dependabot[bot] opened a new pull request, #2229: URL: https://github.com/apache/maven-resolver/pull/2229
Bumps [dev.sigstore:sigstore-java](https://github.com/sigstore/sigstore-java) from 2.3.0 to 2.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/sigstore-java/releases";>dev.sigstore:sigstore-java's releases</a>.</em></p> <blockquote> <h2>v2.4.0</h2> <p>See <a href="https://github.com/sigstore/sigstore-java/blob/main/CHANGELOG.md";>CHANGELOG.md</a> for more details.</p> <h2>What's Changed</h2> <ul> <li>Update after v2.3.0 by <a href="https://github.com/loosebazooka";><code>@loosebazooka</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1286";>sigstore/sigstore-java#1286</a></li> <li>Update com.diffplug.spotless to v8.10.3 by <a href="https://github.com/renovate";><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1291";>sigstore/sigstore-java#1291</a></li> <li>Update dependency org.slf4j:slf4j-simple to v2.0.20 by <a href="https://github.com/renovate";><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1292";>sigstore/sigstore-java#1292</a></li> <li>Update dependency com.gradle.plugin-publish:com.gradle.plugin-publish.gradle.plugin to v2.2.1 by <a href="https://github.com/renovate";><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1293";>sigstore/sigstore-java#1293</a></li> <li>Update dependency de.thetaphi.forbiddenapis:de.thetaphi.forbiddenapis.gradle.plugin to v3.11 by <a href="https://github.com/renovate";><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1294";>sigstore/sigstore-java#1294</a></li> <li>Update dependency go to 1.27.x by <a href="https://github.com/renovate";><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1295";>sigstore/sigstore-java#1295</a></li> <li>Update dependency org.apache.maven.plugin-tools:maven-plugin-annotations to v3.16.0 by <a href="https://github.com/renovate";><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1296";>sigstore/sigstore-java#1296</a></li> <li>fix fuzzing crash during handling parsing malformed strings by <a href="https://github.com/bobcallaway";><code>@bobcallaway</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1298";>sigstore/sigstore-java#1298</a></li> <li>test: use staging instance for RekorClientHttpTest by <a href="https://github.com/aaronlew02";><code>@aaronlew02</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1301";>sigstore/sigstore-java#1301</a></li> <li>Add git sign off config to renovate.json by <a href="https://github.com/loosebazooka";><code>@loosebazooka</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1308";>sigstore/sigstore-java#1308</a></li> <li>Update com.diffplug.spotless to v8.10.4 by <a href="https://github.com/renovate-bot";><code>@renovate-bot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1303";>sigstore/sigstore-java#1303</a></li> <li>Update org.bouncycastle to v1.86 by <a href="https://github.com/renovate-bot";><code>@renovate-bot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1311";>sigstore/sigstore-java#1311</a></li> <li>Update Gradle to v9.8.1 by <a href="https://github.com/renovate-bot";><code>@renovate-bot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1309";>sigstore/sigstore-java#1309</a></li> <li>Update org.immutables to v2.12.3 by <a href="https://github.com/renovate-bot";><code>@renovate-bot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1306";>sigstore/sigstore-java#1306</a></li> <li>Update org.apache.maven to v3.10.0 by <a href="https://github.com/renovate-bot";><code>@renovate-bot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1310";>sigstore/sigstore-java#1310</a></li> <li>Update dependency org.eclipse.jetty:jetty-server to v12.1.14 by <a href="https://github.com/renovate-bot";><code>@renovate-bot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1305";>sigstore/sigstore-java#1305</a></li> <li>Update dependency com.google.guava:guava to v33.7.2-jre by <a href="https://github.com/renovate-bot";><code>@renovate-bot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1304";>sigstore/sigstore-java#1304</a></li> <li>Update dependency org.mockito:mockito-bom to v5.24.0 by <a href="https://github.com/renovate-bot";><code>@renovate-bot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1307";>sigstore/sigstore-java#1307</a></li> <li>Tighten up inclusion/checkpoint processing by <a href="https://github.com/loosebazooka";><code>@loosebazooka</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1300";>sigstore/sigstore-java#1300</a></li> <li>refactor: create dedicated TufGsonSupplier by <a href="https://github.com/aaronlew02";><code>@aaronlew02</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1287";>sigstore/sigstore-java#1287</a></li> <li>Update protobuf_grpc by <a href="https://github.com/renovate-bot";><code>@renovate-bot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1312";>sigstore/sigstore-java#1312</a></li> <li>Update actions/setup-java action to v6 by <a href="https://github.com/renovate-bot";><code>@renovate-bot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1314";>sigstore/sigstore-java#1314</a></li> <li>Update actions/upload-artifact action to v7.0.2 by <a href="https://github.com/renovate-bot";><code>@renovate-bot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1302";>sigstore/sigstore-java#1302</a></li> <li>Update dependency no.nav.security:mock-oauth2-server to v6 by <a href="https://github.com/renovate-bot";><code>@renovate-bot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1316";>sigstore/sigstore-java#1316</a></li> <li>fix: check Rekor log validity at SET integrated time by <a href="https://github.com/aaronlew02";><code>@aaronlew02</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1299";>sigstore/sigstore-java#1299</a></li> <li>Update gradle/actions action to v6 by <a href="https://github.com/renovate-bot";><code>@renovate-bot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1320";>sigstore/sigstore-java#1320</a></li> <li>Update Gradle to v9.8.2 by <a href="https://github.com/renovate-bot";><code>@renovate-bot</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1319";>sigstore/sigstore-java#1319</a></li> <li>Move from maven-verifier to maven-executor by <a href="https://github.com/loosebazooka";><code>@loosebazooka</code></a> in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1321";>sigstore/sigstore-java#1321</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/renovate-bot";><code>@renovate-bot</code></a> made their first contribution in <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1303";>sigstore/sigstore-java#1303</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore-java/compare/v2.3.0...v2.4.0";>https://github.com/sigstore/sigstore-java/compare/v2.3.0...v2.4.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sigstore/sigstore-java/blob/main/CHANGELOG.md";>dev.sigstore:sigstore-java's changelog</a>.</em></p> <blockquote> <h1>[2.4.0] - 2026-10-21</h1> <h2>Fixed</h2> <ul> <li>Check Rekor log validity at SET integrated time: <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1299";>sigstore/sigstore-java#1299</a></li> <li>Match inclusion proof and checkpoint verification exact to spec: <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1300";>sigstore/sigstore-java#1300</a></li> <li>Handle invalid base64 and hex encodings in Rekor verification and parsing: <a href="https://redirect.github.com/sigstore/sigstore-java/pull/1298";>sigstore/sigstore-java#1298</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/sigstore-java/commit/bc2d1f2c94d78bea9652fea60042f5939b44c450";><code>bc2d1f2</code></a> Merge pull request <a href="https://redirect.github.com/sigstore/sigstore-java/issues/1321";>#1321</a> from sigstore/maven-executor</li> <li><a href="https://github.com/sigstore/sigstore-java/commit/1a96d6e0468ed37a8ba3500e195bb3e4fa3b979f";><code>1a96d6e</code></a> Move from maven-verifier to maven-executor</li> <li><a href="https://github.com/sigstore/sigstore-java/commit/a3bd29ca928abe9111f497fbc393fed89153f5f9";><code>a3bd29c</code></a> Merge pull request <a href="https://redirect.github.com/sigstore/sigstore-java/issues/1319";>#1319</a> from renovate-bot/renovate/gradle-9.x</li> <li><a href="https://github.com/sigstore/sigstore-java/commit/2bce28fced8a20b35e41fe93cef0512e1dfae0ec";><code>2bce28f</code></a> Merge pull request <a href="https://redirect.github.com/sigstore/sigstore-java/issues/1320";>#1320</a> from renovate-bot/renovate/gradle-actions-6.x</li> <li><a href="https://github.com/sigstore/sigstore-java/commit/ccd834e66c36d4006b027f05acb96597f3d0e544";><code>ccd834e</code></a> Update gradle/actions action to v6</li> <li><a href="https://github.com/sigstore/sigstore-java/commit/7911b8dba36f3b752b3dde8abfc6ac37ddd6ddc3";><code>7911b8d</code></a> Update Gradle to v9.8.2</li> <li><a href="https://github.com/sigstore/sigstore-java/commit/5af9512452b22533b250fd1114d8e771b0b1b78d";><code>5af9512</code></a> Merge pull request <a href="https://redirect.github.com/sigstore/sigstore-java/issues/1299";>#1299</a> from sigstore/log-set</li> <li><a href="https://github.com/sigstore/sigstore-java/commit/00cf2ebe8acdba1bcdd0f7442347e32df4047004";><code>00cf2eb</code></a> Merge pull request <a href="https://redirect.github.com/sigstore/sigstore-java/issues/1316";>#1316</a> from renovate-bot/renovate/major-no.nav.security</li> <li><a href="https://github.com/sigstore/sigstore-java/commit/8292f1d5377663ef41443417bc47f4e4c0046166";><code>8292f1d</code></a> Merge pull request <a href="https://redirect.github.com/sigstore/sigstore-java/issues/1302";>#1302</a> from renovate-bot/renovate/actions-upload-artifact-7.x</li> <li><a href="https://github.com/sigstore/sigstore-java/commit/3e6f24a318e40f54a9b06f274baee44855a8221d";><code>3e6f24a</code></a> Merge pull request <a href="https://redirect.github.com/sigstore/sigstore-java/issues/1314";>#1314</a> from renovate-bot/renovate/actions-setup-java-6.x</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/sigstore-java/compare/v2.3.0...v2.4.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
