build(deps): Bump slsa-framework/slsa-verifier from 2.4.0 to 2.5.1

[dependabot[bot]]

Bumps slsa-framework/slsa-verifier from 2.4.0 to 2.5.1.

Release notes

Sourced from slsa-framework/slsa-verifier's releases.

v2.5.1

What's Changed

• feat: Add cosign registry opts for provenance registry by @​saisatishkarra in slsa-framework/slsa-verifier#729 and slsa-framework/slsa-verifier#736
• feat: Add support for DSSE Rekor type by @​haydentherapper in slsa-framework/slsa-verifier#742

New Contributors

• @​saisatishkarra made their first contribution in slsa-framework/slsa-verifier#729
• @​ramonpetgrave64 made their first contribution in slsa-framework/slsa-verifier#737
• @​haydentherapper made their first contribution in slsa-framework/slsa-verifier#742

Full Changelog: https://github.com/slsa-framework/slsa-verifier/compare/v2.4.1...v2.5.1

v2.5.1-rc.0

This is a pre-release. DO NOT install

What's Changed

• feat: Add cosign registry opts for provenance registry by @​saisatishkarra in slsa-framework/slsa-verifier#729 and slsa-framework/slsa-verifier#736
• feat: Add support for DSSE Rekor type by @​haydentherapper in slsa-framework/slsa-verifier#742

New Contributors

• @​saisatishkarra made their first contribution in slsa-framework/slsa-verifier#729
• @​ramonpetgrave64 made their first contribution in slsa-framework/slsa-verifier#737
• @​haydentherapper made their first contribution in slsa-framework/slsa-verifier#742

Full Changelog: https://github.com/slsa-framework/slsa-verifier/compare/v2.4.1...v2.5.1-rc.0

v2.4.1

What's Changed

• Fix a verification issue when verifying npm's publish attestations - Low severity https://github.com/slsa-framework/slsa-verifier/security/advisories/GHSA-r2xv-vpr2-42m9. This part of the code remains experimental.

New Contributors

• @​trishankatdatadog made their first contribution in slsa-framework/slsa-verifier#702

Full Changelog: https://github.com/slsa-framework/slsa-verifier/compare/v2.4.0...v2.4.1

v2.4.1-rc.1

Pre-release, do not use

v2.4.1-rc.0

Pre-release, do not use.

Commits

• eb70070 feat: Update verifier version in GHA installer (#747)
• 594b179 chore(deps): update github-actions (#741)
• dc7173b feat: Regression tests for builder v1.10.0 (#745)
• 52c099b feat: Add support for DSSE Rekor type (#742)
• bb41cb6 fix(deps): update go (#498)
• 74119b2 fix(deps): update go to 1.21 (#738)
• 9b2467f feat: fixes #724: add input for --provenance-repository while image verificat...
• ceaebee fix: #642: don't use go-cmp for outputting diff (#737)
• b804933 chore: Remove ianlewis from CODEOWNERS (#732)
• f09d99f feat: Add cosign registry opts for provenance registry (#729)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)