Skip to content

chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0#12524

Merged
BagToad merged 2 commits intotrunkfrom
dependabot/go_modules/github.com/sigstore/rekor-1.5.0
Feb 3, 2026
Merged

chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0#12524
BagToad merged 2 commits intotrunkfrom
dependabot/go_modules/github.com/sigstore/rekor-1.5.0

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 22, 2026

Bumps github.com/sigstore/rekor from 1.4.3 to 1.5.0.

Release notes

Sourced from github.com/sigstore/rekor's releases.

v1.5.0

This release fixes GHSA-273p-m2cw-6833 and GHSA-4c4x-jm2x-pf9j. Note that this drops support for fetching public keys via URL when querying the search API.

Vulnerability Fixes

  • Handle malformed COSE and DSSE entries (#2729)
  • Drop support for fetching public keys by URL in the search index (#2731)

Features

  • Add support for a custom TLS config for clients (#2709)
Changelog

Sourced from github.com/sigstore/rekor's changelog.

v1.5.0

This release fixes GHSA-273p-m2cw-6833 and GHSA-4c4x-jm2x-pf9j. Note that this drops support for fetching public keys via URL when querying the search API.

Vulnerability Fixes

  • Handle malformed COSE and DSSE entries (#2729)
  • Drop support for fetching public keys by URL in the search index (#2731)

Features

  • Add support for a custom TLS config for clients (#2709)
Commits
  • fe9717f Changelog for v1.5.0 (#2730)
  • 60ef2bc Drop support for fetching public keys by URL in the search index (#2731)
  • ca625dc build(deps): Bump github.com/redis/go-redis/v9 from 9.14.1 to 9.17.2 (#2706)
  • 39bae3d Merge commit from fork (#2729)
  • 812e699 build(deps): Bump google.golang.org/api from 0.256.0 to 0.259.0 (#2723)
  • 4596e4e build(deps): Bump golang.org/x/net from 0.47.0 to 0.48.0 (#2722)
  • a3e73cd build(deps): Bump github.com/sigstore/sigstore from 1.9.5 to 1.10.3 (#2724)
  • 94d259c build(deps): Bump the all group across 1 directory with 3 updates (#2727)
  • a5329c9 build(deps): Bump the all group with 2 updates (#2728)
  • 5e6bdcd build(deps): Bump google.com/cloudsdktool/google-cloud-cli (#2726)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jan 22, 2026
@dependabot dependabot bot requested a review from a team as a code owner January 22, 2026 18:46
@dependabot dependabot bot requested a review from BagToad January 22, 2026 18:46
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jan 22, 2026
@dependabot dependabot bot temporarily deployed to cli-automation January 22, 2026 18:46 Inactive
Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.4.3 to 1.5.0.
- [Release notes](https://github.com/sigstore/rekor/releases)
- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)
- [Commits](sigstore/rekor@v1.4.3...v1.5.0)

---
updated-dependencies:
- dependency-name: github.com/sigstore/rekor
  dependency-version: 1.5.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/sigstore/rekor-1.5.0 branch from e31a40c to 0162ee2 Compare January 22, 2026 20:59
@BagToad
Copy link
Member

BagToad commented Feb 3, 2026

@dependabot rebase

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Feb 3, 2026

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@BagToad BagToad force-pushed the dependabot/go_modules/github.com/sigstore/rekor-1.5.0 branch from 8e1567a to b9a63c8 Compare February 3, 2026 17:50
@BagToad BagToad enabled auto-merge February 3, 2026 17:54
@BagToad BagToad merged commit 1714ae5 into trunk Feb 3, 2026
10 of 11 checks passed
@BagToad BagToad deleted the dependabot/go_modules/github.com/sigstore/rekor-1.5.0 branch February 3, 2026 17:59
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Feb 25, 2026
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [cli/cli](https://github.com/cli/cli) | minor | `v2.86.0` → `v2.87.3` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>cli/cli (cli/cli)</summary>

### [`v2.87.3`](https://github.com/cli/cli/releases/tag/v2.87.3): GitHub CLI 2.87.3

[Compare Source](cli/cli@v2.87.2...v2.87.3)

#### What's Changed

- Fix project mutation query variable usage by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;12757](cli/cli#12757)

**Full Changelog**: <cli/cli@v2.87.2...v2.87.3>

### [`v2.87.2`](https://github.com/cli/cli/releases/tag/v2.87.2): GitHub CLI 2.87.2

[Compare Source](cli/cli@v2.87.1...v2.87.2)

#### ℹ️ Note

This release was cut primarily to resolve a publishing issue. We recommend reviewing [the v2.87.1 release notes](https://github.com/cli/cli/releases/tag/v2.87.1) for the complete set of latest features and fixes.

#### What's Changed

- chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12659](cli/cli#12659)

**Full Changelog**: <cli/cli@v2.87.1...v2.87.2>

### [`v2.87.1`](https://github.com/cli/cli/releases/tag/v2.87.1): GitHub CLI 2.87.1

[Compare Source](cli/cli@v2.87.0...v2.87.1)

#### ⚠️ Incomplete Release

The v2.87.1 release experienced a failure in our workflow and is not fully published to the designated package managers/repositories. This is resolved in [v2.87.2](https://github.com/cli/cli/releases/tag/v2.87.2), so we recommend using that release instead.

#### What's Changed

- Remove license bundling debris by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;12716](cli/cli#12716)
- fix(agent-task/capi): use a fixed CAPI API version by [@&#8203;babakks](https://github.com/babakks) in [#&#8203;12731](cli/cli#12731)

**Full Changelog**: <cli/cli@v2.87.0...v2.87.1>

### [`v2.87.0`](https://github.com/cli/cli/releases/tag/v2.87.0): GitHub CLI 2.87.0

[Compare Source](cli/cli@v2.86.0...v2.87.0)

#### `gh workflow run` immediately returns workflow run URL

One of our most requested features - with the latest changes in GitHub API, `gh workflow run` will immediately print the created workflow run URL.

#### Improved `gh auth login` experience in VM/WSL environments

We have observed rare cases of time drift between the wall and monotonic clocks, mostly in WSL or VM environments, causing failures during polling for the OAuth token. This new release implements measures to account for such situations.

If you continue to experience `gh auth login` issues in WSL, please comment in [#&#8203;9370](cli/cli#9370)

#### :copilot: Request Copilot Code Review from `gh` + performance improvements

`gh pr edit` now supports [Copilot Code Review](https://docs.github.com/en/copilot/using-github-copilot/code-review/using-copilot-code-review) as a reviewer. You can request a review from Copilot using the `--add-reviewer @&#8203;copilot` flag or interactively by selecting reviewers in the prompts.

This release also introduces a new search experience for selecting reviewers and assignees in `gh pr edit`. Instead of loading all collaborators and teams upfront, results are now fetched based on inputs to a new search option. Initial options are suggestions based on those involved with the pull request already.

```
? Reviewers  [Use arrows to move, space to select, <right> to all, <left> to none, type to filter]
  [ ]  Search (7472 more)
  [x]  BagToad (Kynan Ware)
> [x]  Copilot (AI)
```

This experience will follow in `gh pr create` and `gh issue` for assignees in a later release.

#### What's Changed

##### ✨ Features

- Bundle licenses at release time by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;12625](cli/cli#12625)
- Add `--query` flag to `project item-list` by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;12696](cli/cli#12696)
- feat(workflow run): retrieve workflow dispatch run details by [@&#8203;babakks](https://github.com/babakks) in [#&#8203;12695](cli/cli#12695)
- Pin REST API version to 2022-11-28 by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;12680](cli/cli#12680)
- Respect `--exit-status` with `--log` and `--log-failed` in `run view` by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;12679](cli/cli#12679)
- Fork with default branch only during pr create by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;12673](cli/cli#12673)
- `gh pr edit`: Add support for Copilot as reviewer with search capability, performance and accessibility improvements by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12567](cli/cli#12567)
- `gh pr edit`: new interactive prompt for assignee selection, performance and accessibility improvements by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12526](cli/cli#12526)

##### 📚 Docs & Chores

- Clean up project item-list query addition changes by [@&#8203;williammartin](https://github.com/williammartin) in [#&#8203;12714](cli/cli#12714)
- `gh release upload`: Clarify `--clobber` flag deletes assets before re-uploading by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12711](cli/cli#12711)
- Add usage examples to `gh gist edit` command by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12710](cli/cli#12710)
- Remove feedback issue template by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12708](cli/cli#12708)
- Migrate issue triage workflows to shared workflows by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12677](cli/cli#12677)
- Migrate MR triage workflows to shared workflows by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12707](cli/cli#12707)
- Add missing TODO comments for featuredetection if-statements by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12701](cli/cli#12701)
- Add manual dispatch to bump-go workflow by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12631](cli/cli#12631)
- typo: dont to don't by [@&#8203;cuiweixie](https://github.com/cuiweixie) in [#&#8203;12554](cli/cli#12554)
- Fix fmt.Errorf format argument in ParseFullReference by [@&#8203;mikelolasagasti](https://github.com/mikelolasagasti) in [#&#8203;12516](cli/cli#12516)
- Lint source.md by [@&#8203;Sethispr](https://github.com/Sethispr) in [#&#8203;12521](cli/cli#12521)

##### :dependabot: Dependencies

- chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12468](cli/cli#12468)
- chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12616](cli/cli#12616)
- Bump go to 1.25.7 by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12630](cli/cli#12630)
- chore(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12629](cli/cli#12629)
- chore: bump `cli/oauth` to `v1.2.2` by [@&#8203;babakks](https://github.com/babakks) in [#&#8203;12573](cli/cli#12573)
- update Go to 1.25.6 by [@&#8203;BagToad](https://github.com/BagToad) in [#&#8203;12580](cli/cli#12580)
- chore(deps): bump actions/attest-build-provenance from 3.1.0 to 3.2.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12558](cli/cli#12558)
- chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12524](cli/cli#12524)
- chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12555](cli/cli#12555)
- chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.4 to 2.13.7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12469](cli/cli#12469)
- chore(deps): bump github.com/sigstore/sigstore from 1.10.0 to 1.10.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12525](cli/cli#12525)
- chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.3.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12515](cli/cli#12515)
- chore(deps): bump actions/download-artifact from 6 to 7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12314](cli/cli#12314)
- chore(deps): bump actions/upload-artifact from 5 to 6 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12315](cli/cli#12315)
- chore(deps): bump goreleaser/goreleaser-action from 6.0.0 to 6.4.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;12354](cli/cli#12354)

#### New Contributors

- [@&#8203;Sethispr](https://github.com/Sethispr) made their first contribution in [#&#8203;12521](cli/cli#12521)
- [@&#8203;cuiweixie](https://github.com/cuiweixie) made their first contribution in [#&#8203;12554](cli/cli#12554)

**Full Changelog**: <cli/cli@v2.86.0...v2.87.0>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNC4yIiwidXBkYXRlZEluVmVyIjoiNDMuMzEuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiUmVub3ZhdGUgQm90IiwiYXV0b21hdGlvbjpib3QtYXV0aG9yZWQiLCJkZXBlbmRlbmN5LXR5cGU6Om1pbm9yIl19-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant