Skip to content

chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.3.1#12515

Merged
babakks merged 2 commits intotrunkfrom
dependabot/go_modules/github.com/theupdateframework/go-tuf/v2-2.3.1
Jan 22, 2026
Merged

chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.3.1#12515
babakks merged 2 commits intotrunkfrom
dependabot/go_modules/github.com/theupdateframework/go-tuf/v2-2.3.1

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 21, 2026

Bumps github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.3.1.

Release notes

Sourced from github.com/theupdateframework/go-tuf/v2's releases.

v2.3.1

What's Changed

Full Changelog: theupdateframework/go-tuf@v2.3.0...v2.3.1

Commits
  • b38d91f Verify threshold is valid (#712)
  • 876cf2a Add tests for failing type assertions (#711)
  • 73345ab Perform type assertion (#710)
  • d3cdc4b chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.9....
  • 880e8da chore(deps): bump github.com/sigstore/sigstore from 1.9.5 to 1.10.3 (#706)
  • d8fbc2c modern go (1.20+) improvements (#705)
  • c180bdd chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 (#704)
  • d52793f Resolve govulncheck errors by bumping go to 1.24.11 (#707)
  • 98340af chore(deps): bump golang.org/x/crypto from 0.40.0 to 0.45.0 (#702)
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jan 21, 2026
@dependabot dependabot bot requested a review from a team as a code owner January 21, 2026 16:43
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Jan 21, 2026
@dependabot dependabot bot requested a review from babakks January 21, 2026 16:43
@dependabot dependabot bot added the go Pull requests that update Go code label Jan 21, 2026
@dependabot dependabot bot temporarily deployed to cli-automation January 21, 2026 16:43 Inactive
Bumps [github.com/theupdateframework/go-tuf/v2](https://github.com/theupdateframework/go-tuf) from 2.3.0 to 2.3.1.
- [Release notes](https://github.com/theupdateframework/go-tuf/releases)
- [Commits](theupdateframework/go-tuf@v2.3.0...v2.3.1)

---
updated-dependencies:
- dependency-name: github.com/theupdateframework/go-tuf/v2
  dependency-version: 2.3.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/theupdateframework/go-tuf/v2-2.3.1 branch from a654976 to d4a4bc4 Compare January 22, 2026 20:59
Copy link
Member

@babakks babakks left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! I'll push a commit to update licenses and will then merge.

Signed-off-by: Babak K. Shandiz <babakks@github.com>
@babakks babakks enabled auto-merge January 22, 2026 21:02
@babakks babakks merged commit e643df9 into trunk Jan 22, 2026
11 checks passed
@babakks babakks deleted the dependabot/go_modules/github.com/theupdateframework/go-tuf/v2-2.3.1 branch January 22, 2026 21:10
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Feb 25, 2026
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [cli/cli](https://github.com/cli/cli) | minor | `v2.86.0` → `v2.87.3` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>cli/cli (cli/cli)</summary>

### [`v2.87.3`](https://github.com/cli/cli/releases/tag/v2.87.3): GitHub CLI 2.87.3

[Compare Source](cli/cli@v2.87.2...v2.87.3)

#### What's Changed

- Fix project mutation query variable usage by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;12757](cli/cli#12757)

**Full Changelog**: <cli/cli@v2.87.2...v2.87.3>

### [`v2.87.2`](https://github.com/cli/cli/releases/tag/v2.87.2): GitHub CLI 2.87.2

[Compare Source](cli/cli@v2.87.1...v2.87.2)

#### ℹ️ Note

This release was cut primarily to resolve a publishing issue. We recommend reviewing [the v2.87.1 release notes](https://github.com/cli/cli/releases/tag/v2.87.1) for the complete set of latest features and fixes.

#### What's Changed

- chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12659](cli/cli#12659)

**Full Changelog**: <cli/cli@v2.87.1...v2.87.2>

### [`v2.87.1`](https://github.com/cli/cli/releases/tag/v2.87.1): GitHub CLI 2.87.1

[Compare Source](cli/cli@v2.87.0...v2.87.1)

#### ⚠️ Incomplete Release

The v2.87.1 release experienced a failure in our workflow and is not fully published to the designated package managers/repositories. This is resolved in [v2.87.2](https://github.com/cli/cli/releases/tag/v2.87.2), so we recommend using that release instead.

#### What's Changed

- Remove license bundling debris by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;12716](cli/cli#12716)
- fix(agent-task/capi): use a fixed CAPI API version by [@&#8203;babakks](https://github.com/babakks) in [#&#8203;12731](cli/cli#12731)

**Full Changelog**: <cli/cli@v2.87.0...v2.87.1>

### [`v2.87.0`](https://github.com/cli/cli/releases/tag/v2.87.0): GitHub CLI 2.87.0

[Compare Source](cli/cli@v2.86.0...v2.87.0)

#### `gh workflow run` immediately returns workflow run URL

One of our most requested features - with the latest changes in GitHub API, `gh workflow run` will immediately print the created workflow run URL.

#### Improved `gh auth login` experience in VM/WSL environments

We have observed rare cases of time drift between the wall and monotonic clocks, mostly in WSL or VM environments, causing failures during polling for the OAuth token. This new release implements measures to account for such situations.

If you continue to experience `gh auth login` issues in WSL, please comment in [#&#8203;9370](cli/cli#9370)

#### :copilot: Request Copilot Code Review from `gh` + performance improvements

`gh pr edit` now supports [Copilot Code Review](https://docs.github.com/en/copilot/using-github-copilot/code-review/using-copilot-code-review) as a reviewer. You can request a review from Copilot using the `--add-reviewer @&#8203;copilot` flag or interactively by selecting reviewers in the prompts.

This release also introduces a new search experience for selecting reviewers and assignees in `gh pr edit`. Instead of loading all collaborators and teams upfront, results are now fetched based on inputs to a new search option. Initial options are suggestions based on those involved with the pull request already.

```
? Reviewers  [Use arrows to move, space to select, <right> to all, <left> to none, type to filter]
  [ ]  Search (7472 more)
  [x]  BagToad (Kynan Ware)
> [x]  Copilot (AI)
```

This experience will follow in `gh pr create` and `gh issue` for assignees in a later release.

#### What's Changed

##### ✨ Features

- Bundle licenses at release time by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;12625](cli/cli#12625)
- Add `--query` flag to `project item-list` by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;12696](cli/cli#12696)
- feat(workflow run): retrieve workflow dispatch run details by [@&#8203;babakks](https://github.com/babakks) in [#&#8203;12695](cli/cli#12695)
- Pin REST API version to 2022-11-28 by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;12680](cli/cli#12680)
- Respect `--exit-status` with `--log` and `--log-failed` in `run view` by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;12679](cli/cli#12679)
- Fork with default branch only during pr create by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;12673](cli/cli#12673)
- `gh pr edit`: Add support for Copilot as reviewer with search capability, performance and accessibility improvements by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12567](cli/cli#12567)
- `gh pr edit`: new interactive prompt for assignee selection, performance and accessibility improvements by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12526](cli/cli#12526)

##### 📚 Docs & Chores

- Clean up project item-list query addition changes by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;12714](cli/cli#12714)
- `gh release upload`: Clarify `--clobber` flag deletes assets before re-uploading by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12711](cli/cli#12711)
- Add usage examples to `gh gist edit` command by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12710](cli/cli#12710)
- Remove feedback issue template by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12708](cli/cli#12708)
- Migrate issue triage workflows to shared workflows by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12677](cli/cli#12677)
- Migrate MR triage workflows to shared workflows by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12707](cli/cli#12707)
- Add missing TODO comments for featuredetection if-statements by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12701](cli/cli#12701)
- Add manual dispatch to bump-go workflow by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12631](cli/cli#12631)
- typo: dont to don't by [@&#8203;cuiweixie](https://github.com/cuiweixie) in [#&#8203;12554](cli/cli#12554)
- Fix fmt.Errorf format argument in ParseFullReference by [@&#8203;mikelolasagasti](https://github.com/mikelolasagasti) in [#&#8203;12516](cli/cli#12516)
- Lint source.md by [@&#8203;Sethispr](https://github.com/Sethispr) in [#&#8203;12521](cli/cli#12521)

##### :dependabot: Dependencies

- chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12468](cli/cli#12468)
- chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12616](cli/cli#12616)
- Bump go to 1.25.7 by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12630](cli/cli#12630)
- chore(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12629](cli/cli#12629)
- chore: bump `cli/oauth` to `v1.2.2` by [@&#8203;babakks](https://github.com/babakks) in [#&#8203;12573](cli/cli#12573)
- update Go to 1.25.6 by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12580](cli/cli#12580)
- chore(deps): bump actions/attest-build-provenance from 3.1.0 to 3.2.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12558](cli/cli#12558)
- chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12524](cli/cli#12524)
- chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12555](cli/cli#12555)
- chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.4 to 2.13.7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12469](cli/cli#12469)
- chore(deps): bump github.com/sigstore/sigstore from 1.10.0 to 1.10.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12525](cli/cli#12525)
- chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.3.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12515](cli/cli#12515)
- chore(deps): bump actions/download-artifact from 6 to 7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12314](cli/cli#12314)
- chore(deps): bump actions/upload-artifact from 5 to 6 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12315](cli/cli#12315)
- chore(deps): bump goreleaser/goreleaser-action from 6.0.0 to 6.4.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12354](cli/cli#12354)

#### New Contributors

- [@&#8203;Sethispr](https://github.com/Sethispr) made their first contribution in [#&#8203;12521](cli/cli#12521)
- [@&#8203;cuiweixie](https://github.com/cuiweixie) made their first contribution in [#&#8203;12554](cli/cli#12554)

**Full Changelog**: <cli/cli@v2.86.0...v2.87.0>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNC4yIiwidXBkYXRlZEluVmVyIjoiNDMuMzEuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiUmVub3ZhdGUgQm90IiwiYXV0b21hdGlvbjpib3QtYXV0aG9yZWQiLCJkZXBlbmRlbmN5LXR5cGU6Om1pbm9yIl19-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant