Repository navigation
fix(deps): update go dependencies (main) - #1229
Open
crossplane-renovate[bot] wants to merge 1 commit into
Open
crossplane-renovate[bot] wants to merge 1 commit into
crossplane-renovate[bot] wants to merge 1 commit into
Conversation
crossplane-renovate
Bot
force-pushed
the
renovate/main-go-dependencies
branch
from
October 28, 2026 08:11
f5181cf to
5a210c3
Compare
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
crossplane-renovate
Bot
force-pushed
the
renovate/main-go-dependencies
branch
3 times, most recently
from
October 31, 2026 08:07
21bfbbd to
4899626
Compare
crossplane-renovate
Bot
force-pushed
the
renovate/main-go-dependencies
branch
from
November 4, 2026 08:21
4899626 to
09c74e3
Compare
Contributor
Author
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v3.1.3→v3.1.4v1.10.8→v1.11.3v1.84.0→v1.85.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
sigstore/cosign (github.com/sigstore/cosign/v3)
v3.1.4Compare Source
Changelog
3428d3cBuild releases with 1.27.3 (#5177)821c9bfAdd AGENTS.md, update contributors.md with reference to AI policy (#5176)cfeaa4aImplementcosign bundle create-from-container(#5144)e2d25b5Mention windows builds in readme (#5147)6a83f9afix(verify): don't panic on a bundle entry with no hash (#5127)0ea1cecrefactor: remove uploadToRekor parameter from ConfirmPrivacyStatementff2a8f4fix(sign): pass digest hash algorithm to underlying signer in SignData7757e8bfix(e2e): enable UseSignedTimestamps in *TSAMTLSWithSigningConfigf624836test(verify): add failure cases for new bundle verification907c3d8fix(sign): propagate BundlePath from SignOptions to KeyOpts0c66ecdclean: update inaccurate warning (#4909)67a1216fix: write referrers when image index has attestations (#5111)ac3a927fix(verify): enforce mutually exclusive key and security key (#5124)048eff5Reorder events in LoadTrustedMaterialAndSigningConfig43d83e8fix(layout): preserve manifest artifactType in index.json when saving (#4821)1dbbc36fix(load): upload bundle layer blobs before manifest PUT81b61e2fix: strip trailing whitespace from attached signature files/stdin (#5058)b327bbafix: clarify COSIGN_REPOSITORY error when repository path is missing3532c1dfix: include annotations in implied payload for offline verifyb84a076Cap the bundle layer read in ociremote.Bundled39ab7cAlign privacy statement prompt behavior (#5076)559c58ccopy annotations by key instead of copying obj (#5103)37cf1bcAdd org.opencontainers.image.title annotation to attestation layers (#4498)dd9ef85feat: Add org.opencontainers.image.source label to images (#5095)00c1772refactor: extract signing flag validation (#5070)39037f1fix: restrict bundle signing and attestation to one artifact (#5081)5b6e930fix: pass missing OIDC flags to KeyOpts (#5079)20c7516fix(verify): support image indexes in local bundle discovery (#5080)81fa4e9fix(verify): propagate CommonVerifyOptions to VerifyCommand (#5094)84effabfix: verify-blob should not force SHA256 for non-default key hash algorithms (#5064)e9af93ffix(providers): clearer errors when GitHub OIDC token request fails (#5062)8b8c87bfeat: --slot option argument shell completion (#5057)0a5f602Deprecate --use-signing-config (#5056)990e273fix: use correct Rekor URLs to activate privacy warning (#5054)151d838fix: only show public-instance privacy statement for the default Rekor URL (#5042)Thanks to all contributors!
sigstore/sigstore (github.com/sigstore/sigstore)
v1.11.3Compare Source
What's Changed
Full Changelog: sigstore/sigstore@v1.11.2...v1.11.3
v1.11.2Compare Source
What's Changed
Full Changelog: sigstore/sigstore@v1.11.1...v1.11.2
v1.11.1Compare Source
What's Changed
v1.11.1 drops the Go version directive to a minor release,
1.27, rather than the patch release,1.27.0. Dependents will need to remove the patch version.0from go.mod files, asgo mod tidywill not automatically do so.Full Changelog: sigstore/sigstore@v1.11.0...v1.11.1
v1.11.0Compare Source
What's Changed
v1.11.0 and v1.10.10 are identical releases tagged for the same commit. Since the minimum Go version has been bumped to 1.27.0, we are releasing this change as a minor version bump. Dependencies that do not want to update to 1.27 yet can use v1.10.11, and we'll backport any security fixes to v1.10.x for the next 6 months while Go 1.26 is still supported.
ed25519public key length in verifier constructors in #2378Full Changelog: sigstore/sigstore@v1.10.9...v1.11.0
v1.10.11Compare Source
v1.10.11 rolls back the release to a previous commit where the minimum Go version is 1.25.0. An upcoming v1.11.0 will require 1.27.0.
v1.10.10Compare Source
What's Changed
ed25519public key length in verifier constructors by @sueun-dev in #2378New Contributors
Full Changelog: sigstore/sigstore@v1.10.9...v1.10.10
v1.10.9Compare Source
What's Changed
Note: #2369 deprecates the TUF client. Use the TUF client from sigstore-go instead: https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf
Full Changelog: sigstore/sigstore@v1.10.8...v1.10.9
grpc/grpc-go (google.golang.org/grpc)
v1.85.0: Release 1.85.0Compare Source
New Features
:authorityheader) in clientstats.OutHeaderevents. (#9296)ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)Bug Fixes
GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMITfrom 100 to 10,000, and close client connections if reads remain throttled for10s. (#9563)Stop()forcefully terminates the server whileGracefulStop()is waiting for active handlers to complete. (#9394)HEADERSframes to comply with RFC 7540 §5.1.1. Previously, truncatedHEADERSframes left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)HEADERSframe includes theEndStreambit. Previously, this caused server handlers to hang when reading a message. (#9391):authorityandHostheaders with HTTP 400 and statusInternal. (#9365):authorityvalue specified by the LB policy instead of inheriting it from a previous attempt. (#9277)io.ErrUnexpectedEOFinstead ofio.EOFupon receiving truncated message headers or bodies after partial data has already been received. (#9204)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.