build(deps): bump the minor-and-patch group across 1 directory with 4 updates

[dependabot]

Bumps the minor-and-patch group with 4 updates in the / directory: github.com/brokenbots/criteria-go-adapter-sdk, github.com/sigstore/sigstore, github.com/sigstore/sigstore-go and google.golang.org/grpc.

Updates github.com/brokenbots/criteria-go-adapter-sdk from 0.5.2 to 0.5.3

Release notes

Sourced from github.com/brokenbots/criteria-go-adapter-sdk's releases.

v0.5.3 — log-stream heartbeat survives an early Log return

Hardening

An adapter whose Log implementation returns early can no longer disable its own liveness heartbeat.

Previously the heartbeat ticker was scoped to the lifetime of the adapter's Log call (defer cancel()), so the natural "nothing to log" implementation — return nil — stopped the heartbeat before a single beat was sent. The host feeds its stall detector solely from log-stream heartbeats and arms it as soon as the stream starts, so such an adapter's sessions were falsely declared crashed after the 90s stall threshold. Honouring the protocol depended on an unwritten rule ("your Log must block until its context is cancelled") that nothing in the signature, docs, or tests communicated.

The SDK now scopes the heartbeat to the stream context, runs impl.Log concurrently, and holds the stream open until the host cancels it.

• Adapters that return early from Log stay healthy.
• Adapters that block on <-ctx.Done() are unaffected.
• A non-nil error from Log still propagates immediately.
• Heartbeats stop on stream-context cancellation, so genuine stall detection is intact.

Covered by TestLogEarlyReturnKeepsHeartbeats, TestLogBlockingReturnUnchanged, TestLogErrorPropagated, and TestLogHeartbeatsStopOnCancel.

Principle

Protocol-level liveness and stream lifetime are the SDK's responsibility, not the adapter author's. An author writing the most obvious implementation of an interface must not be able to produce an adapter that breaks the host.

For adapter authors

Bump github.com/brokenbots/criteria-go-adapter-sdk to v0.5.3 to pick this up.

Commits

• 425071c adapterhost: keep log-stream heartbeat alive for stream lifetime (#12)
• 7ca94dd Merge pull request #2 from brokenbots/security/ws49-ws50-hardening
• fe269f5 security: osv-scanner gate + dependency policy + docs (WS49/WS50)
• 593e6f7 feat(remote): reconnect, LoadClientTLS helper, tests & examples for ServeRemo...
• See full diff in compare view

Updates github.com/sigstore/sigstore from 1.10.8 to 1.10.9

Release notes

Sourced from github.com/sigstore/sigstore's releases.

v1.10.9

What's Changed

Note: sigstore/sigstore#2369 deprecates the TUF client. Use the TUF client from sigstore-go instead: https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf

• Deprecate TUF client, ValidatePubKey in sigstore/sigstore#2369
• docs: add OVHcloud KMS in available external plugins in sigstore/sigstore#2359
• fix(oauthflow): default the device flow poll interval to 5s per RFC 8628 in sigstore/sigstore#2381
• Add BrowserOpener field to InteractiveIDTokenGetter in sigstore/sigstore#2383
• Fix Azure KMS support for RSA signatures in sigstore/sigstore#2355

Full Changelog: sigstore/sigstore@v1.10.8...v1.10.9

Commits

• ee9fe03 Fix Azure KMS support for RSA signatures (#2355)
• b34fd13 feat(hashivault): token helper tests (#2176)
• aed7c8b Dependencies updates (#2384)
• 05a1d97 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azk...
• be12908 build(deps): Bump github.com/hashicorp/vault/api (#2351)
• a8f8715 build(deps): Bump cloud.google.com/go/kms in /pkg/signature/kms/gcp (#2350)
• d91673d build(deps): Bump github.com/aws/aws-sdk-go-v2/config (#2372)
• c482e99 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#2347)
• 6529cc3 build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms (#2376)
• f95e2b7 build(deps): Bump golang.org/x/crypto in /pkg/signature/kms/azure (#2377)
• Additional commits viewable in compare view

Updates github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0

Release notes

Sourced from github.com/sigstore/sigstore-go's releases.

v1.3.0

What's Changed

• Bump actions/setup-go from 6.5.0 to 7.0.0 by @​dependabot[bot] in sigstore/sigstore-go#659
• Bump the minor-patch group across 1 directory with 6 updates by @​dependabot[bot] in sigstore/sigstore-go#660
• fix(verify): prevent nil-pointer panic in TLogEntries by @​cmenjivar in sigstore/sigstore-go#658
• Bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in sigstore/sigstore-go#663
• Bump the minor-patch group across 1 directory with 2 updates by @​dependabot[bot] in sigstore/sigstore-go#662
• Handle 409s from Rekor by fetching the entry by @​Hayden-IO in sigstore/sigstore-go#647
• verify: stop materializing in-toto predicates the verifier never reads by @​mattmoor in sigstore/sigstore-go#666
• Bump linter, disable goconst, run go fix by @​Hayden-IO in sigstore/sigstore-go#664
• Bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @​codysoyland in sigstore/sigstore-go#667

New Contributors

• @​cmenjivar made their first contribution in sigstore/sigstore-go#658
• @​mattmoor made their first contribution in sigstore/sigstore-go#666

Full Changelog: sigstore/sigstore-go@v1.2.2...v1.3.0

Commits

• 22d3691 Bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#667)
• 41fe108 Bump linter, disable goconst, run go fix (#664)
• ba85fa8 verify: stop materializing in-toto predicates the verifier never reads (#666)
• 96c07cb Handle 409s from Rekor v1 by fetching the entry (#647)
• 85e559c Bump the minor-patch group across 1 directory with 2 updates (#662)
• fe6a5a5 Bump actions/checkout from 7.0.0 to 7.0.1 (#663)
• fc71b2a fix(verify): prevent nil-pointer panic in TLogEntries (#658)
• 444ecf7 Bump the minor-patch group across 1 directory with 6 updates (#660)
• 96894f5 Bump actions/setup-go from 6.5.0 to 7.0.0 (#659)
• See full diff in compare view

Updates google.golang.org/grpc from 1.82.1 to 1.83.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.0

Security

• server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
• xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
• xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
• xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
• xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

New Features

• xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
• xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
• authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
  • Special Thanks: @​hnefatl
• xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
• xds: Add support for xDS-based HTTP CONNECT proxies.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
• xds: Add support for contains_match in route header matchers. (#9223)

Bug Fixes

• credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
• grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)
  • Special Thanks: @​Yusufihsangorgel

Commits

• 4c226da Change version to 1.83.0 (#9228)
• c198988 Cherrypick 9223 into v1.83.x (#9279)
• 8ce3ebf Cherrypick PR 9255 into v1.83.x (#9263)
• e393849 Cherry-pick recent changes from master (#9240)
• 2a112a8 authz: add onPolicyUpdate callback to authz file watcher (#9142)
• 1a80fca vet: adds a check to disallow usage of regex.Compile in xDS code (#9216)
• 26ffdb3 [tls] Add safety check in custom cert verification that peer cert chain is no...
• 5013974 internal/grpcsync: add ScheduleAndWait to CallbackSerializer (#9162)
• bd58bc0 internal/transport: increase test timeout locally in TestAccountCheckWindowSi...
• 484f150 httpfilter/extproc: add check to ensure that response trailer mode must be SE...
• Additional commits viewable in compare view

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.