Update module github.com/theupdateframework/go-tuf to v2 by renovate-rancher[bot] · Pull Request #385 · neuvector/scanner

renovate-rancher · 2026-05-24T07:36:51Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/theupdateframework/go-tuf	`v0.7.0` → `v2.4.1`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

theupdateframework/go-tuf (github.com/theupdateframework/go-tuf)

`v2.4.1`

Compare Source

What's Changed

chore(deps): bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 by @dependabot[bot] in #718
Enforce a stricter validation on the repo name for TAP 4 by @rdimitrov in #720

Full Changelog: theupdateframework/go-tuf@v2.4.0...v2.4.1

`v2.4.0`

Compare Source

What's Changed

Add BitLength validation for SuccinctRoles by @rdimitrov in #716
Add thread safety documentation for key types by @rdimitrov in #715
Use restrictive permissions (0700) for cache directories by @rdimitrov in #714
Breaking change: Replace panic with error return in Key.ID() by @rdimitrov in #713

Full Changelog: theupdateframework/go-tuf@v2.3.1...v2.4.0

`v2.3.1`

Compare Source

What's Changed

chore(deps): bump golang.org/x/crypto from 0.40.0 to 0.45.0 by @dependabot[bot] in #702
Resolve govulncheck errors by bumping go to 1.24.11 by @rdimitrov in #707
chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 by @dependabot[bot] in #704
modern go (1.20+) improvements by @udf2457 in #705
chore(deps): bump github.com/sigstore/sigstore from 1.9.5 to 1.10.3 by @dependabot[bot] in #706
chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.9.1 to 0.10.0 by @dependabot[bot] in #708
Perform type assertion by @kommendorkapten in #710
Add tests for failing type assertions by @rdimitrov in #711
Verify threshold is valid by @kommendorkapten in #712

Full Changelog: theupdateframework/go-tuf@v2.3.0...v2.3.1

`v2.3.0`

Compare Source

What's Changed

Update the config for govulncheck by @rdimitrov in #697
Bump Go to 1.24.9 by @rdimitrov in #698

Full Changelog: theupdateframework/go-tuf@v2.2.0...v2.3.0

`v2.2.0`

Compare Source

What's Changed

fix: treat http 403 as an updater error by @MDr164 in #687
chore(deps): bump github.com/sigstore/sigstore from 1.8.4 to 1.8.7 by @dependabot[bot] in #646
chore(deps): bump github.com/cenkalti/backoff/v5 from 5.0.2 to 5.0.3 by @dependabot[bot] in #690
chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.9.0 to 0.9.1 by @dependabot[bot] in #691
chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0 by @dependabot[bot] in #692
chore(deps): bump github.com/stretchr/testify from 1.11.0 to 1.11.1 by @dependabot[bot] in #693
chore(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 by @dependabot[bot] in #694

Full Changelog: theupdateframework/go-tuf@v2.1.1...v2.2.0

`v2.1.1`

Compare Source

What's Changed

Fixed a regression that can fail clients using the DefaultFetcher{} directly without using the constructor.

Set a default HTTP client for DefaultFetcher in DownloadFile method if none is set by @malancas in #686

Full Changelog: theupdateframework/go-tuf@v2.1.0...v2.1.1

`v2.1.0`

Compare Source

What's Changed

Move the repository package under examples/repository by @rdimitrov in #656
docs: Joshua retiring as a maintainer by @joshuagl in #657
fix: multirepo potential nil pointer dereference by @MrDan4es in #658
chore(deps): bump golang.org/x/crypto from 0.23.0 to 0.31.0 by @dependabot in #661
chore(deps): bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @dependabot in #662
chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.8.0 to 0.9.0 by @dependabot in #663
Use the correct verifier for RSA PSS scheme keys by @rdimitrov in #625
updater.go: replace os.WriteFile with file.Write() by @udf2457 in #669
Remove readFile() and reverseSlice() in favour of stdlib by @udf2457 in #671
updater.go: replace url.QueryEscape() with url.PathEscape() by @udf2457 in #675
Bump Go to 1.22 by @rdimitrov in #677
chore(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1 by @dependabot in #679
chore: make function comment match function name by @suchsoon in #680
Update README.md by @trishankatdatadog in #681
chore(deps): bump golang.org/x/crypto from 0.31.0 to 0.35.0 by @dependabot in #683
Allow users to configure custom http.Client or http.RoundTripper in DefaultFetcher by @malancas in #682
Allow users to configure retry behavior in DefaultFetcher by @malancas in #684
Added back timeout to the fetcher DownloadFile method to avoid a breaking change. by @kommendorkapten in #685

New Contributors

@MrDan4es made their first contribution in #658
@suchsoon made their first contribution in #680

Full Changelog: theupdateframework/go-tuf@v2.0.2...v2.1.0

`v2.0.2`

Compare Source

What's Changed

Error in case the delegated role is missing from the snapshot by @rdimitrov in #652

Full Changelog: theupdateframework/go-tuf@v2.0.1...v2.0.2

`v2.0.1`

Compare Source

What's Changed

Security

Fix incorrect delegation lookups that can make go-tuf download the wrong artifact by @rdimitrov (Thanks to @AdamKorcz for reporting it). This fixes CVE-2024-47534 GHSA-4f8r-qqr9-fq8j

Other

Update MAINTAINERS.md by @trishankatdatadog in #647
Update the staging TUF repo in the multi-repo example by @rdimitrov in #650
Fix branch name in multi-repo client example by @rdimitrov in #651

Full Changelog: theupdateframework/go-tuf@v2.0.0...v2.0.1

`v2.0.0`

Compare Source

Breaking changes

This is the first release of go-tuf v2 and it's a complete re-write indicated by the new major version.
We also decided to leave go-tuf as a library only.

What's Changed

chore: fixes the CI status badge and updates the README.md file by @rdimitrov in #569
chore(deps): bump securesystemslib from 0.30.0 to 0.31.0 by @dependabot in #570
docs: add Marvin Drees to the list of go-tuf maintainers by @rdimitrov in #571
chore(deps): bump actions/setup-python from 4.7.1 to 5.0.0 by @dependabot in #572
chore: enable grouping of minor and patch updates. by @kommendorkapten in #580
fix: update tests.yml bumping golangci-lint by @rdimitrov in #582
chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 by @dependabot in #573
chore(deps): bump github/codeql-action from 2 to 3 by @dependabot in #574
chore(deps): bump golang.org/x/crypto from 0.16.0 to 0.17.0 by @dependabot in #575
chore(deps): bump golang.org/x/term from 0.15.0 to 0.16.0 by @dependabot in #577
chore(deps): bump the minor-patch group with 2 updates by @dependabot in #581
feat!: move rdimitrov/go-tuf-metadata to github.com/theupdateframework/go-tuf/v2 by @rdimitrov in #583
Update license from BSD-2-Clause to Apache-2.0 by @rdimitrov in #585
chore(deps): bump github.com/sigstore/sigstore from 1.8.0 to 1.8.1 by @dependabot in #584
Replace main with master in workflows by @kipz in #587
Do not pin to minor Go versions in go.mod by @rdimitrov in #588
Fixes for windows & enable in CI by @kipz in #586
Bring back SECURITY.md by @trishankatdatadog in #591
remove dependency on golang.org/x/exp by @mikedanese in #600
Refactor errors to use pointer receivers by @codysoyland in #602
move testutils under an ./internal/ directory by @mikedanese in #601
Enable macos and windows runners for examples.yml and tests.yml by @rdimitrov in #604
Do not run CI for all Go versions and use caching by @rdimitrov in #606
chore(deps): bump golang.org/x/crypto from 0.18.0 to 0.19.0 by @dependabot in #610
Don't rename unless file is in same dir by @jonnystoten in #603
Use filepath.Join when combining filesystem components by @kommendorkapten in #611
Always use forward slash when splitting target names by @kommendorkapten in #612
chore(deps): bump github.com/sigstore/sigstore from 1.8.1 to 1.8.2 by @dependabot in #614
chore(deps): bump github.com/stretchr/testify from 1.8.4 to 1.9.0 by @dependabot in #615
chore(deps): use stdlib ed25519 instead of x by @MDr164 in #620
chore(deps): bump golang.org/x/crypto from 0.20.0 to 0.21.0 by @dependabot in #621
chore(ci): bump action hashes by @MDr164 in #618
chore(deps): bump gopkg.in/go-jose/go-jose.v2 from 2.6.1 to 2.6.3 by @dependabot in #622
Silence govulncheck by @MDr164 in #619
feat: replace logrus in sim with slog by @MDr164 in #617
repository_simulator_setup.go: Use filepath.Join() instead of concatenation by @udf2457 in #624
Fixes README references from rdimitrov/go-tuf-metadata to theupdateframework/go-tuf by @rdimitrov in #626
fix: use SHA384 for ECDSA P384 by @mrjoelkamp in #629
chore(deps): bump github.com/sigstore/sigstore from 1.8.2 to 1.8.3 by @dependabot in #627
Remove nil error from being printed in "persist metadata" error message by @malancas in #633
fix: deep targets file path by @mrjoelkamp in #632
feat: add missing CODEOWNERS and MAINTAINERS file by @MDr164 in #635
Update MAINTAINERS by @trishankatdatadog in #636
chore(deps): bump github.com/sigstore/sigstore from 1.8.3 to 1.8.4 by @dependabot in #637
chore(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1 by @dependabot in #640
fix: configurable temp file directory by @mrjoelkamp in #638
export API to set RefTime of Updater by @AdamKorcz in #641
Add the ability to customize the HTTP user agent by @steiza in #642
Increase the default value for MaxRootRotations by @kommendorkapten in #645

New Contributors

@kipz made their first contribution in #587
@mikedanese made their first contribution in #600
@codysoyland made their first contribution in #602
@jonnystoten made their first contribution in #603
@MDr164 made their first contribution in #620
@mrjoelkamp made their first contribution in #629
@malancas made their first contribution in #633
@AdamKorcz made their first contribution in #641
@steiza made their first contribution in #642

Full Changelog: theupdateframework/go-tuf@v0.7.0...v2.0.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

renovate-rancher · 2026-05-24T07:36:55Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go mod tidy
go: downloading go.uber.org/goleak v1.3.0
go: downloading gotest.tools/v3 v3.5.2
go: downloading google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6
go: downloading github.com/google/pprof v0.0.0-20250602020802-c6617b811d0e
go: downloading gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
go: downloading go.opentelemetry.io/otel/sdk/metric v1.41.0
go: downloading go.opentelemetry.io/otel/sdk v1.41.0
go: downloading github.com/go-openapi/testify/v2 v2.4.1
go: downloading github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb
go: downloading github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d
go: downloading github.com/hashicorp/go-hclog v1.6.3
go: downloading github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6
go: downloading pgregory.net/rapid v1.2.0
go: downloading github.com/stretchr/objx v0.5.2
go: downloading github.com/gorilla/mux v1.8.1
go: downloading github.com/kr/pretty v0.3.1
go: downloading github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.5
go: downloading github.com/go-openapi/testify/enable/yaml/v2 v2.4.1
go: downloading github.com/creack/pty v1.1.24
go: downloading github.com/graph-gophers/graphql-go v1.9.0
go: downloading github.com/sassoftware/relic/v7 v7.6.2
go: downloading github.com/google/trillian v1.7.2
go: downloading github.com/go-sql-driver/mysql v1.9.3
go: downloading github.com/jackc/pgx/v5 v5.8.0
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.5
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.5
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.5
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.5
go: downloading github.com/tink-crypto/tink-go-awskms/v2 v2.1.0
go: downloading github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0
go: downloading github.com/tink-crypto/tink-go-hcvault/v2 v2.4.0
go: downloading github.com/tink-crypto/tink-go/v2 v2.6.0
go: downloading go.step.sm/crypto v0.76.2
go: downloading github.com/onsi/ginkgo v1.16.5
go: downloading github.com/google/gofuzz v1.2.0
go: downloading github.com/onsi/gomega v1.38.2
go: downloading github.com/go-rod/rod v0.116.2
go: downloading github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24
go: downloading github.com/prometheus/procfs v0.19.2
go: downloading github.com/fatih/color v1.18.0
go: downloading github.com/mattn/go-colorable v0.1.14
go: downloading gonum.org/v1/gonum v0.17.0
go: downloading github.com/kr/text v0.2.0
go: downloading github.com/rogpeppe/go-internal v1.14.1
go: downloading software.sslmate.com/src/go-pkcs12 v0.4.0
go: downloading github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
go: downloading google.golang.org/api v0.269.0
go: downloading github.com/kylelemons/godebug v1.1.0
go: downloading github.com/sergi/go-diff v1.4.0
go: downloading filippo.io/edwards25519 v1.1.1
go: downloading github.com/jmhodges/clock v1.2.0
go: downloading github.com/prometheus/client_golang v1.23.2
go: downloading github.com/prometheus/client_model v0.6.2
go: downloading github.com/jackc/pgpassfile v1.0.0
go: downloading github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761
go: downloading github.com/aws/aws-sdk-go-v2 v1.41.2
go: downloading github.com/aws/aws-sdk-go-v2/config v1.32.10
go: downloading github.com/aws/aws-sdk-go-v2/service/kms v1.50.1
go: downloading github.com/jellydator/ttlcache/v3 v3.4.0
go: downloading cloud.google.com/go/kms v1.26.0
go: downloading cloud.google.com/go v0.123.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0
go: downloading github.com/Azure/azure-sdk-for-go v68.0.0+incompatible
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
go: downloading github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0
go: downloading github.com/hashicorp/vault/api v1.22.0
go: downloading github.com/ysmood/goob v0.4.0
go: downloading github.com/ysmood/got v0.40.0
go: downloading github.com/ysmood/gson v0.7.3
go: downloading github.com/ysmood/fetchup v0.2.3
go: downloading github.com/ysmood/leakless v0.9.0
go: downloading github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef
