Skip to content

🌱 Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 in /tools - #5121

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/tools/github.com/sigstore/sigstore-go-1.2.0
Closed

🌱 Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 in /tools#5121
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/tools/github.com/sigstore/sigstore-go-1.2.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0.

Release notes

Sourced from github.com/sigstore/sigstore-go's releases.

v1.2.0

What's Changed

New Contributors

... (truncated)

Commits
  • 8ca80c4 Fix conformance test failures for managed-key verification (#561) (#638)
  • 40d743a Bump the minor-patch group across 2 directories with 10 updates (#637)
  • 7960906 Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (#631)
  • ef6e924 Encode Rekor v2 DSSE envelopes as hashedrekord (#627)
  • 56c2528 Verify Rekor v2 inclusion using reconstructed leaf hash (#635)
  • dbb07e6 Prevent multi-log threshold bypasses via single compromised log (#633)
  • 7e8ee0f bundle: cap raw TlogEntries length before per-entry parse (#630)
  • 58c7950 Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 (#624)
  • 1ad51ea Bump github.com/in-toto/in-toto-golang (#623)
  • 566ec6c Bump sigstore/sigstore-conformance from 0.0.26 to 0.0.27 (#621)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 10, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 10, 2026 21:10
@dependabot
dependabot Bot requested review from AdamKorcz and spencerschrock and removed request for a team July 10, 2026 21:10
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 10, 2026
@dosubot dosubot Bot added the size:L This PR changes 100-499 lines, ignoring generated files. label Jul 10, 2026
@dependabot
dependabot Bot had a problem deploying to integration-test July 10, 2026 21:10 Failure
@github-actions

github-actions Bot commented Jul 21, 2026

Copy link
Copy Markdown

This pull request has been marked stale because it has been open for 10 days with no activity

@github-actions github-actions Bot added the Stale label Jul 21, 2026
@dependabot
🌱 Bump github.com/sigstore/sigstore-go in /tools
2f5a77c 
Bumps [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) from 1.1.4 to 1.2.0.
- [Release notes](https://github.com/sigstore/sigstore-go/releases)
- [Commits](sigstore/sigstore-go@v1.1.4...v1.2.0)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore-go
  dependency-version: 1.2.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/tools/github.com/sigstore/sigstore-go-1.2.0 branch from 96d3839 to 2f5a77c Compare July 27, 2026 08:24
@dependabot
dependabot Bot had a problem deploying to integration-test July 27, 2026 08:24 Failure
@kusari-inspector

kusari-inspector Bot commented Jul 27, 2026

Copy link
Copy Markdown

Kusari Inspector

Kusari Analysis Results:

Do not proceed without addressing issues

Caution

Flagged Issues Detected
These changes contain flagged issues that may introduce security risks.

While the code analysis found zero issues in the changed files (tools/go.mod and tools/go.sum), the dependency analysis identified three active vulnerabilities with available fixes that we strongly recommend addressing before merging. These are independent analyses and a clean code scan does not mitigate dependency-level risks. The critical concerns are: (1) google.golang.org/grpc v1.81.1 carries GHSA-hrxh-6v49-42gf with a CVSS 8.2 xDS RBAC Authorization Bypass and HTTP/2 Rapid Reset DoS — fix by pinning to v1.82.1 via 'go get google.golang.org/grpc@v1.82.1'; (2) golang.org/x/net v0.55.0 carries CVE-2026-46600, a DNS message parsing panic — fix by pinning to v0.57.0 via 'go get golang.org/x/net@v0.57.0'; (3) golang.org/x/text v0.37.0 carries CVE-2026-56852, an infinite loop DoS on invalid UTF-8 input — fix by pinning to v0.40.0 via 'go get golang.org/x/text@v0.40.0'. All three vulnerabilities have patched versions available and can be resolved with direct pins in go.mod using Go MVS. An additional informational advisory exists for golang.org/x/crypto/openpgp being unmaintained, but it is classified as unfixable at the transitive level and only applies if the project directly uses the openpgp sub-package. We strongly recommend resolving the three patchable vulnerabilities before merging.

Note

View full detailed analysis result for more information on the output and the checks that were run.

Required Dependency Mitigations

  • CRITICAL - google.golang.org/grpc v1.81.1 carries active advisory GHSA-hrxh-6v49-42gf (xDS RBAC Authorization Bypass CVSS 8.2, HTTP/2 Rapid Reset DoS CVSS 7.5, xDS RBAC Panic CVSS 5.9). This version is vulnerable both before and after this PR. Dependency path: github.com/goreleaser/goreleaser/v2 -> google.golang.org/grpc. Fix: Run 'go get google.golang.org/grpc@v1.82.1' to pin the fix directly in go.mod via Go MVS. The fixed version v1.82.1 is not yet picked up by the parent goreleaser dependency, so a direct pin is required.
  • HIGH - golang.org/x/net v0.55.0 carries active advisory GO-2026-5942 (CVE-2026-46600, DNS message parsing panic). The current version introduced in this PR is still vulnerable. Dependency paths: github.com/goreleaser/goreleaser/v2 -> golang.org/x/net and github.com/golangci/golangci-lint/v2 -> github.com/prometheus/client_golang -> golang.org/x/net. Fix: Run 'go get golang.org/x/net@v0.57.0' to pin the patched version directly in go.mod.
  • HIGH - golang.org/x/text v0.37.0 carries active advisory GO-2026-5970 (CVE-2026-56852, infinite loop on invalid UTF-8 input in norm.Iter). Both old and new versions are affected. Dependency paths: github.com/goreleaser/goreleaser/v2 -> golang.org/x/text and github.com/golangci/golangci-lint/v2 -> golang.org/x/text. Fix: Run 'go get golang.org/x/text@v0.40.0' to pin the patched version directly in go.mod.
  • INFO - golang.org/x/crypto v0.52.0 carries advisory GO-2026-5932 indicating the golang.org/x/crypto/openpgp sub-package is unmaintained, unsafe by design, and has known security issues. The vulnerability fix report classifies this as NO_FIX (unfixable at the transitive level). If the project uses golang.org/x/crypto/openpgp, consider migrating to github.com/ProtonMail/go-crypto/openpgp as a maintained drop-in replacement. If openpgp is not used, this advisory does not apply.

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: 2f5a77c, performed at: 2026-07-27T08:26:52Z

Found this helpful? Give it a 👍 or 👎 reaction!

@github-actions github-actions Bot removed the Stale label Jul 28, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #5151.

@dependabot dependabot Bot closed this Aug 1, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/tools/github.com/sigstore/sigstore-go-1.2.0 branch August 1, 2026 00:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@spencerschrock spencerschrock Awaiting requested review from spencerschrock spencerschrock is a code owner automatically assigned from ossf/scorecard-maintainers
@AdamKorcz AdamKorcz Awaiting requested review from AdamKorcz AdamKorcz is a code owner automatically assigned from ossf/scorecard-maintainers

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code size:L This PR changes 100-499 lines, ignoring generated files.

Projects

OpenSSF Scorecard
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants