Skip to content

build(deps): bump github.com/sigstore/fulcio from 1.6.6 to 1.8.5#1311

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/github.com/sigstore/fulcio-1.8.5
Closed

build(deps): bump github.com/sigstore/fulcio from 1.6.6 to 1.8.5#1311
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/github.com/sigstore/fulcio-1.8.5

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 26, 2026 •
edited
Loading

Bumps github.com/sigstore/fulcio from 1.6.6 to 1.8.5.

Release notes

Sourced from github.com/sigstore/fulcio's releases.

v1.8.5

Changelog

This resolves GHSA-59jp-pj84-45mr - Server-side request forgery via MetaIssuer regex bypass

Thanks for all contributors!

v1.8.4

Changelog

  • f5bfa34740fc579523e2da9825ea575227331c6f build(deps): bump github.com/tink-crypto/tink-go/v2 from 2.5.0 to 2.6.0 (#2246)
  • 0039c980ab58e8cabf38d62fb80a607b5f21c0da build(deps): bump goa.design/goa/v3 from 3.22.6 to 3.23.4 (#2245)
  • 3a432f030f1dca4d088f1777f07947a85d1750cd build(deps): bump go.step.sm/crypto from 0.74.0 to 0.75.0 (#2238)
  • f3aba4a94150cad7eaa7dc0445e8cdf6cb037c23 build(deps): bump the all group across 1 directory with 4 updates (#2247)
  • e66a4c6f47d4052c7b38b84f081b26ca3191deb0 build(deps): bump the all group with 8 updates (#2244)
  • a846db6473f4be95443f3772914a15cc156be7b6 build(deps): bump golang from 20b91ed to a22b2e6 (#2243)
  • 5a012f5e4f9617fe649b08ec8531d1e8256577e4 update Run Invocation URI for circleci (#2242)
  • 59dde0af71dbeaa69b8c25edb107ac19bf3a05ce update builder to use go1.25.5 (#2235)
  • 1a6870c7d6f0d2ed6513104ec3f60f8ba5d91c32 build(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#2236)

Thanks for all contributors!

v1.8.3

Changelog

v1.8.3 fixes GHSA-f83f-xpx7-ffpw

  • 3622f6e62cf74ff1477422a8c3aad4ca338ed047 update changelog for v1.8.3 release (#2234)
  • 765a0e57608b9ef390e1eeeea8595b9054c63a5a Merge commit from fork (#2233)
  • 90f8520e1754b20ba0cb33d412ee15006711b85f build(deps): bump github.com/coreos/go-oidc/v3 from 3.16.0 to 3.17.0 (#2225)
  • d88584108bf71c5d375a41a62c05de3c587bd35e build(deps): bump the all group across 1 directory with 6 updates (#2232)
  • a387888860bff3f4100d35aa5a63306bb545e702 build(deps): bump the all group with 4 updates (#2226)
  • 7b0c1a11da32a1eb485ea3368725028c4f3d35be build(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#2227)
  • f0a0d051798bb1869d79ba21fbb9b60bdd896664 build(deps): bump golang from e68f6a0 to 6981837 (#2222)
  • 4ed0ea1b43f96c571de5ed8b44a5703d6c5c2894 Switch docker env from ct_server to TesseraCT (#2210)
  • e902cf880ff56e6749725ea6d63299ab7b370c2d feat: Add support for skipping email_verified claim requirement per issuer (#2220)
  • c0fc26c2c1d8a1e16802dd466fb233d69d3ef35d Add basic E2E tests (#2230)
  • a4ee8608f0349bd546b33406417f8ff1a58b09b1 build(deps): bump sigstore/scaffolding/trillian_log_signer (#2228)
  • 51d916e167276404d153607f076e5a7fb8f30986 build(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 (#2216)
  • bd3a515d86c015a70fa7abd47511fcb1108aafcf add meta-issuer circleci block (#2215)
  • c4d47896482f470adaf09dc7706a54fd66311bfd add circleci info to fulcio (#2192)

Thanks for all contributors!

v1.8.2

... (truncated)

Changelog

Sourced from github.com/sigstore/fulcio's changelog.

v1.8.5

Vulnerability Fixes

v1.8.4

Same changelog as v1.8.3, with a few dependency bumps to resolve a breaking API change

v1.8.3

Vulnerability Fixes

Features

  • feat: Add support for skipping email_verified claim requirement per issuer (#2220)
  • add meta-issuer circleci block (#2215)
  • add circleci info to fulcio (#2192)

Testing

  • Add basic E2E tests (#2230)

v1.8.2

Testing

  • make email address in test cases rfc822 conformant (#2205)

v1.8.1

Same as v1.8.0, but with a fix for the CI build pipeline.

v1.8.0

Bug Fixes

  • fix: K8s API does not accept unauthorized requests (#2111)
  • fix: vault for enterprise expects only the key name (#2117)
  • fix(config): respect cacert on oidc-issuers (#2098)
  • Register /healthz endpoint when listening on duplex http/grpc port (#2046)

Features

  • feat: adds cert loading and key-match validation. (#2173)
  • expose gcp kms retry and timeout options (#2132)
  • server: Use warning log level for client errors (#2147)

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Feb 26, 2026
@openshift-ci openshift-ci bot requested review from bparees and raptorsun February 26, 2026 15:48
@openshift-ci
Copy link

openshift-ci bot commented Feb 26, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign xrajesh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/sigstore/fulcio-1.8.5 branch from 75ccd95 to b2ea833 Compare February 27, 2026 12:47
@dependabot
build(deps): bump github.com/sigstore/fulcio from 1.6.6 to 1.8.5
7893052 
Bumps [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) from 1.6.6 to 1.8.5.
- [Release notes](https://github.com/sigstore/fulcio/releases)
- [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md)
- [Commits](sigstore/fulcio@v1.6.6...v1.8.5)

---
updated-dependencies:
- dependency-name: github.com/sigstore/fulcio
  dependency-version: 1.8.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/sigstore/fulcio-1.8.5 branch from b2ea833 to 7893052 Compare March 2, 2026 16:49
@openshift-ci
Copy link

openshift-ci bot commented Mar 4, 2026

@dependabot[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/bundle-e2e-4-20 7893052 link true /test bundle-e2e-4-20
ci/prow/bundle-e2e-4-22 7893052 link true /test bundle-e2e-4-22

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@raptorsun
Copy link
Contributor

raptorsun commented Mar 5, 2026

/close

@openshift-ci openshift-ci bot closed this Mar 5, 2026
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Mar 5, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@openshift-ci
Copy link

openshift-ci bot commented Mar 5, 2026

@raptorsun: Closed this PR.

Details

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@dependabot dependabot bot deleted the dependabot/go_modules/github.com/sigstore/fulcio-1.8.5 branch March 5, 2026 08:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bparees bparees Awaiting requested review from bparees

@raptorsun raptorsun Awaiting requested review from raptorsun

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@raptorsun