go: downloading github.com/zalando/go-keyring v0.2.6
go: downloading github.com/hashicorp/golang-lru/v2 v2.0.7
go: downloading github.com/hashicorp/golang-lru v0.0.0-20160813221303-0a025b7e63ad
go: downloading github.com/beorn7/perks v1.0.1
go: downloading github.com/prometheus/common v0.67.5
go: downloading github.com/aws/smithy-go v1.24.1
go: downloading github.com/aws/aws-sdk-go-v2/credentials v1.19.10
go: downloading github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.18
go: downloading github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4
go: downloading github.com/aws/aws-sdk-go-v2/service/signin v1.0.6
go: downloading github.com/aws/aws-sdk-go-v2/service/sso v1.30.11
go: downloading github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.15
go: downloading github.com/aws/aws-sdk-go-v2/service/sts v1.41.7
go: downloading github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.18
go: downloading cloud.google.com/go/iam v1.5.3
go: downloading cloud.google.com/go/longrunning v0.8.0
go: downloading github.com/googleapis/gax-go/v2 v2.17.0
go: downloading google.golang.org/genproto v0.0.0-20260128011058-8636f8732409
go: downloading cloud.google.com/go/auth v0.18.2
go: downloading github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2
go: downloading github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0
go: downloading github.com/nxadm/tail v1.4.11
go: downloading github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0
go: downloading github.com/cenkalti/backoff/v4 v4.3.0
go: downloading github.com/hashicorp/errwrap v1.1.0
go: downloading github.com/hashicorp/go-multierror v1.1.1
go: downloading github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0
go: downloading github.com/hashicorp/go-secure-stdlib/strutil v0.1.2
go: downloading github.com/hashicorp/hcl v1.0.1-vault-7
go: downloading github.com/onsi/ginkgo/v2 v2.27.2
go: downloading al.essio.dev/pkg/shellescape v1.6.0
go: downloading github.com/danieljoos/wincred v1.2.3
go: downloading github.com/godbus/dbus/v5 v5.2.2
go: downloading github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.18
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.5
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.18
go: downloading cloud.google.com/go/auth/oauth2adapt v0.2.8
go: downloading cloud.google.com/go/compute/metadata v0.9.0
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0
go: downloading github.com/google/s2a-go v0.1.9
go: downloading gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7
go: downloading github.com/hashicorp/go-sockaddr v1.0.7
go: downloading github.com/ryanuber/go-glob v1.0.0
go: downloading github.com/natefinch/atomic v1.0.1
go: downloading github.com/jackc/puddle/v2 v2.2.2
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.12
go: downloading github.com/golang-jwt/jwt/v5 v5.3.0
go: downloading github.com/fsnotify/fsnotify v1.9.0
go: downloading github.com/Masterminds/semver/v3 v3.4.0
go: downloading github.com/Masterminds/semver v1.5.0
go: downloading github.com/go-task/slim-sprig/v3 v3.0.0
go: downloading golang.org/x/tools v0.43.0
go: downloading github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0
go: finding module for package github.com/theupdateframework/go-tuf/v2/client
go: downloading github.com/theupdateframework/go-tuf/v2 v2.4.2
go: github.com/neuvector/scanner/cmd/sigstore-interface imports
	github.com/theupdateframework/go-tuf/v2/client: module github.com/theupdateframework/go-tuf/v2@latest found (v2.4.2), but does not contain package github.com/theupdateframework/go-tuf/v2/client

Update module github.com/theupdateframework/go-tuf to v2

a2c9d41

renovate-rancher Bot requested a review from a team as a code owner May 24, 2026 07:36

renovate-rancher Bot added the dependencies label May 24, 2026

renovate-rancher Bot requested a review from pohanhuang May 24, 2026 07:36

renovate-rancher Bot added the dependencies label May 24, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update module github.com/theupdateframework/go-tuf to v2#385

Update module github.com/theupdateframework/go-tuf to v2#385
renovate-rancher[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-theupdateframework-go-tuf-2.x

renovate-rancher Bot commented May 24, 2026

Uh oh!

renovate-rancher Bot commented May 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate-rancher Bot commented May 24, 2026

Release Notes

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

Security

Other

Breaking changes

What's Changed

New Contributors

Configuration

Uh oh!

renovate-rancher Bot commented May 24, 2026

⚠️ Artifact update problem

File name: go.sum

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants