chore(deps): bump the all group across 1 directory with 9 updates

[dependabot]

Bumps the all group with 5 updates in the / directory:

Package	From	To
github.com/secure-systems-lab/go-securesystemslib	0.11.0	0.11.1
github.com/sigstore/cosign/v2	2.6.4	2.6.5
github.com/tektoncd/pipeline	1.9.6	1.9.7
k8s.io/api	0.34.10	0.34.11
k8s.io/client-go	0.34.10	0.34.11

Updates github.com/secure-systems-lab/go-securesystemslib from 0.11.0 to 0.11.1

Commits

• 662f0f7 Merge pull request #165 from secure-systems-lab/dependabot/go_modules/github....
• 0b40db0 chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0
• e330185 Merge pull request #166 from secure-systems-lab/dependabot/go_modules/golang....
• 1778905 chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0
• 4d3d2c7 Merge pull request #164 from secure-systems-lab/dependabot/github_actions/act...
• 379ec0d chore(deps): bump actions/checkout from 7.0.0 to 7.0.1
• efcd6cb Merge pull request #163 from secure-systems-lab/dependabot/github_actions/act...
• cd018df chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0
• 5cd75e5 Merge pull request #162 from secure-systems-lab/dependabot/go_modules/golang....
• 4a8f3f8 chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0
• Additional commits viewable in compare view

Updates github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.6.5

Changelog

This release backports GHSA-fx35-mq7g-6g98 (Verification bypass via public key in legacy bundle) to Cosign v2.6.x.

We strongly encourage folks to continue their migration to the bundle format. The Cosign v3.1.x releases support both formats; the primary change being that the default for signing is the bundle format (although you can specify --new-bundle-format=false to sign with the old format). The verification commands in Cosign v3.1.x support both formats, and will try to detect the format for you for maximum compatibility.

Thanks to all contributors!

Commits

• 3e82f50 Verification bypass via public key in legacy bundle (GHSA-fx35-mq7g-6g98) (#5...
• See full diff in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.0

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.0

What's Changed

Functional Changes

• assert: make *AssertionFunc types just aliases by @​dolmen in stretchr/testify#1563

Fixes

• mock: avoid panic when expected type is nil in Arguments.Diff by @​mutaiib in stretchr/testify#1775
• mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @​brackendawson in stretchr/testify#1786
• suite: validate method signatures and continue execution for valid tests by @​vyas-git in stretchr/testify#1665
• assert.PanicsWithError: report error message by @​olivergondza in stretchr/testify#1400
• assert: IsIncreasing et al can return false w/out failing by @​brackendawson in stretchr/testify#1787
• add type to error message of assert.Same by @​egawata in stretchr/testify#1792
• mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @​brackendawson in stretchr/testify#1795
• assert: truncate very long objects in test failure messages by @​brackendawson in stretchr/testify#1646
• assert: fix NotSubset error messages using %#v instead of %q (fixes #1800) by @​nghiack7 in stretchr/testify#1888
• suite: prevent panic when SetupTest skips with HandleStats by @​blackwell-systems in stretchr/testify#1877

Documentation, Build & CI

• CI: test also with Go 1.23 by @​dolmen in stretchr/testify#1783
• Vendor unmaintained github.com/pmezard/go-difflib by @​brackendawson in stretchr/testify#1708
• Promote ccoVeille to maintainer by @​brackendawson in stretchr/testify#1784
• build(deps): bump actions/setup-go from 5 to 6 by @​dependabot[bot] in stretchr/testify#1790
• assert.YAMLEq: Document mutlidoc behavior by @​brackendawson in stretchr/testify#1791
• _codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @​dolmen in stretchr/testify#1782
• doc: remove ineffective inline code blocks by @​brackendawson in stretchr/testify#1714
• Tag generated assertions as non-generated in new .gitattributes by @​ubunatic in stretchr/testify#1815
• chore: vendor go-spew from https://github.com/davecgh/go-spew by @​ccoVeille in stretchr/testify#1827
• require: fix godoc generation for assertions returning a bool by @​Baxromumarov in stretchr/testify#1850
• docs(require): correct example usage to use assert.CollectT (require.CollectT does not exist) by @​a2not in stretchr/testify#1821
• docs: Fix EventuallyWithTf documentation with proper placement of formatting arguments by @​a2not in stretchr/testify#1842
• EMERITUS.md: add @​tylerb by @​dolmen in stretchr/testify#1812
• CI: test also with Go 1.24 by @​alexandear in stretchr/testify#1856
• deps: bump objx to v0.5.3 and remove dependency cycle issue by @​ccoVeille in stretchr/testify#1823
• CI: upgrade GitHub Actions and pin hashes by @​SuperQ in stretchr/testify#1883
• CI: add _readme-gofmt tool to reformat Go code in README by @​dolmen in stretchr/testify#1889
• CI: add check of GitHub Action pinned hashes against tag by @​dolmen in stretchr/testify#1885
• _codegen: modernize by @​dolmen in stretchr/testify#1890
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in stretchr/testify#1906
• mock: Mock.Return does not exist anymore by @​Kentzo in stretchr/testify#1905

New Contributors

• @​mutaiib made their first contribution in stretchr/testify#1775
• @​vyas-git made their first contribution in stretchr/testify#1665
• @​olivergondza made their first contribution in stretchr/testify#1400
• @​egawata made their first contribution in stretchr/testify#1792
• @​ubunatic made their first contribution in stretchr/testify#1815
• @​Baxromumarov made their first contribution in stretchr/testify#1850
• @​a2not made their first contribution in stretchr/testify#1821

... (truncated)

Commits

• 001eb79 Merge pull request #1905 from Kentzo/patch-1
• ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
• 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
• f8c01f3 mock: Mock.Return does not exist anymore
• 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
• a11649e assert: make *AssertionFunc type just aliases
• dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
• 098f8d7 _codegen: use strings.Builder
• d2699be _codegen: modernize
• a463c8c Merge pull request #1885 from stretchr/dolmen/ci-check-ghactions-hashes
• Additional commits viewable in compare view

Updates github.com/tektoncd/pipeline from 1.9.6 to 1.9.7

Release notes

Sourced from github.com/tektoncd/pipeline's releases.

Tekton Pipeline release v1.9.7 "Devon Rex Dreadnought"

-Docs @ v1.9.7 -Examples @ v1.9.7

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.9.7/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a4454652bbad6671ba390d5109a6546be8ae7c3c5842910cbff8d1ab88b1b0c74

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a4454652bbad6671ba390d5109a6546be8ae7c3c5842910cbff8d1ab88b1b0c74
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.9.7/release.yaml
REKOR_UUID=108e9186e8c5677a4454652bbad6671ba390d5109a6546be8ae7c3c5842910cbff8d1ab88b1b0c74
Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.9.7@sha256:" + .digest.sha256')
Download the release file
curl -L "$RELEASE_FILE" > release.yaml
For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

... (truncated)

Commits

• fa066df [release-v1.9.x] bump google.golang.org/protobuf from 1.36.11 to 1.36.12
• ebdf9de fix: update gRPC dependencies
• 37cfce1 [release-v1.9.x] bump ossf/scorecard-action from 2.4.3 to 2.4.4
• 1db9d78 fix(resolutionrequest): refine lifecycle status handling
• 2c49354 fix(resolutionrequest): requeue status update conflicts
• 501eee4 fix(resolutionrequest): preserve resolver-written status fields
• d47d6e1 Add missing "time" import to pipelinerun.go
• a08816e Fix PipelineRun stuck in ResolvingTaskRef when RR enqueue is missed
• f54a237 fix(resolvers): skip non-owner reconciliation
• ff5e82e fix(resolvers): honor leader-election bucket ownership
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.54.0 to 0.55.0

Commits

• f44d03d go.mod: update golang.org/x dependencies
• 5ed4944 crypto/internal/poly1305: provide optimised assembly for riscv64
• b07833c ssh: return window credit for discarded extended data
• d701c51 acme: fix nil pointer dereference in pebble test error reporting
• 999d053 ssh: fix parsing of GSSAPI payloads offering multiple mechanisms
• 90f76b8 ssh: reject certificate signature keys before recursing
• b53964a ssh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers, MACs
• 626e40f ssh: drain stderr on forwarded TCP and Unix channels
• 31914c6 x509roots/fallback: update bundle
• f2135b8 all: clean up minor issues found by staticcheck
• Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12

Updates k8s.io/api from 0.34.10 to 0.34.11

Commits

• 1e59171 Update dependencies to v0.34.11 tag
• 99be55c Merge pull request #141224 from liggitt/golang-deps-1-34
• bfee1c6 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/apimachinery from 0.34.10 to 0.34.11

Commits

• 552e94a Merge pull request #141224 from liggitt/golang-deps-1-34
• 6653278 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/client-go from 0.34.10 to 0.34.11

Commits

• fc59cd8 Update dependencies to v0.34.11 tag
• ba217fd Merge pull request #141224 from liggitt/golang-deps-1-34
• 6e25c7c Merge pull request #140919 from kmala/release-1.34
• 9bc5894 Update golang.org/x deps
• 5cf0023 fix the gomock errors
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign puneetpunamiya after the PR has been reviewed.
You can assign the PR to them by writing /assign @puneetpunamiya in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment