chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.6 to 2.1.0 #310
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -20,24 +20,24 @@ require ( | |||||
| al.essio.dev/pkg/shellescape v1.6.0 // indirect | ||||||
| cel.dev/expr v0.25.1 // indirect | ||||||
| cloud.google.com/go v0.123.0 // indirect | ||||||
| cloud.google.com/go/auth v0.20.0 // indirect | ||||||
| cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect | ||||||
| cloud.google.com/go/compute/metadata v0.9.0 // indirect | ||||||
| cloud.google.com/go/iam v1.7.0 // indirect | ||||||
| cloud.google.com/go/monitoring v1.24.3 // indirect | ||||||
| cloud.google.com/go/storage v1.61.3 // indirect | ||||||
| cyphar.com/go-pathrs v0.2.1 // indirect | ||||||
| dario.cat/mergo v1.0.2 // indirect | ||||||
| github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1 // indirect | ||||||
| github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 // indirect | ||||||
| github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3 // indirect | ||||||
| github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect | ||||||
| github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect | ||||||
| github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect | ||||||
| github.com/BurntSushi/toml v1.6.0 // indirect | ||||||
| github.com/DataDog/zstd v1.5.5 // indirect | ||||||
| github.com/GoogleCloudPlatform/docker-credential-gcr/v2 v2.1.32 // indirect | ||||||
| github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 // indirect | ||||||
| github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect | ||||||
| github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect | ||||||
| github.com/Intevation/gval v1.3.0 // indirect | ||||||
|
|
@@ -68,28 +68,27 @@ require ( | |||||
| github.com/aquasecurity/trivy-checks v1.12.2-0.20251219190323-79d27547baf5 // indirect | ||||||
| github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48 // indirect | ||||||
| github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2 v1.41.7 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/config v1.32.17 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/credentials v1.19.16 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/service/ebs v1.22.1 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/service/ec2 v1.290.0 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/service/ecr v1.55.2 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/service/signin v1.0.11 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/service/sso v1.30.17 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21 // indirect | ||||||
| github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 // indirect | ||||||
| github.com/aws/smithy-go v1.25.1 // indirect | ||||||
| github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect | ||||||
| github.com/bitnami/go-version v0.0.0-20231130084017-bb00604d650c // indirect | ||||||
| github.com/blang/semver v3.5.1+incompatible // indirect | ||||||
|
|
@@ -102,7 +101,7 @@ require ( | |||||
| github.com/chai2010/gettext-go v1.0.2 // indirect | ||||||
| github.com/cheggaaa/pb/v3 v3.1.7 // indirect | ||||||
| github.com/cloudflare/circl v1.6.3 // indirect | ||||||
| github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect | ||||||
| github.com/containerd/cgroups/v3 v3.1.3 // indirect | ||||||
| github.com/containerd/containerd v1.7.30 // indirect | ||||||
| github.com/containerd/containerd/api v1.10.0 // indirect | ||||||
|
|
@@ -135,8 +134,8 @@ require ( | |||||
| github.com/dustin/go-humanize v1.0.1 // indirect | ||||||
| github.com/emicklei/go-restful/v3 v3.13.0 // indirect | ||||||
| github.com/emirpasic/gods v1.18.1 // indirect | ||||||
| github.com/envoyproxy/go-control-plane/envoy v1.37.0 // indirect | ||||||
| github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect | ||||||
| github.com/evanphx/json-patch v5.9.11+incompatible // indirect | ||||||
| github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect | ||||||
| github.com/fatih/color v1.19.0 // indirect | ||||||
|
|
@@ -154,26 +153,27 @@ require ( | |||||
| github.com/go-jose/go-jose/v4 v4.1.4 // indirect | ||||||
| github.com/go-logr/logr v1.4.3 // indirect | ||||||
| github.com/go-logr/stdr v1.2.2 // indirect | ||||||
| github.com/go-openapi/analysis v0.25.0 // indirect | ||||||
| github.com/go-openapi/errors v0.22.7 // indirect | ||||||
| github.com/go-openapi/jsonpointer v0.23.1 // indirect | ||||||
| github.com/go-openapi/jsonreference v0.21.5 // indirect | ||||||
| github.com/go-openapi/loads v0.23.3 // indirect | ||||||
| github.com/go-openapi/runtime v0.31.0 // indirect | ||||||
| github.com/go-openapi/runtime/server-middleware v0.30.0 // indirect | ||||||
| github.com/go-openapi/spec v0.22.4 // indirect | ||||||
| github.com/go-openapi/strfmt v0.26.2 // indirect | ||||||
| github.com/go-openapi/swag v0.26.0 // indirect | ||||||
| github.com/go-openapi/swag/cmdutils v0.26.0 // indirect | ||||||
| github.com/go-openapi/swag/conv v0.26.0 // indirect | ||||||
| github.com/go-openapi/swag/fileutils v0.26.0 // indirect | ||||||
| github.com/go-openapi/swag/jsonname v0.26.0 // indirect | ||||||
| github.com/go-openapi/swag/jsonutils v0.26.0 // indirect | ||||||
| github.com/go-openapi/swag/loading v0.26.0 // indirect | ||||||
| github.com/go-openapi/swag/mangling v0.26.0 // indirect | ||||||
| github.com/go-openapi/swag/netutils v0.26.0 // indirect | ||||||
| github.com/go-openapi/swag/stringutils v0.26.0 // indirect | ||||||
| github.com/go-openapi/swag/typeutils v0.26.0 // indirect | ||||||
| github.com/go-openapi/swag/yamlutils v0.26.0 // indirect | ||||||
| github.com/go-openapi/validate v0.25.2 // indirect | ||||||
| github.com/go-redis/redis/v8 v8.11.5 // indirect | ||||||
| github.com/go-viper/mapstructure/v2 v2.5.0 // indirect | ||||||
|
|
@@ -193,8 +193,8 @@ require ( | |||||
| github.com/google/licenseclassifier/v2 v2.0.0 // indirect | ||||||
| github.com/google/s2a-go v0.1.9 // indirect | ||||||
| github.com/google/uuid v1.6.0 // indirect | ||||||
| github.com/googleapis/enterprise-certificate-proxy v0.3.15 // indirect | ||||||
| github.com/googleapis/gax-go/v2 v2.22.0 // indirect | ||||||
| github.com/gosuri/uitable v0.0.4 // indirect | ||||||
| github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect | ||||||
| github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 // indirect | ||||||
|
|
@@ -309,9 +309,9 @@ require ( | |||||
| github.com/sigstore/protobuf-specs v0.5.0 // indirect | ||||||
| github.com/sigstore/rekor v1.5.1 // indirect | ||||||
| github.com/sigstore/rekor-tiles/v2 v2.0.1 // indirect | ||||||
| github.com/sigstore/sigstore v1.10.6 // indirect | ||||||
| github.com/sigstore/sigstore-go v1.1.4 // indirect | ||||||
| github.com/sigstore/timestamp-authority/v2 v2.1.0 // indirect | ||||||
| github.com/skeema/knownhosts v1.3.1 // indirect | ||||||
| github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect | ||||||
| github.com/spdx/tools-golang v0.5.7 // indirect | ||||||
|
|
@@ -353,9 +353,9 @@ require ( | |||||
| go.etcd.io/bbolt v1.4.3 // indirect | ||||||
| go.opencensus.io v0.24.0 // indirect | ||||||
| go.opentelemetry.io/auto/sdk v1.2.1 // indirect | ||||||
| go.opentelemetry.io/contrib/detectors/gcp v1.42.0 // indirect | ||||||
| go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect | ||||||
| go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect | ||||||
| go.opentelemetry.io/otel v1.43.0 // indirect | ||||||
| go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.40.0 // indirect | ||||||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 // indirect | ||||||
|
|
@@ -366,26 +366,26 @@ require ( | |||||
| go.opentelemetry.io/otel/trace v1.43.0 // indirect | ||||||
| go.opentelemetry.io/proto/otlp v1.9.0 // indirect | ||||||
| go.uber.org/multierr v1.11.0 // indirect | ||||||
| go.uber.org/zap v1.28.0 // indirect | ||||||
| go.yaml.in/yaml/v2 v2.4.3 // indirect | ||||||
| go.yaml.in/yaml/v3 v3.0.4 // indirect | ||||||
| go.yaml.in/yaml/v4 v4.0.0-rc.3 // indirect | ||||||
| golang.org/x/crypto v0.51.0 // indirect | ||||||
|
There was a problem hiding this comment. 🔴 HIGH RISK Updating golang.org/x/crypto to v0.51.0 leaves the project vulnerable to high-severity security issues affecting SSH signature verification and command execution (CVE-2026-42508, CVE-2026-39828, CVE-2026-39829). This version should be bumped to v0.52.0 to address these flaws.
Suggested change
|
||||||
| golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect | ||||||
| golang.org/x/net v0.55.0 // indirect | ||||||
| golang.org/x/oauth2 v0.36.0 // indirect | ||||||
| golang.org/x/sync v0.20.0 // indirect | ||||||
| golang.org/x/sys v0.45.0 // indirect | ||||||
| golang.org/x/term v0.43.0 // indirect | ||||||
| golang.org/x/text v0.37.0 // indirect | ||||||
| golang.org/x/time v0.15.0 // indirect | ||||||
| golang.org/x/tools v0.44.0 // indirect | ||||||
| golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect | ||||||
| google.golang.org/api v0.277.0 // indirect | ||||||
| google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect | ||||||
| google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect | ||||||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260427160629-7cedc36a6bc4 // indirect | ||||||
| google.golang.org/grpc v1.81.0 // indirect | ||||||
| google.golang.org/protobuf v1.36.11 // indirect | ||||||
| gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect | ||||||
| gopkg.in/inf.v0 v0.9.1 // indirect | ||||||
|
|
||||||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔴 HIGH RISK
The dependency github.com/sigstore/rekor is at v1.5.1, which contains a high-severity vulnerability (CVE-2026-48702) that allows for a Denial of Service (OOM) through unbounded gzip decompression. Given that this PR is updating Sigstore dependencies, it is recommended to bump Rekor to v1.5.2.