Update module github.com/sigstore/cosign/v3 to v3.1.4 by renovate[bot] · Pull Request #347 · circleci/runner-init

renovate · 2026-08-16T10:46:12Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/sigstore/cosign/v3	`v3.1.2` → `v3.1.4`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

sigstore/cosign (github.com/sigstore/cosign/v3)

`v3.1.4`

Compare Source

Changelog

3428d3c Build releases with 1.27.3 (#5177)
821c9bf Add AGENTS.md, update contributors.md with reference to AI policy (#5176)
cfeaa4a Implement cosign bundle create-from-container (#5144)
e2d25b5 Mention windows builds in readme (#5147)
6a83f9a fix(verify): don't panic on a bundle entry with no hash (#5127)
0ea1cec refactor: remove uploadToRekor parameter from ConfirmPrivacyStatement
ff2a8f4 fix(sign): pass digest hash algorithm to underlying signer in SignData
7757e8b fix(e2e): enable UseSignedTimestamps in *TSAMTLSWithSigningConfig
f624836 test(verify): add failure cases for new bundle verification
907c3d8 fix(sign): propagate BundlePath from SignOptions to KeyOpts
0c66ecd clean: update inaccurate warning (#4909)
67a1216 fix: write referrers when image index has attestations (#5111)
ac3a927 fix(verify): enforce mutually exclusive key and security key (#5124)
048eff5 Reorder events in LoadTrustedMaterialAndSigningConfig
43d83e8 fix(layout): preserve manifest artifactType in index.json when saving (#4821)
1dbbc36 fix(load): upload bundle layer blobs before manifest PUT
81b61e2 fix: strip trailing whitespace from attached signature files/stdin (#5058)
b327bba fix: clarify COSIGN_REPOSITORY error when repository path is missing
3532c1d fix: include annotations in implied payload for offline verify
b84a076 Cap the bundle layer read in ociremote.Bundle
d39ab7c Align privacy statement prompt behavior (#5076)
559c58c copy annotations by key instead of copying obj (#5103)
37cf1bc Add org.opencontainers.image.title annotation to attestation layers (#4498)
dd9ef85 feat: Add org.opencontainers.image.source label to images (#5095)
00c1772 refactor: extract signing flag validation (#5070)
39037f1 fix: restrict bundle signing and attestation to one artifact (#5081)
5b6e930 fix: pass missing OIDC flags to KeyOpts (#5079)
20c7516 fix(verify): support image indexes in local bundle discovery (#5080)
81fa4e9 fix(verify): propagate CommonVerifyOptions to VerifyCommand (#5094)
84effab fix: verify-blob should not force SHA256 for non-default key hash algorithms (#5064)
e9af93f fix(providers): clearer errors when GitHub OIDC token request fails (#5062)
8b8c87b feat: --slot option argument shell completion (#5057)
0a5f602 Deprecate --use-signing-config (#5056)
990e273 fix: use correct Rekor URLs to activate privacy warning (#5054)
151d838 fix: only show public-instance privacy statement for the default Rekor URL (#5042)

Thanks to all contributors!

`v3.1.3`

Compare Source

What's Changed

This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle.

Auto-detect default digest algorithm for public keys in #5019
fix(pkcs11key): return an error instead of panicking when no key pair matches in #5022
Supporting OCI Signing with X.509 Certificate Chain in #4614
test(inspect): replace mock TSA client usage with local timestamp response generator in #5021
fix: prevent shell completions for various options not taking filenames in #5032
fix(blob): compare file checksums case-insensitively in #5036
Verification bypass via public key in legacy bundle (GHSA-fx35-mq7g-6g98) in #5040

Full Changelog: sigstore/cosign@v3.1.2...v3.1.3

Configuration

📅 Schedule: (UTC)

Branch creation
- Only on Sunday (* * * * 0)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-08-30T20:09:52Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

106 additional dependencies were updated
The go directive was updated for compatibility reasons

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=7 days

Details:

Package	Change
`go`	`1.26.10` -> `1.27`
`buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go`	`v1.36.11-20260415201107-50325440f8f2.1` -> `v1.36.11-20260709200747-435963d16310.1`
`cloud.google.com/go/auth`	`v0.20.0` -> `v0.24.1-0.20261001053825-dbc26066f70a`
`cloud.google.com/go/auth/oauth2adapt`	`v0.2.8` -> `v0.3.0`
`cloud.google.com/go/compute/metadata`	`v0.9.0` -> `v0.10.0`
`cloud.google.com/go/iam`	`v1.11.0` -> `v1.13.0`
`cloud.google.com/go/kms`	`v1.31.0` -> `v1.33.0`
`cloud.google.com/go/longrunning`	`v1.0.0` -> `v1.2.0`
`cloud.google.com/go/monitoring`	`v1.25.0` -> `v1.30.0`
`cuelabs.dev/go/oci/ociregistry`	`v0.0.0-20251212221603-3adeb8663819` -> `v0.0.0-20260601085548-328ff8e2c943`
`cuelang.org/go`	`v0.16.1` -> `v0.17.1`
`github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/provider`	`v0.14.0` -> `v0.18.1`
`github.com/Azure/azure-sdk-for-go/sdk/azcore`	`v1.22.0` -> `v1.23.1`
`github.com/Azure/azure-sdk-for-go/sdk/azidentity`	`v1.14.0` -> `v1.14.1`
`github.com/AzureAD/microsoft-authentication-library-for-go`	`v1.7.2` -> `v1.8.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.33.0` -> `v1.34.0`
`github.com/alibabacloud-go/debug`	`v1.0.0` -> `v1.0.1`
`github.com/alibabacloud-go/tea`	`v1.2.1` -> `v1.3.12`
`github.com/aliyun/credentials-go`	`v1.3.2` -> `v1.4.7`
`github.com/aws/aws-sdk-go-v2`	`v1.42.0` -> `v1.47.3`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.25` -> `v1.33.9`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.19.24` -> `v1.20.9`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.29` -> `v1.20.3`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.4.29` -> `v1.5.6`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.29` -> `v2.8.6`
`github.com/aws/aws-sdk-go-v2/internal/v4a`	`v1.4.30` -> `v1.5.6`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.13.12` -> `v1.13.21`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.13.29` -> `v1.14.6`
`github.com/aws/aws-sdk-go-v2/service/kms`	`v1.53.4` -> `v1.61.4`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.2.0` -> `v1.10.4`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.31.3` -> `v1.38.4`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.36.6` -> `v1.43.4`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.43.3` -> `v1.51.4`
`github.com/aws/smithy-go`	`v1.27.2` -> `v1.28.5`
`github.com/cockroachdb/apd/v3`	`v3.2.1` -> `v3.2.3`
`github.com/coreos/go-oidc/v3`	`v3.18.0` -> `v3.21.0`
`github.com/docker/cli`	`v29.5.3+incompatible` -> `v29.7.2+incompatible`
`github.com/felixge/httpsnoop`	`v1.0.4` -> `v1.1.0`
`github.com/gabriel-vasile/mimetype`	`v1.4.13` -> `v1.4.15`
`github.com/go-openapi/analysis`	`v0.25.2` -> `v1.0.0`
`github.com/go-openapi/errors`	`v0.22.8` -> `v0.22.9`
`github.com/go-openapi/jsonpointer`	`v0.23.1` -> `v1.0.1`
`github.com/go-openapi/jsonreference`	`v0.21.6` -> `v1.0.2`
`github.com/go-openapi/loads`	`v0.24.0` -> `v0.25.3`
`github.com/go-openapi/runtime`	`v0.32.4` -> `v0.33.3`
`github.com/go-openapi/runtime/server-middleware`	`v0.30.0` -> `v0.33.3`
`github.com/go-openapi/spec`	`v0.22.6` -> `v1.0.1`
`github.com/go-openapi/strfmt`	`v0.26.4` -> `v0.27.3`
`github.com/go-openapi/swag`	`v0.26.1` -> `v0.28.0`
`github.com/go-openapi/swag/cmdutils`	`v0.26.1` -> `v0.29.2`
`github.com/go-openapi/swag/conv`	`v0.27.1` -> `v0.29.2`
`github.com/go-openapi/swag/fileutils`	`v0.26.1` -> `v0.29.2`
`github.com/go-openapi/swag/jsonutils`	`v0.27.1` -> `v0.29.2`
`github.com/go-openapi/swag/loading`	`v0.26.1` -> `v0.29.1`
`github.com/go-openapi/swag/mangling`	`v0.26.1` -> `v0.29.1`
`github.com/go-openapi/swag/netutils`	`v0.26.1` -> `v0.29.2`
`github.com/go-openapi/swag/pools`	`v0.27.1` -> `v0.29.2`
`github.com/go-openapi/swag/stringutils`	`v0.26.1` -> `v0.29.2`
`github.com/go-openapi/swag/typeutils`	`v0.27.1` -> `v0.29.2`
`github.com/go-openapi/swag/yamlutils`	`v0.26.1` -> `v0.29.1`
`github.com/go-openapi/validate`	`v0.26.0` -> `v1.0.0`
`github.com/go-playground/validator/v10`	`v10.30.3` -> `v10.30.5`
`github.com/google/go-containerregistry`	`v0.21.7` -> `v0.22.1`
`github.com/google/s2a-go`	`v0.1.9` -> `v0.1.11`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.16` -> `v0.3.22`
`github.com/googleapis/gax-go/v2`	`v2.22.0` -> `v2.26.2`
`github.com/jellydator/ttlcache/v3`	`v3.4.0` -> `v3.4.1`
`github.com/leodido/go-urn`	`v1.4.0` -> `v1.5.0`
`github.com/lestrrat-go/dsig`	`v1.2.1` -> `v1.3.0`
`github.com/lestrrat-go/httprc/v3`	`v3.0.5` -> `v3.0.6`
`github.com/lestrrat-go/jwx/v3`	`v3.1.1` -> `v3.2.0`
`github.com/moby/moby/api`	`v1.54.2` -> `v1.55.0`
`github.com/moby/moby/client`	`v0.4.1` -> `v0.5.1`
`github.com/mozillazg/docker-credential-acr-helper`	`v0.4.0` -> `v0.4.1`
`github.com/oklog/ulid/v2`	`v2.1.1` -> `v2.1.2`
`github.com/open-policy-agent/opa`	`v1.17.1` -> `v1.20.2`
`github.com/pelletier/go-toml/v2`	`v2.2.4` -> `v2.3.1`
`github.com/prometheus/client_golang`	`v1.23.2` -> `v1.25.0`
`github.com/prometheus/client_model`	`v0.6.2` -> `v0.6.3`
`github.com/prometheus/common`	`v0.67.5` -> `v0.72.0`
`github.com/prometheus/procfs`	`v0.20.1` -> `v0.22.0`
`github.com/protocolbuffers/txtpbfmt`	`v0.0.0-20260217160748-a481f6a22f94` -> `v0.0.0-20260420112717-c39628bde8b5`
`github.com/rogpeppe/go-internal`	`v1.14.1` -> `v1.16.0`
`github.com/santhosh-tekuri/jsonschema/v6`	`v6.0.2` -> `v6.0.3`
`github.com/secure-systems-lab/go-securesystemslib`	`v0.11.0` -> `v0.11.1`
`github.com/sigstore/protobuf-specs`	`v0.5.1` -> `v0.5.2`
`github.com/sigstore/rekor`	`v1.5.3` -> `v1.5.4`
`github.com/sigstore/sigstore`	`v1.10.8` -> `v1.11.1`
`github.com/sigstore/sigstore-go`	`v1.2.1` -> `v1.3.0`
`github.com/sigstore/sigstore/pkg/signature/kms/aws`	`v1.10.8` -> `v1.11.1`
`github.com/sigstore/sigstore/pkg/signature/kms/azure`	`v1.10.8` -> `v1.11.1`
`github.com/sigstore/sigstore/pkg/signature/kms/gcp`	`v1.10.8` -> `v1.11.1`
`github.com/sigstore/sigstore/pkg/signature/kms/hashivault`	`v1.10.8` -> `v1.11.1`
`github.com/sigstore/timestamp-authority/v2`	`v2.1.2` -> `v2.1.5`
`github.com/sirupsen/logrus`	`v1.9.4` -> `v1.10.2`
`github.com/spiffe/go-spiffe/v2`	`v2.7.0` -> `v2.8.2`
`github.com/stretchr/objx`	`v0.5.2` -> `v0.5.3`
`github.com/stretchr/testify`	`v1.11.1` -> `v1.12.1`
`github.com/vektah/gqlparser/v2`	`v2.5.33` -> `v2.5.36`
`go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc`	`v0.68.0` -> `v0.70.0`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.68.0` -> `v0.71.0`
`go.yaml.in/yaml/v3`	`v3.0.4` -> `v3.0.5`
`gocloud.dev`	`v0.45.0` -> `v0.46.0`
`golang.org/x/time`	`v0.15.0` -> `v0.16.0`
`google.golang.org/api`	`v0.284.0` -> `v0.301.0`
`google.golang.org/genproto`	`v0.0.0-20260406210006-6f92a3bedf2d` -> `v0.0.0-20260715232425-e75dac1f907d`
`sigs.k8s.io/release-utils`	`v0.12.4` -> `v0.12.5`

renovate Bot requested a review from a team as a code owner August 16, 2026 10:46

renovate Bot added the renovate label Aug 16, 2026

renovate Bot force-pushed the renovate/go-dependencies-(patch-versions) branch from 2f655ad to 2940a2b Compare August 18, 2026 12:59

renovate Bot force-pushed the renovate/go-dependencies-(patch-versions) branch 2 times, most recently from 2a44f1a to 40192d1 Compare August 29, 2026 23:40

renovate Bot changed the title ~~Update go dependencies (patch versions)~~ Update module github.com/alecthomas/kong to v1.16.1 Aug 29, 2026

renovate Bot force-pushed the renovate/go-dependencies-(patch-versions) branch from 40192d1 to 3549344 Compare August 30, 2026 08:38

renovate Bot changed the title ~~Update module github.com/alecthomas/kong to v1.16.1~~ Update go dependencies (patch versions) Aug 30, 2026

renovate Bot force-pushed the renovate/go-dependencies-(patch-versions) branch from 3549344 to cce5bd2 Compare August 30, 2026 15:30

renovate Bot changed the title ~~Update go dependencies (patch versions)~~ Update module github.com/alecthomas/kong to v1.16.1 Aug 30, 2026

renovate Bot force-pushed the renovate/go-dependencies-(patch-versions) branch from cce5bd2 to fcbf95f Compare August 30, 2026 20:09

renovate Bot changed the title ~~Update module github.com/alecthomas/kong to v1.16.1~~ Update go dependencies (patch versions) Aug 30, 2026

renovate Bot force-pushed the renovate/go-dependencies-(patch-versions) branch from fcbf95f to 1d35c01 Compare September 1, 2026 04:02

renovate Bot changed the title ~~Update go dependencies (patch versions)~~ Update module github.com/sigstore/cosign/v3 to v3.1.3 Sep 1, 2026

renovate Bot changed the title ~~Update module github.com/sigstore/cosign/v3 to v3.1.3~~ Update go dependencies (patch versions) Sep 1, 2026

renovate Bot force-pushed the renovate/go-dependencies-(patch-versions) branch 2 times, most recently from 6ebddaa to 3c9ab8f Compare September 7, 2026 19:53

renovate Bot force-pushed the renovate/go-dependencies-(patch-versions) branch from 3c9ab8f to 06434c9 Compare September 15, 2026 12:50

renovate Bot force-pushed the renovate/go-dependencies-(patch-versions) branch 2 times, most recently from 3a935bc to f014c35 Compare September 30, 2026 23:39

renovate Bot force-pushed the renovate/go-dependencies-(patch-versions) branch 3 times, most recently from 2dfa624 to 544afec Compare October 27, 2026 02:04

renovate Bot force-pushed the renovate/go-dependencies-(patch-versions) branch 4 times, most recently from 10b26f6 to 815210d Compare October 29, 2026 17:21

Update module github.com/sigstore/cosign/v3 to v3.1.4

c316fd9

renovate Bot force-pushed the renovate/go-dependencies-(patch-versions) branch from 815210d to c316fd9 Compare November 6, 2026 08:37

renovate Bot changed the title ~~Update go dependencies (patch versions)~~ Update module github.com/sigstore/cosign/v3 to v3.1.4 Nov 6, 2026

Navigation Menu

Repository navigation

Update module github.com/sigstore/cosign/v3 to v3.1.4 - #347

Update module github.com/sigstore/cosign/v3 to v3.1.4#347
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-dependencies-(patch-versions)

renovate Bot commented Aug 16, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Aug 30, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Aug 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v3.1.4

Changelog

Thanks to all contributors!

v3.1.3

What's Changed

Configuration

Uh oh!

renovate Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 16, 2026 •

edited

Loading

`v3.1.4`

`v3.1.3`

renovate Bot commented Aug 30, 2026 •

edited

Loading