Bumps the all group with 8 updates:

Package	From	To
cloud.google.com/go/storage	`1.37.0`	`1.38.0`
github.com/golangci/golangci-lint	`1.55.2`	`1.56.2`
github.com/google/go-containerregistry	`0.18.0`	`0.19.0`
github.com/sigstore/cosign/v2	`2.2.2`	`2.2.3`
github.com/sigstore/rekor	`1.3.4`	`1.3.5`
github.com/tektoncd/pipeline	`0.56.0`	`0.56.1`
golang.org/x/crypto	`0.18.0`	`0.19.0`
google.golang.org/grpc	`1.61.0`	`1.61.1`

Updates cloud.google.com/go/storage from 1.37.0 to 1.38.0

Release notes

Sourced from cloud.google.com/go/storage's releases.

storage: v1.38.0

1.38.0 (2024-02-12)

Features

storage: Support auto-detection of access ID for external_account creds (#9208) (b958d44)

storage: Support custom hostname for VirtualHostedStyle SignedURLs (#9348) (7eec40e)

storage: Support universe domains (#9344) (29a7498)

Bug Fixes

storage: Fix v4 url signing for hosts that specify ports (#9347) (f127b46)

Documentation

storage: Indicate that gRPC is incompatible with universe domains (#9386) (e8bd85b)

Commits

ef12dbd chore(main): release spanner 1.38.0 (#6606)
ccd3614 feat(spanner/spannertest): add support for adding and dropping Foreign Keys (...
bff16a7 feat(spanner/spansql): add support for coalesce expressions (#6461)
e9a94c2 feat(bigquery): improve error when reading null values (#6566)
6b0ac0c feat(bigquery/storage/managedwriter): augment reconnection logic (#6609)
9f3c334 chore(logging): added extra variables on environment test runs (#6511)
f8a307c chore(internal/gapicgen): fix print to not panic (#6583)
a6004e7 feat(iam): start generating apiv2 (#6605)
59d162b fix(spanner): pass userAgent to cloud spanner requests (#6598)
eedc632 feat(bigquery): add trace instrumentation support for individual rpcs (#6493)
Additional commits viewable in compare view

Updates github.com/golangci/golangci-lint from 1.55.2 to 1.56.2

Release notes

Sourced from github.com/golangci/golangci-lint's releases.

v1.56.2

golangci-lint is a free and open-source project, built by people in their free time. Also, the linter authors are an important part of golangci-lint. If you use and appreciate golangci-lint please think to support us (golangci-lint maintainers and linters authors). :heart:

Changelog

6f268403 build(deps): bump github.com/Antonboom/testifylint from 1.1.1 to 1.1.2 (#4371)

5a78c8a0 build(deps): bump github.com/bombsimon/wsl/v4 from 4.2.0 to 4.2.1 (#4367)

71eae84b build(deps): bump github.com/go-critic/go-critic from 0.11.0 to 0.11.1 (#4388)

58a724a0 build(deps): bump github.com/sashamelentyev/usestdlibvars from 1.24.0 to 1.25.0 (#4390)

a35de8c6 build(deps): bump github.com/securego/gosec/v2 from 2.18.2 to 2.19.0 (#4389)

21bb5432 build(deps): bump golang.org/x/oauth2 from 0.16.0 to 0.17.0 in /scripts/gen_github_action_config (#4380)

5513d3c9 build(deps): bump golang.org/x/tools from 0.17.0 to 0.18.0 (#4387)

53578856 build(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 (#4379)

v1.56.1

golangci-lint is a free and open-source project, built by people in their free time. Also, the linter authors are an important part of golangci-lint. If you use and appreciate golangci-lint please think to support us (golangci-lint maintainers and linters authors). :heart:

Changelog

a25592b5 build(deps): bump github.com/Antonboom/testifylint from 1.1.0 to 1.1.1 (#4359)

828b6b4a build(deps): bump github.com/kisielk/errcheck from 1.6.3 to 1.7.0 (#4358)

ca7b7a42 build(deps): bump github.com/mgechev/revive from 1.3.6 to 1.3.7 (#4355)

b525f2b8 govet: disable loopclosure with go1.22 (#4357)

v1.56.0

golangci-lint is a free and open-source project, built by people in their free time. Also, the linter authors are an important part of golangci-lint. If you use and appreciate golangci-lint please think to support us (golangci-lint maintainers and linters authors). :heart:

Changelog

bc169eb6 build(deps): bump actions/cache from 3 to 4 (#4329)

390acc9f build(deps): bump actions/setup-go from 4 to 5 (#4250)

42001943 build(deps): bump github.com/Antonboom/testifylint from 0.2.3 to 1.0.1 (#4186)

a12dde07 build(deps): bump github.com/Antonboom/testifylint from 1.0.1 to 1.0.2 (#4193)

7656f82c build(deps): bump github.com/Antonboom/testifylint from 1.0.2 to 1.1.0 (#4330)

1a00b409 build(deps): bump github.com/GaijinEntertainment/go-exhaustruct/v3 from 3.1.0 to 3.2.0 (#4304)

affa7d11 build(deps): bump github.com/OpenPeeDeeP/depguard/v2 from 2.1.0 to 2.2.0 (#4207)

553161d9 build(deps): bump github.com/alecthomas/go-check-sumtype from 0.1.3 to 0.1.4 (#4317)

e32f2f3f build(deps): bump github.com/bombsimon/wsl/v4 from 3.4.0 to 4.2.0 (#4215)

6e09a205 build(deps): bump github.com/butuzov/ireturn from 0.2.2 to 0.3.0 (#4352)

2b7c777b build(deps): bump github.com/catenacyber/perfsprint from 0.2.0 to 0.3.0 (#4157)

be5c2e93 build(deps): bump github.com/catenacyber/perfsprint from 0.3.0 to 0.3.1 (#4199)

84442f26 build(deps): bump github.com/catenacyber/perfsprint from 0.3.1 to 0.4.0 (#4236)

5083ba8c build(deps): bump github.com/catenacyber/perfsprint from 0.4.0 to 0.5.0 (#4258)

4ea9468c build(deps): bump github.com/catenacyber/perfsprint from 0.5.0 to 0.6.0 (#4346)

1ead82ff build(deps): bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 in /tools (#4307)

... (truncated)

Changelog

Sourced from github.com/golangci/golangci-lint's changelog.

v1.56.2

updated linters

go-critic: from 0.11.0 to 0.11.1

gosec: from 2.18.2 to 2.19.0

testifylint: from 1.1.1 to 1.1.2

usestdlibvars: from 1.24.0 to 1.25.0

wsl: from 4.2.0 to 4.2.1

misc.

Fix missing version in Docker image

Documentation

Explain the limitation of new-from-rev and new-from-patch

v1.56.1

updated linters

errcheck: from 1.6.3 to 1.7.0

govet: disable loopclosure with go1.22

revive: from 1.3.6 to 1.3.7

testifylint: from 1.1.0 to 1.1.1

v1.56.0

new linters

feat: add spancheck linter https://github.com/jjti/go-spancheck

updated linters

depguard: from 2.1.0 to 2.2.0

exhaustive: from 0.11.0 to 0.12.0

exhaustruct: from 3.1.0 to 3.2.0

gci: from 0.11.2 to 0.12.1

ginkgolinter: from 0.14.1 to 0.15.2

go-check-sumtype: from 0.1.3 to 0.1.4

go-critic: from 0.9.0 to 0.11.0

go-errorlint: from 1.4.5 to 1.4.8

go-spancheck: from 0.4.2 to 0.5.2

goconst: from 1.6.0 to 1.7.0

godot: from 1.4.15 to 1.4.16

gofumpt: from 0.5.0 to 0.6.0

inamedparam: from 0.1.2 to 0.1.3

ineffassign: from 0.0.0-20230610083614-0e73809eb601 to 0.1.0

ireturn: from 0.2.2 to 0.3.0

misspell: add mode option

musttag: from v0.7.2 to v0.8.0

paralleltest: from 1.0.8 to 1.0.9

perfsprint: from 0.2.0 to 0.6.0

protogetter: from 0.2.3 to 0.3.4

revive: from 1.3.4 to 1.3.6

sloglint: add static-msg option

sloglint: from 0.1.2 to 0.4.0

testifylint: from 0.2.3 to 1.1.0

... (truncated)

Commits

58a724a build(deps): bump github.com/sashamelentyev/usestdlibvars from 1.24.0 to 1.25...
a35de8c build(deps): bump github.com/securego/gosec/v2 from 2.18.2 to 2.19.0 (#4389)
71eae84 build(deps): bump github.com/go-critic/go-critic from 0.11.0 to 0.11.1 (#4388)
5513d3c build(deps): bump golang.org/x/tools from 0.17.0 to 0.18.0 (#4387)
21bb543 build(deps): bump golang.org/x/oauth2 from 0.16.0 to 0.17.0 in /scripts/gen_g...
5357885 build(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 (#4379)
403437e docs: explain limitation of new-from-rev and new-from-patch (#4377)
bf5008a dev: handle old TODO (#4374)
cc3e67b dev: fix govet.nilness lint issues (#4373)
7cf6cc9 dev: refactor govet impl with slices.Contains (#4372)
Additional commits viewable in compare view

Updates github.com/google/go-containerregistry from 0.18.0 to 0.19.0

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.19.0

What's Changed

Work around docker v25 tarballs by @jonjohnsonjr in google/go-containerregistry#1872

Full Changelog: https://github.com/google/go-containerregistry/compare/v0.18.0...v0.19.0

Commits

8dadbe7 Work around docker v25 tarballs (#1872)
See full diff in compare view

Updates github.com/sigstore/cosign/v2 from 2.2.2 to 2.2.3

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.2.3

Bug Fixes

Fix race condition on verification with multiple signatures attached to image (#3486)

fix(clean): Fix clean cmd for private registries (#3446)

Fixed BYO PKI verification (#3427)

Features

Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)

Add support for OpenVEX predicate type (#3405)

Documentation

Resolves #3088: version sub-command expected behaviour documentation and testing (#3447)

add examples for cosign attach signature cmd (#3468)

Misc

Remove CertSubject function (#3467)

Use local rekor and fulcio instances in e2e tests (#3478)

Full Changelog: https://github.com/sigstore/cosign/compare/v2.2.2...v2.2.3

Changelog

Sourced from github.com/sigstore/cosign/v2's changelog.

v2.2.3

Bug Fixes

Fix race condition on verification with multiple signatures attached to image (#3486)

fix(clean): Fix clean cmd for private registries (#3446)

Fixed BYO PKI verification (#3427)

Features

Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)

Add support for OpenVEX predicate type (#3405)

Documentation

Resolves #3088: version sub-command expected behaviour documentation and testing (#3447)

add examples for cosign attach signature cmd (#3468)

Misc

Remove CertSubject function (#3467)

Use local rekor and fulcio instances in e2e tests (#3478)

Contributors

aalsabag

Bob Callaway

Carlos Tadeu Panato Junior

Colleen Murphy

Hayden B

Mukuls77

Omri Bornstein

Puerco

vivek kumar sahu

Commits

493e6e2 Add changelog for v2.2.3 (#3513)
628df78 chore(deps): bump cpanato/vault-installer from 0.0.2 to 1.0.0 (#3510)
7be8de0 chore(deps): bump google.golang.org/api from 0.157.0 to 0.159.0 (#3508)
554015c chore(deps): bump the actions group with 3 updates (#3509)
8395d97 chore(deps): bump github.com/go-openapi/runtime from 0.26.2 to 0.27.1 (#3507)
1c90a3a chore(deps): bump github.com/open-policy-agent/opa from 0.60.0 to 0.61.0 (#3505)
3f20bde chore(deps): bump github.com/buildkite/agent/v3 from 3.61.0 to 3.62.0 (#3506)
5d79ebf chore(deps): bump the gomod group with 2 updates (#3504)
381c657 fix cross test (#3502)
a445167 Fix CI test failing (#3501)
Additional commits viewable in compare view

Updates github.com/sigstore/rekor from 1.3.4 to 1.3.5

Release notes

Sourced from github.com/sigstore/rekor's releases.

v1.3.5

Changelog

488eb97 v1.3.5 changelog (#1987)

19cd558 output trace in slog and override correlation header name (#1986)

a0453d5 give log timestamps nanosecond precision (#1985)

907f2b5 bump trillian images to v1.6.0 (#1984)

134ef83 remove trillian images from release process (#1983)

9865ca9 Added support for sha384/sha512 hash algorithms in hashedrekords (#1959)

fc28ac1 Change Redis value for locking mechanism (#1957)

fa9ab50 Bump sigstore/sigstore version, fix deprecated func (#1936)

6020532 Fix panic for DSSE canonicalization (#1923)

fe04993 Drop conditional when verifying entry checkpoint (#1917)

a6c25cc Remove timestamp from checkpoint (#1888)

64ab435 Additional unique index correction (#1885)

Thanks for all contributors!

What's Changed

Additional unique index correction by @sabre1041 in sigstore/rekor#1885

Remove timestamp from checkpoint by @haydentherapper in sigstore/rekor#1888

Drop conditional when verifying entry checkpoint by @haydentherapper in sigstore/rekor#1917

Fix panic for DSSE canonicalization by @haydentherapper in sigstore/rekor#1923

update builder to use go1.21 by @cpanato in sigstore/rekor#1956

Change Redis value for locking mechanism by @haydentherapper in sigstore/rekor#1957

remove trillian images from release process by @bobcallaway in sigstore/rekor#1983

bump trillian images to v1.6.0 by @bobcallaway in sigstore/rekor#1984

give log timestamps nanosecond precision by @bobcallaway in sigstore/rekor#1985

output trace in slog and override correlation header name by @bobcallaway in sigstore/rekor#1986

v1.3.5 changelog by @bobcallaway in sigstore/rekor#1987

New Contributors

@ret2libc made their first contribution in sigstore/rekor#1959

Full Changelog: https://github.com/sigstore/rekor/compare/v1.3.4...v1.3.5

Changelog

Sourced from github.com/sigstore/rekor's changelog.

v1.3.5

New Features

output trace in slog and override correlation header name (#1986)

give log timestamps nanosecond precision (#1985)

Added support for sha384/sha512 hash algorithms in hashedrekords (#1959)

Change Redis value for locking mechanism (#1957)

Bug Fixes

Fix panic for DSSE canonicalization (#1923)

Drop conditional when verifying entry checkpoint (#1917)

Remove timestamp from checkpoint (#1888)

Additional unique index correction (#1885)

Quality Enhancements

bump trillian images to v1.6.0 (#1984)

remove trillian images from release process (#1983)

update builder to use go1.21

Contributors

Andrew Block

Bob Callaway

Carlos Tadeu Panato Junior

Hayden Blauzvern

Riccardo Schirone

Commits

488eb97 v1.3.5 changelog (#1987)
19cd558 output trace in slog and override correlation header name (#1986)
a0453d5 give log timestamps nanosecond precision (#1985)
907f2b5 bump trillian images to v1.6.0 (#1984)
134ef83 remove trillian images from release process (#1983)
63aa08f build(deps): Bump google.golang.org/api from 0.157.0 to 0.159.0
8ca4eba build(deps): Bump google/cloud-sdk from 460.0.0 to 461.0.0
14608f3 build(deps): Bump google.golang.org/grpc from 1.60.1 to 1.61.0
2b14bf9 build(deps): Bump golang from 5f5d61d to 76aadd9
74311c7 build(deps): Bump cloud.google.com/go/pubsub from 1.34.0 to 1.36.0
Additional commits viewable in compare view

Updates github.com/tektoncd/pipeline from 0.56.0 to 0.56.1

Release notes

Sourced from github.com/tektoncd/pipeline's releases.

Tekton Pipeline release v0.56.1 "Persian Terminator"

-Docs @ v0.56.1 -Examples @ v0.56.1

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.56.1/release.yaml

Attestation

The Rekor UUID for this release is 24296fb24b8ad77ad1e4c68a476e6b180257b4a6715315a2d40370f46ce4f36ce311c893d7bef2ba

Obtain the attestation:

REKOR_UUID=24296fb24b8ad77ad1e4c68a476e6b180257b4a6715315a2d40370f46ce4f36ce311c893d7bef2ba
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.56.1/release.yaml
REKOR_UUID=24296fb24b8ad77ad1e4c68a476e6b180257b4a6715315a2d40370f46ce4f36ce311c893d7bef2ba
Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.56.1@sha256:" + .digest.sha256')
Download the release file
curl "$RELEASE_FILE" > release.yaml
For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

... (truncated)

Changelog

Sourced from github.com/tektoncd/pipeline's changelog.

Tekton Pipeline Releases

Release Frequency

Tekton Pipelines follows the Tekton community [release policy][release-policy] as follows:

Versions are numbered according to semantic versioning: vX.Y.Z

A new release is produced on a monthly basis

Four releases a year are chosen for long term support (LTS). All remaining releases are supported for approximately 1 month (until the next release is produced)

LTS releases take place in January, April, July and October every year

The first Tekton Pipelines LTS release will be v0.41.0 in October 2022

Releases happen towards the middle of the month, between the 13th and the 20th, depending on week-ends and readiness

Tekton Pipelines produces nightly builds, publicly available on gcr.io/tekton-nightly.

Transition Process

Before release v0.41 Tekton Pipelines has worked on the basis of an undocumented support period of four months, which will be maintained for the releases between v0.37 and v0.40.

Release Process

Tekton Pipeline releases are made of YAML manifests and container images. Manifests are published to cloud object-storage as well as [GitHub][tekton-pipeline-releases]. Container images are signed by [Sigstore][sigstore] via [Tekton Chains][tekton-chains]; signatures can be verified through the [public key][chains-public-key] hosted by the Tekton Chains project.

Further documentation available:

The Tekton Pipeline [release process][tekton-releases-docs]

[Installing Tekton][tekton-installation]

Standard for [release notes][release-notes-standards]

Release

v0.56 (LTS)

Latest Release: [v0.56.1][v0.56-1] (2024-02-13) ([docs][v0.56-1-docs], [examples][v0.56-1-examples])

Initial Release: [v0.56.0][v0.56-0] (2024-01-19)

Estimated End of Life: 2025-01-19

Patch Releases: [v0.56.0][v0.56-0]

v0.53 (LTS)

... (truncated)

Commits

9be03e2 Prior to this PR, when the when.cel field in the final task refers to ordin...
dcbd805 fix(pipeline): correct warning path for duplicate param name in pipeline
3d0d421 Exclude stopped injected sidecars from TaskRun status
6e10518 fix: ensure clustertask annotations are synced to taskrun
777546f do not allow negative requeue times
See full diff in compare view

Updates golang.org/x/crypto from 0.18.0 to 0.19.0

Commits

405cb3b go.mod: update golang.org/x dependencies
913d3ae x509roots/fallback: update bundle
See full diff in compare view

Updates google.golang.org/grpc from 1.61.0 to 1.61.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.61.1

Bug Fixes

server: wait to close connection until incoming socket is drained (with timeout) to prevent data loss on client-side (#6977)

Special Thanks: @s-matyukevich for discovering the root cause

Commits

c6e7f04 Change version to 1.61.1 (#6981)
dbd4cbc cherry-pick #6977 to 1.61.x release branch (#6980)
57ed608 Change version to 1.61.1-dev (#6937)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions

Test name	Commit	Details	Required	Rerun command
pull-tekton-chains-unit-tests	d5bd79e782037fddd85d092dcee4b7c4375a661b	link	true	`/test pull-tekton-chains-unit-tests`
pull-tekton-chains-build-tests	d5bd79e782037fddd85d092dcee4b7c4375a661b	link	true	`/test pull-tekton-chains-build-tests`
pull-tekton-chains-integration-tests	d5bd79e782037fddd85d092dcee4b7c4375a661b	link	true	`/test pull-tekton-chains-integration-tests`

tektoncd / chains

Bump the all group with 8 updates #1055

storage: v1.38.0

1.38.0 (2024-02-12)

Features

Bug Fixes

Documentation

v1.56.2

Changelog

v1.56.1

Changelog

v1.56.0

Changelog

v1.56.2

v1.56.1

v1.56.0

v0.19.0

What's Changed

v2.2.3

Bug Fixes

Features

Documentation

Misc

v2.2.3

Bug Fixes

Features

Documentation

Misc

Contributors

v1.3.5

Changelog

Thanks for all contributors!

What's Changed

New Contributors

v1.3.5

New Features

Bug Fixes

Quality Enhancements

Contributors

Tekton Pipeline release v0.56.1 "Persian Terminator"

Installation one-liner

Attestation

Obtains the list of images with sha from the attestation

Download the release file

For each image in the attestation, match it to the release file

Changes

Features

Tekton Pipeline Releases

Release Frequency

Transition Process

Release Process

Release

v0.56 (LTS)

v0.53 (LTS)

Release 1.61.1

Bug Fixes