[dependabot]

Bumps github.com/sigstore/cosign/v2 from 2.6.2 to 2.6.3.

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.6.3

Changelog

v2.6.3 resolves GHSA-w6c6-c85g-mmv6.

• fecddd3c22045a39f52392e71e79f66854b41352 Fix DSSE predicate check (#4802)
• 564c5b1b0bed7bd991910774c47df1150ffb8aa8 Backport bundle detection to sign and attest (#4727)

Thanks to all contributors!

Changelog

Sourced from github.com/sigstore/cosign/v2's changelog.

v3.0.5

Deprecations

• Deprecate rekor-entry-type flag (#4691)
• Deprecate cosign triangulate (#4676)
• Deprecate cosign copy (#4681)

Features

• Automatically require signed timestamp with Rekor v2 entries (#4666)
• Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)
• Add mTLS support for TSA client connections when signing with a signing config (#4620)
• Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)

Bug Fixes

• Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
• fix: avoid panic on malformed attestation payload (#4651)
• fix: avoid panic on malformed tlog entries (#4649)
• fix: avoid panic on malformed replace payload (#4653)
• Gracefully fail if bundle payload body is not a string (#4648)
• Verify validity of chain rather than just certificate (#4663)
• fix: avoid panic on malformed tlog entry body (#4652)

Documentation

• docs(cosign): clarify RFC3161 revocation semantics (#4642)
• Fix typo in CLI help (#4701)

v3.0.4

v3.0.4 resolves GHSA-whqx-f9j3-ch6m.

Changes

• Fix bundle verify path for old bundle/trusted root (GHSA-whqx-f9j3-ch6m) (#4623)
• Optimize cosign tree performance by caching digest resolution (#4612)
• Don't require a trusted root to verify offline with a key (#4613)
• Support default services for trusted-root and signing-config creation (#4592)

Commits

• fecddd3 Fix DSSE predicate check (#4802)
• 564c5b1 Backport bundle detection to sign and attest (#4727)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by CodeRabbit

• Chores
  • Updated an internal dependency to a newer patch version.

[netlify]

✅ Deploy Preview for olmv1 ready!

Name	Link
🔨 Latest commit	b36da34
🔍 Latest deploy log	https://app.netlify.com/projects/olmv1/deploys/6af6040a2e8062f3b0f34e82
😎 Deploy Preview	https://deploy-preview-3169--olmv1.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign perdasilva for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The indirect dependency github.com/sigstore/cosign/v2 was upgraded from v2.6.2 to v2.6.3.

Changes: Cosign dependency update

Layer / File(s)	Summary
Update cosign dependency go.mod	The indirect github.com/sigstore/cosign/v2 dependency changes from v2.6.2 to v2.6.3.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Possibly related PRs

• operator-framework/operator-controller#3114: Updates the same dependency from v2.5.0 to v2.6.2.

Suggested labels: dependencies, go

Suggested reviewers: rashmigottipati

Merge Risk: Minimal · up to b36da

This is a patch-level dependency update that picks up an upstream security advisory fix. No concrete merge risk was identified.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title states the main change: a Dependabot bump of github.com/sigstore/cosign/v2 from 2.6.2 to 2.6.3. The raw summary confirms that go.mod changes only this indirect dependency version. The title …
Description check		The description covers the required parts of the template. It gives a summary of the change and the motivation: the release notes show that v2.6.3 resolves GHSA-w6c6-c85g-mmv6. It also links the upstr…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title states the main change: a Dependabot bump of github.com/sigstore/cosign/v2 from 2.6.2 to 2.6.3. The raw summary confirms that go.mod changes only this indirect dependency version. The title uses the 🌱 prefix from the template, and it is specific and accurate.

Full details: Description check

Explanation

The description covers the required parts of the template. It gives a summary of the change and the motivation: the release notes show that v2.6.3 resolves GHSA-w6c6-c85g-mmv6. It also links the upstream release notes and commit diff. The template's Reviewer Checklist is absent. The author did not add the checklist items for API Go Documentation, unit tests, commit messages, or linked GitHub issues. The description is mostly complete, so the check passes. The checklist is a non-critical gap for a generated dependency bump.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 0e84c9f0-d2ce-4965-b5a3-5192b76a0fc1

Commits

Reviewing files that changed from the base of the PR and between 3d916af and b36da34.

Files ignored due to path filters: 1

• go.sum is excluded by !**/*.sum

Files selected for processing: 1

• go.mod

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.