Skip to content

Bump the minor-patch group across 2 directories with 7 updates - #651

Merged
kommendorkapten merged 1 commit into
mainfrom
dependabot/go_modules/minor-patch-eb1a8e74ee
Jun 30, 2026
Merged

Bump the minor-patch group across 2 directories with 7 updates#651
kommendorkapten merged 1 commit into
mainfrom
dependabot/go_modules/minor-patch-eb1a8e74ee

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-patch group with 4 updates in the / directory: github.com/go-openapi/runtime, github.com/go-openapi/strfmt, github.com/sigstore/rekor-tiles/v2 and golang.org/x/mod.
Bumps the minor-patch group with 1 update in the /examples/oci-image-verification directory: github.com/google/go-containerregistry.

Updates github.com/go-openapi/runtime from 0.32.3 to 0.32.4

Release notes

Sourced from github.com/go-openapi/runtime's releases.

v0.32.4

0.32.4 - 2026-06-19

Full Changelog: go-openapi/runtime@v0.32.3...v0.32.4

10 commits in this release.

Fixed bugs

  • fix(middleware): nil-guard param.Schema in UntypedRequestBinder map path by @​Copilot in #488 ...

Documentation

Miscellaneous tasks

Updates

People who contributed to this release

runtime license terms

License

... (truncated)

Commits
  • 908a0ff chore: prepare release v0.32.4
  • 5a6fbee build(deps): bump github.com/go-openapi/spec
  • b63b221 build(deps): bump the development-dependencies group with 2 updates
  • d3cd4f6 fix(middleware): nil-guard param.Schema in UntypedRequestBinder map path (#488)
  • 760cc62 build(deps): bump the go-openapi-dependencies group across 2 directories with...
  • 6c5385e build(deps): bump golang.org/x/sync
  • 1045e1c build(deps): bump the development-dependencies group with 9 updates
  • 9b01ff4 build(deps): bump the go-openapi-dependencies group across 2 directories with...
  • deed159 doc: updated contributors file
  • 2dc38ae build(deps): bump the development-dependencies group with 10 updates
  • See full diff in compare view

Updates github.com/go-openapi/strfmt from 0.26.3 to 0.26.4

Release notes

Sourced from github.com/go-openapi/strfmt's releases.

v0.26.4

0.26.4 - 2026-06-29

Full Changelog: go-openapi/strfmt@v0.26.3...v0.26.4

14 commits in this release.

Fixed bugs

Documentation

Code quality

Miscellaneous tasks

Updates

People who contributed to this release

... (truncated)

Commits
  • 09a3881 chore: prepare release v0.26.4
  • 7dcda43 build(deps): bump the other-dependencies group across 3 directories with 1 up...
  • 5b746cb build(deps): bump the go-openapi-dependencies group across 2 directories with...
  • 708588c ci: post README announcements to discord + bump ci-workflows to v0.4.0 (#272)
  • 06b6bb0 fix: validate "uri" format for absolute URIs with a fragment (#131) (#269)
  • 64c4277 chore: disabled goconst linter (#271)
  • a8a2d74 chore(ci): run contributors workflow monthly instead of weekly (#270)
  • 00af19e build(deps): bump the development-dependencies group with 2 updates
  • a3d472a build(deps): bump golang.org/x/net
  • 1928b1d build(deps): bump the development-dependencies group with 9 updates
  • Additional commits viewable in compare view

Updates github.com/go-openapi/swag/conv from 0.26.0 to 0.26.1

Release notes

Sourced from github.com/go-openapi/swag/conv's releases.

v0.26.1

0.26.1 - 2026-06-07

Full Changelog: go-openapi/swag@v0.26.0...v0.26.1

12 commits in this release.

Implemented enhancements

  • feat(loading): sandbox local loading with WithRoot (GHSA-v2xp-g8xf-22pf) by @​fredbi in #203 ...
  • feat(ci): added shared workflow for bot-pr monitoring by @​fredbi ...

Documentation

Miscellaneous tasks

Security

  • doc(loading): document security implications of using the loader by @​fredbi in #207 ...

Updates

People who contributed to this release

swag license terms

... (truncated)

Commits
  • 85923a5 chore: prepare release v0.26.1
  • 336c586 doc(loading): document security implications of using the loader (#207)
  • 92ec622 doc: updated contributors file
  • 3f77c79 doc: aligned with org docs (#205)
  • 40578b5 build(deps): bump the development-dependencies group with 8 updates
  • eefaba1 feat(loading): sandbox local loading with WithRoot (GHSA-v2xp-g8xf-22pf) (#203)
  • 2e99502 feat(ci): added shared workflow for bot-pr monitoring
  • cafd10f build(deps): bump the go-openapi-dependencies group across 15 directories wit...
  • 660dd54 build(deps): bump the development-dependencies group with 7 updates
  • e089511 build(deps): bump the go-openapi-dependencies group across 15 directories wit...
  • Additional commits viewable in compare view

Updates github.com/sigstore/rekor-tiles/v2 from 2.2.2-0.20260601073857-5d098a2b6443 to 2.3.0

Release notes

Sourced from github.com/sigstore/rekor-tiles/v2's releases.

v2.3.0

What's Changed

v2.3.0 drops support for the DSSE entry type. All Sigstore SDKs will now upload DSSEs as hashedrekord entries, to support uploading large DSSEs, such as signed SBOMs, for the public instance. We strongly recommend not relying on the previous DSSE type in any way, as going forward, there will only be one supported entry type.

Breaking Changes

Library Features

Fixes

Full Changelog: sigstore/rekor-tiles@v2.2.1...v2.3.0

Commits

Updates golang.org/x/crypto from 0.52.0 to 0.53.0

Commits
  • 45460e0 go.mod: update golang.org/x dependencies
  • d37c95e pkcs12: limit PBKDF iteration count to prevent CPU exhaustion
  • e2ffffe ssh: reject incomplete gssapi-with-mic configurations
  • 60e158a ssh/test: isolate CLI tests from user SSH config and agent
  • 1b77d23 ssh/knownhosts: reject lines with multiple or unknown markers
  • 3872a2b ssh/knownhosts: verify declared key type matches decoded key
  • 9f72ecc ssh/knownhosts: treat only ASCII space and tab as whitespace
  • 8f405a4 ssh: validate ECDSA curve matches expected algorithm
  • bb41b3d ssh: improve DH GEX group selection using PreferredBits
  • e04e721 ssh/agent: validate ed25519 private key length in Add
  • Additional commits viewable in compare view

Updates golang.org/x/mod from 0.36.0 to 0.37.0

Commits
  • deb1dfc go.mod: update golang.org/x dependencies
  • 087f651 modfile: use slices.Backward
  • 343ee60 x/mod: allow for aggressively conslidating requires
  • See full diff in compare view

Updates github.com/google/go-containerregistry from 0.21.6 to 0.21.7

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.21.7

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.21.6...v0.21.7

Commits
  • c68d899 Bump go version to 1.26.4 (#2350)
  • da61d86 transport: do not re-attach bearer token after cross-host redirect (#2349)
  • 09fe1e5 fix(tarball): normalize paths when matching files (#2334)
  • 5baa399 build(deps): bump the go-deps group across 3 directories with 4 updates (#2348)
  • 97a8a17 fix(transport): apply refreshed bearer token after cross-host redirect (#2337)
  • e963497 internal/gzip: fix goroutine leak in ReadCloserLevel (#2347)
  • 02649ea fix: prevent SSRF in google.List() pagination (#2332)
  • 7204b40 build(deps): bump the actions group across 1 directory with 2 updates (#2344)
  • 4cfaa93 build(deps): bump the go-deps group across 1 directory with 2 updates (#2343)
  • 6849394 pkg/registry: export RedirectError (#2177)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the minor-patch group across 2 directories with 7 updates
7d3b745 
Bumps the minor-patch group with 4 updates in the / directory: [github.com/go-openapi/runtime](https://github.com/go-openapi/runtime), [github.com/go-openapi/strfmt](https://github.com/go-openapi/strfmt), [github.com/sigstore/rekor-tiles/v2](https://github.com/sigstore/rekor-tiles) and [golang.org/x/mod](https://github.com/golang/mod).
Bumps the minor-patch group with 1 update in the /examples/oci-image-verification directory: [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry).


Updates `github.com/go-openapi/runtime` from 0.32.3 to 0.32.4
- [Release notes](https://github.com/go-openapi/runtime/releases)
- [Commits](go-openapi/runtime@v0.32.3...v0.32.4)

Updates `github.com/go-openapi/strfmt` from 0.26.3 to 0.26.4
- [Release notes](https://github.com/go-openapi/strfmt/releases)
- [Commits](go-openapi/strfmt@v0.26.3...v0.26.4)

Updates `github.com/go-openapi/swag/conv` from 0.26.0 to 0.26.1
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.26.0...v0.26.1)

Updates `github.com/sigstore/rekor-tiles/v2` from 2.2.2-0.20260601073857-5d098a2b6443 to 2.3.0
- [Release notes](https://github.com/sigstore/rekor-tiles/releases)
- [Changelog](https://github.com/sigstore/rekor-tiles/blob/main/RELEASE.md)
- [Commits](https://github.com/sigstore/rekor-tiles/commits/v2.3.0)

Updates `golang.org/x/crypto` from 0.52.0 to 0.53.0
- [Commits](golang/crypto@v0.52.0...v0.53.0)

Updates `golang.org/x/mod` from 0.36.0 to 0.37.0
- [Commits](golang/mod@v0.36.0...v0.37.0)

Updates `github.com/google/go-containerregistry` from 0.21.6 to 0.21.7
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](google/go-containerregistry@v0.21.6...v0.21.7)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/runtime
  dependency-version: 0.32.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: github.com/go-openapi/strfmt
  dependency-version: 0.26.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: github.com/go-openapi/swag/conv
  dependency-version: 0.26.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: github.com/sigstore/rekor-tiles/v2
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: golang.org/x/crypto
  dependency-version: 0.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: golang.org/x/mod
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.21.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jun 30, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner June 30, 2026 01:46
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jun 30, 2026
@Hayden-IO
Hayden-IO enabled auto-merge (squash) June 30, 2026 01:48
@Hayden-IO
Hayden-IO disabled auto-merge June 30, 2026 01:48
Hayden-IO
Hayden-IO reviewed Jun 30, 2026
View reviewed changes
Comment thread go.mod
module github.com/sigstore/sigstore-go

go 1.25.0
go 1.25.8

@Hayden-IO Hayden-IO Jun 30, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can't keep up the fight with keeping this as .0. sigstore/rekor-tiles#820 caused this. The best thing we can do is continue to shed dependencies.

@kommendorkapten kommendorkapten Jun 30, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Keeping the dependencies set small is admirable for sure!

@kommendorkapten
kommendorkapten merged commit d6ec891 into main Jun 30, 2026
13 checks passed
@kommendorkapten
kommendorkapten deleted the dependabot/go_modules/minor-patch-eb1a8e74ee branch June 30, 2026 07:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Hayden-IO Hayden-IO Hayden-IO approved these changes
@kommendorkapten kommendorkapten kommendorkapten approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Hayden-IO @kommendorkapten