Skip to content

Bump the all group across 1 directory with 5 updates#126

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/all-7c48243c03
Open

Bump the all group across 1 directory with 5 updates#126
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/all-7c48243c03

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 7, 2026 •
edited
Loading

Bumps the all group with 4 updates in the / directory: github.com/google/go-containerregistry, github.com/maxbrunsfeld/counterfeiter/v6, github.com/openvex/go-vex and github.com/sigstore/cosign/v2.

Updates github.com/google/go-containerregistry from 0.21.0 to 0.21.5

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.21.5

What's Changed

Full Changelog: google/go-containerregistry@v0.21.4...v0.21.5

v0.21.4

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.21.3...v0.21.4

v0.21.3

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.21.2...v0.21.3

v0.21.2

What's Changed

... (truncated)

Commits
  • 5b80281 build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in the go-deps gro...
  • b99bca2 build(deps): bump aws-actions/configure-aws-credentials (#2257)
  • f8be1d4 update to Go 1.26.2 (#2255)
  • 87ad88b Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0 (#2254)
  • e8813dd goreleaser: Update goreleaser config and GH action for releases (#2253)
  • e90447d replace gcloud in binary calls in pkg/v1/google tests (#2085)
  • 0d0368c revert path traversal and symlink escape changes (#2250)
  • a2f47d4 transport: validate Bearer realm URL to prevent SSRF (#2243)
  • 19a36cd fork distribution client v3 auth-challenge as an internal package (squashed) ...
  • c612a9b Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group (#2240)
  • Additional commits viewable in compare view

Updates github.com/maxbrunsfeld/counterfeiter/v6 from 6.12.1 to 6.12.2

Release notes

Sourced from github.com/maxbrunsfeld/counterfeiter/v6's releases.

v6.12.2

What's Changed

Full Changelog: maxbrunsfeld/counterfeiter@v6.12.1...v6.12.2

Commits
  • 4fbda3b Merge pull request #358 from maxbrunsfeld/dependabot/go_modules/golang.org/x/...
  • 49c41c0 Bump golang.org/x/tools from 0.42.0 to 0.43.0
  • 266628f Merge pull request #357 from maxbrunsfeld/dependabot/go_modules/golang.org/x/...
  • e19e05e Bump golang.org/x/text from 0.34.0 to 0.35.0
  • 46bc143 Merge pull request #355 from maxbrunsfeld/dependabot/go_modules/golang.org/x/...
  • 2fa471e Bump golang.org/x/tools from 0.41.0 to 0.42.0
  • 0f165c0 Merge pull request #356 from maxbrunsfeld/dependabot/go_modules/golang.org/x/...
  • 807573e Bump golang.org/x/text from 0.33.0 to 0.34.0
  • 7c40434 Merge pull request #354 from maxbrunsfeld/dependabot/go_modules/github.com/on...
  • 92c75ca Bump github.com/onsi/gomega from 1.39.0 to 1.39.1
  • Additional commits viewable in compare view

Updates github.com/openvex/go-vex from 0.2.7 to 0.2.8

Release notes

Sourced from github.com/openvex/go-vex's releases.

v0.2.8

No release notes provided.

Commits
  • a340b5d Merge pull request #201 from openvex/dependabot/go_modules/all-218c634111
  • 214cbfc Bump github.com/package-url/packageurl-go
  • 6fb153b Merge pull request #200 from puerco/intoto-attestation
  • acc5892 Wrap tests to satisfy branch protection
  • 973475b Update boilerplates
  • 077b3f7 Add matrix testing
  • 76f3595 Fix linter nits. bump to golangcilint 2.11
  • ced2cc0 Add marshaling tests for predicate and statement
  • 84208d5 go mod tidy
  • 40b92ff Update predicate for new intoto and predicate
  • Additional commits viewable in compare view

Updates github.com/package-url/packageurl-go from 0.1.3 to 0.1.5

Release notes

Sourced from github.com/package-url/packageurl-go's releases.

v0.1.5

What's Changed

New Contributors

Full Changelog: package-url/packageurl-go@v0.1.4...v0.1.5

v0.1.4

What's Changed

New Contributors

Full Changelog: package-url/packageurl-go@v0.1.3...v0.1.4

Commits
  • 53d197f TestRoundtrip: complements parsing/toString tests in purl-spec
  • b33c146 parsing should support slashes in version names
  • 2c7e350 Merge pull request #90 from Talgarr/master
  • ccaaf70 Remove version requirement for TypeSwift
  • 384a9f2 update purl-spec tests
  • 8382d52 update submodule
  • 41187c2 add vscode-extension purl
  • 8cc1ea4 update purl-spec submodule
  • 77b148e add support for pkg:otp
  • c721992 add go.sum (good practice)
  • Additional commits viewable in compare view

Updates github.com/sigstore/cosign/v2 from 2.6.2 to 2.6.3

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.6.3

Changelog

v2.6.3 resolves GHSA-w6c6-c85g-mmv6.

  • fecddd3c22045a39f52392e71e79f66854b41352 Fix DSSE predicate check (#4802)
  • 564c5b1b0bed7bd991910774c47df1150ffb8aa8 Backport bundle detection to sign and attest (#4727)

Thanks to all contributors!

Changelog

Sourced from github.com/sigstore/cosign/v2's changelog.

v3.0.5

Deprecations

  • Deprecate rekor-entry-type flag (#4691)
  • Deprecate cosign triangulate (#4676)
  • Deprecate cosign copy (#4681)

Features

  • Automatically require signed timestamp with Rekor v2 entries (#4666)
  • Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)
  • Add mTLS support for TSA client connections when signing with a signing config (#4620)
  • Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)

Bug Fixes

  • Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
  • fix: avoid panic on malformed attestation payload (#4651)
  • fix: avoid panic on malformed tlog entries (#4649)
  • fix: avoid panic on malformed replace payload (#4653)
  • Gracefully fail if bundle payload body is not a string (#4648)
  • Verify validity of chain rather than just certificate (#4663)
  • fix: avoid panic on malformed tlog entry body (#4652)

Documentation

  • docs(cosign): clarify RFC3161 revocation semantics (#4642)
  • Fix typo in CLI help (#4701)

v3.0.4

v3.0.4 resolves GHSA-whqx-f9j3-ch6m.

Changes

  • Fix bundle verify path for old bundle/trusted root (GHSA-whqx-f9j3-ch6m) (#4623)
  • Optimize cosign tree performance by caching digest resolution (#4612)
  • Don't require a trusted root to verify offline with a key (#4613)
  • Support default services for trusted-root and signing-config creation (#4592)
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Apr 7, 2026
@dependabot
Bump the all group across 1 directory with 5 updates
a357072 
Bumps the all group with 4 updates in the / directory: [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry), [github.com/maxbrunsfeld/counterfeiter/v6](https://github.com/maxbrunsfeld/counterfeiter), [github.com/openvex/go-vex](https://github.com/openvex/go-vex) and [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign).


Updates `github.com/google/go-containerregistry` from 0.21.0 to 0.21.5
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](google/go-containerregistry@v0.21.0...v0.21.5)

Updates `github.com/maxbrunsfeld/counterfeiter/v6` from 6.12.1 to 6.12.2
- [Release notes](https://github.com/maxbrunsfeld/counterfeiter/releases)
- [Commits](maxbrunsfeld/counterfeiter@v6.12.1...v6.12.2)

Updates `github.com/openvex/go-vex` from 0.2.7 to 0.2.8
- [Release notes](https://github.com/openvex/go-vex/releases)
- [Commits](openvex/go-vex@v0.2.7...v0.2.8)

Updates `github.com/package-url/packageurl-go` from 0.1.3 to 0.1.5
- [Release notes](https://github.com/package-url/packageurl-go/releases)
- [Commits](package-url/packageurl-go@v0.1.3...v0.1.5)

Updates `github.com/sigstore/cosign/v2` from 2.6.2 to 2.6.3
- [Release notes](https://github.com/sigstore/cosign/releases)
- [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md)
- [Commits](sigstore/cosign@v2.6.2...v2.6.3)

---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.21.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/maxbrunsfeld/counterfeiter/v6
  dependency-version: 6.12.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/openvex/go-vex
  dependency-version: 0.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/package-url/packageurl-go
  dependency-version: 0.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/sigstore/cosign/v2
  dependency-version: 2.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/go_modules/all-7c48243c03 branch from a400a0e to a357072 Compare May 8, 2026 10:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants