volker.raschek/prometheus-postgres-exporter
1
1 Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

chore(deps): update dependency sigstore/cosign to v3.1.4 #217

Merged
CSRBot merged 1 commits from renovate/sigstore-cosign-3.x into master 2026-10-20 21:02:52 +02:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
CSRBot commented 2026-10-20 21:02:10 +02:00
Collaborator
Copy link
Copy source

This PR contains the following updates:

Package Update Change
sigstore/cosign patch v3.1.3 → v3.1.4

Release Notes

sigstore/cosign (sigstore/cosign)

v3.1.4

Compare Source

Changelog

  • 3428d3c Build releases with 1.27.3 (#​5177)
  • 821c9bf Add AGENTS.md, update contributors.md with reference to AI policy (#​5176)
  • cfeaa4a Implement cosign bundle create-from-container (#​5144)
  • e2d25b5 Mention windows builds in readme (#​5147)
  • 6a83f9a fix(verify): don't panic on a bundle entry with no hash (#​5127)
  • 0ea1cec refactor: remove uploadToRekor parameter from ConfirmPrivacyStatement
  • ff2a8f4 fix(sign): pass digest hash algorithm to underlying signer in SignData
  • 7757e8b fix(e2e): enable UseSignedTimestamps in *TSAMTLSWithSigningConfig
  • f624836 test(verify): add failure cases for new bundle verification
  • 907c3d8 fix(sign): propagate BundlePath from SignOptions to KeyOpts
  • 0c66ecd clean: update inaccurate warning (#​4909)
  • 67a1216 fix: write referrers when image index has attestations (#​5111)
  • ac3a927 fix(verify): enforce mutually exclusive key and security key (#​5124)
  • 048eff5 Reorder events in LoadTrustedMaterialAndSigningConfig
  • 43d83e8 fix(layout): preserve manifest artifactType in index.json when saving (#​4821)
  • 1dbbc36 fix(load): upload bundle layer blobs before manifest PUT
  • 81b61e2 fix: strip trailing whitespace from attached signature files/stdin (#​5058)
  • b327bba fix: clarify COSIGN_REPOSITORY error when repository path is missing
  • 3532c1d fix: include annotations in implied payload for offline verify
  • b84a076 Cap the bundle layer read in ociremote.Bundle
  • d39ab7c Align privacy statement prompt behavior (#​5076)
  • 559c58c copy annotations by key instead of copying obj (#​5103)
  • 37cf1bc Add org.opencontainers.image.title annotation to attestation layers (#​4498)
  • dd9ef85 feat: Add org.opencontainers.image.source label to images (#​5095)
  • 00c1772 refactor: extract signing flag validation (#​5070)
  • 39037f1 fix: restrict bundle signing and attestation to one artifact (#​5081)
  • 5b6e930 fix: pass missing OIDC flags to KeyOpts (#​5079)
  • 20c7516 fix(verify): support image indexes in local bundle discovery (#​5080)
  • 81fa4e9 fix(verify): propagate CommonVerifyOptions to VerifyCommand (#​5094)
  • 84effab fix: verify-blob should not force SHA256 for non-default key hash algorithms (#​5064)
  • e9af93f fix(providers): clearer errors when GitHub OIDC token request fails (#​5062)
  • 8b8c87b feat: --slot option argument shell completion (#​5057)
  • 0a5f602 Deprecate --use-signing-config (#​5056)
  • 990e273 fix: use correct Rekor URLs to activate privacy warning (#​5054)
  • 151d838 fix: only show public-instance privacy statement for the default Rekor URL (#​5042)
Thanks to all contributors!

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [sigstore/cosign](https://github.com/sigstore/cosign) | patch | `v3.1.3` → `v3.1.4` | --- ### Release Notes <details> <summary>sigstore/cosign (sigstore/cosign)</summary> ### [`v3.1.4`](https://github.com/sigstore/cosign/releases/tag/v3.1.4) [Compare Source](https://github.com/sigstore/cosign/compare/v3.1.3...v3.1.4) #### Changelog - [`3428d3c`](https://github.com/sigstore/cosign/commit/3428d3c2217e06f641de9f298ae597e2f85eb989) Build releases with 1.27.3 ([#&#8203;5177](https://github.com/sigstore/cosign/issues/5177)) - [`821c9bf`](https://github.com/sigstore/cosign/commit/821c9bf35ba3ff72fa2cfb1c833b316d74aa92e4) Add AGENTS.md, update contributors.md with reference to AI policy ([#&#8203;5176](https://github.com/sigstore/cosign/issues/5176)) - [`cfeaa4a`](https://github.com/sigstore/cosign/commit/cfeaa4a435c9d42cf724b3e1aac20c1cc09c4be7) Implement `cosign bundle create-from-container` ([#&#8203;5144](https://github.com/sigstore/cosign/issues/5144)) - [`e2d25b5`](https://github.com/sigstore/cosign/commit/e2d25b54f768bdaa868318651e453b7bbc53c0ce) Mention windows builds in readme ([#&#8203;5147](https://github.com/sigstore/cosign/issues/5147)) - [`6a83f9a`](https://github.com/sigstore/cosign/commit/6a83f9a2083343b89afc7431c2dda45fb5bf14e8) fix(verify): don't panic on a bundle entry with no hash ([#&#8203;5127](https://github.com/sigstore/cosign/issues/5127)) - [`0ea1cec`](https://github.com/sigstore/cosign/commit/0ea1cec1aad8edc3b06986ad4681bb8af256bca8) refactor: remove uploadToRekor parameter from ConfirmPrivacyStatement - [`ff2a8f4`](https://github.com/sigstore/cosign/commit/ff2a8f4ea297a3f6bd2a76be692ac2d8042bef89) fix(sign): pass digest hash algorithm to underlying signer in SignData - [`7757e8b`](https://github.com/sigstore/cosign/commit/7757e8b3e30f9d22a79b23fce3ce3f5b12a1d000) fix(e2e): enable UseSignedTimestamps in \*TSAMTLSWithSigningConfig - [`f624836`](https://github.com/sigstore/cosign/commit/f6248362195f3f457b71e38d0dc8c6c61fc67bbe) test(verify): add failure cases for new bundle verification - [`907c3d8`](https://github.com/sigstore/cosign/commit/907c3d899c0e5e8ea1c5ce78c23db6d9a9d40247) fix(sign): propagate BundlePath from SignOptions to KeyOpts - [`0c66ecd`](https://github.com/sigstore/cosign/commit/0c66ecdff337f647bbcb0259efe61a81e33a76e8) clean: update inaccurate warning ([#&#8203;4909](https://github.com/sigstore/cosign/issues/4909)) - [`67a1216`](https://github.com/sigstore/cosign/commit/67a1216d73f7a6f5450f050ff5c7d87b9442f624) fix: write referrers when image index has attestations ([#&#8203;5111](https://github.com/sigstore/cosign/issues/5111)) - [`ac3a927`](https://github.com/sigstore/cosign/commit/ac3a927375b7257dc4fa75e94c55e2231ff44242) fix(verify): enforce mutually exclusive key and security key ([#&#8203;5124](https://github.com/sigstore/cosign/issues/5124)) - [`048eff5`](https://github.com/sigstore/cosign/commit/048eff58950a5cb9e82ffb3f65d90b3b62407e08) Reorder events in LoadTrustedMaterialAndSigningConfig - [`43d83e8`](https://github.com/sigstore/cosign/commit/43d83e849099e1711613d24082003d8c2a724598) fix(layout): preserve manifest artifactType in index.json when saving ([#&#8203;4821](https://github.com/sigstore/cosign/issues/4821)) - [`1dbbc36`](https://github.com/sigstore/cosign/commit/1dbbc36ca42b8afc15b6d504acc6d4989405c8b8) fix(load): upload bundle layer blobs before manifest PUT - [`81b61e2`](https://github.com/sigstore/cosign/commit/81b61e249ca151253e8652a5d05c758b6ea54a86) fix: strip trailing whitespace from attached signature files/stdin ([#&#8203;5058](https://github.com/sigstore/cosign/issues/5058)) - [`b327bba`](https://github.com/sigstore/cosign/commit/b327bba1f03162829cc6c9aeb258e06b3ba17320) fix: clarify COSIGN\_REPOSITORY error when repository path is missing - [`3532c1d`](https://github.com/sigstore/cosign/commit/3532c1d092736825e12487ec5740cc262ee471a1) fix: include annotations in implied payload for offline verify - [`b84a076`](https://github.com/sigstore/cosign/commit/b84a0764645cd0ab42dee4bb9d75b97f16e86665) Cap the bundle layer read in ociremote.Bundle - [`d39ab7c`](https://github.com/sigstore/cosign/commit/d39ab7c81275e326733740015b712a48f084a175) Align privacy statement prompt behavior ([#&#8203;5076](https://github.com/sigstore/cosign/issues/5076)) - [`559c58c`](https://github.com/sigstore/cosign/commit/559c58cffced054c566b100ca4fad9a2a1242c64) copy annotations by key instead of copying obj ([#&#8203;5103](https://github.com/sigstore/cosign/issues/5103)) - [`37cf1bc`](https://github.com/sigstore/cosign/commit/37cf1bc49976f49bfbf7690a55b301efe480becd) Add org.opencontainers.image.title annotation to attestation layers ([#&#8203;4498](https://github.com/sigstore/cosign/issues/4498)) - [`dd9ef85`](https://github.com/sigstore/cosign/commit/dd9ef8589841c8c4b8fb6460b93b21165c356382) feat: Add org.opencontainers.image.source label to images ([#&#8203;5095](https://github.com/sigstore/cosign/issues/5095)) - [`00c1772`](https://github.com/sigstore/cosign/commit/00c17724d9e05a58af030a9f14eb82c177e6dcb2) refactor: extract signing flag validation ([#&#8203;5070](https://github.com/sigstore/cosign/issues/5070)) - [`39037f1`](https://github.com/sigstore/cosign/commit/39037f1c76986c6ba1ca36aa06064186c1f6a553) fix: restrict bundle signing and attestation to one artifact ([#&#8203;5081](https://github.com/sigstore/cosign/issues/5081)) - [`5b6e930`](https://github.com/sigstore/cosign/commit/5b6e93010c06276215fb59ce9398971fad60ec90) fix: pass missing OIDC flags to KeyOpts ([#&#8203;5079](https://github.com/sigstore/cosign/issues/5079)) - [`20c7516`](https://github.com/sigstore/cosign/commit/20c751629b990e4cbaa5d1524c3aea8ca2e3c41e) fix(verify): support image indexes in local bundle discovery ([#&#8203;5080](https://github.com/sigstore/cosign/issues/5080)) - [`81fa4e9`](https://github.com/sigstore/cosign/commit/81fa4e98171e84b34bd41d5d15040c6140677163) fix(verify): propagate CommonVerifyOptions to VerifyCommand ([#&#8203;5094](https://github.com/sigstore/cosign/issues/5094)) - [`84effab`](https://github.com/sigstore/cosign/commit/84effabfc90218daa4e4e73bb29bb45de9ef3304) fix: verify-blob should not force SHA256 for non-default key hash algorithms ([#&#8203;5064](https://github.com/sigstore/cosign/issues/5064)) - [`e9af93f`](https://github.com/sigstore/cosign/commit/e9af93ff293490fa2a7cb8088e712e21f11a5ded) fix(providers): clearer errors when GitHub OIDC token request fails ([#&#8203;5062](https://github.com/sigstore/cosign/issues/5062)) - [`8b8c87b`](https://github.com/sigstore/cosign/commit/8b8c87b68a75f70c12e1adf25f9bb87f24abea7e) feat: --slot option argument shell completion ([#&#8203;5057](https://github.com/sigstore/cosign/issues/5057)) - [`0a5f602`](https://github.com/sigstore/cosign/commit/0a5f602ff372628fe0872e6cf29e76dd43ab8841) Deprecate --use-signing-config ([#&#8203;5056](https://github.com/sigstore/cosign/issues/5056)) - [`990e273`](https://github.com/sigstore/cosign/commit/990e273c0072cf0ab6e57bdfe364586c43131010) fix: use correct Rekor URLs to activate privacy warning ([#&#8203;5054](https://github.com/sigstore/cosign/issues/5054)) - [`151d838`](https://github.com/sigstore/cosign/commit/151d838c1518818d171338fc5d4831bb388a46a5) fix: only show public-instance privacy statement for the default Rekor URL ([#&#8203;5042](https://github.com/sigstore/cosign/issues/5042)) ##### Thanks to all contributors! </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTYuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjExNi4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbInJlbm92YXRlL2F1dG9tZXJnZSIsInJlbm92YXRlL2dpdGh1Yi1hY3Rpb24iXX0=-->
CSRBot added 1 commit 2026-10-20 21:02:11 +02:00
chore(deps): update dependency sigstore/cosign to v3.1.4
Helm / helm-lint (push) Successful in 13s
Details
Helm / helm-unittest (push) Successful in 21s
Details
Helm / helm-lint (pull_request) Successful in 13s
Details
Helm / helm-unittest (pull_request) Successful in 16s
Details
e47eaf6f23
CODEOWNERS rules requested review from volker.raschek 2026-10-20 21:02:11 +02:00
CSRBot scheduled this pull request to auto merge when all checks succeed 2026-10-20 21:02:12 +02:00
CSRBot merged commit 72163590d1 into master 2026-10-20 21:02:52 +02:00
CSRBot deleted branch renovate/sigstore-cosign-3.x 2026-10-20 21:02:52 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
volker.raschek
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
CSRBot (CSRBot) volker.raschek (Markus Pesch)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: volker.raschek/prometheus-postgres-exporter#217