Skip to content

chore(deps): bump github.com/sigstore/fulcio from 1.8.1 to 1.8.3 #1727

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
dependabot wants to merge 1 commit into from
Closed

chore(deps): bump github.com/sigstore/fulcio from 1.8.1 to 1.8.3 #1727

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 5, 2025 •
edited
Loading

Bumps github.com/sigstore/fulcio from 1.8.1 to 1.8.3.

Release notes

Sourced from github.com/sigstore/fulcio's releases.

v1.8.3

Changelog

v1.8.3 fixes GHSA-f83f-xpx7-ffpw

  • 3622f6e62cf74ff1477422a8c3aad4ca338ed047 update changelog for v1.8.3 release (#2234)
  • 765a0e57608b9ef390e1eeeea8595b9054c63a5a Merge commit from fork (#2233)
  • 90f8520e1754b20ba0cb33d412ee15006711b85f build(deps): bump github.com/coreos/go-oidc/v3 from 3.16.0 to 3.17.0 (#2225)
  • d88584108bf71c5d375a41a62c05de3c587bd35e build(deps): bump the all group across 1 directory with 6 updates (#2232)
  • a387888860bff3f4100d35aa5a63306bb545e702 build(deps): bump the all group with 4 updates (#2226)
  • 7b0c1a11da32a1eb485ea3368725028c4f3d35be build(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#2227)
  • f0a0d051798bb1869d79ba21fbb9b60bdd896664 build(deps): bump golang from e68f6a0 to 6981837 (#2222)
  • 4ed0ea1b43f96c571de5ed8b44a5703d6c5c2894 Switch docker env from ct_server to TesseraCT (#2210)
  • e902cf880ff56e6749725ea6d63299ab7b370c2d feat: Add support for skipping email_verified claim requirement per issuer (#2220)
  • c0fc26c2c1d8a1e16802dd466fb233d69d3ef35d Add basic E2E tests (#2230)
  • a4ee8608f0349bd546b33406417f8ff1a58b09b1 build(deps): bump sigstore/scaffolding/trillian_log_signer (#2228)
  • 51d916e167276404d153607f076e5a7fb8f30986 build(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 (#2216)
  • bd3a515d86c015a70fa7abd47511fcb1108aafcf add meta-issuer circleci block (#2215)
  • c4d47896482f470adaf09dc7706a54fd66311bfd add circleci info to fulcio (#2192)

Thanks for all contributors!

v1.8.2

This release also changes the format of the binary and container signature, which is now a Sigstore bundle. To verify a release, use the latest Cosign 3.x, verifying with cosign verify-blob --bundle <artifact>-keyless.sigstore.json <artifact>.

Testing

  • make email address in test cases rfc822 conformant (#2205)
Changelog

Sourced from github.com/sigstore/fulcio's changelog.

v1.8.3

Vulnerability Fixes

Features

  • feat: Add support for skipping email_verified claim requirement per issuer (#2220)
  • add meta-issuer circleci block (#2215)
  • add circleci info to fulcio (#2192)

Testing

  • Add basic E2E tests (#2230)

v1.8.2

Testing

  • make email address in test cases rfc822 conformant (#2205)
Commits
  • 3622f6e update changelog for v1.8.3 release (#2234)
  • 765a0e5 Merge commit from fork (#2233)
  • 90f8520 build(deps): bump github.com/coreos/go-oidc/v3 from 3.16.0 to 3.17.0 (#2225)
  • d885841 build(deps): bump the all group across 1 directory with 6 updates (#2232)
  • a387888 build(deps): bump the all group with 4 updates (#2226)
  • 7b0c1a1 build(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#2227)
  • f0a0d05 build(deps): bump golang from e68f6a0 to 6981837 (#2222)
  • 4ed0ea1 Switch docker env from ct_server to TesseraCT (#2210)
  • e902cf8 feat: Add support for skipping email_verified claim requirement per issuer (#...
  • c0fc26c Add basic E2E tests (#2230)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Dec 5, 2025
@dependabot dependabot bot requested a review from a team as a code owner December 5, 2025 18:20
@dependabot dependabot bot added the kind/chore chore, maintenance, etc. label Dec 5, 2025
@github-actions github-actions bot added the size/m Medium label Dec 5, 2025
@frewilhelm
Copy link
Contributor

frewilhelm commented Dec 5, 2025 •
edited
Loading

probably failing because of sigstore v1.10 (see open-component-model/ocm-project#780)

@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/sigstore/fulcio-1.8.3 branch 2 times, most recently from 1c5cdf5 to d7d46fb Compare December 15, 2025 09:58
@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/sigstore/fulcio-1.8.3 branch 4 times, most recently from 60c30b0 to 25c81d4 Compare December 22, 2025 14:25
@dependabot
chore(deps): bump github.com/sigstore/fulcio from 1.8.1 to 1.8.3
a0958e2 
Bumps [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) from 1.8.1 to 1.8.3.
- [Release notes](https://github.com/sigstore/fulcio/releases)
- [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md)
- [Commits](sigstore/fulcio@v1.8.1...v1.8.3)

---
updated-dependencies:
- dependency-name: github.com/sigstore/fulcio
  dependency-version: 1.8.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/sigstore/fulcio-1.8.3 branch from 25c81d4 to a0958e2 Compare December 23, 2025 09:34
@frewilhelm
Copy link
Contributor

frewilhelm commented Dec 23, 2025

@dependabot show github.com/sigstore/sigstore ignore conditions

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Dec 23, 2025

Ignore Conditions
Dependency Ignore Condition
github.com/sigstore/sigstore [> 1.9.6-0.20250729224751-181c5d3339b3]

@jakobmoellerdev
Copy link
Member

jakobmoellerdev commented Dec 23, 2025

superceded by #1757

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Dec 23, 2025

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot bot deleted the dependabot/go_modules/github.com/sigstore/fulcio-1.8.3 branch December 23, 2025 09:49
@frewilhelm
Copy link
Contributor

frewilhelm commented Dec 23, 2025

@dependabot unignore github.com/sigstore/sigstore

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Dec 23, 2025

OK, I will stop ignoring the github.com/sigstore/sigstore dependency.

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Dec 23, 2025

Looks like this PR is closed. If you re-open it I'll rebase it as long as no-one else has edited it (you can use @dependabot reopen if the branch has been deleted).

@frewilhelm
Copy link
Contributor

frewilhelm commented Dec 23, 2025

https://github.com/dependabot show github.com/sigstore/sigstore ignore conditions

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Dec 23, 2025

No ignore conditions found for the dependency github.com/sigstore/sigstore

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. size/m Medium

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@frewilhelm @jakobmoellerdev