Skip to content

build(deps): bump the go-dependencies group in /tools with 14 updates - #1956

Merged
rcaril merged 1 commit into
mainfrom
dependabot/go_modules/tools/go-dependencies-e1bbc1c4c3
Oct 28, 2026
Merged

build(deps): bump the go-dependencies group in /tools with 14 updates#1956
rcaril merged 1 commit into
mainfrom
dependabot/go_modules/tools/go-dependencies-e1bbc1c4c3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group in /tools with 14 updates:

Package From To
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager 0.4.16 0.4.17
github.com/aws/aws-sdk-go-v2/service/ecr 1.66.4 1.66.5
github.com/aws/aws-sdk-go-v2/service/ecrpublic 1.47.4 1.47.5
github.com/aws/aws-sdk-go-v2/service/kms 1.61.4 1.61.5
github.com/docker/cli 29.9.1+incompatible 29.9.2+incompatible
github.com/docker/docker-credential-helpers 0.9.10 0.9.12
github.com/go-openapi/validate 1.0.0 1.0.1
github.com/google/certificate-transparency-go 1.3.3 1.4.0
github.com/huandu/xstrings 1.6.2 1.6.3
github.com/sigstore/cosign/v3 3.1.3 3.1.4
github.com/sigstore/rekor 1.5.4 1.5.5
github.com/sigstore/timestamp-authority/v2 2.1.4 2.1.5
google.golang.org/api 0.304.0 0.306.0
google.golang.org/genproto/googleapis/rpc 0.0.0-20261005182115-fad411399dd8 0.0.0-20261019180522-ce908d29299b

Updates github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.4.16 to 0.4.17

Commits
  • a4cce72 Release 2026-10-19
  • b9fa987 Regenerated Clients
  • 6053b94 Update API model
  • 04c5879 EventBridge endpoint test only assert scheme + host (#3592)
  • acc7f17 Fix allow null values into non-sparse lists as zero-value (#3590)
  • 4486a31 s3/transfermanager: fix panic in concurrentReader when len(p) is smaller than...
  • fdedcfa Release 2026-10-14
  • b23ae98 Regenerated Clients
  • 3f0de9a Update endpoints model
  • 14be3b3 Update API model
  • Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/ecr from 1.66.4 to 1.66.5

Commits
  • a4cce72 Release 2026-10-19
  • b9fa987 Regenerated Clients
  • 6053b94 Update API model
  • 04c5879 EventBridge endpoint test only assert scheme + host (#3592)
  • acc7f17 Fix allow null values into non-sparse lists as zero-value (#3590)
  • 4486a31 s3/transfermanager: fix panic in concurrentReader when len(p) is smaller than...
  • fdedcfa Release 2026-10-14
  • b23ae98 Regenerated Clients
  • 3f0de9a Update endpoints model
  • 14be3b3 Update API model
  • Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/ecrpublic from 1.47.4 to 1.47.5

Commits

Updates github.com/aws/aws-sdk-go-v2/service/kms from 1.61.4 to 1.61.5

Commits

Updates github.com/docker/cli from 29.9.1+incompatible to 29.9.2+incompatible

Commits

Updates github.com/docker/docker-credential-helpers from 0.9.10 to 0.9.12

Release notes

Sourced from github.com/docker/docker-credential-helpers's releases.

v0.9.12

What's Changed

  • secretservice: Fix get_attribute ownership and NULL attribute

Full Changelog: docker/docker-credential-helpers@v0.9.11...v0.9.12

v0.9.11

What's Changed

  • update to go1.26.10
  • secretservice: free buffers returned by get and list
  • build(deps): bump docker/bake-action from 7.4.0 to 7.5.0

Full Changelog: docker/docker-credential-helpers@v0.9.10...v0.9.11

Commits
  • 29ae62c Merge pull request #477 from vvoland/secretservice-fix-ownership
  • 8077dee secretservice: Fix prefix matching of attribute names
  • 59a2f25 secretservice: Fix crash on items without cached attributes
  • 6d89904 secretservice: Return an owned copy of item attributes
  • 901c3e7 Merge pull request #474 from locker95/secretservice-free-cgo-buffers
  • 9502455 Merge pull request #476 from thaJeztah/bump_go2
  • d1948b3 Merge pull request #475 from docker/dependabot/github_actions/docker-actions-...
  • eb5849b update to go1.26.10
  • d61b6ab build(deps): bump docker/bake-action
  • 3b640f2 secretservice: free buffers returned by get and list
  • See full diff in compare view

Updates github.com/go-openapi/validate from 1.0.0 to 1.0.1

Release notes

Sourced from github.com/go-openapi/validate's releases.

v1.0.1

1.0.1 - 2026-10-20

Full Changelog: go-openapi/validate@v1.0.0...v1.0.1

10 commits in this release.

Documentation

Miscellaneous tasks

Updates

People who contributed to this release

validate license terms

License

Commits
  • 269dfbe chore: update strfmt and golang.org dependencies (#307)
  • 16f7a05 Recursion guard (#306)
  • d16ffd7 chore(deps): bump the go-openapi-dependencies group across 1 directory with 2...
  • 9b52ade chore(deps): bump the development-dependencies group with 9 updates
  • d56dbb5 doc: updated contributors file
  • 534d81d chore(deps): bump github.com/go-openapi/jsonpointer
  • 0ba214d chore(deps): bump github.com/go-openapi/errors
  • a30278f chore(deps): bump github.com/go-openapi/testify/v2
  • ea2780b chore(deps): bump the development-dependencies group with 9 updates
  • 9865f54 chore(deps): bump the go-openapi-dependencies group with 10 updates
  • See full diff in compare view

Updates github.com/google/certificate-transparency-go from 1.3.3 to 1.4.0

Release notes

Sourced from github.com/google/certificate-transparency-go's releases.

v1.4.0

Full Changelog: google/certificate-transparency-go@v1.3.3...v1.4.0

Changelog

Sourced from github.com/google/certificate-transparency-go's changelog.

CERTIFICATE-TRANSPARENCY-GO Changelog

HEAD

  • Bump trillian to v1.8.0, and drop tracing support by @​phbnf
  • Fix tls.Unmarshal decoding a Uint24 field from the start of the buffer instead of the field's offset by @​robstradling
  • Switch Ed25519 import from deprecated golang.org/x/crypto/ed25519 to stdlib crypto/ed25519 by @​JasonPowr
  • Added --emit_proxy_headers flag to ctfe by @​mhutchinson
Commits

Updates github.com/huandu/xstrings from 1.6.2 to 1.6.3

Release notes

Sourced from github.com/huandu/xstrings's releases.

Bug fixes for ExpandTabs, Squeeze, justification and first-rune case mapping

This release fixes invalid UTF-8 handling in ExpandTabs, Squeeze and the justification helpers, and makes FirstRuneToUpper / FirstRuneToLower honor all Unicode case mappings.

Most fixes preserve bytes which were not supposed to be changed. As a result, invalid UTF-8 bytes are no longer rewritten as U+FFFD in these functions; valid UTF-8 output is unchanged.

Bug fixes

ExpandTabs: invalid bytes after the first tab

ExpandTabs copied the input prefix before the first tab, but every later rune was written back with WriteRune. Invalid bytes decode to utf8.RuneError and were rewritten as U+FFFD, so the same byte was preserved before a tab and corrupted after it.

  • ExpandTabs("\t\xffx", 4) returned " \uFFFDx" instead of " \xffx".
  • ExpandTabs("\xff\t\xfe", 4) returned "\xff \uFFFD" instead of "\xff \xfe".

Non-tab bytes are now copied unchanged.

Squeeze: retained bytes and duplicate detection

Two separate issues affected invalid input:

  • After the first squeeze, retained runes were written with WriteRune, rewriting invalid bytes as U+FFFD: Squeeze("aa\xffb", "a") returned "a\uFFFDb" instead of "a\xffb", and even a non-matching pattern such as "z" changed the bytes (#73).
  • Duplicate detection compared decoded runes. Every invalid byte decodes to RuneError, so distinct invalid bytes, and an invalid byte next to a valid U+FFFD, were treated as repeated runes and collapsed: Squeeze("\xff\xfe", "") returned "\xff" and Squeeze("\xff\uFFFD", "") returned "\xff" (#76).

Retained bytes are now copied unchanged, and adjacent runes are compared by their original bytes. Identical bytes still squeeze normally when the rune is eligible for squeezing, while distinct sequences are kept.

LeftJustify, RightJustify, Center: truncated pad strings

When the pad string was cut in the middle of its runes, writePadString decoded each pad rune and wrote it back with WriteRune. Invalid bytes in that partial pad became U+FFFD, although complete pad repetitions were already copied unchanged.

  • LeftJustify("a", 3, "x\xffy") returned "ax\uFFFD" instead of "ax\xff".
  • RightJustify("a", 2, "\xffx") returned "\uFFFDa" instead of "\xffa".
  • Center("a", 4, "x\xffy") returned "xax\uFFFD" instead of "xax\xff".

Partial pad bytes are now copied unchanged (#75).

FirstRuneToUpper / FirstRuneToLower: Unicode case mappings outside Ll/Lu

The functions only changed the first rune when unicode.IsLower / unicode.IsUpper was true. Characters with case mappings outside those categories were skipped, including titlecase digraphs, Roman numerals and circled letters.

  • FirstRuneToUpper("Džuro") returned "Džuro" instead of "DŽuro".
  • FirstRuneToLower("Džuro") returned "Džuro" instead of "džuro".
  • FirstRuneToUpper("ⅳ chapter") returned "ⅳ chapter" instead of "Ⅳ chapter".
  • FirstRuneToUpper("ⓐ label") returned "ⓐ label" instead of "Ⓐ label".

The functions now apply unicode.ToUpper / unicode.ToLower and return the original string when the first rune has no mapping. Suffixes, uncased runes and invalid UTF-8 are handled as before (#72).

Behaviour changes

  • FirstRuneToUpper and FirstRuneToLower now change every rune with a standard Unicode simple case mapping, not only runes in Ll/Lu. This includes titlecase, letterlike and circled characters.
  • ExpandTabs, Squeeze, LeftJustify, RightJustify and Center now preserve invalid UTF-8 bytes instead of rewriting them as U+FFFD in the affected paths. The output is byte-preserving, but remains invalid UTF-8 if the input is invalid. Valid UTF-8 results are unchanged.

... (truncated)

Commits
  • 28aabeb Merge pull request #76 from huandu/fix/squeeze-byte-equality
  • 2584c02 Distinguish invalid bytes when squeezing strings
  • 51092b1 Merge pull request #75 from huandu/fix/justify-preserve-pad-bytes
  • 3ded970 Merge pull request #74 from yuefdev/fix/expandtabs-preserve-bytes-sol
  • 51da7c1 Merge pull request #73 from yuefdev/fix/squeeze-preserve-bytes
  • 2128155 Merge pull request #72 from ac1982/fix/first-rune-unicode-case
  • e9f44f0 Preserve pad bytes when justifying strings
  • 8292f9c Preserve untouched bytes when expanding tabs
  • 95eed7c Preserve untouched bytes when squeezing strings
  • 5225f07 Honor Unicode case mappings for the first rune
  • See full diff in compare view

Updates github.com/sigstore/cosign/v3 from 3.1.3 to 3.1.4

Release notes

Sourced from github.com/sigstore/cosign/v3's releases.

v3.1.4

Changelog

  • 3428d3c2217e06f641de9f298ae597e2f85eb989 Build releases with 1.27.3 (#5177)
  • 821c9bf35ba3ff72fa2cfb1c833b316d74aa92e4 Add AGENTS.md, update contributors.md with reference to AI policy (#5176)
  • cfeaa4a435c9d42cf724b3e1aac20c1cc09c4be7 Implement cosign bundle create-from-container (#5144)
  • e2d25b54f768bdaa868318651e453b7bbc53c0ce Mention windows builds in readme (#5147)
  • 6a83f9a2083343b89afc7431c2dda45fb5bf14e8 fix(verify): don't panic on a bundle entry with no hash (#5127)
  • 0ea1cec1aad8edc3b06986ad4681bb8af256bca8 refactor: remove uploadToRekor parameter from ConfirmPrivacyStatement
  • ff2a8f4ea297a3f6bd2a76be692ac2d8042bef89 fix(sign): pass digest hash algorithm to underlying signer in SignData
  • 7757e8b3e30f9d22a79b23fce3ce3f5b12a1d000 fix(e2e): enable UseSignedTimestamps in *TSAMTLSWithSigningConfig
  • f6248362195f3f457b71e38d0dc8c6c61fc67bbe test(verify): add failure cases for new bundle verification
  • 907c3d899c0e5e8ea1c5ce78c23db6d9a9d40247 fix(sign): propagate BundlePath from SignOptions to KeyOpts
  • 0c66ecdff337f647bbcb0259efe61a81e33a76e8 clean: update inaccurate warning (#4909)
  • 67a1216d73f7a6f5450f050ff5c7d87b9442f624 fix: write referrers when image index has attestations (#5111)
  • ac3a927375b7257dc4fa75e94c55e2231ff44242 fix(verify): enforce mutually exclusive key and security key (#5124)
  • 048eff58950a5cb9e82ffb3f65d90b3b62407e08 Reorder events in LoadTrustedMaterialAndSigningConfig
  • 43d83e849099e1711613d24082003d8c2a724598 fix(layout): preserve manifest artifactType in index.json when saving (#4821)
  • 1dbbc36ca42b8afc15b6d504acc6d4989405c8b8 fix(load): upload bundle layer blobs before manifest PUT
  • 81b61e249ca151253e8652a5d05c758b6ea54a86 fix: strip trailing whitespace from attached signature files/stdin (#5058)
  • b327bba1f03162829cc6c9aeb258e06b3ba17320 fix: clarify COSIGN_REPOSITORY error when repository path is missing
  • 3532c1d092736825e12487ec5740cc262ee471a1 fix: include annotations in implied payload for offline verify
  • b84a0764645cd0ab42dee4bb9d75b97f16e86665 Cap the bundle layer read in ociremote.Bundle
  • d39ab7c81275e326733740015b712a48f084a175 Align privacy statement prompt behavior (#5076)
  • 559c58cffced054c566b100ca4fad9a2a1242c64 copy annotations by key instead of copying obj (#5103)
  • 37cf1bc49976f49bfbf7690a55b301efe480becd Add org.opencontainers.image.title annotation to attestation layers (#4498)
  • dd9ef8589841c8c4b8fb6460b93b21165c356382 feat: Add org.opencontainers.image.source label to images (#5095)
  • 00c17724d9e05a58af030a9f14eb82c177e6dcb2 refactor: extract signing flag validation (#5070)
  • 39037f1c76986c6ba1ca36aa06064186c1f6a553 fix: restrict bundle signing and attestation to one artifact (#5081)
  • 5b6e93010c06276215fb59ce9398971fad60ec90 fix: pass missing OIDC flags to KeyOpts (#5079)
  • 20c751629b990e4cbaa5d1524c3aea8ca2e3c41e fix(verify): support image indexes in local bundle discovery (#5080)
  • 81fa4e98171e84b34bd41d5d15040c6140677163 fix(verify): propagate CommonVerifyOptions to VerifyCommand (#5094)
  • 84effabfc90218daa4e4e73bb29bb45de9ef3304 fix: verify-blob should not force SHA256 for non-default key hash algorithms (#5064)
  • e9af93ff293490fa2a7cb8088e712e21f11a5ded fix(providers): clearer errors when GitHub OIDC token request fails (#5062)
  • 8b8c87b68a75f70c12e1adf25f9bb87f24abea7e feat: --slot option argument shell completion (#5057)
  • 0a5f602ff372628fe0872e6cf29e76dd43ab8841 Deprecate --use-signing-config (#5056)
  • 990e273c0072cf0ab6e57bdfe364586c43131010 fix: use correct Rekor URLs to activate privacy warning (#5054)
  • 151d838c1518818d171338fc5d4831bb388a46a5 fix: only show public-instance privacy statement for the default Rekor URL (#5042)

Thanks to all contributors!

Commits
  • 0e48502 chore(deps): bump the gomod group across 1 directory with 6 updates (#5178)
  • 4e2efa3 chore(deps): bump the all group with 2 updates (#5173)
  • 3428d3c Build releases with 1.27.3 (#5177)
  • 8effbea chore(deps): bump the actions group with 6 updates (#5175)
  • 821c9bf Add AGENTS.md, update contributors.md with reference to AI policy (#5176)
  • cfeaa4a Implement cosign bundle create-from-container (#5144)
  • 63d9aa1 chore(deps): bump the actions group across 1 directory with 7 updates (#5166)
  • e2d25b5 Mention windows builds in readme (#5147)
  • 6a83f9a fix(verify): don't panic on a bundle entry with no hash (#5127)
  • 0ea1cec refactor: remove uploadToRekor parameter from ConfirmPrivacyStatement
  • Additional commits viewable in compare view

Updates github.com/sigstore/rekor from 1.5.4 to 1.5.5

Release notes

Sourced from github.com/sigstore/rekor's releases.

v1.5.5

Changelog

This release is built with Go 1.27.3 and updates the PGP dependency to no longer use the unmaintained x/crypto package.

  • 206912e3cf61ba3fed587896e10d4812411e6913 build releases w/ go 1.27.3 toolchain on golang-cross v1.27.2-0 (#3029)
  • 8ae33bde942047f3f8003a01625c577687c605d9 Replace cyberphone/json-canonicalization with encoding/json/jsontext (#3028)
  • 6da522bd9133aae992a1a725baeb4b093e447a1a Replace hashicorp/go-retryablehttp with std lib retry transport (#2933)
  • 2192dfbb5633472a97c1a8a33bb9167767fc0e32 re-implement pgp v3 signature support (#3018)
  • b7e5e99f66562fbbbba531303efe8f7278e14c17 feat: serve the API over TLS with a configurable TLS policy (#2920)
  • 37d393838e056aa397aa308ceda6f8b6498dcd30 fix broken sigv3 parsing, add tests (#2959)
  • d8bd80452e41ae5be1d792f391531ff742e8246b dsse parsing cpu/memory optimization (#2946)
  • db458f0eefd738dd4dfd0df8b451142b345716a3 ensure invalid treeIDs always return with 400 errors (#2958)
  • 9651c3f007a7afdd45f380b837f34d2e47f6b4f0 use WithCancel ctx for async tasks (#2947)
  • eee7d8d644f5713e3c1ace419425aa3ceadc46d7 Update 413 status code error handling (#2813)

Thanks for all contributors!

Changelog

Sourced from github.com/sigstore/rekor's changelog.

v1.5.5

Features

  • feat: serve the API over TLS with a configurable TLS policy (#2920)

Bug Fixes

  • re-implement pgp v3 signature support (#3018)
  • fix broken PGP sigv3 parsing, add tests (#2959)
  • ensure invalid treeIDs always return with 400 errors (#2958)
  • use WithCancel ctx for async tasks (#2947)
  • Update 413 status code error handling (#2813)

Improvements

  • Replace cyberphone/json-canonicalization with encoding/json/jsontext (#3028)
  • Replace hashicorp/go-retryablehttp with std lib retry transport (#2933)
  • Drop patch version from go directive in go.mod (#3027)
  • Bump sigstore/sigstore to v1.11, bump min Go version to 1.27, modernize code (#2992)
  • bump go-openapi and mysql driver (#2985)
  • remove gocovmerge for go tool cover (#2963)
  • build releases w/ go 1.27.0 toolchain (#2960)
  • dsse parsing cpu/memory optimization (#2946)
  • numerous upgraded dependencies
  • builds use go 1.27 (including JSON, gc improvements)

Contributors

  • Anitha Natarajan
  • Bob Callaway
  • Hayden
  • Radoslav Dimitrov
  • Stef Graces
Commits
  • 206912e build releases w/ go 1.27.3 toolchain on golang-cross v1.27.2-0 (#3029)
  • be7483f add changelog for v1.5.5 (#2961)
  • 8ae33bd Replace cyberphone/json-canonicalization with encoding/json/jsontext (#3028)
  • 6da522b Replace hashicorp/go-retryablehttp with std lib retry transport (#2933)
  • 2192dfb re-implement pgp v3 signature support (#3018)
  • 7a6bb48 build(deps): Bump github.com/go-chi/chi/v5 from 5.3.2 to 5.5.0 (#3022)
  • ec44788 build(deps): Bump golang.org/x/net from 0.59.0 to 0.61.0 (#3023)
  • 7582306 build(deps): Bump github.com/tink-crypto/tink-go/v2 from 2.8.0 to 2.9.0 (#3024)
  • 504f816 build(deps): Bump cloud.google.com/go/profiler from 0.6.0 to 0.7.0 (#3025)
  • fb3f514 build(deps): Bump google.com/cloudsdktool/google-cloud-cli (#3020)
  • Additional commits viewable in compare view

Updates github.com/sigstore/timestamp-authority/v2 from 2.1.4 to 2.1.5

Release notes

Sourced from github.com/sigstore/timestamp-authority/v2's releases.

v2.1.5

What's Changed

Full Changelog: sigstore/timestamp-authority@v2.1.4...v2.1.5

Commits
  • 58825e9 chore(deps): bump golang.org/x/net from 0.59.0 to 0.61.0 (#1522)
  • 0156561 chore(deps): bump zizmorcore/zizmor (#1521)
  • 8ca81a4 chore(deps): bump the actions group with 2 updates (#1523)
  • 7a5caea Drop patch version from go directive in go.mod (#1524)
  • 7420acb Reject an NTP request attempt count below one (#1520)
  • a471208 chore(deps): bump zizmorcore/zizmor (#1515)
  • e8fc944 chore(deps): bump the actions group with 3 updates (#1516)
  • abf9a2f chore(deps): bump github.com/prometheus/client_golang (#1518)
  • 5c2da9d chore(deps): bump actions/upload-artifact (#1514)
  • 49cb2c8 chore(deps): bump the gomod group with 2 updates (#1512)
  • Additional commits viewable in compare view

Updates google.golang.org/api from 0.304.0 to 0.306.0

Release notes

Sourced from google.golang.org/api's releases.

v0.306.0

0.306.0 (2026-10-20)

Features

Bug Fixes

  • gensupport: Defer chunk context cancellation until response body is closed (#3782) (ef4e011)

v0.305.0

0.305.0 (2026-10-18)

Features

Changelog

Sourced from google.golang.org/api's changelog.

0.306.0 (2026-10-20)

Features

Bug Fixes

  • gensupport: Defer chunk context cancellation until response body is closed (#3782) (ef4e011)

0.305.0 (2026-10-18)

Features

Commits

Updates google.golang.org/genproto/googleapis/rpc from 0.0.0-20261005182115-fad411399dd8 to 0.0.0-20261019180522-ce908d29299b

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the go-dependencies group in /tools with 14 updates
060ddfd 
Bumps the go-dependencies group in /tools with 14 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager](https://github.com/aws/aws-sdk-go-v2) | `0.4.16` | `0.4.17` |
| [github.com/aws/aws-sdk-go-v2/service/ecr](https://github.com/aws/aws-sdk-go-v2) | `1.66.4` | `1.66.5` |
| [github.com/aws/aws-sdk-go-v2/service/ecrpublic](https://github.com/aws/aws-sdk-go-v2) | `1.47.4` | `1.47.5` |
| [github.com/aws/aws-sdk-go-v2/service/kms](https://github.com/aws/aws-sdk-go-v2) | `1.61.4` | `1.61.5` |
| [github.com/docker/cli](https://github.com/docker/cli) | `29.9.1+incompatible` | `29.9.2+incompatible` |
| [github.com/docker/docker-credential-helpers](https://github.com/docker/docker-credential-helpers) | `0.9.10` | `0.9.12` |
| [github.com/go-openapi/validate](https://github.com/go-openapi/validate) | `1.0.0` | `1.0.1` |
| [github.com/google/certificate-transparency-go](https://github.com/google/certificate-transparency-go) | `1.3.3` | `1.4.0` |
| [github.com/huandu/xstrings](https://github.com/huandu/xstrings) | `1.6.2` | `1.6.3` |
| [github.com/sigstore/cosign/v3](https://github.com/sigstore/cosign) | `3.1.3` | `3.1.4` |
| [github.com/sigstore/rekor](https://github.com/sigstore/rekor) | `1.5.4` | `1.5.5` |
| [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority) | `2.1.4` | `2.1.5` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.304.0` | `0.306.0` |
| [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20261005182115-fad411399dd8` | `0.0.0-20261019180522-ce908d29299b` |


Updates `github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager` from 0.4.16 to 0.4.17
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@feature/s3/transfermanager/v0.4.16...feature/s3/transfermanager/v0.4.17)

Updates `github.com/aws/aws-sdk-go-v2/service/ecr` from 1.66.4 to 1.66.5
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/ecr/v1.66.4...service/ecr/v1.66.5)

Updates `github.com/aws/aws-sdk-go-v2/service/ecrpublic` from 1.47.4 to 1.47.5
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.47.4...v1.47.5)

Updates `github.com/aws/aws-sdk-go-v2/service/kms` from 1.61.4 to 1.61.5
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/fsx/v1.61.4...service/fsx/v1.61.5)

Updates `github.com/docker/cli` from 29.9.1+incompatible to 29.9.2+incompatible
- [Commits](docker/cli@v29.9.1...v29.9.2)

Updates `github.com/docker/docker-credential-helpers` from 0.9.10 to 0.9.12
- [Release notes](https://github.com/docker/docker-credential-helpers/releases)
- [Commits](docker/docker-credential-helpers@v0.9.10...v0.9.12)

Updates `github.com/go-openapi/validate` from 1.0.0 to 1.0.1
- [Release notes](https://github.com/go-openapi/validate/releases)
- [Commits](go-openapi/validate@v1.0.0...v1.0.1)

Updates `github.com/google/certificate-transparency-go` from 1.3.3 to 1.4.0
- [Release notes](https://github.com/google/certificate-transparency-go/releases)
- [Changelog](https://github.com/google/certificate-transparency-go/blob/master/CHANGELOG.md)
- [Commits](google/certificate-transparency-go@v1.3.3...v1.4.0)

Updates `github.com/huandu/xstrings` from 1.6.2 to 1.6.3
- [Release notes](https://github.com/huandu/xstrings/releases)
- [Commits](huandu/xstrings@v1.6.2...v1.6.3)

Updates `github.com/sigstore/cosign/v3` from 3.1.3 to 3.1.4
- [Release notes](https://github.com/sigstore/cosign/releases)
- [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md)
- [Commits](sigstore/cosign@v3.1.3...v3.1.4)

Updates `github.com/sigstore/rekor` from 1.5.4 to 1.5.5
- [Release notes](https://github.com/sigstore/rekor/releases)
- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)
- [Commits](sigstore/rekor@v1.5.4...v1.5.5)

Updates `github.com/sigstore/timestamp-authority/v2` from 2.1.4 to 2.1.5
- [Release notes](https://github.com/sigstore/timestamp-authority/releases)
- [Changelog](https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md)
- [Commits](sigstore/timestamp-authority@v2.1.4...v2.1.5)

Updates `google.golang.org/api` from 0.304.0 to 0.306.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.304.0...v0.306.0)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20261005182115-fad411399dd8 to 0.0.0-20261019180522-ce908d29299b
- [Commits](https://github.com/googleapis/go-genproto/commits)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager
  dependency-version: 0.4.17
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecr
  dependency-version: 1.66.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecrpublic
  dependency-version: 1.47.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/kms
  dependency-version: 1.61.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/docker/cli
  dependency-version: 29.9.2+incompatible
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/docker/docker-credential-helpers
  dependency-version: 0.9.12
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/go-openapi/validate
  dependency-version: 1.0.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/google/certificate-transparency-go
  dependency-version: 1.4.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/huandu/xstrings
  dependency-version: 1.6.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/sigstore/cosign/v3
  dependency-version: 3.1.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/sigstore/rekor
  dependency-version: 1.5.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/sigstore/timestamp-authority/v2
  dependency-version: 2.1.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: google.golang.org/api
  dependency-version: 0.306.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-version: 0.0.0-20261019180522-ce908d29299b
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the tools Indicates that a given PR updates the repo tooling. label Oct 28, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 28, 2026 16:53
@dependabot
dependabot Bot requested a review from rcaril October 28, 2026 16:53
@github-actions github-actions Bot added the Skip-Changelog do not add a changelog entry for this change label Oct 28, 2026
@rcaril
rcaril enabled auto-merge (squash) October 28, 2026 16:58
@rcaril
rcaril merged commit f2c89c4 into main Oct 28, 2026
22 of 33 checks passed
@rcaril
rcaril deleted the dependabot/go_modules/tools/go-dependencies-e1bbc1c4c3 branch October 28, 2026 17:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rcaril rcaril rcaril approved these changes

Assignees

No one assigned

Labels

Skip-Changelog do not add a changelog entry for this change tools Indicates that a given PR updates the repo tooling.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rcaril