaJeztah/bump_testify
  • e7d2120 chore(deps): bump github.com/stretchr/testify v1.12.1
  • 8b673a9 Merge pull request #1583 from thaJeztah/release_1.10.1
  • 0b920ad Merge pull request #1584 from thaJeztah/more_coverage
  • 5e20694 TextFormatter: cover nil pointer method receivers
  • 8312732 update changelog for v1.10.1
  • e987a40 Merge pull request #1582 from thaJeztah/panic_handler
  • 17d574b TextFormatter: recover panics from Error and String methods
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.56.0 to 0.57.0

Commits

@dependabot
build(deps): bump the go-deps group across 1 directory with 13 updates
97340b9 
Bumps the go-deps group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) | `0.6.1` | `0.7.0` |
| [github.com/elazarl/goproxy](https://github.com/elazarl/goproxy) | `1.8.4` | `1.9.1` |
| [github.com/miekg/dns](https://github.com/miekg/dns) | `1.1.72` | `1.1.73` |
| [github.com/minio/minio-go/v7](https://github.com/minio/minio-go) | `7.2.0` | `7.3.0` |
| [github.com/sigstore/cosign/v3](https://github.com/sigstore/cosign) | `3.0.6` | `3.1.3` |
| [github.com/sigstore/rekor](https://github.com/sigstore/rekor) | `1.5.2` | `1.5.3` |
| [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.10.8` | `1.10.10` |
| [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) | `1.2.0` | `1.2.2` |
| [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus) | `1.9.4` | `1.10.2` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.56.0` | `0.57.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.22.0` | `0.23.0` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.297.0` | `0.298.0` |
| [oras.land/oras-go/v2](https://github.com/oras-project/oras-go) | `2.6.1` | `2.6.2` |



Updates `github.com/cyphar/filepath-securejoin` from 0.6.1 to 0.7.0
- [Release notes](https://github.com/cyphar/filepath-securejoin/releases)
- [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md)
- [Commits](cyphar/filepath-securejoin@v0.6.1...v0.7.0)

Updates `github.com/elazarl/goproxy` from 1.8.4 to 1.9.1
- [Release notes](https://github.com/elazarl/goproxy/releases)
- [Commits](elazarl/goproxy@v1.8.4...v1.9.1)

Updates `github.com/miekg/dns` from 1.1.72 to 1.1.73
- [Commits](miekg/dns@v1.1.72...v1.1.73)

Updates `github.com/minio/minio-go/v7` from 7.2.0 to 7.3.0
- [Release notes](https://github.com/minio/minio-go/releases)
- [Commits](minio/minio-go@v7.2.0...v7.3.0)

Updates `github.com/sigstore/cosign/v3` from 3.0.6 to 3.1.3
- [Release notes](https://github.com/sigstore/cosign/releases)
- [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md)
- [Commits](sigstore/cosign@v3.0.6...v3.1.3)

Updates `github.com/sigstore/rekor` from 1.5.2 to 1.5.3
- [Release notes](https://github.com/sigstore/rekor/releases)
- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)
- [Commits](sigstore/rekor@v1.5.2...v1.5.3)

Updates `github.com/sigstore/sigstore` from 1.10.8 to 1.10.10
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.10.8...v1.10.10)

Updates `github.com/sigstore/sigstore-go` from 1.2.0 to 1.2.2
- [Release notes](https://github.com/sigstore/sigstore-go/releases)
- [Commits](sigstore/sigstore-go@v1.2.0...v1.2.2)

Updates `github.com/sirupsen/logrus` from 1.9.4 to 1.10.2
- [Release notes](https://github.com/sirupsen/logrus/releases)
- [Changelog](https://github.com/sirupsen/logrus/blob/master/CHANGELOG.md)
- [Commits](sirupsen/logrus@v1.9.4...v1.10.2)

Updates `golang.org/x/crypto` from 0.56.0 to 0.57.0
- [Commits](golang/crypto@v0.56.0...v0.57.0)

Updates `golang.org/x/sync` from 0.22.0 to 0.23.0
- [Commits](golang/sync@v0.22.0...v0.23.0)

Updates `google.golang.org/api` from 0.297.0 to 0.298.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.297.0...v0.298.0)

Updates `oras.land/oras-go/v2` from 2.6.1 to 2.6.2
- [Release notes](https://github.com/oras-project/oras-go/releases)
- [Changelog](https://github.com/oras-project/oras-go/blob/main/RELEASES.md)
- [Commits](oras-project/oras-go@v2.6.1...v2.6.2)

---
updated-dependencies:
- dependency-name: github.com/cyphar/filepath-securejoin
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/elazarl/goproxy
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/miekg/dns
  dependency-version: 1.1.73
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/minio/minio-go/v7
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/sigstore/cosign/v3
  dependency-version: 3.1.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/sigstore/rekor
  dependency-version: 1.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/sigstore/sigstore
  dependency-version: 1.10.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/sigstore/sigstore-go
  dependency-version: 1.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/sirupsen/logrus
  dependency-version: 1.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/crypto
  dependency-version: 0.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/sync
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: google.golang.org/api
  dependency-version: 0.298.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: oras.land/oras-go/v2
  dependency-version: 2.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency label Sep 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants