Skip to content

chore(deps): bump the all group across 1 directory with 4 updates - #1897

Open
dependabot[bot] wants to merge 1 commit into
release-v0.26.xfrom
dependabot/go_modules/release-v0.26.x/all-bf93725d52
Open

chore(deps): bump the all group across 1 directory with 4 updates#1897
dependabot[bot] wants to merge 1 commit into
release-v0.26.xfrom
dependabot/go_modules/release-v0.26.x/all-bf93725d52

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the all group with 4 updates in the / directory: github.com/google/go-containerregistry, github.com/sigstore/cosign/v2, google.golang.org/protobuf and k8s.io/apimachinery.

Updates github.com/google/go-containerregistry from 0.21.7 to 0.21.9

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.21.9

What's Changed

Full Changelog: google/go-containerregistry@v0.21.8...v0.21.9

v0.21.8

The artifacts attached to this release are missing SLSA provenance, see #2390.

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.21.7...v0.21.8

Commits
  • 7b32099 build(deps): bump the actions group with 3 updates (#2398)
  • 2a4447d fix: remove '.' from unsafe path prefixes (#2400)
  • 43cc3e8 fix: prevent data race on scope refreshes within remote.writer (#2396)
  • 7775aab actions: pin slsa generator version following linter exception (#2395)
  • 2ea098f Bump go version to 1.26.5 (#2388)
  • ec2e586 actions: reformat ALL actions (#2386)
  • ab819b6 actions: fix unformatted action (#2385)
  • eed9a20 actions: update actions to be pinned by hash (#2384)
  • 8a97709 build(deps): bump github.com/moby/moby/client (#2380)
  • d04bf7d tarball: use correct file extension for zstd/uncompressed (#2382)
  • Additional commits viewable in compare view

Updates github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.6.5

Changelog

This release backports GHSA-fx35-mq7g-6g98 (Verification bypass via public key in legacy bundle) to Cosign v2.6.x.

We strongly encourage folks to continue their migration to the bundle format. The Cosign v3.1.x releases support both formats; the primary change being that the default for signing is the bundle format (although you can specify --new-bundle-format=false to sign with the old format). The verification commands in Cosign v3.1.x support both formats, and will try to detect the format for you for maximum compatibility.

Thanks to all contributors!

Commits

Updates google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12

Updates k8s.io/apimachinery from 0.34.10 to 0.34.11

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the all group across 1 directory with 4 updates
ba4f130 
Bumps the all group with 4 updates in the / directory: [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry), [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign), google.golang.org/protobuf and [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery).


Updates `github.com/google/go-containerregistry` from 0.21.7 to 0.21.9
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](google/go-containerregistry@v0.21.7...v0.21.9)

Updates `github.com/sigstore/cosign/v2` from 2.6.4 to 2.6.5
- [Release notes](https://github.com/sigstore/cosign/releases)
- [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md)
- [Commits](sigstore/cosign@v2.6.4...v2.6.5)

Updates `google.golang.org/protobuf` from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12

Updates `k8s.io/apimachinery` from 0.34.10 to 0.34.11
- [Commits](kubernetes/apimachinery@v0.34.10...v0.34.11)

---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.21.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/sigstore/cosign/v2
  dependency-version: 2.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.34.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Used by dependabot - identifies all PRs created by dependabot kind/misc Categorizes issue or PR as a miscellaneuous one. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesnt merit a release note. labels Aug 21, 2026
@tekton-robot
tekton-robot requested review from jkhelil and wlynch August 21, 2026 14:15
@tekton-robot

tekton-robot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign chuangw6 after the PR has been reviewed.
You can assign the PR to them by writing /assign @chuangw6 in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot tekton-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Aug 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jkhelil jkhelil Awaiting requested review from jkhelil
@wlynch wlynch Awaiting requested review from wlynch

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Used by dependabot - identifies all PRs created by dependabot kind/misc Categorizes issue or PR as a miscellaneuous one. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesnt merit a release note. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tekton-robot