Skip to content

build(deps): bump the go-deps group across 1 directory with 10 updates - #2187

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-2ddc3271c8
Open

build(deps): bump the go-deps group across 1 directory with 10 updates#2187
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-2ddc3271c8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-deps group with 10 updates in the / directory:

Package From To
github.com/elazarl/goproxy 1.8.4 1.9.2
github.com/miekg/dns 1.1.72 1.1.73
github.com/minio/minio-go/v7 7.2.1 7.3.0
github.com/onsi/gomega 1.43.0 1.44.0
github.com/prometheus/client_golang 1.24.1 1.25.0
github.com/sigstore/cosign/v3 3.0.6 3.1.3
github.com/sigstore/rekor 1.5.2 1.5.3
github.com/sigstore/sigstore 1.10.8 1.11.0
github.com/sigstore/sigstore-go 1.2.1 1.2.2
google.golang.org/api 0.297.0 0.301.0

Updates github.com/elazarl/goproxy from 1.8.4 to 1.9.2

Release notes

Sourced from github.com/elazarl/goproxy's releases.

v1.9.2

What's Changed

New Contributors

Full Changelog: elazarl/goproxy@v1.9.1...v1.9.2

v1.9.1

What's Changed

New Contributors

Full Changelog: elazarl/goproxy@v1.9.0...v1.9.1

v1.9.0: HTTP/2 MITM Full Support

What's Changed

Full Changelog: elazarl/goproxy@v1.8.6...v1.9.0

Highlights & Acknowledgements

  • HTTP/2 MITM Support: This release introduces native support for inspecting and manipulating HTTP/2 traffic within GoProxy's MITM functionality. A special thanks to the team at @​LumiaSecurity (including @​omriza for the review) for supporting the development of these HTTP/2 MITM features and contributing to this major enhancement. Achieving full HTTP/2 MITM capability represents a huge milestone for GoProxy, taking our library to the next level for whoever needs it. To enable it, make sure that AllowHTTP2 is set to true in the proxy configuration.

⚠️ Possible Breaking Change

  • Previously there was an incomplete implementation of HTTP/2 inside the h2.go file, with an exported H2Transport struct. Probably no one was using it, but if you were, be careful that in this release it has been removed to create the full HTTP/2 MITM implementation.

v1.8.6

What's Changed

New Contributors

... (truncated)

Commits
  • a05e922 Forward buffered client bytes when starting MITM WebSocket relay (#805)
  • e24f2c7 Fix: prevent panic on malformed URL during MITM (#809)
  • 0108e0f Merge pull request #807 from haimingZZ/fix/whether-typos
  • ab155fe docs: fix typo 'wether' -> 'whether' in dispatcher.go comments
  • e540bd6 fix(mitm): never frame bodiless responses as chunked (#797)
  • 2b17647 Echo client HTTP version in CONNECT tunnel reply (#802) (#804)
  • 4c85e93 Fix: normalize req.URL.Host in MITM by prioritizing inner Host header (#799)
  • 6225cd3 Use Go standard library to check port (#795)
  • 5e44068 HTTP/2 MITM Full Support (#785)
  • a4bf432 Stream MITM response bodies (#794)
  • Additional commits viewable in compare view

Updates github.com/miekg/dns from 1.1.72 to 1.1.73

Commits

Updates github.com/minio/minio-go/v7 from 7.2.1 to 7.3.0

Release notes

Sourced from github.com/minio/minio-go/v7's releases.

v7.3.0

What's Changed

New Contributors

Full Changelog: minio/minio-go@v7.2.1...v7.3.0

Commits
  • ce0e323 update lib version to v7.3.0
  • 2f55211 rdma: build against libs3rdma, and fix the size guard's off-by-one (#2283)
  • 1e3d492 feat: propagate caller context through credential providers (#2275)
  • e7b0801 Add AIStor Lifecycle Compression (#2281)
  • b15d168 build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#2280)
  • d1e1ecd fix: return delete-marker ObjectInfo from StatObject alongside the error (#2273)
  • f230068 fix: declare aws-chunked content encoding on streaming uploads (#2277)
  • 90530cf Add end-to-end checksum verification on GetObject (#2272)
  • a4c24f9 build(deps): bump the actions group with 2 updates (#2279)
  • 28bece5 rdma: reject buffers over the 4 GiB cuObject registration limit (#2278)
  • Additional commits viewable in compare view

Updates github.com/onsi/gomega from 1.43.0 to 1.44.0

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.44.0

Fixes

  • BeNumerically compares signed and unsigned integers by value: -1 no longer equals uint64(math.MaxUint64) and uint(5) is now greater than -3 (#925) [26e3c6b]
  • BeNumerically("~") no longer overflows when computing the distance between extreme integers (#928) [1955764]
  • BeNumerically("==", x, threshold) now honors the threshold for floats, as it already did for integers (#927) [10e2aca]
  • HaveKeyWithValue succeeds if any key accepted by the key matcher has a matching value, rather than depending on map iteration order (#929) [ffc577a]
  • HaveKey and HaveKeyWithValue treat key and value matcher errors like ContainElement does: a match wins, and an error is only reported when nothing matches (#926) [dc91598]
  • MatchJSON no longer treats numbers too large for a float64 as equal to one another (#930) [9d619a5]
  • MatchJSON compares integers beyond ±2^53 exactly, so neighboring large integers (e.g. IDs) no longer match; all other numbers are still compared as float64s (#931) [8ef1aa7, 630fe12]
  • HaveExactElements reports missing or extra elements that start at index 0, and reports the first extra element's index rather than the last (#934) [af1b777]
  • MatchYAML compares every document in a multi-document stream rather than only the first; empty documents (e.g. a leading or trailing ---) are ignored (#933) [2773796]
  • MatchXML ignores namespace prefixes: elements and attributes are compared by namespace URI, and the URIs declared on each element must match whatever prefix they are bound to (#932) [c0dbd89, 2565350]

v1.43.1

Maintenance

  • Update go.yaml.in/yaml/v3 to v3.0.5 [d547015]
  • Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. Releases still ship the stripped-down tree on master-lite - tests removed and Ginkgo dropped from go.mod - and the workflow now builds it and checks it on every push. See RELEASING.md. [e9dc84d]
Changelog

Sourced from github.com/onsi/gomega's changelog.

1.44.0

Fixes

  • BeNumerically compares signed and unsigned integers by value: -1 no longer equals uint64(math.MaxUint64) and uint(5) is now greater than -3 (#925) [26e3c6b]
  • BeNumerically("~") no longer overflows when computing the distance between extreme integers (#928) [1955764]
  • BeNumerically("==", x, threshold) now honors the threshold for floats, as it already did for integers (#927) [10e2aca]
  • HaveKeyWithValue succeeds if any key accepted by the key matcher has a matching value, rather than depending on map iteration order (#929) [ffc577a]
  • HaveKey and HaveKeyWithValue treat key and value matcher errors like ContainElement does: a match wins, and an error is only reported when nothing matches (#926) [dc91598]
  • MatchJSON no longer treats numbers too large for a float64 as equal to one another (#930) [9d619a5]
  • MatchJSON compares integers beyond ±2^53 exactly, so neighboring large integers (e.g. IDs) no longer match; all other numbers are still compared as float64s (#931) [8ef1aa7, 630fe12]
  • HaveExactElements reports missing or extra elements that start at index 0, and reports the first extra element's index rather than the last (#934) [af1b777]
  • MatchYAML compares every document in a multi-document stream rather than only the first; empty documents (e.g. a leading or trailing ---) are ignored (#933) [2773796]
  • MatchXML ignores namespace prefixes: elements and attributes are compared by namespace URI, and the URIs declared on each element must match whatever prefix they are bound to (#932) [c0dbd89, 2565350]

1.43.1

Maintenance

  • Update go.yaml.in/yaml/v3 to v3.0.5 [d547015]
  • Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. Releases still ship the stripped-down tree on master-lite - tests removed and Ginkgo dropped from go.mod - and the workflow now builds it and checks it on every push. See RELEASING.md. [e9dc84d]
Commits

Updates github.com/prometheus/client_golang from 1.24.1 to 1.25.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.25.0

⚠️ This release raises the minimum required Go version to 1.26 and includes breaking API changes in api/prometheus/v1 (see the [CHANGE] entries below). ⚠️

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135

What's Changed

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135
Commits

Updates github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.3

Release notes

Sourced from github.com/sigstore/cosign/v3's releases.

v3.1.3

What's Changed

This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle.

Full Changelog: sigstore/cosign@v3.1.2...v3.1.3

v3.1.2

This may be the last Cosign v3.1 release, as we finish deprecations and removing unused functionality. Soon we'll start work on Cosign v4 where we will remove things that are currently deprecated. We'll continue to support Cosign v3, with it's opt-in backwards compatibility, as described in our versioning policy.

If you haven't already, now is an excellent time to move to the bundle format that has been supported since Cosign v2.6.

We have received a ton of fixes over the past month from folks using Cosign in a variety of environments - thank you all!

Deprecations

  • 816f2b6634821cefe6ceabbffdd5ff7ffc00d0a4 Deprecate --payload for sign and verify commands (#4991)

Features

  • 5121398c0ae6f4444d8ffd10447d7b765184f304 docs: add OVHcloud KMS in available external plugins (#4962)
  • 38f73bb8fd949fad71e7086bd122080b2d47ceeb Add insecure registry flag to ko publish in kind-verify-attestation workflow (#4970)
  • 2e0749ac11c7326299f6af65ae6a3ab6a6750586 Deprecate --output-attestation (#4958)
  • 2233166935e2940a530e5a740adc095f4ca4863d Add bundle inspect command (#4842)

Fixes

  • eb3bb86f712a1163591b6663bbc434afb6fad467 Guard against empty certificate PEM in mutate.Signature (#4998)
  • 089731c31f750153e9d91ec248c990e3b1991c2b fix(download): Validate predicate type for new bundle format
  • d996ce12df6967bb5bf81e3244bfbbe1c2665f34 Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)
  • 8ca5b2002f5cd43614c476665e2055e59392b59d Fix Makefile: fall back to "unknown" version info when built outside a git repo (#5000)
  • df78bf67985f09e431f88b69be5842b7d0f5f4eb fix(verify): skip identity validation for security keys (#5012)
  • aebdc3a232083841b9c957fbba6b80b41df8caad fix: include artifactType in OCI 1.1 signature referrer manifest
  • c0edaac063a90b1dcacdabc7fc23e6c6f8ade90d Allow attestation download to handle both bundle types (#4996)
  • a8642c7b8611d557b4a592e6b94b188bd9427d7c Fix panic in dockerfile verify on malformed FROM lines (#4979)
  • ef3e3b446a011852929a08f51095ecc67495bfe7 fix(release): restore signing-step auth and fail on image signing errors (#4978)
  • 16ddbcf9040b75e2329f2436b65ba3ed340dac88 feat(signing-config): add --base-config flag to override services from base config (#4977)
  • f17f812494b558499d89a37a6c9161657d2371e9 fix: pass NewBundleFormat to KeyOpts in sign command (#4981)
  • 6ef8d9d040a481e26e065349c292799615ea7e7b fix: ignore build stage references in dockerfile verify (#4961)
  • 8dbdef561622178f453d64d83faa02b1744a19f7 fix: allow '=' in annotation values (#4957)

Cleanup

... (truncated)

Commits
  • 11926fa Verification bypass via public key in legacy bundle (GHSA-fx35-mq7g-6g98) (#5...
  • 4d589ba fix(blob): compare file checksums case-insensitively (#5036)
  • 83d9ec8 fix: prevent shell completions for various options not taking filenames (#5032)
  • 0238975 test(inspect): replace mock TSA client usage with local timestamp response ge...
  • d6d86c2 Supporting OCI Signing with X.509 Certificate Chain (#4614)
  • a3ee83c fix(pkcs11key): return an error instead of panicking when no key pair matches...
  • d6857f2 Auto-detect default digest algorithm for public keys (#5019)
  • 193d215 Remove unused policy evaluation code (#4936)
  • eb3bb86 Guard against empty certificate PEM in mutate.Signature (#4998)
  • 089731c fix(download): Validate predicate type for new bundle format
  • Additional commits viewable in compare view

Updates github.com/sigstore/rekor from 1.5.2 to 1.5.3

Release notes

Sourced from github.com/sigstore/rekor's releases.

v1.5.3

Changelog

  • 7d9dcffcc27c4912e7d17fc768db01aa2d5cf26c Changelog for v1.5.3 (#2871)
  • f230638c11a77e26bcef2bd2d502623527c23397 Use bytes.Equal for inclusion proof root hash comparison (#2861)
  • 747226830b6888555f2ed195d65c592e85a5cfb1 return 499 if client disconnects instead of 500 (#2870)
  • 792221be80dedadc9f41ae5975ac2b5b5d9a6921 build(deps): Bump google.golang.org/grpc from 1.80.0 to 1.82.0 (#2859)
  • 912dda344477c9c2ce0782731553a8fc0b76c58d build(deps): Bump the all group across 1 directory with 7 updates (#2869)
  • 0f9921df54391f4936eae6753a13cacb6e0d659a Change max upperbound on latency metrics (#2868)
  • 322a3f2cd78f0ada4901f68c56e4a8bb86e0e609 build(deps): Bump golang from 87a41d2 to f96cc55 (#2855)
  • e997a8abe2f187b316bba229171b83d474136a90 build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 (#2857)
  • 4444582076ed0bd3071ab5c1044426fdccf855c3 build(deps): Bump golang.org/x/net from 0.52.0 to 0.55.0 in /hack/tools (#2866)
  • f81061c497f66244d6f3f45b9f1c4b009defb6c4 Move fuzz into its own workflow (#2865)
  • 1a2f3f22a7e4e0033411b587f792b09e17bbd56c build(deps): Bump google.com/cloudsdktool/google-cloud-cli (#2862)
  • cf8f143d98a2476d4b0bc476a4ceeec6032a5807 build(deps): Bump the all group with 2 updates (#2863)
  • 4e6fd6005a6c006c3f0bc644df9bb9b1b0bd1128 build(deps): Bump the all group across 1 directory with 11 updates
  • 088835b8916af4554020909b34d692b67cf583e6 build(deps): Bump golang in the all group across 1 directory
  • 37eb42417790461684d34aa79f505f41dc9e95b7 build(deps): Bump the all group across 1 directory with 2 updates
  • bbc0f78d46da013db889a10947f57c47c9339952 build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  • 32e68681ada478a959d7786cbe7966e06197bff0 build(deps): Bump codecov/codecov-action from 6.0.1 to 7.0.0
  • 400f8d54e79cf8438cdfaa4a21a23f72250d9152 build(deps): Bump github.com/go-openapi/loads from 0.23.3 to 0.24.0
  • a2d42d58996106e40ba7d163892a8cfe3797df6c build(deps): Bump github.com/redis/go-redis/v9 from 9.18.0 to 9.20.0
  • e1e207b3a3c7fd2d1391ac0e0e92d0d6b2c616f3 build(deps): Bump github.com/go-openapi/runtime from 0.29.4 to 0.32.2
  • 128ebabceab62c82a4cc7308fb18ef476100fcf7 build(deps): Bump golang from 313faae to 2d6c802
  • 6c9dd721e4500dc56b8bf3d70cf4af31ed058dbd build(deps): Bump golang.org/x/net from 0.53.0 to 0.55.0
  • 65c104c47b03ca8f487464c417782452bfef8add build(deps): Bump the all group across 1 directory with 4 updates
  • 6e4daae2da593cd88729e3de1d531c50cd8c5dee build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  • adebc681c70eef419c71aa33f7ed8d85dddf878c update builder to use go1.26.3

Thanks for all contributors!

Changelog

Sourced from github.com/sigstore/rekor's changelog.

v1.5.3

Features

  • return 499 when clients disconnect instead of 500 (#2870)

Improvements

  • Change max upperbound on latency metrics (#2868)
Commits
  • 7d9dcff Changelog for v1.5.3 (#2871)
  • f230638 Use bytes.Equal for inclusion proof root hash comparison (#2861)
  • 7472268 return 499 if client disconnects instead of 500 (#2870)
  • 792221b build(deps): Bump google.golang.org/grpc from 1.80.0 to 1.82.0 (#2859)
  • 912dda3 build(deps): Bump the all group across 1 directory with 7 updates (#2869)
  • 0f9921d Change max upperbound on latency metrics (#2868)
  • 322a3f2 build(deps): Bump golang from 87a41d2 to f96cc55 (#2855)
  • e997a8a build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 (#2857)
  • 4444582 build(deps): Bump golang.org/x/net from 0.52.0 to 0.55.0 in /hack/tools (#2866)
  • f81061c Move fuzz into its own workflow (#2865)
  • Additional commits viewable in compare view

Updates github.com/sigstore/sigstore from 1.10.8 to 1.11.0

Release notes

Sourced from github.com/sigstore/sigstore's releases.

v1.11.0

What's Changed

v1.11.0 and v1.10.10 are identical releases tagged for the same commit. Since the minimum Go version has been bumped to 1.27.0, we are releasing this change as a minor version bump. Dependencies that do not want to update to 1.27 yet can use v1.10.11, and we'll backport any security fixes to v1.10.x for the next 6 months while Go 1.26 is still supported.

@dependabot
build(deps): bump the go-deps group across 1 directory with 10 updates
4d33863 
Bumps the go-deps group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/elazarl/goproxy](https://github.com/elazarl/goproxy) | `1.8.4` | `1.9.2` |
| [github.com/miekg/dns](https://github.com/miekg/dns) | `1.1.72` | `1.1.73` |
| [github.com/minio/minio-go/v7](https://github.com/minio/minio-go) | `7.2.1` | `7.3.0` |
| [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.43.0` | `1.44.0` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.24.1` | `1.25.0` |
| [github.com/sigstore/cosign/v3](https://github.com/sigstore/cosign) | `3.0.6` | `3.1.3` |
| [github.com/sigstore/rekor](https://github.com/sigstore/rekor) | `1.5.2` | `1.5.3` |
| [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.10.8` | `1.11.0` |
| [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) | `1.2.1` | `1.2.2` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.297.0` | `0.301.0` |



Updates `github.com/elazarl/goproxy` from 1.8.4 to 1.9.2
- [Release notes](https://github.com/elazarl/goproxy/releases)
- [Commits](elazarl/goproxy@v1.8.4...v1.9.2)

Updates `github.com/miekg/dns` from 1.1.72 to 1.1.73
- [Commits](miekg/dns@v1.1.72...v1.1.73)

Updates `github.com/minio/minio-go/v7` from 7.2.1 to 7.3.0
- [Release notes](https://github.com/minio/minio-go/releases)
- [Commits](minio/minio-go@v7.2.1...v7.3.0)

Updates `github.com/onsi/gomega` from 1.43.0 to 1.44.0
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.43.0...v1.44.0)

Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.24.1...v1.25.0)

Updates `github.com/sigstore/cosign/v3` from 3.0.6 to 3.1.3
- [Release notes](https://github.com/sigstore/cosign/releases)
- [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md)
- [Commits](sigstore/cosign@v3.0.6...v3.1.3)

Updates `github.com/sigstore/rekor` from 1.5.2 to 1.5.3
- [Release notes](https://github.com/sigstore/rekor/releases)
- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)
- [Commits](sigstore/rekor@v1.5.2...v1.5.3)

Updates `github.com/sigstore/sigstore` from 1.10.8 to 1.11.0
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.10.8...v1.11.0)

Updates `github.com/sigstore/sigstore-go` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/sigstore/sigstore-go/releases)
- [Commits](sigstore/sigstore-go@v1.2.1...v1.2.2)

Updates `google.golang.org/api` from 0.297.0 to 0.301.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.297.0...v0.301.0)

---
updated-dependencies:
- dependency-name: github.com/elazarl/goproxy
  dependency-version: 1.9.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/miekg/dns
  dependency-version: 1.1.73
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/minio/minio-go/v7
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/sigstore/cosign/v3
  dependency-version: 3.1.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/sigstore/rekor
  dependency-version: 1.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/sigstore/sigstore
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/sigstore/sigstore-go
  dependency-version: 1.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: google.golang.org/api
  dependency-version: 0.301.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency label Oct 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants