Skip to content

Conversation

@malancas
Copy link
Contributor

@malancas malancas commented May 27, 2025

Update the dependency to v1.0.0 and replace deprecated types and functions.

Signed-off-by: Meredith Lancaster <[email protected]>
Copilot AI review requested due to automatic review settings May 27, 2025 15:28
@malancas malancas requested a review from a team as a code owner May 27, 2025 15:28
@malancas malancas requested a review from BagToad May 27, 2025 15:28
@malancas malancas temporarily deployed to cli-automation May 27, 2025 15:28 — with GitHub Actions Inactive
@cliAutomation cliAutomation added the external pull request originating outside of the CLI core team label May 27, 2025
@cliAutomation
Copy link
Collaborator

Hi! Thanks for the pull request. Please ensure that this change is linked to an issue by mentioning an issue number in the description of the pull request. If this pull request would close the issue, please put the word 'Fixes' before the issue number somewhere in the pull request body. If this is a tiny change like fixing a typo, feel free to ignore this message.

@malancas malancas changed the title Update sigstore-go dependency to v1 Update sigstore-go dependency to v1.0.0 May 27, 2025
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates the sigstore-go module to v1.0.0 and brings a set of direct and indirect Go dependencies up to their latest patch or minor releases.

  • Upgrade github.com/sigstore/sigstore-go to v1.0.0
  • Bump several golang.org/x/*, google.golang.org/*, and other indirect modules
  • Introduce github.com/cenkalti/backoff/v5 as an indirect requirement
Comments suppressed due to low confidence (1)

go.mod:47

  • Please verify that import paths and any API changes for sigstore-go v1 are applied correctly—major version upgrades can introduce breaking changes. Run go test ./... to confirm compatibility.
github.com/sigstore/sigstore-go v1.0.0

github.com/aymerick/douceur v0.2.0 // indirect
github.com/blang/semver v3.5.1+incompatible // indirect
github.com/catppuccin/go v0.3.0 // indirect
github.com/cenkalti/backoff/v5 v5.0.2 // indirect
Copy link

Copilot AI May 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] If backoff/v5 isn’t used directly by the code, you can remove this require and run go mod tidy to let Go manage indirect dependencies automatically.

Suggested change
github.com/cenkalti/backoff/v5 v5.0.2 // indirect

Copilot uses AI. Check for mistakes.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I ran go mod tidy and this line was not removed. Ignoring this suggestion for now.

Signed-off-by: Meredith Lancaster <[email protected]>
@malancas malancas requested a review from a team as a code owner May 27, 2025 15:34
Signed-off-by: Meredith Lancaster <[email protected]>
Copy link
Member

@BagToad BagToad left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving on behalf of CLI team for the go.mod updates.

@malancas malancas merged commit 4fcd6bf into cli:trunk May 27, 2025
9 checks passed
@malancas malancas deleted the sigstore-go-v1 branch May 27, 2025 16:12
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Jun 13, 2025
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [cli/cli](https://github.com/cli/cli) | minor | `v2.73.0` -> `v2.74.1` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>cli/cli (cli/cli)</summary>

### [`v2.74.1`](https://github.com/cli/cli/releases/tag/v2.74.1): GitHub CLI 2.74.1

[Compare Source](cli/cli@v2.74.0...v2.74.1)

#### What's Changed

-   Document support for `@copilot` in `gh [pr|issue] edit --add-assignee` and `--remove-assignee` by [@&#8203;timrogers](https://github.com/timrogers) in cli/cli#11056
-   Fix pr edit when URL is provided by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#11057
-   Fix const in MR finder tests by [@&#8203;babakks](https://github.com/babakks) in cli/cli#11091

**Full Changelog**: cli/cli@v2.74.0...v2.74.1

### [`v2.74.0`](https://github.com/cli/cli/releases/tag/v2.74.0): GitHub CLI 2.74.0

[Compare Source](cli/cli@v2.73.0...v2.74.0)

#### Security

A security vulnerability has been identified in a core `gh` dependency, `go-gh`, where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing.

This issue is addressed in this `gh` release by updating `go-gh` to a fixed version.

For more information, see GHSA-g9f5-x53j-h563

#### What's changed

##### ✨ Features

-   Add `preview prompter` command by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#10745
-   \[gh run watch] Support `--compact` flag by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10629
-   Fix brew update notifications by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#11024

##### 🐛 Fixes

-   Revert "\[gh config] Escape pipe symbol in Long desc for website manual" by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#11004
-   Fix formatting in allowed values for `gh config --help` by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#11003
-   fix: `gh gist edit` panic when no file in a gist by [@&#8203;phanen](https://github.com/phanen) in cli/cli#10627
-   Add retry logic when fetching TUF content in `gh attestation` commands by [@&#8203;malancas](https://github.com/malancas) in cli/cli#10943

##### 📚 Docs & Chores

-   Update README.md by [@&#8203;irhdab](https://github.com/irhdab) in cli/cli#11022
-   Add tests for `RenderJobs` and `RenderJobsCompact` by [@&#8203;babakks](https://github.com/babakks) in cli/cli#11013
-   Add example usage of `--head` option to `pr list` docs by [@&#8203;babakks](https://github.com/babakks) in cli/cli#10979
-   Mention `pr create` will print the created MR's URL by [@&#8203;babakks](https://github.com/babakks) in cli/cli#10980
-   Add Digest to ReleaseAsset struct by [@&#8203;bdehamer](https://github.com/bdehamer) in cli/cli#11030

##### :dependabot: Dependencies

-   Bump `go-gh` to v2.12.1 by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#11043
-   chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.8 to 1.4.9 by [@&#8203;dependabot](https://github.com/dependabot) in cli/cli#10825
-   Update sigstore-go dependency to v1.0.0 by [@&#8203;malancas](https://github.com/malancas) in cli/cli#11028
-   chore(deps): bump github.com/sigstore/protobuf-specs from 0.4.1 to 0.4.2 by [@&#8203;dependabot](https://github.com/dependabot) in cli/cli#10999
-   chore(deps): bump github.com/yuin/goldmark from 1.7.8 to 1.7.12 by [@&#8203;dependabot](https://github.com/dependabot) in cli/cli#11032

#### New Contributors

-   [@&#8203;irhdab](https://github.com/irhdab) made their first contribution in cli/cli#11022
-   [@&#8203;phanen](https://github.com/phanen) made their first contribution in cli/cli#10627

**Full Changelog**: cli/cli@v2.73.0...v2.74.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC41MC4wIiwidXBkYXRlZEluVmVyIjoiNDAuNTAuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiUmVub3ZhdGUgQm90Il19-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

external pull request originating outside of the CLI core team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants