fix(deps): update go

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
github.com/coreos/go-oidc/v3	require	minor	v3.6.0 -> v3.8.0
github.com/go-openapi/strfmt	require	patch	v0.21.7 -> v0.21.8
github.com/google/go-cmp	require	minor	v0.5.9 -> v0.6.0
github.com/sigstore/rekor	require	minor	v1.2.2-0.20230530122220-67cc9e58bd23 -> v1.3.4
github.com/sigstore/sigstore	require	patch	v1.7.1 -> v1.7.6
github.com/spf13/cobra	require	minor	v1.7.0 -> v1.8.0
golang.org/x/oauth2	require	minor	v0.10.0 -> v0.15.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

coreos/go-oidc (github.com/coreos/go-oidc/v3)

v3.8.0

Compare Source

What's Changed

• support provider device_authorization_endpoint by @​cbodonnell in https://github.com/coreos/go-oidc/pull/365

New Contributors

• @​cbodonnell made their first contribution in https://github.com/coreos/go-oidc/pull/365

Full Changelog: coreos/go-oidc@v3.7.0...v3.8.0

v3.7.0

Compare Source

What's Changed

• io/ioutil deprecated by @​testwill in https://github.com/coreos/go-oidc/pull/380
• oidc: use %w verb for wrapping errors by @​rliebz in https://github.com/coreos/go-oidc/pull/381
• vulnerability: bump dependencies [CVE-2023-44487] by @​joshua-auchincloss in https://github.com/coreos/go-oidc/pull/393

New Contributors

• @​testwill made their first contribution in https://github.com/coreos/go-oidc/pull/380
• @​rliebz made their first contribution in https://github.com/coreos/go-oidc/pull/381
• @​joshua-auchincloss made their first contribution in https://github.com/coreos/go-oidc/pull/393

Full Changelog: coreos/go-oidc@v3.6.0...v3.7.0

go-openapi/strfmt (github.com/go-openapi/strfmt)

v0.21.8

Compare Source

google/go-cmp (github.com/google/go-cmp)

v0.6.0

Compare Source

New API:

• (#​340) Add cmpopts.EquateComparable

Documentation changes:

• (#​337) Use of hotlinking of Go identifiers

Build changes:

• (#​325) Remove purego fallbacks

Testing changes:

• (#​322) Run tests for Go 1.20 version
• (#​332) Pin GitHub action versions
• (#​327) set workflow permission to read-only

sigstore/rekor (github.com/sigstore/rekor)

v1.3.4

Compare Source

New Features

• add mysql indexstorage backend
• add s3 storage for attestations

Bug Fixes

• fix: Do not check for pubsub.topics.get on initialization (#​1853)
• fix optional field in cose schema

Quality Enhancements

• Update ranges.go (#​1852)
• update indexstorage interface to reduce roundtrips (#​1838)
• use a single validator library in rekor-cli (#​1818)
• Remove go-playground/validator dependency from pkg/pki (#​1817)

Contributors

• Bob Callaway
• Carlos Tadeu Panato Junior
• Hayden B
• James Alseth
• Kenny Leung
• Noah Kreiger
• Zach Steindler

v1.3.3

Compare Source

New Features

• update trillian to 1.5.3 (#​1803)
• adds redis_auth (#​1627)
• Add method to get artifact hash for an entry (#​1777)

Bug Fixes

• Update signer flag description (#​1804)
• install go at correct version for codeql (#​1762)

Quality Enhancements

• make e2e tests more usable with docker-compose (#​1770)

Contributors

• Bob Callaway
• Carlos Tadeu Panato Junior
• Hayden B
• ian hundere
• Kenny Leung

v1.3.2

Compare Source

• move to go 1.21.3 to pick up fixes for CVE-2023-39325

Bug Fixes

• build(deps): Bump golang.org/x/net from 0.16.0 to 0.17.0 (#​1753)
• build(deps): Bump github.com/google/go-cmp from 0.5.9 to 0.6.0 (#​1755)
• build(deps): Bump google/cloud-sdk from 449.0.0 to 450.0.0 (#​1757)
• build(deps): Bump google.golang.org/grpc from 1.58.2 to 1.58.3 (#​1754)
• update Dockerfile for go 1.21.3 (#​1752)
• update builder image to use go1.21.3 (#​1751)

Contributors

• Carlos Tadeu Panato Junior

v1.3.1

Compare Source

New Features

• enable GCP cloud profiling on rekor-server (#​1746)
• move index storage into interface (#​1741)
• add info to readme to denote additional documentation sources (#​1722)
• Add type of ed25519 key for TUF (#​1677)
• Allow parsing base64-encoded TUF metadata and root content (#​1671)

Quality Enhancements

• disable quota in trillian in test harness (#​1680)

Bug Fixes

• Update contact for code of conduct (#​1720)
• fix: typo (#​1711)
• Fix panic when parsing SSH SK pubkeys (#​1712)
• Correct index creation (#​1708)
• Update .ko.yaml (#​1682)
• docs: fixzes a small typo on the readme (#​1686)
• chore: fix backfill-redis Makefile target (#​1685)

Contributors

• Andres Galante
• Andrew Block
• Appu
• Bob Callaway
• Carlos Tadeu Panato Junior
• guangwu
• Hayden B
• jonvnadelberg
• Lance Ball

v1.3.0

Compare Source

New Features

• feat: Support publishing new log entries to Pub/Sub topics (#​1580)
• Change values of Identity.Raw, add fingerprints (#​1628)
• Extract all subjects from SANs for x509 verifier (#​1632)
• Fix type comment for Identity struct (#​1619)
• Refactor Identities API (#​1611)
• Refactor Verifiers to return multiple keys (#​1601)

Quality Enhancements

• set min go version to 1.21 (#​1651)
• Upgrade to go1.21 (#​1636)

Bug Fixes

• Update openapi.yaml (#​1655)
• pass transient errors through retrieveLogEntry (#​1653)
• return full entryID on HTTP 409 responses (#​1650)
• Update checkpoint link (#​1597)
• Use correct log index in inclusion proof (#​1599)
• remove instrumentation library (#​1595)
• pki: clean up fuzzer (#​1594)
• alpine: add max metadata size to fuzzer (#​1571)

Contributors

• AdamKorcz
• Appu
• Bob Callaway
• Carlos Tadeu Panato Junior
• Ceridwen Coghlan
• Hayden B
• James Alseth

sigstore/sigstore (github.com/sigstore/sigstore)

v1.7.6

Compare Source

What's Changed

• Fixes the error handling in kms/hashivault by @​PuneetPunamiya in https://github.com/sigstore/sigstore/pull/1497
• Fix cosign generate Azure key pair bug by @​malancas in https://github.com/sigstore/sigstore/pull/1525

Full Changelog: sigstore/sigstore@v1.7.5...v1.7.6

v1.7.5

Compare Source

What's Changed

• build(deps): bump cloud.google.com/go/kms from 1.15.2 to 1.15.3 in /pkg/signature/kms/gcp by @​dependabot in https://github.com/sigstore/sigstore/pull/1459
• build(deps): bump github.com/aws/aws-sdk-go-v2/service/kms from 1.24.6 to 1.24.7 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1458
• build(deps): bump github.com/sigstore/sigstore from 1.7.3 to 1.7.4 in /test/fuzz by @​dependabot in https://github.com/sigstore/sigstore/pull/1457
• build(deps): bump actions/checkout from 4.1.0 to 4.1.1 by @​dependabot in https://github.com/sigstore/sigstore/pull/1460
• build(deps): bump github.com/aws/aws-sdk-go from 1.45.25 to 1.45.27 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1462
• build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.18.45 to 1.19.0 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1461
• build(deps): bump github.com/aws/aws-sdk-go from 1.45.27 to 1.45.28 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1464
• build(deps): bump google.golang.org/api from 0.147.0 to 0.148.0 in /pkg/signature/kms/gcp by @​dependabot in https://github.com/sigstore/sigstore/pull/1463
• build(deps): bump github.com/aws/aws-sdk-go from 1.45.28 to 1.46.0 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1466
• Create POLICY.md for algs/KMS by @​haydentherapper in https://github.com/sigstore/sigstore/pull/1465
• build(deps): bump github.com/aws/aws-sdk-go from 1.46.0 to 1.46.1 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1468
• build(deps): bump github.com/aws/aws-sdk-go from 1.46.1 to 1.46.2 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1469
• build(deps): bump google.golang.org/grpc from 1.55.0 to 1.56.3 in /pkg/signature/kms/azure by @​dependabot in https://github.com/sigstore/sigstore/pull/1477
• build(deps): bump google.golang.org/grpc from 1.55.0 to 1.56.3 in /pkg/signature/kms/hashivault by @​dependabot in https://github.com/sigstore/sigstore/pull/1475
• build(deps): bump google.golang.org/grpc from 1.55.0 to 1.56.3 in /test/fuzz by @​dependabot in https://github.com/sigstore/sigstore/pull/1474
• build(deps): bump hashicorp/vault from 1.15.0 to 1.15.1 in /test/e2e by @​dependabot in https://github.com/sigstore/sigstore/pull/1472
• build(deps): bump github.com/aws/aws-sdk-go from 1.46.2 to 1.46.3 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1471
• build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.19.0 to 1.19.1 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1470
• build(deps): bump google.golang.org/grpc from 1.55.0 to 1.56.3 in /pkg/signature/kms/aws by @​dependabot in https://github.com/sigstore/sigstore/pull/1476
• build(deps): bump google.golang.org/grpc from 1.55.0 to 1.56.3 by @​dependabot in https://github.com/sigstore/sigstore/pull/1473
• build(deps): bump github.com/coreos/go-oidc/v3 from 3.6.0 to 3.7.0 by @​dependabot in https://github.com/sigstore/sigstore/pull/1467
• bump go-tuf to v0.6.1 by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1479

Full Changelog: sigstore/sigstore@v1.7.4...v1.7.5

v1.7.4

Compare Source

What's Changed

• upgrade ci to run go1.21 and set min go version to 1.20 by @​cpanato in https://github.com/sigstore/sigstore/pull/1372
• chore: Update the containers/image branch name by @​haiyuewa in https://github.com/sigstore/sigstore/pull/1403
• Handles the error in kms/hashivault by @​PuneetPunamiya in https://github.com/sigstore/sigstore/pull/1414
• update crypto/net/oauth2 dependencies by @​cpanato in https://github.com/sigstore/sigstore/pull/1435
• ensure e2e tests run on new KMS modules by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1441

New Contributors

• @​haiyuewa made their first contribution in https://github.com/sigstore/sigstore/pull/1403
• @​PuneetPunamiya made their first contribution in https://github.com/sigstore/sigstore/pull/1414

Full Changelog: sigstore/sigstore@v1.7.3...v1.7.4

v1.7.3

Compare Source

What's Changed

• chore: update go-containerregistry by @​k4leung4 in https://github.com/sigstore/sigstore/pull/1318
• fix(azure): RS512 should be used when key size is 512 by @​shaneing in https://github.com/sigstore/sigstore/pull/1331
• Add VerifySignature integration test and cleanup other tests and print statements by @​malancas in https://github.com/sigstore/sigstore/pull/1369

New Contributors

• @​shaneing made their first contribution in https://github.com/sigstore/sigstore/pull/1331

Full Changelog: sigstore/sigstore@v1.7.2...v1.7.3

v1.7.2

Compare Source

What's Changed

• fix race condition in unit test by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1263
• Specify hashes when comparing target meta. by @​kommendorkapten in https://github.com/sigstore/sigstore/pull/1247
• hide warning from setup-gcloud by @​bobcallaway in https://github.com/sigstore/sigstore/pull/1264
• Add support for additional Azure clouds (bug fix), add optional integration test by @​malancas in https://github.com/sigstore/sigstore/pull/1272
• Bump TUF root version by @​haydentherapper in https://github.com/sigstore/sigstore/pull/1312

Full Changelog: sigstore/sigstore@v1.7.1...v1.7.2

spf13/cobra (github.com/spf13/cobra)

v1.8.0

Compare Source

✨ Features

• Support usage as plugin for tools like kubectl by @​nirs in https://github.com/spf13/cobra/pull/2018 - this means that programs that utilize a "plugin-like" structure have much better support and usage (like for completions, command paths, etc.)
• Move documentation sources to site/content by @​umarcor in https://github.com/spf13/cobra/pull/1428
• Add 'one required flag' group by @​marevers in https://github.com/spf13/cobra/pull/1952 - this includes a new MarkFlagsOneRequired API for flags which can be used to mark a flag group as required and cause command failure if at least one is not used when invoked.
• Customizable error message prefix by @​5ouma in https://github.com/spf13/cobra/pull/2023 - This adds the SetErrPrefix and ErrPrefix APIs on the Command struct to allow for setting a custom prefix for errors
• feat: add getters for flag completions by @​avirtopeanu-ionos in https://github.com/spf13/cobra/pull/1943
• Feature: allow running persistent run hooks of all parents by @​vkhoroz in https://github.com/spf13/cobra/pull/2044
• Improve API to get flag completion function by @​marckhouzam in https://github.com/spf13/cobra/pull/2063

🐛 Bug fixes

• Fix typo in fish completions by @​twpayne in https://github.com/spf13/cobra/pull/1945
• Fix grammar: 'allows to' by @​supertassu in https://github.com/spf13/cobra/pull/1978
• powershell: escape variable with curly brackets by @​Luap99 in https://github.com/spf13/cobra/pull/1960
• Don't complete --help flag when flag parsing disabled by @​marckhouzam in https://github.com/spf13/cobra/pull/2061
• Replace all non-alphanumerics in active help env var program prefix by @​scop in https://github.com/spf13/cobra/pull/1940

🔧 Maintenance

• build(deps): bump golangci/golangci-lint-action from 3.4.0 to 3.5.0 by @​dependabot in https://github.com/spf13/cobra/pull/1971
• build(deps): bump golangci/golangci-lint-action from 3.5.0 to 3.6.0 by @​dependabot in https://github.com/spf13/cobra/pull/1976
• build(deps): bump golangci/golangci-lint-action from 3.6.0 to 3.7.0 by @​dependabot in https://github.com/spf13/cobra/pull/2021
• build(deps): bump actions/setup-go from 3 to 4 by @​dependabot in https://github.com/spf13/cobra/pull/1934
• build(deps): bump github.com/cpuguy83/go-md2man/v2 from 2.0.2 to 2.0.3 by @​dependabot in https://github.com/spf13/cobra/pull/2047
• build(deps): bump actions/checkout from 3 to 4 by @​dependabot in https://github.com/spf13/cobra/pull/2028
• command: temporarily disable G602 due to securego/gosec#1005 by @​umarcor in https://github.com/spf13/cobra/pull/2022

🧪 Testing & CI/CD

• test: make fish_completions_test more robust by @​branchvincent in https://github.com/spf13/cobra/pull/1980
• golangci: enable 'unused' and disable deprecated replaced by it by @​umarcor in https://github.com/spf13/cobra/pull/1983
• cleanup: minor corrections to unit tests by @​JunNishimura in https://github.com/spf13/cobra/pull/2003
• ci: test golang 1.21 by @​nunoadrego in https://github.com/spf13/cobra/pull/2024
• Fix linter errors by @​marckhouzam in https://github.com/spf13/cobra/pull/2052
• Add tests for flag completion registration by @​marckhouzam in https://github.com/spf13/cobra/pull/2053

✏️ Documentation

• doc: fix typo, Deperecated -> Deprecated by @​callthingsoff in https://github.com/spf13/cobra/pull/2000
• Add notes to doc about the execution condition of *PreRun and *PostRun functions by @​haoming29 in https://github.com/spf13/cobra/pull/2041

---

Thank you everyone who contributed to this release and all your hard work! Cobra and this community would never be possible without all of you!!!! 🐍

Full Changelog: spf13/cobra@v1.7.0...v1.8.0

---

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.