Bump github.com/sigstore/fulcio from 1.8.5 to 1.8.6

[dependabot]

Bumps github.com/sigstore/fulcio from 1.8.5 to 1.8.6.

Release notes

Sourced from github.com/sigstore/fulcio's releases.

v1.8.6

Changelog

• 378c654f48c3bafdced04ead7010aab2cb4c6ca1 Block cross-host redirects and restrict bearer token to expected host (#2354)
• 39b48e6a8f2efe1809a1b19b4301666c3fd36667 Include raw subject in certificates (#2307)
• 80eaed06e911cdfd26dd18f02b8e862f7f6ee453 Update Azure AKS OIDC issuer URL regex (#2266)
• 001376a50932095cf4b6e65299ed2d29abe83524 add support for new circleci root issuer (#2278)

Thanks for all contributors!

Changelog

Sourced from github.com/sigstore/fulcio's changelog.

v1.8.6

Features

• Include raw subject in certificates (#2307)

Commits

• 378c654 Block cross-host redirects and restrict bearer token to expected host (#2354)
• 7a5d3e3 bump builder image to use go1.26.3 (#2353)
• a05982e build(deps): bump go.step.sm/crypto from 0.75.0 to 0.81.0 (#2348)
• dfa63a8 build(deps): bump golang from 313faae to 2d6c802 (#2344)
• 7b3a344 build(deps): bump google.golang.org/api from 0.279.0 to 0.280.0 (#2349)
• 9290f7f build(deps): bump the all group with 2 updates (#2350)
• 423d535 build(deps): bump nginx from 1.31.0 to 1.31.1 in the all group (#2352)
• 19a3f8e build(deps): bump the all group across 1 directory with 6 updates (#2337)
• 6b597ce build(deps): bump google.golang.org/api from 0.276.0 to 0.279.0 (#2338)
• 0d1dc79 build(deps): bump nginx from 1.29.8 to 1.31.0 in the all group (#2342)
• Additional commits viewable in compare view

Summary by CodeRabbit

• Chores
  • Updated supporting libraries, container tooling, file monitoring, and signing components to newer versions.
  • Added an indirect dependency required by the updated signing components.

[openshift-ci]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Walkthrough

This PR updates indirect Go module dependencies in go.mod, including container tooling, filesystem notifications, container registries, and sigstore packages. It also adds github.com/morikuni/aec.

Changes

Dependency version updates

Layer / File(s)	Summary
Indirect module requirement updates go.mod	Updates estargz, go-connections, fsnotify, go-containerregistry, fulcio, and sigstore; adds indirect morikuni/aec.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: savitharaghunathan

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only go.mod and go.sum changed; no test files or Ginkgo titles were added or modified.
Test Structure And Quality	✅ Passed	PASS: The PR only updates go.mod/go.sum dependency versions; no Ginkgo test files or test code were changed, so the test-quality review is not applicable.
Microshift Test Compatibility	✅ Passed	Only go.mod and go.sum changed; no Ginkgo specs or test code were added, so MicroShift compatibility is unaffected.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only go.mod and go.sum changed; no Ginkgo/e2e test files or test logic were added, so there’s no SNO compatibility concern.
Topology-Aware Scheduling Compatibility	✅ Passed	Only go.mod/go.sum dependency bumps changed; no deployment manifests, controllers, or scheduling code were modified.
Ote Binary Stdout Contract	✅ Passed	PR only updates go.mod/go.sum; no main/init/TestMain/suite setup stdout writes were added or changed.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only go.mod/go.sum changed; no new Ginkgo e2e tests or networking code were added, so the IPv6/disconnected check is not applicable.
No-Weak-Crypto	✅ Passed	PR only updates go.mod/go.sum; no weak-crypto algorithms, custom crypto, or secret-comparison code were added.
Container-Privileges	✅ Passed	PR only changes go.mod and go.sum; no container/K8s manifests or privilege settings are touched.
No-Sensitive-Data-In-Logs	✅ Passed	Only go.mod/go.sum dependency bumps are changed; no logging code or new strings that could expose secrets were added.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects one of the main dependency bumps in the PR and is specific and clear.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/go_modules/github.com/sigstore/fulcio-1.8.6

---

_{Comment @coderabbitai help to get the list of available commands.}

[kaovilai]

unfortunately this contain go bump from fulcio from googleapis/enterprise-certificate-proxy#195

if not urgent i would wait for new fulcio.

but low risk as this is not lib repo in general.. we ship built binary.

[openshift-ci]

rebase

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign sseago for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign sseago for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment