volker.raschek/prometheus-postgres-exporter
1
1
Fork 0
Code Issues 1 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

chore(deps): update dependency sigstore/cosign to v3.1.3 #190

Open
CSRBot wants to merge 1 commits from renovate/sigstore-cosign-3.x into master
pull from: renovate/sigstore-cosign-3.x
merge into: :master
Conversation 0 Commits 1 Files Changed 1
+1 -1
CSRBot commented 2026-08-06 05:16:10 +02:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Update Change
sigstore/cosign patch v3.1.2 → v3.1.3

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

sigstore/cosign (sigstore/cosign)

v3.1.3

Compare Source

What's Changed

This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle.

  • Auto-detect default digest algorithm for public keys in #​5019
  • fix(pkcs11key): return an error instead of panicking when no key pair matches in #​5022
  • Supporting OCI Signing with X.509 Certificate Chain in #​4614
  • test(inspect): replace mock TSA client usage with local timestamp response generator in #​5021
  • fix: prevent shell completions for various options not taking filenames in #​5032
  • fix(blob): compare file checksums case-insensitively in #​5036
  • Verification bypass via public key in legacy bundle (GHSA-fx35-mq7g-6g98) in #​5040

Full Changelog: https://github.com/sigstore/cosign/compare/v3.1.2...v3.1.3

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [sigstore/cosign](https://github.com/sigstore/cosign) | patch | `v3.1.2` → `v3.1.3` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/156) for more information. --- ### Release Notes <details> <summary>sigstore/cosign (sigstore/cosign)</summary> ### [`v3.1.3`](https://github.com/sigstore/cosign/releases/tag/v3.1.3) [Compare Source](https://github.com/sigstore/cosign/compare/v3.1.2...v3.1.3) #### What's Changed This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle. - Auto-detect default digest algorithm for public keys in [#&#8203;5019](https://github.com/sigstore/cosign/pull/5019) - fix(pkcs11key): return an error instead of panicking when no key pair matches in [#&#8203;5022](https://github.com/sigstore/cosign/pull/5022) - Supporting OCI Signing with X.509 Certificate Chain in [#&#8203;4614](https://github.com/sigstore/cosign/pull/4614) - test(inspect): replace mock TSA client usage with local timestamp response generator in [#&#8203;5021](https://github.com/sigstore/cosign/pull/5021) - fix: prevent shell completions for various options not taking filenames in [#&#8203;5032](https://github.com/sigstore/cosign/pull/5032) - fix(blob): compare file checksums case-insensitively in [#&#8203;5036](https://github.com/sigstore/cosign/pull/5036) - Verification bypass via public key in legacy bundle (GHSA-fx35-mq7g-6g98) in [#&#8203;5040](https://github.com/sigstore/cosign/pull/5040) **Full Changelog**: <https://github.com/sigstore/cosign/compare/v3.1.2...v3.1.3> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODguMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4OC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbInJlbm92YXRlL2F1dG9tZXJnZSIsInJlbm92YXRlL2dpdGh1Yi1hY3Rpb24iXX0=-->
CSRBot added 1 commit 2026-08-06 05:16:10 +02:00
chore(deps): update dependency sigstore/cosign to v3.1.3
Helm / helm-lint (push) Failing after 0s
Details
Helm / helm-unittest (push) Failing after 1s
Details
Helm / helm-lint (pull_request) Failing after 1s
Details
Helm / helm-unittest (pull_request) Failing after 0s
Details
9cf7123761
CODEOWNERS rules requested review from volker.raschek 2026-08-06 05:16:10 +02:00
CSRBot scheduled this pull request to auto merge when all checks succeed 2026-08-06 05:16:13 +02:00
volker.raschek was assigned by CSRBot 2026-08-06 08:18:29 +02:00
Some required checks failed
Helm / helm-lint (push) Failing after 0s
Details
Helm / helm-unittest (push) Failing after 1s
Details
Helm / helm-lint (pull_request) Failing after 1s
Required
Details
Helm / helm-unittest (pull_request) Failing after 0s
Required
Details
Some required checks were not successful.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/sigstore-cosign-3.x:renovate/sigstore-cosign-3.x
git checkout renovate/sigstore-cosign-3.x
Sign in to join this conversation.
Reviewers
No Reviewers
volker.raschek
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
CSRBot (CSRBot) volker.raschek (Markus Pesch)
No Assignees volker.raschek
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: volker.raschek/prometheus-postgres-exporter#190