build(deps): bump the all-deps group across 1 directory with 6 updates

[dependabot]

Bumps the all-deps group with 6 updates in the / directory:

Package	From	To
github.com/sigstore/protobuf-specs	0.5.1	0.5.2
github.com/sigstore/sigstore	1.10.8	1.10.9
github.com/sigstore/sigstore-go	1.2.2	1.3.0
github.com/sigstore/sigstore/pkg/signature/kms/hashivault	1.10.8	1.10.9
github.com/sirupsen/logrus	1.9.4	1.10.1
google.golang.org/protobuf	1.36.11	1.36.12

Updates github.com/sigstore/protobuf-specs from 0.5.1 to 0.5.2

Changelog

Sourced from github.com/sigstore/protobuf-specs's changelog.

v0.5.2

• Add monitor configuration protobuf definition (#907)
• Add custom java_package to envelope.proto (#923)

Commits

• 0342fe5 Prepare for 0.5.2 release (#925)
• 15d97a6 build(deps): bump ts-proto from 2.11.8 to 2.12.0 in /protoc-builder/hack in t...
• 39f729e build(deps): bump the actions-deps group across 1 directory with 6 updates (#...
• f46db79 build(deps): bump the java-deps group in /java with 4 updates (#919)
• 1e1e712 Add custom java_package to envelope.proto (#923)
• 104df67 build(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /protoc-bui...
• 0ebecc1 build(deps): bump the rust-deps group in /gen/pb-rust with 8 updates (#920)
• 436804b build(deps): bump the actions-deps group across 1 directory with 7 updates (#...
• 63617ed build(deps): bump the docker-refs group (#918)
• fc5238b build(deps): bump tar from 7.5.16 to 7.5.22 in /protoc-builder/hack (#913)
• Additional commits viewable in compare view

Updates github.com/sigstore/sigstore from 1.10.8 to 1.10.9

Release notes

Sourced from github.com/sigstore/sigstore's releases.

v1.10.9

What's Changed

Note: sigstore/sigstore#2369 deprecates the TUF client. Use the TUF client from sigstore-go instead: https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf

• Deprecate TUF client, ValidatePubKey in sigstore/sigstore#2369
• docs: add OVHcloud KMS in available external plugins in sigstore/sigstore#2359
• fix(oauthflow): default the device flow poll interval to 5s per RFC 8628 in sigstore/sigstore#2381
• Add BrowserOpener field to InteractiveIDTokenGetter in sigstore/sigstore#2383
• Fix Azure KMS support for RSA signatures in sigstore/sigstore#2355

Full Changelog: sigstore/sigstore@v1.10.8...v1.10.9

Commits

• ee9fe03 Fix Azure KMS support for RSA signatures (#2355)
• b34fd13 feat(hashivault): token helper tests (#2176)
• aed7c8b Dependencies updates (#2384)
• 05a1d97 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azk...
• be12908 build(deps): Bump github.com/hashicorp/vault/api (#2351)
• a8f8715 build(deps): Bump cloud.google.com/go/kms in /pkg/signature/kms/gcp (#2350)
• d91673d build(deps): Bump github.com/aws/aws-sdk-go-v2/config (#2372)
• c482e99 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#2347)
• 6529cc3 build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms (#2376)
• f95e2b7 build(deps): Bump golang.org/x/crypto in /pkg/signature/kms/azure (#2377)
• Additional commits viewable in compare view

Updates github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0

Release notes

Sourced from github.com/sigstore/sigstore-go's releases.

v1.3.0

What's Changed

• Bump actions/setup-go from 6.5.0 to 7.0.0 by @​dependabot[bot] in sigstore/sigstore-go#659
• Bump the minor-patch group across 1 directory with 6 updates by @​dependabot[bot] in sigstore/sigstore-go#660
• fix(verify): prevent nil-pointer panic in TLogEntries by @​cmenjivar in sigstore/sigstore-go#658
• Bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in sigstore/sigstore-go#663
• Bump the minor-patch group across 1 directory with 2 updates by @​dependabot[bot] in sigstore/sigstore-go#662
• Handle 409s from Rekor by fetching the entry by @​Hayden-IO in sigstore/sigstore-go#647
• verify: stop materializing in-toto predicates the verifier never reads by @​mattmoor in sigstore/sigstore-go#666
• Bump linter, disable goconst, run go fix by @​Hayden-IO in sigstore/sigstore-go#664
• Bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @​codysoyland in sigstore/sigstore-go#667

New Contributors

• @​cmenjivar made their first contribution in sigstore/sigstore-go#658
• @​mattmoor made their first contribution in sigstore/sigstore-go#666

Full Changelog: sigstore/sigstore-go@v1.2.2...v1.3.0

Commits

• 22d3691 Bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#667)
• 41fe108 Bump linter, disable goconst, run go fix (#664)
• ba85fa8 verify: stop materializing in-toto predicates the verifier never reads (#666)
• 96c07cb Handle 409s from Rekor v1 by fetching the entry (#647)
• 85e559c Bump the minor-patch group across 1 directory with 2 updates (#662)
• fe6a5a5 Bump actions/checkout from 7.0.0 to 7.0.1 (#663)
• fc71b2a fix(verify): prevent nil-pointer panic in TLogEntries (#658)
• 444ecf7 Bump the minor-patch group across 1 directory with 6 updates (#660)
• 96894f5 Bump actions/setup-go from 6.5.0 to 7.0.0 (#659)
• See full diff in compare view

Updates github.com/sigstore/sigstore/pkg/signature/kms/hashivault from 1.10.8 to 1.10.9

Release notes

Sourced from github.com/sigstore/sigstore/pkg/signature/kms/hashivault's releases.

v1.10.9

What's Changed

Note: sigstore/sigstore#2369 deprecates the TUF client. Use the TUF client from sigstore-go instead: https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf

• Deprecate TUF client, ValidatePubKey in sigstore/sigstore#2369
• docs: add OVHcloud KMS in available external plugins in sigstore/sigstore#2359
• fix(oauthflow): default the device flow poll interval to 5s per RFC 8628 in sigstore/sigstore#2381
• Add BrowserOpener field to InteractiveIDTokenGetter in sigstore/sigstore#2383
• Fix Azure KMS support for RSA signatures in sigstore/sigstore#2355

Full Changelog: sigstore/sigstore@v1.10.8...v1.10.9

Commits

• ee9fe03 Fix Azure KMS support for RSA signatures (#2355)
• b34fd13 feat(hashivault): token helper tests (#2176)
• aed7c8b Dependencies updates (#2384)
• 05a1d97 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azk...
• be12908 build(deps): Bump github.com/hashicorp/vault/api (#2351)
• a8f8715 build(deps): Bump cloud.google.com/go/kms in /pkg/signature/kms/gcp (#2350)
• d91673d build(deps): Bump github.com/aws/aws-sdk-go-v2/config (#2372)
• c482e99 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#2347)
• 6529cc3 build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms (#2376)
• f95e2b7 build(deps): Bump golang.org/x/crypto in /pkg/signature/kms/azure (#2377)
• Additional commits viewable in compare view

Updates github.com/sirupsen/logrus from 1.9.4 to 1.10.1

Release notes

Sourced from github.com/sirupsen/logrus's releases.

v1.10.1

Logrus v1.10.1

This patch release fixes two issues in field formatting and handling:

• Fix a regression introduced in v1.10.0 where TextFormatter could panic when formatting nil or panicking error and fmt.Stringer values.
• Allow function-backed values implementing error to be used with WithError, WithField, and WithFields.

Dependency Changes

• update github.com/stretchr/testify to v1.12.0

Full Changelog: sirupsen/logrus@v1.10.0...v1.10.1

v1.10.0

Logrus v1.10.0

This release focuses on substantial performance improvements, concurrency correctness, and better interoperability with modern Go logging APIs.

🚀 Performance

Major improvements across TextFormatter, entry handling, and common logger paths:

• ~17% lower geomean runtime across the benchmark suite
• ~27% higher geomean formatter throughput
• Common enabled logging paths are ~30–44% faster
• WithError is ~40% faster
• Chained fields are ~46% faster
• TextFormatter paths are up to ~40% faster
• Allocation counts are reduced by ~25–74% across measured TextFormatter cases, with the largest reductions in colored output

The improvements also show up in complete logger paths:

• Logger + TextFormatter is ~31% faster, with ~24% fewer allocations
• Logger + JSONFormatter is ~21% faster, with ~10% fewer allocations

JSONFormatter itself remains largely unchanged in runtime performance, with small allocation reductions.

🔄 log/slog interoperability

v1.10 adds bidirectional interoperability between Logrus and Go's log/slog:

• A Logrus slog hook can forward existing Logrus entries to an slog logger.
• hooks/slog.NewHandler implements slog.Handler, allowing log/slog records to use an existing Logrus logger and its hooks, formatter, and output.
• The handler preserves levels, fields, groups, context, record timestamps, and optionally caller information.
• Caller reporting is configured per handler, without requiring Logrus's logger-wide ReportCaller option.
• Custom slog levels can be mapped to Logrus levels.

... (truncated)

Changelog

Sourced from github.com/sirupsen/logrus's changelog.

1.10.1

Fixes:

• Fix a regression introduced in v1.10.0 where TextFormatter could panic when formatting nil or panicking error and fmt.Stringer values.
• Allow function-backed implementations of error as field values.

1.10.0

Fixes:

• Fix reentrant logging deadlocks in formatter paths.
• Fix race conditions in formatter and entry handling.
• Fix generic Log, Logf, Logln, and LogFn methods unexpectedly panicking when called with PanicLevel. Use the corresponding Panic methods when panic behavior is desired.
• Improve concurrency safety around formatter and hook access.

Features:

• Add slog hook for forwarding Logrus entries to log/slog.
• Add slog.Handler for forwarding log/slog records to a Logrus logger, including levels, fields, groups, context, time, and optional caller reporting. The hook and handler can also be combined to help migrate between Logrus and log/slog.
• Add minimal, composable logging interfaces for each log level. This enables consumers to depend on narrower interfaces, making it easier to substitute or adapt logging implementations.
• Allow Entry.Caller to be set explicitly and preserve it across derived entries, enabling custom caller detection without Logrus overwriting caller information when ReportCaller is enabled.

Changed:

• Raise minimum supported Go version to 1.23.
• TextFormatter now renders []byte values as raw/quoted strings instead of slice-of-ints.
• TextFormatter now uses distinct dimmed colors for debug and trace output.
• TextFormatter now automatically enables colors on Windows terminals with ANSI support, matching the behavior on other platforms.
• Entry.HasCaller is now deprecated in favor of checking Entry.Caller directly.
• Deprecated MutexWrap, which was unintentionally exposed as public API. It remains available as an alias for compatibility but should not be used directly.

Performance:

• Significantly improve TextFormatter performance and reduce allocations.
• Optimize common Entry and Logger hot paths.
• Reduce allocations in caller reporting.

... (truncated)

Commits

• 8b673a9 Merge pull request #1583 from thaJeztah/release_1.10.1
• 0b920ad Merge pull request #1584 from thaJeztah/more_coverage
• 5e20694 TextFormatter: cover nil pointer method receivers
• 8312732 update changelog for v1.10.1
• e987a40 Merge pull request #1582 from thaJeztah/panic_handler
• 17d574b TextFormatter: recover panics from Error and String methods
• 134c80f Merge pull request #1579 from thaJeztah/err_handling
• 7350f42 logger: WithError: wrap logger.WithError for consistency
• b3369d2 entry: allow function-backed error fields
• 1080083 Merge pull request #1578 from thaJeztah/err_handling_tests
• Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.36.11 to 1.36.12

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.82%. Comparing base (eba7143) to head (c13d88a).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #60   +/-   ##
=======================================
  Coverage   71.82%   71.82%           
=======================================
  Files          30       30           
  Lines        2740     2740           
=======================================
  Hits         1968     1968           
  Misses        446      446           
  Partials      326      326           

Flag	Coverage Δ
unit	71.82% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.