Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 5, 2025

Bumps github.com/sigstore/fulcio from 1.7.1 to 1.8.3.

Release notes

Sourced from github.com/sigstore/fulcio's releases.

v1.8.3

Changelog

v1.8.3 fixes GHSA-f83f-xpx7-ffpw

  • 3622f6e62cf74ff1477422a8c3aad4ca338ed047 update changelog for v1.8.3 release (#2234)
  • 765a0e57608b9ef390e1eeeea8595b9054c63a5a Merge commit from fork (#2233)
  • 90f8520e1754b20ba0cb33d412ee15006711b85f build(deps): bump github.com/coreos/go-oidc/v3 from 3.16.0 to 3.17.0 (#2225)
  • d88584108bf71c5d375a41a62c05de3c587bd35e build(deps): bump the all group across 1 directory with 6 updates (#2232)
  • a387888860bff3f4100d35aa5a63306bb545e702 build(deps): bump the all group with 4 updates (#2226)
  • 7b0c1a11da32a1eb485ea3368725028c4f3d35be build(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#2227)
  • f0a0d051798bb1869d79ba21fbb9b60bdd896664 build(deps): bump golang from e68f6a0 to 6981837 (#2222)
  • 4ed0ea1b43f96c571de5ed8b44a5703d6c5c2894 Switch docker env from ct_server to TesseraCT (#2210)
  • e902cf880ff56e6749725ea6d63299ab7b370c2d feat: Add support for skipping email_verified claim requirement per issuer (#2220)
  • c0fc26c2c1d8a1e16802dd466fb233d69d3ef35d Add basic E2E tests (#2230)
  • a4ee8608f0349bd546b33406417f8ff1a58b09b1 build(deps): bump sigstore/scaffolding/trillian_log_signer (#2228)
  • 51d916e167276404d153607f076e5a7fb8f30986 build(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 (#2216)
  • bd3a515d86c015a70fa7abd47511fcb1108aafcf add meta-issuer circleci block (#2215)
  • c4d47896482f470adaf09dc7706a54fd66311bfd add circleci info to fulcio (#2192)

Thanks for all contributors!

v1.8.2

This release also changes the format of the binary and container signature, which is now a Sigstore bundle. To verify a release, use the latest Cosign 3.x, verifying with cosign verify-blob --bundle <artifact>-keyless.sigstore.json <artifact>.

Testing

  • make email address in test cases rfc822 conformant (#2205)

v1.8.1

Same as v1.8.0, but with a fix for the CI build pipeline.

v1.8.0

Bug Fixes

  • fix: K8s API does not accept unauthorized requests (#2111)
  • fix: vault for enterprise expects only the key name (#2117)
  • fix(config): respect cacert on oidc-issuers (#2098)
  • Register /healthz endpoint when listening on duplex http/grpc port (#2046)

Features

  • feat: adds cert loading and key-match validation. (#2173)

... (truncated)

Changelog

Sourced from github.com/sigstore/fulcio's changelog.

v1.8.3

Vulnerability Fixes

Features

  • feat: Add support for skipping email_verified claim requirement per issuer (#2220)
  • add meta-issuer circleci block (#2215)
  • add circleci info to fulcio (#2192)

Testing

  • Add basic E2E tests (#2230)

v1.8.2

Testing

  • make email address in test cases rfc822 conformant (#2205)

v1.8.1

Same as v1.8.0, but with a fix for the CI build pipeline.

v1.8.0

Bug Fixes

  • fix: K8s API does not accept unauthorized requests (#2111)
  • fix: vault for enterprise expects only the key name (#2117)
  • fix(config): respect cacert on oidc-issuers (#2098)
  • Register /healthz endpoint when listening on duplex http/grpc port (#2046)

Features

  • feat: adds cert loading and key-match validation. (#2173)
  • expose gcp kms retry and timeout options (#2132)
  • server: Use warning log level for client errors (#2147)
  • Add workflow to periodically validate OIDC issuers (#2188)
  • Add Chainguard issuer (#2078)
  • Add logging for template error (#2194)
  • Add extension for deployment environment (#2190)

Removal

  • Remove cmd/create_tink_keyset (#2096)
Commits
  • 3622f6e update changelog for v1.8.3 release (#2234)
  • 765a0e5 Merge commit from fork (#2233)
  • 90f8520 build(deps): bump github.com/coreos/go-oidc/v3 from 3.16.0 to 3.17.0 (#2225)
  • d885841 build(deps): bump the all group across 1 directory with 6 updates (#2232)
  • a387888 build(deps): bump the all group with 4 updates (#2226)
  • 7b0c1a1 build(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#2227)
  • f0a0d05 build(deps): bump golang from e68f6a0 to 6981837 (#2222)
  • 4ed0ea1 Switch docker env from ct_server to TesseraCT (#2210)
  • e902cf8 feat: Add support for skipping email_verified claim requirement per issuer (#...
  • c0fc26c Add basic E2E tests (#2230)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) from 1.7.1 to 1.8.3.
- [Release notes](https://github.com/sigstore/fulcio/releases)
- [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md)
- [Commits](sigstore/fulcio@v1.7.1...v1.8.3)

---
updated-dependencies:
- dependency-name: github.com/sigstore/fulcio
  dependency-version: 1.8.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency label Dec 5, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant