Skip to content

chore(deps): bump the all group across 1 directory with 4 updates - #1838

Merged
vdemeester merged 1 commit into
release-v0.20.xfrom
dependabot/go_modules/release-v0.20.x/all-7682376d7d
Jul 28, 2026
Merged

chore(deps): bump the all group across 1 directory with 4 updates#1838
vdemeester merged 1 commit into
release-v0.20.xfrom
dependabot/go_modules/release-v0.20.x/all-7682376d7d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the all group with 3 updates in the / directory: github.com/sigstore/cosign/v2, k8s.io/api and k8s.io/client-go.

Updates github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.6.4

This release is a backport of OCI manifest fixes, and better support for cosign attestation download when you are using a mix of old Cosign signatures with the more recent bundle format.

We strongly encourage folks to continue their migration to the bundle format. The Cosign v3.1.x releases support both formats; the primary change being that the default for signing is the bundle format (although you can specify --new-bundle-format=false to sign with the old format). The verification commands in Cosign v3.1.x support both formats, and will try to detect the format for you for maximum compatibility.

Changelog

  • 26261f05411d5552949ee1d97df1f8e55ec0e13d Allow attestation download to handle both bundle types (#4996) (#5017)
  • d49a0c151125448fc247bb8c367518f46e1c0487 fix: include artifactType in OCI 1.1 signature referrer manifest (cherry-pick PR-4997 to release-2.6) (#5002)

Thanks to all contributors!

Commits
  • 26261f0 Allow attestation download to handle both bundle types (#4996) (#5017)
  • d49a0c1 fix: include artifactType in OCI 1.1 signature referrer manifest (cherry-pick...
  • See full diff in compare view

Updates k8s.io/api from 0.34.9 to 0.34.10

Commits
  • 06d3e85 Update dependencies to v0.34.10 tag
  • f40c031 Merge pull request #139665kmala/automated-cherry-pick-of-#137451
  • ac55670 Update google.golang.org/protobuf to v1.36.12-0.20260120151049-f2248ac996af
  • See full diff in compare view

Updates k8s.io/apimachinery from 0.34.9 to 0.34.10

Commits
  • 57ea95f Merge pull request #139665kmala/automated-cherry-pick-of-#137451
  • d8d0b08 Update google.golang.org/protobuf to v1.36.12-0.20260120151049-f2248ac996af
  • See full diff in compare view

Updates k8s.io/client-go from 0.34.9 to 0.34.10

Commits
  • e1a156e Update dependencies to v0.34.10 tag
  • 995d2ae Merge pull request #140004 from kmala/release-1.34
  • b1ab8bf Fix vet and mock errrors
  • 27c4342 Merge pull request #139665kmala/automated-cherry-pick-of-#137451
  • 38b8677 Update google.golang.org/protobuf to v1.36.12-0.20260120151049-f2248ac996af
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Used by dependabot - identifies all PRs created by dependabot kind/misc Categorizes issue or PR as a miscellaneuous one. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesnt merit a release note. labels Jul 27, 2026
@tekton-robot tekton-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jul 27, 2026
@anithapriyanatarajan

anithapriyanatarajan commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
chore(deps): bump the all group across 1 directory with 4 updates
6af48e2 
Bumps the all group with 3 updates in the / directory: [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign), [k8s.io/api](https://github.com/kubernetes/api) and [k8s.io/client-go](https://github.com/kubernetes/client-go).


Updates `github.com/sigstore/cosign/v2` from 2.6.3 to 2.6.4
- [Release notes](https://github.com/sigstore/cosign/releases)
- [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md)
- [Commits](sigstore/cosign@v2.6.3...v2.6.4)

Updates `k8s.io/api` from 0.34.9 to 0.34.10
- [Commits](kubernetes/api@v0.34.9...v0.34.10)

Updates `k8s.io/apimachinery` from 0.34.9 to 0.34.10
- [Commits](kubernetes/apimachinery@v0.34.9...v0.34.10)

Updates `k8s.io/client-go` from 0.34.9 to 0.34.10
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.34.9...v0.34.10)

---
updated-dependencies:
- dependency-name: github.com/sigstore/cosign/v2
  dependency-version: 2.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: k8s.io/api
  dependency-version: 0.34.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.34.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: k8s.io/client-go
  dependency-version: 0.34.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/release-v0.20.x/all-7682376d7d branch from c00aa39 to 6af48e2 Compare July 28, 2026 09:28
@anithapriyanatarajan

anithapriyanatarajan commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

/lgtm

@tekton-robot tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Jul 28, 2026
@vdemeester vdemeester added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 28, 2026
@tekton-robot

tekton-robot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@vdemeester
vdemeester merged commit 7e23bd3 into release-v0.20.x Jul 28, 2026
8 of 9 checks passed
@dependabot
dependabot Bot deleted the dependabot/go_modules/release-v0.20.x/all-7682376d7d branch July 28, 2026 12:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chitrangpatel chitrangpatel Awaiting requested review from chitrangpatel
@wlynch wlynch Awaiting requested review from wlynch

Assignees

@anithapriyanatarajan anithapriyanatarajan

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. dependencies Used by dependabot - identifies all PRs created by dependabot kind/misc Categorizes issue or PR as a miscellaneuous one. lgtm Indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesnt merit a release note. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@anithapriyanatarajan @tekton-robot @vdemeester