chore(deps): bump the all group across 1 directory with 17 updates

[dependabot]

Bumps the all group with 13 updates in the / directory:

Package	From	To
github.com/google/go-containerregistry	0.21.7	0.21.9
github.com/sigstore/cosign/v2	2.6.3	2.6.5
github.com/sigstore/rekor	1.5.2	1.5.3
github.com/sigstore/sigstore	1.10.8	1.10.9
github.com/sigstore/sigstore/pkg/signature/kms/aws	1.10.8	1.10.9
github.com/sigstore/sigstore/pkg/signature/kms/azure	1.10.8	1.10.9
github.com/sigstore/sigstore/pkg/signature/kms/gcp	1.10.8	1.10.9
github.com/sigstore/sigstore/pkg/signature/kms/hashivault	1.10.8	1.10.9
github.com/tektoncd/pipeline	1.14.0	1.14.1
google.golang.org/protobuf	1.36.12-0.20260120151049-f2248ac996af	1.36.12
k8s.io/api	0.36.2	0.36.3
k8s.io/client-go	0.36.2	0.36.3
k8s.io/code-generator	0.36.2	0.36.3

Updates github.com/google/go-containerregistry from 0.21.7 to 0.21.9

Commits

• 7b32099 build(deps): bump the actions group with 3 updates (#2398)
• 2a4447d fix: remove '.' from unsafe path prefixes (#2400)
• 43cc3e8 fix: prevent data race on scope refreshes within remote.writer (#2396)
• 7775aab actions: pin slsa generator version following linter exception (#2395)
• 2ea098f Bump go version to 1.26.5 (#2388)
• ec2e586 actions: reformat ALL actions (#2386)
• ab819b6 actions: fix unformatted action (#2385)
• eed9a20 actions: update actions to be pinned by hash (#2384)
• 8a97709 build(deps): bump github.com/moby/moby/client (#2380)
• d04bf7d tarball: use correct file extension for zstd/uncompressed (#2382)
• Additional commits viewable in compare view

Updates github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.5

Commits

• 3e82f50 Verification bypass via public key in legacy bundle (GHSA-fx35-mq7g-6g98) (#5...
• 26261f0 Allow attestation download to handle both bundle types (#4996) (#5017)
• d49a0c1 fix: include artifactType in OCI 1.1 signature referrer manifest (cherry-pick...
• See full diff in compare view

Updates github.com/sigstore/rekor from 1.5.2 to 1.5.3

Changelog

Sourced from github.com/sigstore/rekor's changelog.

v1.5.3

Features

• return 499 when clients disconnect instead of 500 (#2870)

Improvements

• Change max upperbound on latency metrics (#2868)

Commits

• 7d9dcff Changelog for v1.5.3 (#2871)
• f230638 Use bytes.Equal for inclusion proof root hash comparison (#2861)
• 7472268 return 499 if client disconnects instead of 500 (#2870)
• 792221b build(deps): Bump google.golang.org/grpc from 1.80.0 to 1.82.0 (#2859)
• 912dda3 build(deps): Bump the all group across 1 directory with 7 updates (#2869)
• 0f9921d Change max upperbound on latency metrics (#2868)
• 322a3f2 build(deps): Bump golang from 87a41d2 to f96cc55 (#2855)
• e997a8a build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 (#2857)
• 4444582 build(deps): Bump golang.org/x/net from 0.52.0 to 0.55.0 in /hack/tools (#2866)
• f81061c Move fuzz into its own workflow (#2865)
• Additional commits viewable in compare view

Updates github.com/sigstore/sigstore from 1.10.8 to 1.10.9

Commits

• ee9fe03 Fix Azure KMS support for RSA signatures (#2355)
• b34fd13 feat(hashivault): token helper tests (#2176)
• aed7c8b Dependencies updates (#2384)
• 05a1d97 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azk...
• be12908 build(deps): Bump github.com/hashicorp/vault/api (#2351)
• a8f8715 build(deps): Bump cloud.google.com/go/kms in /pkg/signature/kms/gcp (#2350)
• d91673d build(deps): Bump github.com/aws/aws-sdk-go-v2/config (#2372)
• c482e99 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#2347)
• 6529cc3 build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms (#2376)
• f95e2b7 build(deps): Bump golang.org/x/crypto in /pkg/signature/kms/azure (#2377)
• Additional commits viewable in compare view

Updates github.com/sigstore/sigstore/pkg/signature/kms/aws from 1.10.8 to 1.10.9

Commits

• ee9fe03 Fix Azure KMS support for RSA signatures (#2355)
• b34fd13 feat(hashivault): token helper tests (#2176)
• aed7c8b Dependencies updates (#2384)
• 05a1d97 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azk...
• be12908 build(deps): Bump github.com/hashicorp/vault/api (#2351)
• a8f8715 build(deps): Bump cloud.google.com/go/kms in /pkg/signature/kms/gcp (#2350)
• d91673d build(deps): Bump github.com/aws/aws-sdk-go-v2/config (#2372)
• c482e99 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#2347)
• 6529cc3 build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms (#2376)
• f95e2b7 build(deps): Bump golang.org/x/crypto in /pkg/signature/kms/azure (#2377)
• Additional commits viewable in compare view

Updates github.com/sigstore/sigstore/pkg/signature/kms/azure from 1.10.8 to 1.10.9

Commits

• ee9fe03 Fix Azure KMS support for RSA signatures (#2355)
• b34fd13 feat(hashivault): token helper tests (#2176)
• aed7c8b Dependencies updates (#2384)
• 05a1d97 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azk...
• be12908 build(deps): Bump github.com/hashicorp/vault/api (#2351)
• a8f8715 build(deps): Bump cloud.google.com/go/kms in /pkg/signature/kms/gcp (#2350)
• d91673d build(deps): Bump github.com/aws/aws-sdk-go-v2/config (#2372)
• c482e99 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#2347)
• 6529cc3 build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms (#2376)
• f95e2b7 build(deps): Bump golang.org/x/crypto in /pkg/signature/kms/azure (#2377)
• Additional commits viewable in compare view

Updates github.com/sigstore/sigstore/pkg/signature/kms/gcp from 1.10.8 to 1.10.9

Commits

• ee9fe03 Fix Azure KMS support for RSA signatures (#2355)
• b34fd13 feat(hashivault): token helper tests (#2176)
• aed7c8b Dependencies updates (#2384)
• 05a1d97 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azk...
• be12908 build(deps): Bump github.com/hashicorp/vault/api (#2351)
• a8f8715 build(deps): Bump cloud.google.com/go/kms in /pkg/signature/kms/gcp (#2350)
• d91673d build(deps): Bump github.com/aws/aws-sdk-go-v2/config (#2372)
• c482e99 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#2347)
• 6529cc3 build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms (#2376)
• f95e2b7 build(deps): Bump golang.org/x/crypto in /pkg/signature/kms/azure (#2377)
• Additional commits viewable in compare view

Updates github.com/sigstore/sigstore/pkg/signature/kms/hashivault from 1.10.8 to 1.10.9

Commits

• ee9fe03 Fix Azure KMS support for RSA signatures (#2355)
• b34fd13 feat(hashivault): token helper tests (#2176)
• aed7c8b Dependencies updates (#2384)
• 05a1d97 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azk...
• be12908 build(deps): Bump github.com/hashicorp/vault/api (#2351)
• a8f8715 build(deps): Bump cloud.google.com/go/kms in /pkg/signature/kms/gcp (#2350)
• d91673d build(deps): Bump github.com/aws/aws-sdk-go-v2/config (#2372)
• c482e99 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#2347)
• 6529cc3 build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms (#2376)
• f95e2b7 build(deps): Bump golang.org/x/crypto in /pkg/signature/kms/azure (#2377)
• Additional commits viewable in compare view

Updates github.com/tektoncd/pipeline from 1.14.0 to 1.14.1

Changelog

Sourced from github.com/tektoncd/pipeline's changelog.

Tekton Pipeline Releases

Release Frequency

Tekton Pipelines follows the Tekton community [release policy][release-policy] as follows:

• Versions are numbered according to semantic versioning: vX.Y.Z
• A new release is produced on a monthly basis
• Four releases a year are chosen for long term support (LTS). All remaining releases are supported for approximately 1 month (until the next release is produced)
  • LTS releases take place in January, April, July and October every year
  • The first Tekton Pipelines LTS release will be v0.41.0 in October 2022
  • Releases happen towards the middle of the month, between the 13th and the 20th, depending on week-ends and readiness

Tekton Pipelines produces nightly builds, publicly available on gcr.io/tekton-nightly.

Transition Process

Before release v0.41 Tekton Pipelines has worked on the basis of an undocumented support period of four months, which will be maintained for the releases between v0.37 and v0.40.

Release Process

Tekton Pipeline releases are made of YAML manifests and container images. Manifests are published to cloud object-storage as well as [GitHub][tekton-pipeline-releases]. Container images are signed by [Sigstore][sigstore] via [Tekton Chains][tekton-chains]; signatures can be verified through the [public key][chains-public-key] hosted by the Tekton Chains project.

Further documentation available:

• The Tekton Pipeline [release process][tekton-releases-docs]
• [Installing Tekton][tekton-installation]
• Standard for [release notes][release-notes-standards]

Release

v1.15 (LTS)

• Latest Release: [v1.15.0][v1.15-0] (2026-07-31) ([docs][v1.15-0-docs], [examples][v1.15-0-examples])
• Initial Release: [v1.15.0][v1.15-0] (2026-07-31)
• End of Life: 2027-07-31
• Patch Releases: [v1.15.0][v1.15-0]

v1.12 (LTS)

... (truncated)

Commits

• aa28e09 Add results to valid variable prefixes in pipeline validation
• See full diff in compare view

Updates go.opentelemetry.io/otel/sdk/metric from 1.43.0 to 1.44.0

Changelog

Sourced from go.opentelemetry.io/otel/sdk/metric's changelog.

[1.44.0/0.66.0/0.20.0/0.0.17] 2026-05-27

Added

• Add ByteSlice and ByteSliceValue functions for new BYTESLICE attribute type in go.opentelemetry.io/otel/attribute. (#7948)
• Apply attribute value limit to the KindBytes attribute type in go.opentelemetry.io/otel/sdk/log. (#7990)
• Apply attribute value limit to the BYTESLICE attribute type in go.opentelemetry.io/otel/sdk/trace. (#7990)
• Support BYTESLICE attributes in go.opentelemetry.io/otel/trace. (#8153)
• Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8153)
• Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8153)
• Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8153)
• Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8153)
• Add String method for Value type in go.opentelemetry.io/otel/attribute. (#8142)
• Add Slice and SliceValue functions for new SLICE attribute type in go.opentelemetry.io/otel/attribute. (#8166)
• Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8216)
• Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8216)
• Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8216)
• Support SLICE attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8216)
• Apply AttributeValueLengthLimit to attribute.SLICE type attribute values in go.opentelemetry.io/otel/sdk/trace, recursively truncating contained string values. (#8217)
• Add Error field on Record type in go.opentelemetry.io/otel/log/logtest. (#8148)
• Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8157)
• Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8157)
• Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8157)
• Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8157)
• Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8157)
• Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8157)
• Add Settable to go.opentelemetry.io/otel/metric/x to allow reusing attribute options. (#8178)
• Add experimental support for splitting metric data across multiple batches in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE=<max_size> to enable for all periodic readers. See go.opentelemetry.io/otel/sdk/metric/internal/x for feature documentation. (#8071)
• Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. Enable with OTEL_GO_X_OBSERVABILITY=true environment variable. See go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/x for feature documentation. (#8192)
• Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. Enable with OTEL_GO_X_OBSERVABILITY=true environment variable. See go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/x for feature documentation. (#8194)
• Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. Enable with OTEL_GO_X_OBSERVABILITY=true environment variable. See go.opentelemetry.io/otel/stdout/stdoutlog/internal/x for feature documentation. (#8263)
• Add WithDefaultAttributes to go.opentelemetry.io/otel/metric/x to support setting default attributes on instruments. (#8135)
• Add go.opentelemetry.io/otel/semconv/v1.41.0 package. The package contains semantic conventions from the v1.41.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.40.0. (#8324)
• Add Observable variants of instruments to go.opentelemetry.io/otel/semconv/v1.41.0 package. (#8350)
• Generate explicit histogram bucket boundaries from weaver configuration for HTTP and RPC duration instruments in go.opentelemetry.io/otel/semconv/v1.41.0. (#8002)

Changed

• ⚠️ Breaking Change: go.opentelemetry.io/otel/sdk/metric now applies a default cardinality limit of 2000 to comply with the Metrics SDK specification recommendation. New attribute sets are dropped when the cardinality limit is reached. The measurement of these sets are aggregated into a special attribute set containing attribute.Bool("otel.metric.overflow", true).

... (truncated)

Commits

• b62d928 Release 1.44.0 (#8376)
• 94132a0 chore(deps): update golang.org/x/telemetry digest to 5997936 (#8379)
• 6fdcf82 feat: add self-observability metrics to otlpmetricgrpc metric exporters (#8192)
• 761bbfc fix(deps): update golang.org/x (#8377)
• 3a91dc6 fix(deps): update googleapis to 3dc84a4 (#8375)
• f593185 exporters/otlp: default max request size to 64 MiB (#8365)
• f02feac Merge commit from fork
• 36c2f1b semconvkit: add invariant test for histogram-exclusion rule (#8370)
• d0b6cbd sdk/metric: document unit-sensitivity of DefaultAggregationSelector (#8224)
• 9a68034 add self observability for stdout exporter (#8263)
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.53.0 to 0.54.0

Commits

• cdce021 go.mod: update golang.org/x dependencies
• d9474cc openpgp: make the deprecation message more explicit
• 7626c50 ssh: verify declared key type matches decoded key in authorized_keys
• 0471e79 ssh/agent: enforce strict limits on DSA key parameters
• 6435c37 ssh: sanitize client disconnect messages
• 7d695da ssh/agent: drain channel stderr in agent forwarders
• 5b7f841 acme/autocert: fix data race in Manager.createCert
• 0b316e7 argon2: update RFC 9106 parameter recommendations
• 55aec0a x509roots/fallback: update bundle
• 5f2de1a internal: remove wycheproof tests
• See full diff in compare view

Updates google.golang.org/grpc from 1.82.0 to 1.82.1

Commits

• ebd8f06 Change version to 1.82.1 (#9238)
• 4ea465d Cherry-pick commits (#9236)
• 9494a2c Change version to 1.82.1-dev (#9171)
• See full diff in compare view

Updates google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12

Updates k8s.io/api from 0.36.2 to 0.36.3

Commits

• 3fde3c4 Update dependencies to v0.36.3 tag
• 53c47b9 Merge pull request #140296 from jpbetz/cherry-pick-smd-306-revert
• 1831886 Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.2 to 0.36.3

Commits

• 40bf4b2 Update dependencies to v0.36.3 tag
• 34d46be Merge pull request #140296 from jpbetz/cherry-pick-smd-306-revert
• 66a3724 Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3
• See full diff in compare view

Updates k8s.io/client-go from 0.36.2 to 0.36.3

Commits

• 44a8af2 Update dependencies to v0.36.3 tag
• f501ada Merge pull request #140296 from jpbetz/cherry-pick-smd-306-revert
• a43e1d7 Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3
• See full diff in compare view

Updates k8s.io/code-generator from 0.36.2 to 0.36.3

Commits

• f4c4331 Update dependencies to v0.36.3 tag
• f2be266 Merge pull request #140296 from jpbetz/cherry-pick-smd-306-revert
• 415a84d Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign lcarva after the PR has been reviewed.
You can assign the PR to them by writing /assign @lcarva in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[waveywaves]

@dependabot rebase

[dependabot]

Sorry, only users with push access can use that command.