chore(deps): bump the all group with 3 updates

[dependabot]

Bumps the all group with 3 updates: github.com/gittuf/gittuf, github.com/go-git/go-git/v5 and github.com/octo-sts/app.

Updates github.com/gittuf/gittuf from 0.14.0 to 0.14.1

Release notes

Sourced from github.com/gittuf/gittuf's releases.

v0.14.1

This release ships some small improvements, and fixes security vulnerabilities in dependencies. See GHSA-7rmh-48mx-2vwc.

Changelog

Added

• Added unit tests for the TUI

Updated

• Increased testing coverage for remote policy synchronization and gitinterface
• Fixed issue with git-remote-gittuf and pruning remote branches
• Updated various dependencies

Contributors

This release includes work by @​theycallmeaabie, @​dawgdevv, @​Aaravanand00, @​kevinpchen, @​adityasaky and @​patzielinski. Dependency updates courtesy of @​dependabot.

Changelog

Sourced from github.com/gittuf/gittuf's changelog.

v0.14.1

This release ships some small improvements, and fixes security vulnerabilities in dependencies. See the release notes on GitHub for more information.

Added

• Added unit tests for the TUI

Updated

• Increased testing coverage for remote policy synchronization and gitinterface
• Fixed issue with git-remote-gittuf and pruning remote branches
• Updated various dependencies

Commits

• 79d8613 Merge pull request #1328 from gittuf/prepare-v0.14.1
• 056b1a5 Prepare v0.14.1
• d82320f Merge pull request #1327 from gittuf/bump-gitsign
• 605cf1f deps: Bump gitsign
• 64c180e Merge pull request #1326 from gittuf/dependabot/go_modules/all-d7145cbce0
• b7e091b chore(deps): bump github.com/go-git/go-git/v5 in the all group
• 91d5c81 Merge pull request #1324 from gittuf/dependabot/github_actions/all-47375755e7
• 2ee3efb chore(deps): bump gittuf/gittuf-installer in the all group
• df5896f Merge pull request #1305 from dawgdevv/improve-gitinterface-coverage-v2
• ef8df12 Merge pull request #1263 from theycallmeaabie/fix-git-remote-prune
• Additional commits viewable in compare view

Updates github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.19.0

What's Changed

• build: Update module github.com/go-git/go-git/v5 to v5.18.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#2010
• v5: Bump sha1cd and go-billy by @​pjbgf in go-git/go-git#2060
• v5: Align object encoding with upstream by @​pjbgf in go-git/go-git#2065

Full Changelog: go-git/go-git@v5.18.0...v5.19.0

Commits

• bc930f4 Merge pull request #2065 from go-git/commit-v5
• d315264 plumbing: object, Reset object before decode
• 6e1d348 plumbing: object, Align Tree handling with upstream
• e134ba3 tests: Skip double checks in Git v2.11
• 1971422 tests: Add git conformance tests for signing verification
• a387aa8 plumbing: object, Add ErrMalformedTag
• f415670 plumbing: object, Decode Tag headers via a state machine
• 5b0cd38 plumbing: object, Reject multi-signature commits at Verify
• fe8ed62 plumbing: object, Align Tag.EncodeWithoutSignature with Commit
• 98e337d plumbing: object, Add support for Tag.SignatureSHA256
• Additional commits viewable in compare view

Updates github.com/octo-sts/app from 0.7.0 to 0.7.1

Release notes

Sourced from github.com/octo-sts/app's releases.

v0.7.1

What's Changed

• chore(deps): bump cloud.google.com/go/kms from 1.29.0 to 1.30.0 by @​dependabot[bot] in octo-sts/app#1359
• chore(deps): bump cloud.google.com/go/secretmanager from 1.19.0 to 1.20.0 by @​dependabot[bot] in octo-sts/app#1358
• Fix license to show date and company by @​joedborg in octo-sts/app#1361
• chore(deps): bump github.com/chainguard-dev/terraform-infra-common from 1.0.4 to 1.0.5 in the all group by @​dependabot[bot] in octo-sts/app#1362
• chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @​dependabot[bot] in octo-sts/app#1363
• chore(deps): bump the all group with 2 updates by @​dependabot[bot] in octo-sts/app#1364
• chore(deps): bump chainguard-dev/common/infra from 1.0.4 to 1.0.5 in /modules/app in the all group across 1 directory by @​dependabot[bot] in octo-sts/app#1365
• Bump Go to 1.26 by @​joedborg in octo-sts/app#1366
• chore(deps): bump k8s.io/apimachinery from 0.35.4 to 0.36.0 by @​dependabot[bot] in octo-sts/app#1332

Full Changelog: octo-sts/app@v0.7.0...v0.7.1

Commits

• 5148fa2 chore(deps): bump k8s.io/apimachinery from 0.35.4 to 0.36.0 (#1332)
• b84ff05 Bump Go to 1.26 (#1366)
• 6ef915b chore(deps): bump chainguard-dev/common/infra from 1.0.4 to 1.0.5 in /modules...
• 93f74db chore(deps): bump the all group with 2 updates (#1364)
• cb823cd chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 (#1363)
• 0baf4e6 chore(deps): bump github.com/chainguard-dev/terraform-infra-common from 1.0.4...
• 81ca4c6 Fix license to show date and company (#1361)
• d7c2b93 chore(deps): bump cloud.google.com/go/secretmanager from 1.19.0 to 1.20.0 (#1...
• 517dbaa chore(deps): bump cloud.google.com/go/kms from 1.29.0 to 1.30.0 (#1359)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions