deps: bump the go_modules group across 1 directory with 4 updates - #2213
Merged
Quang Nguyen (nddq) merged 1 commit intoApr 20, 2026
Merged
Conversation
Bumps the go_modules group with 4 updates in the / directory: [github.com/moby/spdystream](https://github.com/moby/spdystream), [github.com/buger/jsonparser](https://github.com/buger/jsonparser), [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority) and [github.com/theupdateframework/go-tuf/v2](https://github.com/theupdateframework/go-tuf). Updates `github.com/moby/spdystream` from 0.5.0 to 0.5.1 - [Release notes](https://github.com/moby/spdystream/releases) - [Commits](moby/spdystream@v0.5.0...v0.5.1) Updates `github.com/buger/jsonparser` from 1.1.1 to 1.1.2 - [Release notes](https://github.com/buger/jsonparser/releases) - [Commits](buger/jsonparser@v1.1.1...v1.1.2) Updates `github.com/sigstore/timestamp-authority/v2` from 2.0.3 to 2.0.6 - [Release notes](https://github.com/sigstore/timestamp-authority/releases) - [Changelog](https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md) - [Commits](sigstore/timestamp-authority@v2.0.3...v2.0.6) Updates `github.com/theupdateframework/go-tuf/v2` from 2.3.0 to 2.4.1 - [Release notes](https://github.com/theupdateframework/go-tuf/releases) - [Commits](theupdateframework/go-tuf@v2.3.0...v2.4.1) --- updated-dependencies: - dependency-name: github.com/moby/spdystream dependency-version: 0.5.1 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/buger/jsonparser dependency-version: 1.1.2 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/sigstore/timestamp-authority/v2 dependency-version: 2.0.6 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/theupdateframework/go-tuf/v2 dependency-version: 2.4.1 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
area/dependencies
dependabot
Bot
added
area/dependencies
dependabot
Bot
requested review from
Simone Rodigari (SRodi) and
Qingchuan Hao (mainred)
April 20, 2026 20:46
Quang Nguyen (nddq)
approved these changes
Apr 20, 2026
Quang Nguyen (nddq)
enabled auto-merge
April 20, 2026 20:48
Quang Nguyen (nddq)
deleted the
dependabot/go_modules/go_modules-38fa76b6ac
branch
April 20, 2026 21:42
Laksh (lakshk98)
pushed a commit
to lakshk98/retina
that referenced
this pull request
Aug 4, 2026
…crosoft#2213) Bumps the go_modules group with 4 updates in the / directory: [github.com/moby/spdystream](https://github.com/moby/spdystream), [github.com/buger/jsonparser](https://github.com/buger/jsonparser), [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority) and [github.com/theupdateframework/go-tuf/v2](https://github.com/theupdateframework/go-tuf). Updates `github.com/moby/spdystream` from 0.5.0 to 0.5.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/moby/spdystream/releases">github.com/moby/spdystream's releases</a>.</em></p> <blockquote> <h2>v0.5.1</h2> <h2>What's Changed</h2> <h3>Security</h3> <p>Fix memory amplification in SPDY frame parsing leads to denial of service (<a href="https://github.com/moby/spdystream/security/advisories/GHSA-pc3f-x583-g7j2">CVE-2026-35469</a> / <a href="https://github.com/moby/spdystream/security/advisories/GHSA-pc3f-x583-g7j2">GHSA-pc3f-x583-g7j2</a>)</p> <h3>Changes</h3> <ul> <li>spdy: fix duplicate license headers, add LICENSE, PATENTS, and update NOTICE <a href="https://redirect.github.com/moby/spdystream/pull/106">moby/spdystream#106</a></li> <li>ci: update actions and test against latest Go versions <a href="https://redirect.github.com/moby/spdystream/pull/107">moby/spdystream#107</a></li> <li>use ioutil.Discard for go1.13 compatibility <a href="https://redirect.github.com/moby/spdystream/pull/109">moby/spdystream#109</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/moby/spdystream/compare/v0.5.0...v0.5.1">https://github.com/moby/spdystream/compare/v0.5.0...v0.5.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/moby/spdystream/commit/c59e5d73daa301bde452ea77545bdf51e32554a2"><code>c59e5d7</code></a> Merge pull request <a href="https://redirect.github.com/moby/spdystream/issues/109">#109</a> from thaJeztah/use_ioutil</li> <li><a href="https://github.com/moby/spdystream/commit/2fd0155e904f1f9b834b8460e8fdb8522bb59f84"><code>2fd0155</code></a> use ioutil.Discard for go1.13 compatibility</li> <li><a href="https://github.com/moby/spdystream/commit/ef6121f62c730110bf5ae604a865a8613bfb787f"><code>ef6121f</code></a> Merge commit from fork</li> <li><a href="https://github.com/moby/spdystream/commit/241cec95b8f02919845dc4758f1f5310fc886739"><code>241cec9</code></a> compare with signed Int for 32-bit Arm</li> <li><a href="https://github.com/moby/spdystream/commit/21c38640c8c8f43173b17e5bc6690a5fa25d6935"><code>21c3864</code></a> Add options to customize limits</li> <li><a href="https://github.com/moby/spdystream/commit/acf9b456d06816c5cf23bf3892e13441f947d5fd"><code>acf9b45</code></a> spdy: update godoc for MaxDataLength</li> <li><a href="https://github.com/moby/spdystream/commit/eb6360582bf1343f485ca87b76efc9e72b49d690"><code>eb63605</code></a> spdy: limit header-size and header-count</li> <li><a href="https://github.com/moby/spdystream/commit/2f21da42eaab90f03a82fb03d0de8e91eb1d0fc6"><code>2f21da4</code></a> spdy: fix header block byte accounting</li> <li><a href="https://github.com/moby/spdystream/commit/5976b6612f07a27f2e9a4de875485defb43b5d50"><code>5976b66</code></a> spdy: enforce 24-bit frame length limits</li> <li><a href="https://github.com/moby/spdystream/commit/cf0ec5d0fe4dbb2f3525f733946e0d0ddbfd5b13"><code>cf0ec5d</code></a> Guard against oversized SPDY frames</li> <li>Additional commits viewable in <a href="https://github.com/moby/spdystream/compare/v0.5.0...v0.5.1">compare view</a></li> </ul> </details> <br /> Updates `github.com/buger/jsonparser` from 1.1.1 to 1.1.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/buger/jsonparser/releases">github.com/buger/jsonparser's releases</a>.</em></p> <blockquote> <h2>v1.1.2</h2> <h2>What's Changed</h2> <ul> <li>Updated travis to build for 1.13 to 1.15 by <a href="https://github.com/janreggie"><code>@janreggie</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/225">buger/jsonparser#225</a></li> <li> <ul> <li>eliminate 2 allocations in EachKey() by <a href="https://github.com/Villenny"><code>@Villenny</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/223">buger/jsonparser#223</a></li> </ul> </li> <li>fix issue <a href="https://redirect.github.com/buger/jsonparser/issues/150">#150</a> (in deleting case) by <a href="https://github.com/daria-kay"><code>@daria-kay</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/226">buger/jsonparser#226</a></li> <li>fixing the oss-fuzz issue by <a href="https://github.com/daria-kay"><code>@daria-kay</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/227">buger/jsonparser#227</a></li> <li>Fix parseInt overflow check false negative by <a href="https://github.com/carsonip"><code>@carsonip</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/231">buger/jsonparser#231</a></li> <li>Added bespoke error for null cases by <a href="https://github.com/jonomacd"><code>@jonomacd</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/228">buger/jsonparser#228</a></li> <li>Fuzzing: Add CIFuzz by <a href="https://github.com/AdamKorcz"><code>@AdamKorcz</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/239">buger/jsonparser#239</a></li> <li>Added latest versions of go to tests by <a href="https://github.com/moredure"><code>@moredure</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/244">buger/jsonparser#244</a></li> <li>fix EachKey pIdxFlags allocation by <a href="https://github.com/unxcepted"><code>@unxcepted</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/241">buger/jsonparser#241</a></li> <li>fix: prevent panic on negative slice index in Delete with malformed JSON (GO-2026-4514) by <a href="https://github.com/dbarrosop"><code>@dbarrosop</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/276">buger/jsonparser#276</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/janreggie"><code>@janreggie</code></a> made their first contribution in <a href="https://redirect.github.com/buger/jsonparser/pull/225">buger/jsonparser#225</a></li> <li><a href="https://github.com/Villenny"><code>@Villenny</code></a> made their first contribution in <a href="https://redirect.github.com/buger/jsonparser/pull/223">buger/jsonparser#223</a></li> <li><a href="https://github.com/daria-kay"><code>@daria-kay</code></a> made their first contribution in <a href="https://redirect.github.com/buger/jsonparser/pull/226">buger/jsonparser#226</a></li> <li><a href="https://github.com/carsonip"><code>@carsonip</code></a> made their first contribution in <a href="https://redirect.github.com/buger/jsonparser/pull/231">buger/jsonparser#231</a></li> <li><a href="https://github.com/jonomacd"><code>@jonomacd</code></a> made their first contribution in <a href="https://redirect.github.com/buger/jsonparser/pull/228">buger/jsonparser#228</a></li> <li><a href="https://github.com/moredure"><code>@moredure</code></a> made their first contribution in <a href="https://redirect.github.com/buger/jsonparser/pull/244">buger/jsonparser#244</a></li> <li><a href="https://github.com/unxcepted"><code>@unxcepted</code></a> made their first contribution in <a href="https://redirect.github.com/buger/jsonparser/pull/241">buger/jsonparser#241</a></li> <li><a href="https://github.com/dbarrosop"><code>@dbarrosop</code></a> made their first contribution in <a href="https://redirect.github.com/buger/jsonparser/pull/276">buger/jsonparser#276</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/buger/jsonparser/compare/v1.1.1...v1.1.2">https://github.com/buger/jsonparser/compare/v1.1.1...v1.1.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/buger/jsonparser/commit/a69e7e01cd4ad67bdfd3ac2c080b9212af16f4b0"><code>a69e7e0</code></a> Merge pull request <a href="https://redirect.github.com/buger/jsonparser/issues/276">#276</a> from dbarrosop/master</li> <li><a href="https://github.com/buger/jsonparser/commit/d3eacc0bab779d6cf98221f5268828fff287876e"><code>d3eacc0</code></a> fix: prevent panic on negative slice index in Delete with malformed JSON (GO-...</li> <li><a href="https://github.com/buger/jsonparser/commit/61b32cfdfa0f5d368ef7c7daef28ce12d538740f"><code>61b32cf</code></a> Merge pull request <a href="https://redirect.github.com/buger/jsonparser/issues/241">#241</a> from unxcepted/master</li> <li><a href="https://github.com/buger/jsonparser/commit/2181e8398f18397c9cacbaea9889314bb585e868"><code>2181e83</code></a> Merge pull request <a href="https://redirect.github.com/buger/jsonparser/issues/244">#244</a> from ScaleChamp/patch-2</li> <li><a href="https://github.com/buger/jsonparser/commit/1510b5194182fc2fb898f28cdbceb42fd7258bfa"><code>1510b51</code></a> Added latest versions of go to tests</li> <li><a href="https://github.com/buger/jsonparser/commit/6fc2e488ed3cc4f1f1debec3b0c70715bd7be6fd"><code>6fc2e48</code></a> fix: eachkey allocation</li> <li><a href="https://github.com/buger/jsonparser/commit/a6f867eb7787e4ec54536b77b5d628ddf5c4f73d"><code>a6f867e</code></a> Merge pull request <a href="https://redirect.github.com/buger/jsonparser/issues/239">#239</a> from AdamKorcz/cifuzz1</li> <li><a href="https://github.com/buger/jsonparser/commit/cbc01fdbbe131706e89eeaaf0cd917760d8d3949"><code>cbc01fd</code></a> Fuzzing: Add CIFuzz</li> <li><a href="https://github.com/buger/jsonparser/commit/dc92d6932a1272b4d8f485f798a88c3a75106256"><code>dc92d69</code></a> Merge pull request <a href="https://redirect.github.com/buger/jsonparser/issues/228">#228</a> from jonomacd/null-handling</li> <li><a href="https://github.com/buger/jsonparser/commit/2d9d6343e8621ddc18c70749663f74bc584c0de4"><code>2d9d634</code></a> Merge pull request <a href="https://redirect.github.com/buger/jsonparser/issues/231">#231</a> from carsonip/fix-parseint-overflow-check</li> <li>Additional commits viewable in <a href="https://github.com/buger/jsonparser/compare/v1.1.1...v1.1.2">compare view</a></li> </ul> </details> <br /> Updates `github.com/sigstore/timestamp-authority/v2` from 2.0.3 to 2.0.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/timestamp-authority/releases">github.com/sigstore/timestamp-authority/v2's releases</a>.</em></p> <blockquote> <h2>v2.0.6</h2> <h2>What's Changed</h2> <ul> <li>Ensure correct certificate is used for TSA auth checks (GHSA-xm5m-wgh2-rrg3) by <a href="https://github.com/jku"><code>@jku</code></a> in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1333">sigstore/timestamp-authority#1333</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/timestamp-authority/compare/v2.0.5...v2.0.6">https://github.com/sigstore/timestamp-authority/compare/v2.0.5...v2.0.6</a></p> <h2>v2.0.5</h2> <h2>What's Changed</h2> <p>This release updates the chi middleware to resolve a panic.</p> <ul> <li>Update the semantics of the NTP monitoring so its clear in the README in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1276">sigstore/timestamp-authority#1276</a></li> <li>docs: note that CRL/OCSP checks are not performed in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1277">sigstore/timestamp-authority#1277</a></li> <li>Increase default HTTP idle timeout in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1287">sigstore/timestamp-authority#1287</a></li> <li>Upgrade chi middleware v4 -> v5 in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1307">sigstore/timestamp-authority#1307</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/timestamp-authority/compare/v2.0.4...v2.0.5">https://github.com/sigstore/timestamp-authority/compare/v2.0.4...v2.0.5</a></p> <h2>v2.0.4</h2> <h2>Changelog</h2> <ul> <li>5ddd4e6ad32117ae431eca6299ed9d29a6d33f5a update changelog for v2.0.4 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1258">#1258</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>chore(deps): bump go.step.sm/crypto from 0.74.0 to 0.75.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1239">sigstore/timestamp-authority#1239</a></li> <li>chore(deps): bump github.com/tink-crypto/tink-go-hcvault/v2 from 2.3.0 to 2.4.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1238">sigstore/timestamp-authority#1238</a></li> <li>chore(deps): bump github.com/go-openapi/errors from 0.22.4 to 0.22.5 in the gomod group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1240">sigstore/timestamp-authority#1240</a></li> <li>chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7 in the actions group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1241">sigstore/timestamp-authority#1241</a></li> <li>chore(deps): bump golang from <code>20b91ed</code> to <code>0ece421</code> by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1242">sigstore/timestamp-authority#1242</a></li> <li>chore(deps): bump golang.org/x/net from 0.47.0 to 0.48.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1244">sigstore/timestamp-authority#1244</a></li> <li>chore(deps): bump github.com/go-openapi/spec from 0.22.1 to 0.22.2 in the gomod group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1243">sigstore/timestamp-authority#1243</a></li> <li>chore(deps): bump golang from <code>0ece421</code> to <code>a22b2e6</code> by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1245">sigstore/timestamp-authority#1245</a></li> <li>chore(deps): bump the gomod group with 5 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1246">sigstore/timestamp-authority#1246</a></li> <li>chore(deps): bump github.com/tink-crypto/tink-go/v2 from 2.5.0 to 2.6.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1247">sigstore/timestamp-authority#1247</a></li> <li>chore(deps): bump the actions group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1248">sigstore/timestamp-authority#1248</a></li> <li>chore(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 in the gomod group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1249">sigstore/timestamp-authority#1249</a></li> <li>chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 in the actions group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1250">sigstore/timestamp-authority#1250</a></li> <li>chore(deps): bump actions/cache from 4.3.0 to 5.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1251">sigstore/timestamp-authority#1251</a></li> <li>chore(deps): bump golang from <code>a22b2e6</code> to <code>36b4f45</code> by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1253">sigstore/timestamp-authority#1253</a></li> <li>chore(deps): bump the gomod group with 5 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1254">sigstore/timestamp-authority#1254</a></li> <li>chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1257">sigstore/timestamp-authority#1257</a></li> <li>chore(deps): bump actions/cache from 5.0.0 to 5.0.1 in the actions group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1256">sigstore/timestamp-authority#1256</a></li> <li>chore(deps): bump github.com/go-playground/validator/v10 from 10.28.0 to 10.29.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1255">sigstore/timestamp-authority#1255</a></li> <li>update changelog for v2.0.4 by <a href="https://github.com/bobcallaway"><code>@bobcallaway</code></a> in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1258">sigstore/timestamp-authority#1258</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/timestamp-authority/compare/v2.0.3...v2.0.4">https://github.com/sigstore/timestamp-authority/compare/v2.0.3...v2.0.4</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md">github.com/sigstore/timestamp-authority/v2's changelog</a>.</em></p> <blockquote> <h1>v2.0.5</h1> <p>This release updates the chi middleware to resolve a panic.</p> <h2>Bug Fixes</h2> <ul> <li>Upgrade chi middleware v4 -> v5 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1307">#1307</a>)</li> </ul> <h2>Docs</h2> <ul> <li>Update the semantics of the NTP monitoring so its clear in the README (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1276">#1276</a>)</li> <li>docs: note that CRL/OCSP checks are not performed (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1277">#1277</a>)</li> </ul> <h2>Misc</h2> <ul> <li>Increase default HTTP idle timeout (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1287">#1287</a>)</li> </ul> <h1>v2.0.4</h1> <p>Only contains dependency updates, but fixes <a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1252">#1252</a> due to breaking API change in sigstore/sigstore</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/timestamp-authority/commit/9583b6186084a309cb6ccaf4323a29781901e962"><code>9583b61</code></a> Ensure correct certificate is used for TSA auth checks (GHSA-xm5m-wgh2-rrg3) ...</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/7aab8b4373e4ffdc6c7a1efa28856adf9f2efd40"><code>7aab8b4</code></a> chore(deps): bump golang.org/x/net from 0.51.0 to 0.52.0 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1322">#1322</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/48c7b2c9ed18208534c857533b7753d04fefd370"><code>48c7b2c</code></a> chore(deps): bump codecov/codecov-action from 5.5.3 to 6.0.0 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1327">#1327</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/49ca4e4f265d5a65bfc9d49615e1553359e1e181"><code>49ca4e4</code></a> chore(deps): bump the gomod group with 2 updates (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1326">#1326</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/5812ba002dafc8b5d10b19bc4e1da54d21aa159c"><code>5812ba0</code></a> chore(deps): bump go.step.sm/crypto from 0.76.2 to 0.77.2 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1328">#1328</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/6a334a895dc81be7b8c889e85c329cf85870ff10"><code>6a334a8</code></a> chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1329">#1329</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/d799204b84ac6ca1fcd98b35e6bf457a2944d55c"><code>d799204</code></a> chore(deps): bump actions/upload-artifact in the actions group (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1332">#1332</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/b9ce1025213a9101052aeaa5c2310c6ff8351173"><code>b9ce102</code></a> chore(deps): bump golang from 1.26.0 to 1.26.2 in the docker group (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1331">#1331</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/54bc0c1a0eaf516e088bf5fd90deee6fc88f3f60"><code>54bc0c1</code></a> chore(deps): bump the gomod group across 1 directory with 6 updates (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1324">#1324</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/ffb897a2e26b43963429537a019972db30d1f066"><code>ffb897a</code></a> chore(deps): bump the actions group across 1 directory with 4 updates (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1325">#1325</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/timestamp-authority/compare/v2.0.3...v2.0.6">compare view</a></li> </ul> </details> <br /> Updates `github.com/theupdateframework/go-tuf/v2` from 2.3.0 to 2.4.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/theupdateframework/go-tuf/releases">github.com/theupdateframework/go-tuf/v2's releases</a>.</em></p> <blockquote> <h2>v2.4.1</h2> <h2>What's Changed</h2> <ul> <li>chore(deps): bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/718">theupdateframework/go-tuf#718</a></li> <li>Enforce a stricter validation on the repo name for TAP 4 by <a href="https://github.com/rdimitrov"><code>@rdimitrov</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/720">theupdateframework/go-tuf#720</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/theupdateframework/go-tuf/compare/v2.4.0...v2.4.1">https://github.com/theupdateframework/go-tuf/compare/v2.4.0...v2.4.1</a></p> <h2>v2.4.0</h2> <h2>What's Changed</h2> <ul> <li>Add BitLength validation for SuccinctRoles by <a href="https://github.com/rdimitrov"><code>@rdimitrov</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/716">theupdateframework/go-tuf#716</a></li> <li>Add thread safety documentation for key types by <a href="https://github.com/rdimitrov"><code>@rdimitrov</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/715">theupdateframework/go-tuf#715</a></li> <li>Use restrictive permissions (0700) for cache directories by <a href="https://github.com/rdimitrov"><code>@rdimitrov</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/714">theupdateframework/go-tuf#714</a></li> <li>Breaking change: Replace panic with error return in Key.ID() by <a href="https://github.com/rdimitrov"><code>@rdimitrov</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/713">theupdateframework/go-tuf#713</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/theupdateframework/go-tuf/compare/v2.3.1...v2.4.0">https://github.com/theupdateframework/go-tuf/compare/v2.3.1...v2.4.0</a></p> <h2>v2.3.1</h2> <h2>What's Changed</h2> <ul> <li>chore(deps): bump golang.org/x/crypto from 0.40.0 to 0.45.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/702">theupdateframework/go-tuf#702</a></li> <li>Resolve govulncheck errors by bumping go to 1.24.11 by <a href="https://github.com/rdimitrov"><code>@rdimitrov</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/707">theupdateframework/go-tuf#707</a></li> <li>chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/704">theupdateframework/go-tuf#704</a></li> <li>modern go (1.20+) improvements by <a href="https://github.com/udf2457"><code>@udf2457</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/705">theupdateframework/go-tuf#705</a></li> <li>chore(deps): bump github.com/sigstore/sigstore from 1.9.5 to 1.10.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/706">theupdateframework/go-tuf#706</a></li> <li>chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.9.1 to 0.10.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/708">theupdateframework/go-tuf#708</a></li> <li>Perform type assertion by <a href="https://github.com/kommendorkapten"><code>@kommendorkapten</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/710">theupdateframework/go-tuf#710</a></li> <li>Add tests for failing type assertions by <a href="https://github.com/rdimitrov"><code>@rdimitrov</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/711">theupdateframework/go-tuf#711</a></li> <li>Verify threshold is valid by <a href="https://github.com/kommendorkapten"><code>@kommendorkapten</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/712">theupdateframework/go-tuf#712</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/theupdateframework/go-tuf/compare/v2.3.0...v2.3.1">https://github.com/theupdateframework/go-tuf/compare/v2.3.0...v2.3.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/theupdateframework/go-tuf/commit/d361e2ea24e427581343dee5c7a32b485d79fcc0"><code>d361e2e</code></a> Enforce a stricter validation on the repo name for TAP 4 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/720">#720</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/29aae36c83127913c24e881bc1f95dbb0f0961e6"><code>29aae36</code></a> chore(deps): bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/718">#718</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/bde5f18dc95dfac365fc452ee4e278e5fd66d4b4"><code>bde5f18</code></a> Replace panic with error return in Key.ID() (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/713">#713</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/f400bf4c20476804475d34239f01212e1041ec38"><code>f400bf4</code></a> Use restrictive permissions (0700) for cache directories (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/714">#714</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/d2dbc180e74f4fe371392bb0b02d5a8659bc2fa4"><code>d2dbc18</code></a> Add thread safety documentation for key types (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/715">#715</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/846cd4eccd92b1a333c89cb45cf4f179de74018f"><code>846cd4e</code></a> Add BitLength validation for SuccinctRoles (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/716">#716</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/b38d91fdbc69dfe31fe9230d97dafe527ea854a0"><code>b38d91f</code></a> Verify threshold is valid (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/712">#712</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/876cf2a82b320be6deb43f4ad629057b209a584e"><code>876cf2a</code></a> Add tests for failing type assertions (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/711">#711</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/73345ab6b0eb7e59d525dac17a428f043074cef6"><code>73345ab</code></a> Perform type assertion (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/710">#710</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/d3cdc4b2796d8c452ce17766f0cade2e80a3597d"><code>d3cdc4b</code></a> chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.9....</li> <li>Additional commits viewable in <a href="https://github.com/theupdateframework/go-tuf/compare/v2.3.0...v2.4.1">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/retina/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Laksh (lakshk98)
pushed a commit
to lakshk98/retina
that referenced
this pull request
Aug 4, 2026
…crosoft#2213) Bumps the go_modules group with 4 updates in the / directory: [github.com/moby/spdystream](https://github.com/moby/spdystream), [github.com/buger/jsonparser](https://github.com/buger/jsonparser), [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority) and [github.com/theupdateframework/go-tuf/v2](https://github.com/theupdateframework/go-tuf). Updates `github.com/moby/spdystream` from 0.5.0 to 0.5.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/moby/spdystream/releases">github.com/moby/spdystream's releases</a>.</em></p> <blockquote> <h2>v0.5.1</h2> <h2>What's Changed</h2> <h3>Security</h3> <p>Fix memory amplification in SPDY frame parsing leads to denial of service (<a href="https://github.com/moby/spdystream/security/advisories/GHSA-pc3f-x583-g7j2">CVE-2026-35469</a> / <a href="https://github.com/moby/spdystream/security/advisories/GHSA-pc3f-x583-g7j2">GHSA-pc3f-x583-g7j2</a>)</p> <h3>Changes</h3> <ul> <li>spdy: fix duplicate license headers, add LICENSE, PATENTS, and update NOTICE <a href="https://redirect.github.com/moby/spdystream/pull/106">moby/spdystream#106</a></li> <li>ci: update actions and test against latest Go versions <a href="https://redirect.github.com/moby/spdystream/pull/107">moby/spdystream#107</a></li> <li>use ioutil.Discard for go1.13 compatibility <a href="https://redirect.github.com/moby/spdystream/pull/109">moby/spdystream#109</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/moby/spdystream/compare/v0.5.0...v0.5.1">https://github.com/moby/spdystream/compare/v0.5.0...v0.5.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/moby/spdystream/commit/c59e5d73daa301bde452ea77545bdf51e32554a2"><code>c59e5d7</code></a> Merge pull request <a href="https://redirect.github.com/moby/spdystream/issues/109">#109</a> from thaJeztah/use_ioutil</li> <li><a href="https://github.com/moby/spdystream/commit/2fd0155e904f1f9b834b8460e8fdb8522bb59f84"><code>2fd0155</code></a> use ioutil.Discard for go1.13 compatibility</li> <li><a href="https://github.com/moby/spdystream/commit/ef6121f62c730110bf5ae604a865a8613bfb787f"><code>ef6121f</code></a> Merge commit from fork</li> <li><a href="https://github.com/moby/spdystream/commit/241cec95b8f02919845dc4758f1f5310fc886739"><code>241cec9</code></a> compare with signed Int for 32-bit Arm</li> <li><a href="https://github.com/moby/spdystream/commit/21c38640c8c8f43173b17e5bc6690a5fa25d6935"><code>21c3864</code></a> Add options to customize limits</li> <li><a href="https://github.com/moby/spdystream/commit/acf9b456d06816c5cf23bf3892e13441f947d5fd"><code>acf9b45</code></a> spdy: update godoc for MaxDataLength</li> <li><a href="https://github.com/moby/spdystream/commit/eb6360582bf1343f485ca87b76efc9e72b49d690"><code>eb63605</code></a> spdy: limit header-size and header-count</li> <li><a href="https://github.com/moby/spdystream/commit/2f21da42eaab90f03a82fb03d0de8e91eb1d0fc6"><code>2f21da4</code></a> spdy: fix header block byte accounting</li> <li><a href="https://github.com/moby/spdystream/commit/5976b6612f07a27f2e9a4de875485defb43b5d50"><code>5976b66</code></a> spdy: enforce 24-bit frame length limits</li> <li><a href="https://github.com/moby/spdystream/commit/cf0ec5d0fe4dbb2f3525f733946e0d0ddbfd5b13"><code>cf0ec5d</code></a> Guard against oversized SPDY frames</li> <li>Additional commits viewable in <a href="https://github.com/moby/spdystream/compare/v0.5.0...v0.5.1">compare view</a></li> </ul> </details> <br /> Updates `github.com/buger/jsonparser` from 1.1.1 to 1.1.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/buger/jsonparser/releases">github.com/buger/jsonparser's releases</a>.</em></p> <blockquote> <h2>v1.1.2</h2> <h2>What's Changed</h2> <ul> <li>Updated travis to build for 1.13 to 1.15 by <a href="https://github.com/janreggie"><code>@janreggie</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/225">buger/jsonparser#225</a></li> <li> <ul> <li>eliminate 2 allocations in EachKey() by <a href="https://github.com/Villenny"><code>@Villenny</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/223">buger/jsonparser#223</a></li> </ul> </li> <li>fix issue <a href="https://redirect.github.com/buger/jsonparser/issues/150">#150</a> (in deleting case) by <a href="https://github.com/daria-kay"><code>@daria-kay</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/226">buger/jsonparser#226</a></li> <li>fixing the oss-fuzz issue by <a href="https://github.com/daria-kay"><code>@daria-kay</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/227">buger/jsonparser#227</a></li> <li>Fix parseInt overflow check false negative by <a href="https://github.com/carsonip"><code>@carsonip</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/231">buger/jsonparser#231</a></li> <li>Added bespoke error for null cases by <a href="https://github.com/jonomacd"><code>@jonomacd</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/228">buger/jsonparser#228</a></li> <li>Fuzzing: Add CIFuzz by <a href="https://github.com/AdamKorcz"><code>@AdamKorcz</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/239">buger/jsonparser#239</a></li> <li>Added latest versions of go to tests by <a href="https://github.com/moredure"><code>@moredure</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/244">buger/jsonparser#244</a></li> <li>fix EachKey pIdxFlags allocation by <a href="https://github.com/unxcepted"><code>@unxcepted</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/241">buger/jsonparser#241</a></li> <li>fix: prevent panic on negative slice index in Delete with malformed JSON (GO-2026-4514) by <a href="https://github.com/dbarrosop"><code>@dbarrosop</code></a> in <a href="https://redirect.github.com/buger/jsonparser/pull/276">buger/jsonparser#276</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/janreggie"><code>@janreggie</code></a> made their first contribution in <a href="https://redirect.github.com/buger/jsonparser/pull/225">buger/jsonparser#225</a></li> <li><a href="https://github.com/Villenny"><code>@Villenny</code></a> made their first contribution in <a href="https://redirect.github.com/buger/jsonparser/pull/223">buger/jsonparser#223</a></li> <li><a href="https://github.com/daria-kay"><code>@daria-kay</code></a> made their first contribution in <a href="https://redirect.github.com/buger/jsonparser/pull/226">buger/jsonparser#226</a></li> <li><a href="https://github.com/carsonip"><code>@carsonip</code></a> made their first contribution in <a href="https://redirect.github.com/buger/jsonparser/pull/231">buger/jsonparser#231</a></li> <li><a href="https://github.com/jonomacd"><code>@jonomacd</code></a> made their first contribution in <a href="https://redirect.github.com/buger/jsonparser/pull/228">buger/jsonparser#228</a></li> <li><a href="https://github.com/moredure"><code>@moredure</code></a> made their first contribution in <a href="https://redirect.github.com/buger/jsonparser/pull/244">buger/jsonparser#244</a></li> <li><a href="https://github.com/unxcepted"><code>@unxcepted</code></a> made their first contribution in <a href="https://redirect.github.com/buger/jsonparser/pull/241">buger/jsonparser#241</a></li> <li><a href="https://github.com/dbarrosop"><code>@dbarrosop</code></a> made their first contribution in <a href="https://redirect.github.com/buger/jsonparser/pull/276">buger/jsonparser#276</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/buger/jsonparser/compare/v1.1.1...v1.1.2">https://github.com/buger/jsonparser/compare/v1.1.1...v1.1.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/buger/jsonparser/commit/a69e7e01cd4ad67bdfd3ac2c080b9212af16f4b0"><code>a69e7e0</code></a> Merge pull request <a href="https://redirect.github.com/buger/jsonparser/issues/276">#276</a> from dbarrosop/master</li> <li><a href="https://github.com/buger/jsonparser/commit/d3eacc0bab779d6cf98221f5268828fff287876e"><code>d3eacc0</code></a> fix: prevent panic on negative slice index in Delete with malformed JSON (GO-...</li> <li><a href="https://github.com/buger/jsonparser/commit/61b32cfdfa0f5d368ef7c7daef28ce12d538740f"><code>61b32cf</code></a> Merge pull request <a href="https://redirect.github.com/buger/jsonparser/issues/241">#241</a> from unxcepted/master</li> <li><a href="https://github.com/buger/jsonparser/commit/2181e8398f18397c9cacbaea9889314bb585e868"><code>2181e83</code></a> Merge pull request <a href="https://redirect.github.com/buger/jsonparser/issues/244">#244</a> from ScaleChamp/patch-2</li> <li><a href="https://github.com/buger/jsonparser/commit/1510b5194182fc2fb898f28cdbceb42fd7258bfa"><code>1510b51</code></a> Added latest versions of go to tests</li> <li><a href="https://github.com/buger/jsonparser/commit/6fc2e488ed3cc4f1f1debec3b0c70715bd7be6fd"><code>6fc2e48</code></a> fix: eachkey allocation</li> <li><a href="https://github.com/buger/jsonparser/commit/a6f867eb7787e4ec54536b77b5d628ddf5c4f73d"><code>a6f867e</code></a> Merge pull request <a href="https://redirect.github.com/buger/jsonparser/issues/239">#239</a> from AdamKorcz/cifuzz1</li> <li><a href="https://github.com/buger/jsonparser/commit/cbc01fdbbe131706e89eeaaf0cd917760d8d3949"><code>cbc01fd</code></a> Fuzzing: Add CIFuzz</li> <li><a href="https://github.com/buger/jsonparser/commit/dc92d6932a1272b4d8f485f798a88c3a75106256"><code>dc92d69</code></a> Merge pull request <a href="https://redirect.github.com/buger/jsonparser/issues/228">#228</a> from jonomacd/null-handling</li> <li><a href="https://github.com/buger/jsonparser/commit/2d9d6343e8621ddc18c70749663f74bc584c0de4"><code>2d9d634</code></a> Merge pull request <a href="https://redirect.github.com/buger/jsonparser/issues/231">#231</a> from carsonip/fix-parseint-overflow-check</li> <li>Additional commits viewable in <a href="https://github.com/buger/jsonparser/compare/v1.1.1...v1.1.2">compare view</a></li> </ul> </details> <br /> Updates `github.com/sigstore/timestamp-authority/v2` from 2.0.3 to 2.0.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/timestamp-authority/releases">github.com/sigstore/timestamp-authority/v2's releases</a>.</em></p> <blockquote> <h2>v2.0.6</h2> <h2>What's Changed</h2> <ul> <li>Ensure correct certificate is used for TSA auth checks (GHSA-xm5m-wgh2-rrg3) by <a href="https://github.com/jku"><code>@jku</code></a> in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1333">sigstore/timestamp-authority#1333</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/timestamp-authority/compare/v2.0.5...v2.0.6">https://github.com/sigstore/timestamp-authority/compare/v2.0.5...v2.0.6</a></p> <h2>v2.0.5</h2> <h2>What's Changed</h2> <p>This release updates the chi middleware to resolve a panic.</p> <ul> <li>Update the semantics of the NTP monitoring so its clear in the README in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1276">sigstore/timestamp-authority#1276</a></li> <li>docs: note that CRL/OCSP checks are not performed in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1277">sigstore/timestamp-authority#1277</a></li> <li>Increase default HTTP idle timeout in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1287">sigstore/timestamp-authority#1287</a></li> <li>Upgrade chi middleware v4 -> v5 in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1307">sigstore/timestamp-authority#1307</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/timestamp-authority/compare/v2.0.4...v2.0.5">https://github.com/sigstore/timestamp-authority/compare/v2.0.4...v2.0.5</a></p> <h2>v2.0.4</h2> <h2>Changelog</h2> <ul> <li>5ddd4e6ad32117ae431eca6299ed9d29a6d33f5a update changelog for v2.0.4 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1258">#1258</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>chore(deps): bump go.step.sm/crypto from 0.74.0 to 0.75.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1239">sigstore/timestamp-authority#1239</a></li> <li>chore(deps): bump github.com/tink-crypto/tink-go-hcvault/v2 from 2.3.0 to 2.4.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1238">sigstore/timestamp-authority#1238</a></li> <li>chore(deps): bump github.com/go-openapi/errors from 0.22.4 to 0.22.5 in the gomod group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1240">sigstore/timestamp-authority#1240</a></li> <li>chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7 in the actions group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1241">sigstore/timestamp-authority#1241</a></li> <li>chore(deps): bump golang from <code>20b91ed</code> to <code>0ece421</code> by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1242">sigstore/timestamp-authority#1242</a></li> <li>chore(deps): bump golang.org/x/net from 0.47.0 to 0.48.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1244">sigstore/timestamp-authority#1244</a></li> <li>chore(deps): bump github.com/go-openapi/spec from 0.22.1 to 0.22.2 in the gomod group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1243">sigstore/timestamp-authority#1243</a></li> <li>chore(deps): bump golang from <code>0ece421</code> to <code>a22b2e6</code> by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1245">sigstore/timestamp-authority#1245</a></li> <li>chore(deps): bump the gomod group with 5 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1246">sigstore/timestamp-authority#1246</a></li> <li>chore(deps): bump github.com/tink-crypto/tink-go/v2 from 2.5.0 to 2.6.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1247">sigstore/timestamp-authority#1247</a></li> <li>chore(deps): bump the actions group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1248">sigstore/timestamp-authority#1248</a></li> <li>chore(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 in the gomod group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1249">sigstore/timestamp-authority#1249</a></li> <li>chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 in the actions group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1250">sigstore/timestamp-authority#1250</a></li> <li>chore(deps): bump actions/cache from 4.3.0 to 5.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1251">sigstore/timestamp-authority#1251</a></li> <li>chore(deps): bump golang from <code>a22b2e6</code> to <code>36b4f45</code> by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1253">sigstore/timestamp-authority#1253</a></li> <li>chore(deps): bump the gomod group with 5 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1254">sigstore/timestamp-authority#1254</a></li> <li>chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1257">sigstore/timestamp-authority#1257</a></li> <li>chore(deps): bump actions/cache from 5.0.0 to 5.0.1 in the actions group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1256">sigstore/timestamp-authority#1256</a></li> <li>chore(deps): bump github.com/go-playground/validator/v10 from 10.28.0 to 10.29.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1255">sigstore/timestamp-authority#1255</a></li> <li>update changelog for v2.0.4 by <a href="https://github.com/bobcallaway"><code>@bobcallaway</code></a> in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1258">sigstore/timestamp-authority#1258</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/timestamp-authority/compare/v2.0.3...v2.0.4">https://github.com/sigstore/timestamp-authority/compare/v2.0.3...v2.0.4</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md">github.com/sigstore/timestamp-authority/v2's changelog</a>.</em></p> <blockquote> <h1>v2.0.5</h1> <p>This release updates the chi middleware to resolve a panic.</p> <h2>Bug Fixes</h2> <ul> <li>Upgrade chi middleware v4 -> v5 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1307">#1307</a>)</li> </ul> <h2>Docs</h2> <ul> <li>Update the semantics of the NTP monitoring so its clear in the README (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1276">#1276</a>)</li> <li>docs: note that CRL/OCSP checks are not performed (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1277">#1277</a>)</li> </ul> <h2>Misc</h2> <ul> <li>Increase default HTTP idle timeout (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1287">#1287</a>)</li> </ul> <h1>v2.0.4</h1> <p>Only contains dependency updates, but fixes <a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1252">#1252</a> due to breaking API change in sigstore/sigstore</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/timestamp-authority/commit/9583b6186084a309cb6ccaf4323a29781901e962"><code>9583b61</code></a> Ensure correct certificate is used for TSA auth checks (GHSA-xm5m-wgh2-rrg3) ...</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/7aab8b4373e4ffdc6c7a1efa28856adf9f2efd40"><code>7aab8b4</code></a> chore(deps): bump golang.org/x/net from 0.51.0 to 0.52.0 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1322">#1322</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/48c7b2c9ed18208534c857533b7753d04fefd370"><code>48c7b2c</code></a> chore(deps): bump codecov/codecov-action from 5.5.3 to 6.0.0 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1327">#1327</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/49ca4e4f265d5a65bfc9d49615e1553359e1e181"><code>49ca4e4</code></a> chore(deps): bump the gomod group with 2 updates (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1326">#1326</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/5812ba002dafc8b5d10b19bc4e1da54d21aa159c"><code>5812ba0</code></a> chore(deps): bump go.step.sm/crypto from 0.76.2 to 0.77.2 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1328">#1328</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/6a334a895dc81be7b8c889e85c329cf85870ff10"><code>6a334a8</code></a> chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1329">#1329</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/d799204b84ac6ca1fcd98b35e6bf457a2944d55c"><code>d799204</code></a> chore(deps): bump actions/upload-artifact in the actions group (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1332">#1332</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/b9ce1025213a9101052aeaa5c2310c6ff8351173"><code>b9ce102</code></a> chore(deps): bump golang from 1.26.0 to 1.26.2 in the docker group (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1331">#1331</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/54bc0c1a0eaf516e088bf5fd90deee6fc88f3f60"><code>54bc0c1</code></a> chore(deps): bump the gomod group across 1 directory with 6 updates (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1324">#1324</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/ffb897a2e26b43963429537a019972db30d1f066"><code>ffb897a</code></a> chore(deps): bump the actions group across 1 directory with 4 updates (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1325">#1325</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/timestamp-authority/compare/v2.0.3...v2.0.6">compare view</a></li> </ul> </details> <br /> Updates `github.com/theupdateframework/go-tuf/v2` from 2.3.0 to 2.4.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/theupdateframework/go-tuf/releases">github.com/theupdateframework/go-tuf/v2's releases</a>.</em></p> <blockquote> <h2>v2.4.1</h2> <h2>What's Changed</h2> <ul> <li>chore(deps): bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/718">theupdateframework/go-tuf#718</a></li> <li>Enforce a stricter validation on the repo name for TAP 4 by <a href="https://github.com/rdimitrov"><code>@rdimitrov</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/720">theupdateframework/go-tuf#720</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/theupdateframework/go-tuf/compare/v2.4.0...v2.4.1">https://github.com/theupdateframework/go-tuf/compare/v2.4.0...v2.4.1</a></p> <h2>v2.4.0</h2> <h2>What's Changed</h2> <ul> <li>Add BitLength validation for SuccinctRoles by <a href="https://github.com/rdimitrov"><code>@rdimitrov</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/716">theupdateframework/go-tuf#716</a></li> <li>Add thread safety documentation for key types by <a href="https://github.com/rdimitrov"><code>@rdimitrov</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/715">theupdateframework/go-tuf#715</a></li> <li>Use restrictive permissions (0700) for cache directories by <a href="https://github.com/rdimitrov"><code>@rdimitrov</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/714">theupdateframework/go-tuf#714</a></li> <li>Breaking change: Replace panic with error return in Key.ID() by <a href="https://github.com/rdimitrov"><code>@rdimitrov</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/713">theupdateframework/go-tuf#713</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/theupdateframework/go-tuf/compare/v2.3.1...v2.4.0">https://github.com/theupdateframework/go-tuf/compare/v2.3.1...v2.4.0</a></p> <h2>v2.3.1</h2> <h2>What's Changed</h2> <ul> <li>chore(deps): bump golang.org/x/crypto from 0.40.0 to 0.45.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/702">theupdateframework/go-tuf#702</a></li> <li>Resolve govulncheck errors by bumping go to 1.24.11 by <a href="https://github.com/rdimitrov"><code>@rdimitrov</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/707">theupdateframework/go-tuf#707</a></li> <li>chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/704">theupdateframework/go-tuf#704</a></li> <li>modern go (1.20+) improvements by <a href="https://github.com/udf2457"><code>@udf2457</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/705">theupdateframework/go-tuf#705</a></li> <li>chore(deps): bump github.com/sigstore/sigstore from 1.9.5 to 1.10.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/706">theupdateframework/go-tuf#706</a></li> <li>chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.9.1 to 0.10.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/708">theupdateframework/go-tuf#708</a></li> <li>Perform type assertion by <a href="https://github.com/kommendorkapten"><code>@kommendorkapten</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/710">theupdateframework/go-tuf#710</a></li> <li>Add tests for failing type assertions by <a href="https://github.com/rdimitrov"><code>@rdimitrov</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/711">theupdateframework/go-tuf#711</a></li> <li>Verify threshold is valid by <a href="https://github.com/kommendorkapten"><code>@kommendorkapten</code></a> in <a href="https://redirect.github.com/theupdateframework/go-tuf/pull/712">theupdateframework/go-tuf#712</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/theupdateframework/go-tuf/compare/v2.3.0...v2.3.1">https://github.com/theupdateframework/go-tuf/compare/v2.3.0...v2.3.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/theupdateframework/go-tuf/commit/d361e2ea24e427581343dee5c7a32b485d79fcc0"><code>d361e2e</code></a> Enforce a stricter validation on the repo name for TAP 4 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/720">#720</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/29aae36c83127913c24e881bc1f95dbb0f0961e6"><code>29aae36</code></a> chore(deps): bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/718">#718</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/bde5f18dc95dfac365fc452ee4e278e5fd66d4b4"><code>bde5f18</code></a> Replace panic with error return in Key.ID() (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/713">#713</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/f400bf4c20476804475d34239f01212e1041ec38"><code>f400bf4</code></a> Use restrictive permissions (0700) for cache directories (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/714">#714</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/d2dbc180e74f4fe371392bb0b02d5a8659bc2fa4"><code>d2dbc18</code></a> Add thread safety documentation for key types (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/715">#715</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/846cd4eccd92b1a333c89cb45cf4f179de74018f"><code>846cd4e</code></a> Add BitLength validation for SuccinctRoles (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/716">#716</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/b38d91fdbc69dfe31fe9230d97dafe527ea854a0"><code>b38d91f</code></a> Verify threshold is valid (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/712">#712</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/876cf2a82b320be6deb43f4ad629057b209a584e"><code>876cf2a</code></a> Add tests for failing type assertions (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/711">#711</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/73345ab6b0eb7e59d525dac17a428f043074cef6"><code>73345ab</code></a> Perform type assertion (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/710">#710</a>)</li> <li><a href="https://github.com/theupdateframework/go-tuf/commit/d3cdc4b2796d8c452ce17766f0cade2e80a3597d"><code>d3cdc4b</code></a> chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.9....</li> <li>Additional commits viewable in <a href="https://github.com/theupdateframework/go-tuf/compare/v2.3.0...v2.4.1">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/retina/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the go_modules group with 4 updates in the / directory: github.com/moby/spdystream, github.com/buger/jsonparser, github.com/sigstore/timestamp-authority/v2 and github.com/theupdateframework/go-tuf/v2.
Updates
github.com/moby/spdystreamfrom 0.5.0 to 0.5.1Release notes
Sourced from github.com/moby/spdystream's releases.
Commits
c59e5d7Merge pull request #109 from thaJeztah/use_ioutil2fd0155use ioutil.Discard for go1.13 compatibilityef6121fMerge commit from fork241cec9compare with signed Int for 32-bit Arm21c3864Add options to customize limitsacf9b45spdy: update godoc for MaxDataLengtheb63605spdy: limit header-size and header-count2f21da4spdy: fix header block byte accounting5976b66spdy: enforce 24-bit frame length limitscf0ec5dGuard against oversized SPDY framesUpdates
github.com/buger/jsonparserfrom 1.1.1 to 1.1.2Release notes
Sourced from github.com/buger/jsonparser's releases.
Commits
a69e7e0Merge pull request #276 from dbarrosop/masterd3eacc0fix: prevent panic on negative slice index in Delete with malformed JSON (GO-...61b32cfMerge pull request #241 from unxcepted/master2181e83Merge pull request #244 from ScaleChamp/patch-21510b51Added latest versions of go to tests6fc2e48fix: eachkey allocationa6f867eMerge pull request #239 from AdamKorcz/cifuzz1cbc01fdFuzzing: Add CIFuzzdc92d69Merge pull request #228 from jonomacd/null-handling2d9d634Merge pull request #231 from carsonip/fix-parseint-overflow-checkUpdates
github.com/sigstore/timestamp-authority/v2from 2.0.3 to 2.0.6Release notes
Sourced from github.com/sigstore/timestamp-authority/v2's releases.
Changelog
Sourced from github.com/sigstore/timestamp-authority/v2's changelog.
Commits
9583b61Ensure correct certificate is used for TSA auth checks (GHSA-xm5m-wgh2-rrg3) ...7aab8b4chore(deps): bump golang.org/x/net from 0.51.0 to 0.52.0 (#1322)48c7b2cchore(deps): bump codecov/codecov-action from 5.5.3 to 6.0.0 (#1327)49ca4e4chore(deps): bump the gomod group with 2 updates (#1326)5812ba0chore(deps): bump go.step.sm/crypto from 0.76.2 to 0.77.2 (#1328)6a334a8chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#1329)d799204chore(deps): bump actions/upload-artifact in the actions group (#1332)b9ce102chore(deps): bump golang from 1.26.0 to 1.26.2 in the docker group (#1331)54bc0c1chore(deps): bump the gomod group across 1 directory with 6 updates (#1324)ffb897achore(deps): bump the actions group across 1 directory with 4 updates (#1325)Updates
github.com/theupdateframework/go-tuf/v2from 2.3.0 to 2.4.1Release notes
Sourced from github.com/theupdateframework/go-tuf/v2's releases.
Commits
d361e2eEnforce a stricter validation on the repo name for TAP 4 (#720)29aae36chore(deps): bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 (#718)bde5f18Replace panic with error return in Key.ID() (#713)f400bf4Use restrictive permissions (0700) for cache directories (#714)d2dbc18Add thread safety documentation for key types (#715)846cd4eAdd BitLength validation for SuccinctRoles (#716)b38d91fVerify threshold is valid (#712)876cf2aAdd tests for failing type assertions (#711)73345abPerform type assertion (#710)d3cdc4bchore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.9....Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.