chore(deps): update dependency tuf to v5 - autoclosed

[renovate-rancher]

This PR contains the following updates:

Package	Update	Change
tuf	major	==3.1.0 -> ==5.1.0

---

Release Notes

theupdateframework/python-tuf (tuf)

v5.1.0

Compare Source

Changed

• ngclient: default user-agent was updated from "tuf/x.y.z" to "python-tuf/x.y.z" (#​2632)
• ngclient: max_root_rotations default value was bumped to 256 to prevent a too small value
  from creating issues in actual deployments were the embedded root is not easily
  updateable (#​2675)
• repository: do_snapshot() and do_timestamp() now always create new versions if current version
  is not correctly signed (#​2650)
• Various infrastructure and documentation improvements

v5.0.0

Compare Source

This release, most notably, marks stable securesystemslib v1.0.0 as minimum
requirement. The update causes a minor break in the new DSSE API (see below)
and affects users who also directly depend on securesystemslib. See the securesystemslib release
notes
and the updated python-tuf examples (#​2617) for details. ngclient API remains
backwards-compatible.

Changed

• DSSE API: change SimpleEnvelope.signatures type to dict, remove
  SimpleEnvelope.signatures_dict (#​2617)
• ngclient: support app-specific user-agents (#​2612)
• Various build, test and lint improvements

v4.0.0

Compare Source

This release is a small API change for Metadata API users (see below).
ngclient API is compatible but optional DSSE support has been added.

Added

• Added optional DSSE support to Metadata API and ngclient (#​2436)

Changed

• Metadata API: Improved verification functionality for repository users (#​2551):
  • This is an API change for Metadata API users (
    Root.get_verification_result() and Targets.get_verification_result()
    specifically)
  • Root.get_root_verification_result() has been added to handle the special
    case of root verification
• Started using UTC datetimes instead of naive datetimes internally (#​2573)
• Constrain securesystemslib dependency to <0.32.0 in preparation for future
  securesystemslib API changes
• Various build, test and lint improvements

v3.1.1

Compare Source

This is a security fix release to address advisory GHSA-77hh-43cm-v8j6. The issue does not affect tuf.ngclient users, but could affect tuf.api.metadata users.

Changed

• Added additional input validation to tuf.api.metadata.Targets.get_delegated_role()

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.