Update module github.com/sigstore/sigstore-go to v1.2.1 by renovate-rancher[bot] · Pull Request #466 · neuvector/scanner

renovate-rancher · 2026-06-13T07:53:24Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/sigstore/sigstore-go	`v1.1.4` → `v1.2.1`

Release Notes

sigstore/sigstore-go (github.com/sigstore/sigstore-go)

`v1.2.1`

Compare Source

What's Changed

v1.2.1 resolves GHSA-wqqc-jjcq-vfxm.

Check signature time against public key validity window in #642

Full Changelog: sigstore/sigstore-go@v1.2.0...v1.2.1

`v1.2.0`

Compare Source

What's Changed

Add preferred method for verifying log entry proofs by @Hayden-IO in #557
docs(verify): annotate identity matchers and regexp semantics by @1seal in #558
Bump actions/setup-go from 6.1.0 to 6.2.0 by @dependabot[bot] in #563
Bump the minor-patch group across 1 directory with 7 updates by @dependabot[bot] in #565
ensure we have verification material before attempting to extract public key by @bobcallaway in #566
fix(tlog): fail closed for rekor v2 parsing by @1seal in #562
Bump sigstore-conformance to latest by @cmurphy in #559
Bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in #573
Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 in /examples/oci-image-verification by @dependabot[bot] in #576
Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 in /examples/oci-image-verification by @dependabot[bot] in #571
Bump production and staging TUF roots by @Hayden-IO in #580
Support DSSE signing conformance test by @aaronlew02 in #582
Fix nil pointer dereference in LiveTrustedRoot refresh by @Hayden-IO in #584
Bump sigstore/sigstore-conformance from 0.0.25 to 0.0.26 by @dependabot[bot] in #585
chore: remove large test dependencies by replacing ctfe usage by @Hayden-IO in #587
Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 by @dependabot[bot] in #575
Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 by @dependabot[bot] in #569
Bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.4.1 by @dependabot[bot] in #578
Set minimum threshold for WithIntegratedTimestamps by @Hayden-IO in #590
Bump all recent deps by @Hayden-IO in #586
Bump the minor-patch group across 1 directory with 2 updates by @dependabot[bot] in #591
Bump github.com/docker/cli from 29.0.3+incompatible to 29.2.0+incompatible in /examples/oci-image-verification by @dependabot[bot] in #595
deps: update go-openapi/strfmt to v0.26.1 by @tonistiigi in #603
verify message digest matches artifact hash by @piceri in #600
Run go fix across codebase by @Hayden-IO in #610
Harden verification, HTTP clients, and TUF by @Hayden-IO in #609
Verify log entry digest matches artifact/envelope by @Hayden-IO in #611
Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #608
Bump actions/setup-go from 6.2.0 to 6.4.0 by @dependabot[bot] in #606
Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 in /examples/oci-image-verification by @dependabot[bot] in #614
Bump google.golang.org/grpc from 1.78.0 to 1.79.3 by @dependabot[bot] in #601
Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 by @dependabot[bot] in #613
Bump go-tuf, rekor-tiles versions by @Hayden-IO in #616
Bump sigstore/sigstore-conformance from 0.0.26 to 0.0.27 by @dependabot[bot] in #621
Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 in /examples/oci-image-verification by @dependabot[bot] in #623
Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 by @dependabot[bot] in #624
bundle: cap raw TlogEntries length before per-entry parse by @tonghuaroot in #630
Prevent multi-log threshold bypasses via single compromised log by @Hayden-IO in #633
Verify Rekor v2 inclusion using reconstructed leaf hash by @codysoyland in #635
Encode Rekor v2 DSSE envelopes as hashedrekord by @codysoyland in #627
Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @dependabot[bot] in #631
Bump the minor-patch group across 2 directories with 10 updates by @dependabot[bot] in #637
Fix conformance test failures for managed-key verification by @codysoyland in #638

New Contributors

@1seal made their first contribution in #558
@aaronlew02 made their first contribution in #582
@tonistiigi made their first contribution in #603
@piceri made their first contribution in #600
@tonghuaroot made their first contribution in #630

Full Changelog: sigstore/sigstore-go@v1.1.4...v1.2.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

renovate-rancher · 2026-06-13T07:53:26Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

40 additional dependencies were updated

Details:

Package	Change
`github.com/sigstore/rekor`	`v1.5.1` -> `v1.5.2`
`github.com/sigstore/sigstore`	`v1.10.6` -> `v1.10.8`
`github.com/go-chi/chi/v5`	`v5.2.5` -> `v5.3.0`
`github.com/go-openapi/analysis`	`v0.24.3` -> `v0.25.2`
`github.com/go-openapi/jsonpointer`	`v0.22.5` -> `v0.23.1`
`github.com/go-openapi/jsonreference`	`v0.21.5` -> `v0.21.6`
`github.com/go-openapi/runtime`	`v0.29.3` -> `v0.32.3`
`github.com/go-openapi/spec`	`v0.22.4` -> `v0.22.5`
`github.com/go-openapi/strfmt`	`v0.26.1` -> `v0.26.3`
`github.com/go-openapi/swag`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/cmdutils`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/conv`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/fileutils`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/jsonname`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/jsonutils`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/loading`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/mangling`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/netutils`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/stringutils`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/typeutils`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/swag/yamlutils`	`v0.25.5` -> `v0.26.0`
`github.com/go-openapi/validate`	`v0.25.2` -> `v0.25.3`
`github.com/grpc-ecosystem/grpc-gateway/v2`	`v2.27.7` -> `v2.29.0`
`github.com/in-toto/attestation`	`v1.1.2` -> `v1.2.0`
`github.com/letsencrypt/boulder`	`v0.20260223.0` -> `v0.20260309.0`
`github.com/secure-systems-lab/go-securesystemslib`	`v0.10.0` -> `v0.11.0`
`github.com/sigstore/protobuf-specs`	`v0.5.0` -> `v0.5.1`
`github.com/sigstore/rekor-tiles/v2`	`v2.2.1` -> `v2.2.2-0.20260601073857-5d098a2b6443`
`github.com/sigstore/timestamp-authority/v2`	`v2.0.6` -> `v2.1.2`
`github.com/theupdateframework/go-tuf/v2`	`v2.4.1` -> `v2.4.2-0.20260407074541-7e8f69f906ef`
`github.com/transparency-dev/formats`	`v0.0.0-20251017110053-404c0d5b696c` -> `v0.1.1`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.65.0` -> `v0.67.0`
`go.opentelemetry.io/otel`	`v1.43.0` -> `v1.44.0`
`go.opentelemetry.io/otel/metric`	`v1.43.0` -> `v1.44.0`
`go.opentelemetry.io/otel/trace`	`v1.43.0` -> `v1.44.0`
`go.uber.org/zap`	`v1.27.1` -> `v1.28.0`
`go.yaml.in/yaml/v2`	`v2.4.3` -> `v2.4.4`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260316180232-0b37fe3546d5` -> `v0.0.0-20260526163538-3dc84a4a5aaa`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260316180232-0b37fe3546d5` -> `v0.0.0-20260523011958-0a33c5d7ca68`
`k8s.io/klog/v2`	`v2.130.1` -> `v2.140.0`

renovate-rancher Bot requested a review from a team as a code owner June 13, 2026 07:53

renovate-rancher Bot added the dependencies label Jun 13, 2026

renovate-rancher Bot requested a review from williamlin-suse June 13, 2026 07:53

renovate-rancher Bot force-pushed the renovate/github.com-sigstore-sigstore-go-1.x branch 5 times, most recently from 308b4b8 to 3b64aa0 Compare June 17, 2026 06:25

renovate-rancher Bot changed the title ~~Update module github.com/sigstore/sigstore-go to v1.2.0~~ Update module github.com/sigstore/sigstore-go to v1.2.1 Jun 17, 2026

renovate-rancher Bot force-pushed the renovate/github.com-sigstore-sigstore-go-1.x branch 2 times, most recently from 90437fd to fcb0f99 Compare June 19, 2026 06:23

Update module github.com/sigstore/sigstore-go to v1.2.1

891bc9e

renovate-rancher Bot force-pushed the renovate/github.com-sigstore-sigstore-go-1.x branch from fcb0f99 to 891bc9e Compare June 20, 2026 06:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update module github.com/sigstore/sigstore-go to v1.2.1#466

Update module github.com/sigstore/sigstore-go to v1.2.1#466
renovate-rancher[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-sigstore-sigstore-go-1.x

renovate-rancher Bot commented Jun 13, 2026 •

edited

Loading

Uh oh!

renovate-rancher Bot commented Jun 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate-rancher Bot commented Jun 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.2.1

What's Changed

v1.2.0

What's Changed

New Contributors

Configuration

Uh oh!

renovate-rancher Bot commented Jun 13, 2026

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate-rancher Bot commented Jun 13, 2026 •

edited

Loading

`v1.2.1`

`v1.2.0`