Skip to content

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Jan 13, 2026

Bumps github.com/sigstore/fulcio from 1.8.3 to 1.8.5.

Release notes

Sourced from github.com/sigstore/fulcio's releases.

v1.8.5

Changelog

This resolves GHSA-59jp-pj84-45mr - Server-side request forgery via MetaIssuer regex bypass

Thanks for all contributors!

v1.8.4

Changelog

  • f5bfa34740fc579523e2da9825ea575227331c6f build(deps): bump github.com/tink-crypto/tink-go/v2 from 2.5.0 to 2.6.0 (#2246)
  • 0039c980ab58e8cabf38d62fb80a607b5f21c0da build(deps): bump goa.design/goa/v3 from 3.22.6 to 3.23.4 (#2245)
  • 3a432f030f1dca4d088f1777f07947a85d1750cd build(deps): bump go.step.sm/crypto from 0.74.0 to 0.75.0 (#2238)
  • f3aba4a94150cad7eaa7dc0445e8cdf6cb037c23 build(deps): bump the all group across 1 directory with 4 updates (#2247)
  • e66a4c6f47d4052c7b38b84f081b26ca3191deb0 build(deps): bump the all group with 8 updates (#2244)
  • a846db6473f4be95443f3772914a15cc156be7b6 build(deps): bump golang from 20b91ed to a22b2e6 (#2243)
  • 5a012f5e4f9617fe649b08ec8531d1e8256577e4 update Run Invocation URI for circleci (#2242)
  • 59dde0af71dbeaa69b8c25edb107ac19bf3a05ce update builder to use go1.25.5 (#2235)
  • 1a6870c7d6f0d2ed6513104ec3f60f8ba5d91c32 build(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#2236)

Thanks for all contributors!

Changelog

Sourced from github.com/sigstore/fulcio's changelog.

v1.8.5

Vulnerability Fixes

v1.8.4

Same changelog as v1.8.3, with a few dependency bumps to resolve a breaking API change

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) from 1.8.3 to 1.8.5.
- [Release notes](https://github.com/sigstore/fulcio/releases)
- [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md)
- [Commits](sigstore/fulcio@v1.8.3...v1.8.5)

---
updated-dependencies:
- dependency-name: github.com/sigstore/fulcio
  dependency-version: 1.8.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jan 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant