volker.raschek/db-wait
1
0
Fork 0
Code Issues 1 Pull Requests 2 Actions Packages Projects Releases 3 Wiki Activity

chore(deps): update dependency sigstore/cosign to v3.1.3 #263

Open
CSRBot wants to merge 1 commits from renovate/sigstore-cosign-3.x into master
pull from: renovate/sigstore-cosign-3.x
merge into: :master
Conversation 0 Commits 1 Files Changed 1
+1 -1
CSRBot commented 2026-08-06 05:05:08 +02:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Update Change
sigstore/cosign patch v3.1.2 → v3.1.3

Release Notes

sigstore/cosign (sigstore/cosign)

v3.1.3

Compare Source

What's Changed

This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle.

  • Auto-detect default digest algorithm for public keys in #​5019
  • fix(pkcs11key): return an error instead of panicking when no key pair matches in #​5022
  • Supporting OCI Signing with X.509 Certificate Chain in #​4614
  • test(inspect): replace mock TSA client usage with local timestamp response generator in #​5021
  • fix: prevent shell completions for various options not taking filenames in #​5032
  • fix(blob): compare file checksums case-insensitively in #​5036
  • Verification bypass via public key in legacy bundle (GHSA-fx35-mq7g-6g98) in #​5040

Full Changelog: https://github.com/sigstore/cosign/compare/v3.1.2...v3.1.3

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [sigstore/cosign](https://github.com/sigstore/cosign) | patch | `v3.1.2` → `v3.1.3` | --- ### Release Notes <details> <summary>sigstore/cosign (sigstore/cosign)</summary> ### [`v3.1.3`](https://github.com/sigstore/cosign/releases/tag/v3.1.3) [Compare Source](https://github.com/sigstore/cosign/compare/v3.1.2...v3.1.3) #### What's Changed This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle. - Auto-detect default digest algorithm for public keys in [#&#8203;5019](https://github.com/sigstore/cosign/pull/5019) - fix(pkcs11key): return an error instead of panicking when no key pair matches in [#&#8203;5022](https://github.com/sigstore/cosign/pull/5022) - Supporting OCI Signing with X.509 Certificate Chain in [#&#8203;4614](https://github.com/sigstore/cosign/pull/4614) - test(inspect): replace mock TSA client usage with local timestamp response generator in [#&#8203;5021](https://github.com/sigstore/cosign/pull/5021) - fix: prevent shell completions for various options not taking filenames in [#&#8203;5032](https://github.com/sigstore/cosign/pull/5032) - fix(blob): compare file checksums case-insensitively in [#&#8203;5036](https://github.com/sigstore/cosign/pull/5036) - Verification bypass via public key in legacy bundle (GHSA-fx35-mq7g-6g98) in [#&#8203;5040](https://github.com/sigstore/cosign/pull/5040) **Full Changelog**: <https://github.com/sigstore/cosign/compare/v3.1.2...v3.1.3> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODguMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE2LjEiLCJ0YXJnZXRCcmFuY2giOiJtYXN0ZXIiLCJsYWJlbHMiOlsicmVub3ZhdGUvYXV0b21lcmdlIiwicmVub3ZhdGUvZ2l0aHViLWFjdGlvbiJdfQ==-->
CSRBot added 1 commit 2026-08-06 05:05:09 +02:00
chore(deps): update dependency sigstore/cosign to v3.1.3
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (pull_request) Failing after 1s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (pull_request) Failing after 2s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (push) Failing after 0s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (pull_request) Failing after 1s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (push) Failing after 1s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (pull_request) Failing after 0s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (push) Failing after 1s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (push) Failing after 0s
Details
Lint Markdown files / Run markdown linter (pull_request) Failing after 1s
Details
b1f3deaeb1
CSRBot scheduled this pull request to auto merge when all checks succeed 2026-08-06 05:05:11 +02:00
volker.raschek was assigned by CSRBot 2026-08-06 08:05:22 +02:00
Some required checks failed
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (pull_request) Failing after 1s
Required
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (pull_request) Failing after 2s
Required
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (push) Failing after 0s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (pull_request) Failing after 1s
Required
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (push) Failing after 1s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (pull_request) Failing after 0s
Required
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (push) Failing after 1s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (push) Failing after 0s
Details
Lint Markdown files / Run markdown linter (pull_request) Failing after 1s
Required
Details
Some required checks were not successful.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/sigstore-cosign-3.x:renovate/sigstore-cosign-3.x
git checkout renovate/sigstore-cosign-3.x
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 renovate/rebase
Rebase branch on base branch via renovate
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
CSRBot (CSRBot) volker.raschek (Markus Pesch)
No Assignees volker.raschek
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: volker.raschek/db-wait#263