chore(deps): update go dependencies by red-hat-konflux[bot] · Pull Request #419 · securesign/fulcio

red-hat-konflux · 2026-07-17T21:23:52Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Pending
chainguard.dev/go-grpc-kit	require	minor	`v0.17.17` → `v0.18.0`
chainguard.dev/sdk	require	patch	`v0.1.50` → `v0.1.138`	`v0.1.143` (+4)
cloud.google.com/go/auth	indirect	minor	`v0.20.0` → `v0.22.0`
cloud.google.com/go/iam	indirect	minor	`v1.11.0` → `v1.12.0`
cloud.google.com/go/kms	indirect	minor	`v1.31.0` → `v1.32.0`
github.com/Masterminds/semver/v3	indirect	minor	`v3.3.1` → `v3.5.0`
github.com/aws/smithy-go	indirect	patch	`v1.27.3` → `v1.27.4`
github.com/cenkalti/backoff/v4	indirect	major	`v4.3.0` → `v7.0.0`
github.com/cenkalti/backoff/v5	indirect	major	`v5.0.3` → `v7.0.0`
github.com/chainguard-dev/clog	indirect	patch	`v1.8.0` → `v1.8.1`
github.com/go-jose/go-jose/v3	indirect	major	`v3.0.5` → `v4.1.4`
github.com/google/go-containerregistry	indirect	patch	`v0.21.4` → `v0.21.7`
github.com/grpc-ecosystem/go-grpc-middleware	require	major	`v1.4.0` → `v2.3.3`
github.com/hashicorp/hcl	indirect	major	`v1.0.1-vault-7` → `v2.24.0`
github.com/jellydator/ttlcache/v3	indirect	patch	`v3.4.0` → `v3.4.1`
github.com/letsencrypt/boulder	indirect	minor	`v0.20260406.0` → `v0.20260713.0`	`v0.20260720.0`
github.com/pelletier/go-toml/v2	indirect	minor	`v2.3.0` → `v2.4.3`
github.com/spiffe/go-spiffe/v2	require	minor	`v2.6.0` → `v2.8.1`
github.com/tink-crypto/tink-go-awskms/v2	require	major	`v2.1.0` → `v3.0.0`
github.com/tink-crypto/tink-go-gcpkms/v2	require	minor	`v2.2.0` → `v2.3.0`
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	indirect	minor	`v0.67.0` → `v0.69.0`
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	indirect	minor	`v0.67.0` → `v0.69.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace	indirect	minor	`v1.43.0` → `v1.44.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	indirect	minor	`v1.43.0` → `v1.44.0`
goa.design/goa/v3	require	minor	`v3.25.3` → `v3.28.0`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

chainguard-dev/go-grpc-kit (chainguard.dev/go-grpc-kit)

`v0.18.0`

Compare Source

What's Changed

fix: loopback transport credentials in LoopbackDialOptions by @k4leung4 in #555
Bump google.golang.org/grpc from 1.79.3 to 1.80.0 by @dependabot[bot] in #571
Bump chainguard-dev/actions from 1.6.9 to 1.6.13 by @dependabot[bot] in #567
Bump actions/setup-go from 6.0.0 to 6.4.0 by @dependabot[bot] in #566
Bump step-security/harden-runner from 2.16.0 to 2.16.1 by @dependabot[bot] in #569
Bump the otel group across 1 directory with 4 updates by @dependabot[bot] in #573
Bump google.golang.org/api from 0.272.0 to 0.274.0 by @dependabot[bot] in #570
chore(workflows): add actionlint and zizmor action linters [SECINT-75] by @stevebeattie in #572
build(deps): bump step-security/action-actionlint from 1.69.1 to 1.72.0 by @dependabot[bot] in #580
build(deps): bump step-security/harden-runner from 2.16.0 to 2.17.0 by @dependabot[bot] in #579
build(deps): bump google.golang.org/api from 0.274.0 to 0.275.0 by @dependabot[bot] in #578
build(deps): bump chainguard-dev/actions from 1.6.13 to 1.6.14 by @dependabot[bot] in #577
build(deps): bump actions/cache from 5.0.4 to 5.0.5 by @dependabot[bot] in #574
build(deps): bump golang.org/x/net from 0.52.0 to 0.53.0 in the golang-org-x group by @dependabot[bot] in #575
build(deps): bump step-security/action-misspell from 1.27.1 to 1.27.2 by @dependabot[bot] in #576
build(deps): bump step-security/harden-runner from 2.17.0 to 2.19.0 by @dependabot[bot] in #584
build(deps): bump google.golang.org/api from 0.275.0 to 0.276.0 by @dependabot[bot] in #585
build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.28.0 to 2.29.0 in the grpc group across 1 directory by @dependabot[bot] in #583
build(deps): bump chainguard-dev/actions from 1.6.14 to 1.6.15 by @dependabot[bot] in #581
build(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 by @dependabot[bot] in #582
build(deps): bump google.golang.org/api from 0.276.0 to 0.277.0 by @dependabot[bot] in #591
build(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @dependabot[bot] in #590
build(deps): bump step-security/harden-runner from 2.19.0 to 2.19.1 by @dependabot[bot] in #589
build(deps): bump chainguard-dev/actions from 1.6.15 to 1.6.19 by @dependabot[bot] in #588
build(deps): bump step-security/action-tflint from 1.24.2 to 1.25.0 by @dependabot[bot] in #587
build(deps): bump google.golang.org/api from 0.277.0 to 0.278.0 by @dependabot[bot] in #594
build(deps): bump step-security/woke-action-reviewdog from 0.1.1 to 0.1.2 by @dependabot[bot] in #593
build(deps): bump google.golang.org/api from 0.278.0 to 0.279.0 by @dependabot[bot] in #597
build(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in #598
build(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 by @dependabot[bot] in #596
build(deps): bump step-security/harden-runner from 2.19.1 to 2.19.3 by @dependabot[bot] in #595
build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @dependabot[bot] in #600
build(deps): bump step-security/harden-runner from 2.19.3 to 2.19.4 by @dependabot[bot] in #599
build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #603
feat(options): dial unix domain socket targets by @iainlane in #610
feat(options): add keepalive and dial-until-ready helpers by @iainlane in #611
build(deps): bump chainguard-dev/actions from 1.6.19 to 1.6.23 by @dependabot[bot] in #607
ci: always run Action lint so the required check reports by @stevebeattie in #612
feat(duplex): support graceful shutdown of the duplex server by @iainlane in #609
build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #614
fix(ci): GitHub Actions security hardening by @stevebeattie in #617
build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @dependabot[bot] in #630
build(deps): bump chainguard-dev/actions/donotsubmit from 1.6.23 to 1.6.25 by @dependabot[bot] in #627
build(deps): bump chainguard-dev/actions/trailing-space from 1.6.23 to 1.6.25 by @dependabot[bot] in #625
build(deps): bump chainguard-dev/actions/eof-newline from 1.6.23 to 1.6.25 by @dependabot[bot] in #626
build(deps): bump chainguard-dev/actions/nodiff from 1.6.23 to 1.6.25 by @dependabot[bot] in #624
build(deps): bump chainguard-dev/actions/boilerplate from 1.6.23 to 1.6.25 by @dependabot[bot] in #623
build(deps): bump chainguard-dev/actions/goimports from 1.6.23 to 1.6.25 by @dependabot[bot] in #622
build(deps): bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in #621
build(deps): bump github.com/chainguard-dev/clog from 1.8.0 to 1.8.1 by @dependabot[bot] in #620
build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #619
build(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @dependabot[bot] in #615
General housekeeping by @cpanato in #633

New Contributors

@iainlane made their first contribution in #610

Full Changelog: chainguard-dev/go-grpc-kit@v0.17.17...v0.18.0

chainguard-dev/sdk (chainguard.dev/sdk)

`v0.1.138`

Compare Source

fix(advisory): rename reports field to resolved_vulns_reports [skillup] (#47040)
feat(scim): define token lifecycle API and permissions (#46676)

`v0.1.137`

Compare Source

feat(advisory): migrate SecurityAdvisory endpoints to v2beta1 (#45820)

`v0.1.136`

Compare Source

feat(iam): add a guardener service principal (#46988)

`v0.1.135`

Compare Source

feat(chainctl): add hidden policies validate subcommand (#45586)

`v0.1.134`

Compare Source

feat(capabilities): mark all rebuilder-api capabilities internal_only

`v0.1.133`

Compare Source

feat(osv-dump)[ARG-201] Add OSV Dump and wire up staging to build the tarball manually (#45694)

`v0.1.132`

Compare Source

feat(roles): adds custom policies capabilities (#46535)

`v0.1.131`

Compare Source

feat(registry): add CreateTag, promote DeleteTag to v2beta1, remove v2alpha1 (#45208)

`v0.1.130`

Compare Source

oidc: Add backend support for custom IDPs to enable PKCE (#44767)

`v0.1.129`

Compare Source

docs(sdk): add doc.go and example tests for githubflow, uploads, uidp [skillup] (#46514)

`v0.1.128`

Compare Source

feat(rexie): the split rexie protocol packages + class capabilities (#46559)

`v0.1.127`

Compare Source

feat(guardener): on-demand actions migration API with long-running operations (#45466)

`v0.1.126`

Compare Source

fix(iam/v2beta1): add field_behavior to oidc oneof field [skillup] (#46469)

`v0.1.125`

Compare Source

fix(iter): add maxPages ceiling and fix test UIDs [skillup] (#46063)

`v0.1.124`

Compare Source

feat(libraries): cache source_type/malware, default to Chainguard-built with upstream opt-in (#45337)

`v0.1.123`

Compare Source

feat(libraries): reject inert allow entries; warn on block/allow overlap (#45684)

`v0.1.122`

Compare Source

feat(registry): add custom APK keyring proto fields (CON-1873, PR 1/6) (#43731)

`v0.1.121`

Compare Source

feat(chainctl): filter required/optional helm refs (#44641)

`v0.1.120`

Compare Source

Elastic Build: the event producer for the build index (#45935)

`v0.1.119`

Compare Source

fix(iam/v2beta1): add CloudEvents annotations and event.go for roles [skillup] (#45982)

`v0.1.118`

Compare Source

aws-marketplace: move LIST cap to viewer role (#45964)

`v0.1.117`

Compare Source

feat(rebuilder-api) add untrusted to libraries.rebuilder.admin, sa-signer, sa-publish, sa-build for updating status with minted JWT (#45858)

`v0.1.116`

Compare Source

feat(libraries): surface Athena entitlement tiers in public APIs (#45765)

`v0.1.115`

Compare Source

feat(registry): promote RepoReadme endpoints to v2beta1 (#45740)

`v0.1.114`

Compare Source

feat(guardener): add support-only entitlement service (#45525)

`v0.1.113`

Compare Source

feat(iam): add v1 ExternalGroupRoleMappings BatchDelete (#45725)

`v0.1.112`

Compare Source

feat(rexie): the deployed edge — REv2 surface over an in-process scheduler (#45292)
fix(api-impl/registry): resolve UpdateRepoReadme authz scope and honor update_mask (#45530)

`v0.1.111`

Compare Source

fix #45468: auth/aws.VerifyToken: canonicalize audience/identity header values to match SigV4 (whitespace hygiene) (#45470)

`v0.1.110`

Compare Source

feat(policies-proto): allow ValidatePolicy to accept parameter_schemas (#45492)

`v0.1.109`

Compare Source

feat(api-impl/registry): error on managed repo field changes for synced repos (#45363)

`v0.1.108`

Compare Source

feat(libraries): persist LibraryPolicy blocked_licenses end to end (#45373)

`v0.1.107`

Compare Source

fix(sdk/auth/aws): require binding headers, host, and date to be signed in VerifyToken (#45286)

`v0.1.106`

Compare Source

feat(chainctl): add guardener github status to list linked GitHub orgs (#45328)

`v0.1.105`

Compare Source

Policies/add validate policy rpc (#44846)
feat(dfc): add a server-built build report with base image changes (#45187)

`v0.1.104`

Compare Source

feat(iam): grant guardener admin capabilities to the Owner role (#45194)

`v0.1.103`

Compare Source

feat(api-impl/registry): implement v2beta1 CreateRepo (#44895)

`v0.1.102`

Compare Source

feat(api-impl/libraries): add before upper-bound filter to malware blocklist API (#44694)

`v0.1.101`

Compare Source

feat(loggie): add live build-log streaming across the buildie services

`v0.1.100`

Compare Source

fix(deps): update go-deps (#44646)

`v0.1.99`

Compare Source

feat(capabilities): add staff-only CVE remediation caps; make rebuilder admin internal

`v0.1.98`

Compare Source

feat(registry): expose chart CHANGELOG.md via GetChart (#42852)

`v0.1.97`

Compare Source

fix: add missing iam_scope annotation to UpdateAWSMarketplaceSubscriptionRequest.subscription (#44607)

`v0.1.96`

Compare Source

fix(deps): update go-deps (#43961)

`v0.1.95`

Compare Source

feat(api-impl): admin override for policies (#44387)

`v0.1.94`

Compare Source

feat(advisories): include severity information in advisory API (#42513)

`v0.1.93`

Compare Source

Policies dryrun backend (#44204)

`v0.1.92`

Compare Source

feat(cassie): split action-cache capabilities from CAS (#44174)

`v0.1.91`

Compare Source

feat(guardener): self-service GitHub org↔group linking (API + chainctl + KMS-signed state) (#43173)

`v0.1.90`

Compare Source

fix #44025: ValidateHelmRepoURL accepts file://, ftp:// and empty-host URLs (#44038)

`v0.1.89`

Compare Source

feat(datastore/iam): add BatchDelete to ExternalGroupRoleMappings (#43816)

`v0.1.88`

Compare Source

fix(iam): wire GroupsClaim through v2beta1 IdP converter (#43959)

`v0.1.87`

Compare Source

expose chart image requirement in API (#43909)

`v0.1.86`

Compare Source

feat(registry): add RemoveEntitlementImages with soft delete (#42334)
feat(api-impl/registry): implement v2alpha1 Repo README APIs (#43928)

`v0.1.85`

Compare Source

chore(registry): remove dead image Diff API remnants (#43536)

`v0.1.84`

Compare Source

aws-marketplace: add subscription reconciler (#43795)

`v0.1.83`

Compare Source

Updates go.opentelemetry.io/otel from 1.43 to 1.44 (#43876)
fix(deps): update chainguard (#43806)

`v0.1.82`

Compare Source

registry: rename CAP_REPO_SYNC_ADMIN to CAP_REPO_INTERNAL_ADMIN and tidy repo v2 field semantics (#43778)

`v0.1.81`

Compare Source

feat(iam): BatchCreateRoleBindings cache, AIP-233 role_uid, and event docs (#43370)

`v0.1.80`

Compare Source

Add emeritoss to bundle allowlist (#43725)

`v0.1.79`

Compare Source

feat(iam): promote Terms endpoints to v2beta1 and remove v2alpha1 (#43364)

`v0.1.78`

Compare Source

sdk: propose v2beta1 Repos CRUD, readme singleton, and admin API (#42682)

`v0.1.77`

Compare Source

registry: add v2 GetArchitectures and GetSize endpoints (#41969)

`v0.1.76`

Compare Source

feat(bots/microflow): GitHub PR reconciler that runs microflows (#42726)

`v0.1.75`

Compare Source

feat(rebuilder): grant prod-eco-python build SA malware-status access

`v0.1.74`

Compare Source

feat(argos): ArgosVulns query API — org-scoped CGP metadata (BatchGet, ListForOrg) (#41760)

`v0.1.73`

Compare Source

feat(advisories): record grype DB provenance on detection and fixed events (#43211)

`v0.1.72`

Compare Source

feat(libraries): migrate Artifacts service to v2beta1 (#42526)

`v0.1.71`

Compare Source

feat(iam): migrate ExternalGroupRoleMapping to v2beta1 (#43160)

`v0.1.70`

Compare Source

registry: emit subdomain on pull/push events for skills attribution (#43168)

`v0.1.69`

Compare Source

graphql: add update for AWS subscriptions (#43165)

`v0.1.68`

Compare Source

policies: audit events on policy mutations (#43083)

`v0.1.67`

Compare Source

feat(iam): enrich group-mapping audit events (IdP + capabilities) (#43035)

`v0.1.66`

Compare Source

api: add Update RPC for aws marketplace subscriptions (#43141)

`v0.1.65`

Compare Source

fix(chainctl,sdk/sts): bound, retry, and fail-fast the refresh-token exchange instead of hanging or going interactive (CUS-839) (#42233)

`v0.1.64`

Compare Source

feat(AddChart): allow users to specify a tag (#42952)
sdk: rename AWS marketplace subscription caps and add to owner (#43008)

`v0.1.63`

Compare Source

feat(iam): migrate DFC agent to v2alpha1 Terms endpoints (#42386)

`v0.1.62`

Compare Source

graphql: add AWSMarketplaceSubscriptions and AWS_MARKETPLACE OrgKind (#42767)
feat(iam): add BatchCreateRoleBindings RPC to v2beta1 RoleBindingsService (#40816)

`v0.1.61`

Compare Source

feat(iam/proto): add SCIM sub-config to IdentityProvider (CUS-422) (#42132)

`v0.1.60`

Compare Source

add chart endpoint and charts service (#41082)

`v0.1.59`

Compare Source

Add custom APK repositories field to CustomOverlay (#41940)

`v0.1.58`

Compare Source

Full Changelog: chainguard-dev/sdk@v0.1.57...v0.1.58

`v0.1.57`

Compare Source

What's Changed

fix(sts): repoint mono-readonly trust policy to open-source-publish by @jml in #157

Full Changelog: chainguard-dev/sdk@v0.1.56...v0.1.57

googleapis/google-cloud-go (cloud.google.com/go/auth)

`v0.22.0`

Compare Source

bigtable:
- cbt: Support cells per column limit for row read.
- bttest: Correctly handle empty RowSet.
- Fix ReadModifyWrite operation in emulator.
- Fix API path in GetCluster.
bigquery:
- BEHAVIOR CHANGE: Retry on 503 status code.
- Add dataset.DeleteWithContents.
- Add SchemaUpdateOptions for query jobs.
- Add Timeline to QueryStatistics.
- Add more stats to ExplainQueryStage.
- Support Parquet data format.
datastore:
- Support omitempty for times.
dlp:
- BREAKING CHANGE: Remove v1beta1 client. Please migrate to the v2 client,
  which is now out of beta.
- Add v2 client.
firestore:
- BEHAVIOR CHANGE: Treat set({}, MergeAll) as valid.
iam:
- Support JWT signing via SignJwt callopt.
profiler:
- BEHAVIOR CHANGE: PollForSerialOutput returns an error when context.Done.
- BEHAVIOR CHANGE: Increase the initial backoff to 1 minute.
- Avoid returning empty serial port output.
pubsub:
- BEHAVIOR CHANGE: Don't backoff during next retryable error once stream is healthy.
- BEHAVIOR CHANGE: Don't backoff on EOF.
- pstest: Support Acknowledge and ModifyAckDeadline RPCs.
redis:
- Add v1 beta Redis client.
spanner:
- Support SessionLabels.
speech:
- Add api v1 beta1 client.
storage:
- BEHAVIOR CHANGE: Retry reads when retryable error occurs.
- Fix delete of object in requester-pays bucket.
- Support KMS integration.

`v0.21.0`

Compare Source

bigquery:
- Add OpenCensus tracing.
firestore:
- BREAKING CHANGE: If a document does not exist, return a DocumentSnapshot
  whose Exists method returns false. DocumentRef.Get and Transaction.Get
  return the non-nil DocumentSnapshot in addition to a NotFound error.
  DocumentRef.GetAll and Transaction.GetAll return a non-nil
  DocumentSnapshot instead of nil.
- Add DocumentIterator.Stop. Call Stop whenever you are done with a
  DocumentIterator.
- Added Query.Snapshots and DocumentRef.Snapshots, which provide realtime
  notification of updates. See https://cloud.google.com/firestore/docs/query-data/listen.
- Canceling an RPC now always returns a grpc.Status with codes.Canceled.
spanner:
- Add CommitTimestamp, which supports inserting the commit timestamp of a
  transaction into a column.

Masterminds/semver (github.com/Masterminds/semver/v3)

`v3.5.0`

Compare Source

What's Changed

Adding more prerelease tests by @mattfarina in #273
Update constraint error messages by @mattfarina in #278
Fix edge cases by @mattfarina in #279
Adding some checks in by @mattfarina in #280
Updating deps by @mattfarina in #281
Bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in #282
Bump actions/cache from 4.2.3 to 5.0.5 by @dependabot[bot] in #283
Bump golangci/golangci-lint-action from 7.0.1 to 9.2.0 by @dependabot[bot] in #284
Updating gitignore for devcontainers by @mattfarina in #286
Fixing some quality issues by @mattfarina in #287

New Contributors

@dependabot[bot] made their first contribution in #282

Full Changelog: Masterminds/semver@v3.4.0...v3.5.0

`v3.4.0`

Compare Source

There are a few changes in this release to highlight:

Constraints now has a property IncludePrerelease. When set to true the Check and Validate methods will include prereleases.
When an AND group has one constraint with a prerelease but more than one constraint then prereleases will be included. For example, >1.0.0-beta.1 < 2. In the past this would not have included prereleases because each constraint needed to have a prerelease. Now, only one constraint needs to have a prerelease. This is considered a long standing bug fix. Note, this does not carry across OR groups. For example, >1.0.0-beta.1 < 2 || > 3. In this case, prereleases will not be included when evaluating against >3.
NewVersion coercion with leading "0"'s is restored. This can be disabled by setting the package level property CoerceNewVersion to false.

What's Changed

fix the CodeQL link by @dmitris in #257
Restore detailed errors when failed to parse with NewVersion by @mattfarina in #262
updating go version tested with by @mattfarina in #263
Restore the ability to have leading 0's with NewVersion by @mattfarina in #266
Handle pre-releases on all in an and group by @mattfarina in #267
Add property to include prereleases by @mattfarina in #268
Updating the error message handling by @mattfarina in #269
Update the release notes and readme for new version by @mattfarina in #270

New Contributors

@dmitris made their first contribution in #257

Full Changelog: Masterminds/semver@v3.3.1...v3.4.0

aws/smithy-go (github.com/aws/smithy-go)

`v1.27.4`

Compare Source

cenkalti/backoff (github.com/cenkalti/backoff/v4)

`v7.0.0`

Compare Source

`v6.0.1`

Compare Source

`v6.0.0`

Compare Source

`v5.0.3`

Compare Source

`v5.0.2`

Compare Source

`v5.0.1`

Compare Source

`v5.0.0`

Compare Source

chainguard-dev/clog (github.com/chainguard-dev/clog)

`v1.8.1`

Compare Source

What's Changed

Bump step-security/harden-runner from 2.13.3 to 2.15.1 by @dependabot[bot] in #60
chore(workflows): add actionlint and zizmor action linters [SECINT-75] by @stevebeattie in #61
Bump step-security/harden-runner from 2.15.1 to 2.18.0 by @dependabot[bot] in #65
Bump step-security/harden-runner from 2.18.0 to 2.19.0 by @dependabot[bot] in #67
fix(ci): add persist-credentials: false and zizmor pedantic config by @stevebeattie in #69
fix: convert WARN string for cloud batch by @crosleyzack in #76

New Contributors

@stevebeattie made their first contribution in #61
@crosleyzack made their first contribution in #76

Full Changelog: chainguard-dev/clog@v1.8.0...v1.8.1

go-jose/go-jose (github.com/go-jose/go-jose/v3)

`v4.1.4`

Compare Source

What's Changed

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

red-hat-konflux · 2026-07-17T21:23:55Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go mod tidy
go: downloading github.com/tink-crypto/tink-go-awskms/v3 v3.0.0
go: downloading go.uber.org/goleak v1.3.0
go: downloading github.com/go-rod/rod v0.116.2
go: downloading gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
go: downloading github.com/klauspost/compress v1.18.6
go: downloading go.yaml.in/yaml/v2 v2.4.4
go: downloading github.com/frankban/quicktest v1.14.6
go: downloading go.opentelemetry.io/otel/sdk/metric v1.44.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0
go: downloading github.com/go-test/deep v1.1.1
go: downloading github.com/hashicorp/go-hclog v1.6.3
go: downloading github.com/ysmood/goob v0.4.0
go: downloading github.com/ysmood/got v0.40.0
go: downloading github.com/ysmood/gson v0.7.3
go: downloading github.com/ysmood/fetchup v0.2.3
go: downloading github.com/ysmood/leakless v0.9.0
go: downloading github.com/kr/pretty v0.3.1
go: downloading github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1
go: downloading github.com/c2sp/wycheproof v0.0.0-20260105152342-fca0d3ba9f12
go: downloading github.com/fatih/color v1.18.0
go: downloading github.com/mattn/go-colorable v0.1.14
go: downloading github.com/mattn/go-isatty v0.0.20
go: downloading github.com/jmhodges/clock v1.2.0
go: downloading github.com/kr/text v0.2.0
go: downloading github.com/rogpeppe/go-internal v1.14.1
go: downloading gonum.org/v1/gonum v0.17.0
go: downloading github.com/envoyproxy/go-control-plane/envoy v1.37.0
go: downloading github.com/keybase/go-keychain v0.0.1
go: downloading github.com/envoyproxy/go-control-plane v0.14.0
go: downloading github.com/envoyproxy/protoc-gen-validate v1.3.3
go: downloading github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2
go: downloading github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10
go: finding module for package github.com/grpc-ecosystem/go-grpc-middleware/v2/recovery
go: finding module for package github.com/grpc-ecosystem/go-grpc-middleware/v2/logging/zap
go: finding module for package github.com/grpc-ecosystem/go-grpc-middleware/v2/retry
go: finding module for package github.com/grpc-ecosystem/go-grpc-middleware/v2/logging/zap/ctxzap
go: github.com/sigstore/fulcio/cmd/app imports
	github.com/grpc-ecosystem/go-grpc-middleware/v2/logging/zap: module github.com/grpc-ecosystem/go-grpc-middleware/v2@latest found (v2.3.3), but does not contain package github.com/grpc-ecosystem/go-grpc-middleware/v2/logging/zap
go: github.com/sigstore/fulcio/cmd/app imports
	github.com/grpc-ecosystem/go-grpc-middleware/v2/recovery: module github.com/grpc-ecosystem/go-grpc-middleware/v2@latest found (v2.3.3), but does not contain package github.com/grpc-ecosystem/go-grpc-middleware/v2/recovery
go: github.com/sigstore/fulcio/cmd/app imports
	github.com/grpc-ecosystem/go-grpc-middleware/v2/retry: module github.com/grpc-ecosystem/go-grpc-middleware/v2@latest found (v2.3.3), but does not contain package github.com/grpc-ecosystem/go-grpc-middleware/v2/retry
go: github.com/sigstore/fulcio/pkg/log imports
	github.com/grpc-ecosystem/go-grpc-middleware/v2/logging/zap/ctxzap: module github.com/grpc-ecosystem/go-grpc-middleware/v2@latest found (v2.3.3), but does not contain package github.com/grpc-ecosystem/go-grpc-middleware/v2/logging/zap/ctxzap

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot added the dependencies label Jul 17, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.3/go-deps branch 7 times, most recently from 3dc6b48 to c398b26 Compare July 19, 2026 05:32

red-hat-konflux Bot changed the title ~~chore(deps): update go dependencies~~ Update Go Dependencies Jul 19, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.3/go-deps branch from c398b26 to 80823b3 Compare July 19, 2026 09:39

red-hat-konflux Bot changed the title ~~Update Go Dependencies~~ chore(deps): update go dependencies Jul 19, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.3/go-deps branch 6 times, most recently from 5c9739f to 924a700 Compare July 20, 2026 19:44

red-hat-konflux Bot changed the title ~~chore(deps): update go dependencies~~ Update Go Dependencies Jul 20, 2026

chore(deps): update go dependencies

fbf8e99

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.3/go-deps branch from 924a700 to fbf8e99 Compare July 21, 2026 01:37

red-hat-konflux Bot changed the title ~~Update Go Dependencies~~ chore(deps): update go dependencies Jul 21, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update go dependencies#419

chore(deps): update go dependencies#419
red-hat-konflux[bot] wants to merge 1 commit into
release-1.3from
konflux/mintmaker/release-1.3/go-deps

red-hat-konflux Bot commented Jul 17, 2026 •

edited

Loading

Uh oh!

red-hat-konflux Bot commented Jul 17, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

red-hat-konflux Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Configuration

Documentation

Uh oh!

red-hat-konflux Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: go.sum

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

red-hat-konflux Bot commented Jul 17, 2026 •

edited

Loading

red-hat-konflux Bot commented Jul 17, 2026 •

edited

Loading