chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.6 to 2.1.0

[dependabot]

Bumps github.com/sigstore/timestamp-authority/v2 from 2.0.6 to 2.1.0.

Release notes

Sourced from github.com/sigstore/timestamp-authority/v2's releases.

v2.1.0

What's Changed

• Bound path and HTTP method metric label cardinality to prevent OOM in sigstore/timestamp-authority#1374
• Fix spec violations in policy, EKU, and hash verification in sigstore/timestamp-authority#1375

Full Changelog: sigstore/timestamp-authority@v2.0.6...v2.1.0

Commits

• 58ae149 Fix spec violations in policy, EKU, and hash verification (#1375)
• 506ec57 Bound path and HTTP method metric label cardinality to prevent OOM (#1374)
• ee10add chore(deps): bump the actions group with 2 updates (#1370)
• 5238ec7 chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 (#1369)
• 0ff73b8 chore(deps): bump goreleaser/goreleaser-action in the actions group (#1367)
• 97813ca chore(deps): bump the actions group with 2 updates (#1366)
• ece88f8 chore(deps): bump github.com/go-openapi/runtime from 0.30.0 to 0.31.0 (#1365)
• 77e0ee5 chore(deps): bump github.com/tink-crypto/tink-go-awskms/v2 to v3 (#1364)
• 6ea07df chore(deps): bump go.step.sm/crypto from 0.80.0 to 0.81.0 (#1363)
• f1dc03b chore(deps): bump github.com/tink-crypto/tink-go-hcvault/v2 (#1362)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The update of github.com/sigstore/timestamp-authority/v2 to version 2.1.0 successfully addresses specific metric label cardinality issues and specification violations in verification logic. However, high-severity security flaws have been identified in the current dependency tree. Specifically, golang.org/x/crypto and github.com/sigstore/rekor are at versions containing critical vulnerabilities, including potential unauthorized command execution and Denial of Service (OOM). These security risks should be remediated by upgrading the affected packages to their patched versions.

About this PR

• There is a systemic security risk identified in the Sigstore ecosystem dependencies being used. While one component is updated, others like Rekor remain at vulnerable versions, potentially leaving the application open to Denial of Service attacks.

Test suggestions

• Verify that timestamp verification logic remains compatible with the library's fixes for EKU and hash verification.
• Confirm the application builds and initializes correctly with the updated transitive dependencies for AWS and GCP.
• Verify that telemetry and metrics collection still operate as expected with the new bounded label cardinality.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that timestamp verification logic remains compatible with the library's fixes for EKU and hash verification.
2. Confirm the application builds and initializes correctly with the updated transitive dependencies for AWS and GCP.
3. Verify that telemetry and metrics collection still operate as expected with the new bounded label cardinality.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

Updating golang.org/x/crypto to v0.51.0 leaves the project vulnerable to high-severity security issues affecting SSH signature verification and command execution (CVE-2026-42508, CVE-2026-39828, CVE-2026-39829). This version should be bumped to v0.52.0 to address these flaws.

Suggested change

	golang.org/x/crypto v0.51.0 // indirect
	golang.org/x/crypto v0.52.0 // indirect

[codacy-production]

_{🔴 HIGH RISK}

The dependency github.com/sigstore/rekor is at v1.5.1, which contains a high-severity vulnerability (CVE-2026-48702) that allows for a Denial of Service (OOM) through unbounded gzip decompression. Given that this PR is updating Sigstore dependencies, it is recommended to bump Rekor to v1.5.2.

Suggested change

	github.com/sigstore/rekor v1.5.1 // indirect
	github.com/sigstore/rekor v1.5.2 // indirect