Bump the oc-mirror-v2-security-updates group across 1 directory with 3 updates

[dependabot]

Bumps the oc-mirror-v2-security-updates group with 3 updates in the / directory: github.com/google/cel-go, github.com/sigstore/fulcio and google.golang.org/grpc.

Updates github.com/google/cel-go from 0.28.1 to 0.29.0

Release notes

Sourced from github.com/google/cel-go's releases.

Release v0.29.0

What's Changed

New Features

• Add JSON encoder extension — a new ext library for JSON encoding by @​rohan-patnaik in cel-expr/cel-go#1340
• Upstream network.IP/CIDR support from Kubernetes by @​tdesrosi in cel-expr/cel-go#1238
• Managed execution frame with async call foundations by @​TristonianJones in cel-expr/cel-go#1316
• Execution frame integration with updated InterpretableV2 by @​TristonianJones in cel-expr/cel-go#1344
• Add conformance test runner for CEL Policies by @​l46kok in cel-expr/cel-go#1319

Bug Fixes

• Fix unintentional unwrapping of optionals at any level of depth by @​TristonianJones in cel-expr/cel-go#1315
• Fix has() unknown propagation during partial evaluation by @​0xASTRA in cel-expr/cel-go#1324
• Enforce expression size limit before source construction by @​thesmartshadow in cel-expr/cel-go#1302
• Policy variable scoping fixes by @​jnthntatum in cel-expr/cel-go#1321
• Emit valid CEL for doubles in scientific notation in the parser/unparser by @​moraneus in cel-expr/cel-go#1326
• Allow aliases for simple names in containers by @​rohan-patnaik in cel-expr/cel-go#1327
• Reject out-of-range minutes in timezone offset parsing by @​alhudz in cel-expr/cel-go#1336
• Validate offset on empty-string path in indexOf and lastIndexOf by @​alhudz in cel-expr/cel-go#1335
• Guard int32/uint32 map key narrowing in qualifyInternal by @​alhudz in cel-expr/cel-go#1337
• Add max size check to genRange() in ext/lists to prevent OOM by @​marwan9696 in cel-expr/cel-go#1310

Cost Tracking

• Ensure receiver and global matches cost estimates agree by @​TristonianJones in cel-expr/cel-go#1350
• startsWith/endsWith runtime cost agreement with checked cost by @​TristonianJones in cel-expr/cel-go#1351
• Avoid repeated construction of cost tracker by @​pohly in cel-expr/cel-go#1357

Testing & Tooling

• Test Runner usability improvements by @​jnthntatum in cel-expr/cel-go#1320
• Minor updates to test coverage and code quality by @​TristonianJones in cel-expr/cel-go#1318
• Remove duplicate policy tests now covered by policy conformance tests by @​l46kok in cel-expr/cel-go#1332
• Minor Google3 import fixes by @​l46kok in cel-expr/cel-go#1331

Documentation

• Update documentation for nested first-match rules by @​jnthntatum in cel-expr/cel-go#1323
• Add migration warning to README by @​dmitriplotnikov in cel-expr/cel-go#1330

Commits

• fa16799 avoid repeated construction of cost tracker (#1357)
• ea3d5c0 feat(ext): add json encoder (#1340)
• a4d0d64 startsWith / endsWith runtime cost agreement with checked cost (#1351)
• d4efa77 Ensure receiver and global matches cost estimates agree (#1350)
• 13cff33 ext/lists: add max size check to genRange() to prevent OOM (#1310)
• f0ffa7e Execution frame integration with updated IntepretableV2 (#1344)
• f1ec2f6 guard int32/uint32 map key narrowing in qualifyInternal (#1337)
• 258e7c8 Managed execution frame with async call foundations (#1316)
• 14f6746 validate offset on empty-string path in indexOf and lastIndexOf (#1335)
• 783267d reject out-of-range minutes in timezone offset parsing (#1336)
• Additional commits viewable in compare view

Updates github.com/sigstore/fulcio from 1.8.5 to 1.8.6

Release notes

Sourced from github.com/sigstore/fulcio's releases.

v1.8.6

Changelog

• 378c654f48c3bafdced04ead7010aab2cb4c6ca1 Block cross-host redirects and restrict bearer token to expected host (#2354)
• 39b48e6a8f2efe1809a1b19b4301666c3fd36667 Include raw subject in certificates (#2307)
• 80eaed06e911cdfd26dd18f02b8e862f7f6ee453 Update Azure AKS OIDC issuer URL regex (#2266)
• 001376a50932095cf4b6e65299ed2d29abe83524 add support for new circleci root issuer (#2278)

Thanks for all contributors!

Changelog

Sourced from github.com/sigstore/fulcio's changelog.

v1.8.6

Features

• Include raw subject in certificates (#2307)

Commits

• 378c654 Block cross-host redirects and restrict bearer token to expected host (#2354)
• 7a5d3e3 bump builder image to use go1.26.3 (#2353)
• a05982e build(deps): bump go.step.sm/crypto from 0.75.0 to 0.81.0 (#2348)
• dfa63a8 build(deps): bump golang from 313faae to 2d6c802 (#2344)
• 7b3a344 build(deps): bump google.golang.org/api from 0.279.0 to 0.280.0 (#2349)
• 9290f7f build(deps): bump the all group with 2 updates (#2350)
• 423d535 build(deps): bump nginx from 1.31.0 to 1.31.1 in the all group (#2352)
• 19a3f8e build(deps): bump the all group across 1 directory with 6 updates (#2337)
• 6b597ce build(deps): bump google.golang.org/api from 0.276.0 to 0.279.0 (#2338)
• 0d1dc79 build(deps): bump nginx from 1.29.8 to 1.31.0 in the all group (#2342)
• Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.82.0 to 1.82.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.82.1

Security

• server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
• xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
• xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
• xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.

Commits

• ebd8f06 Change version to 1.82.1 (#9238)
• 4ea465d Cherry-pick commits (#9236)
• 9494a2c Change version to 1.82.1-dev (#9171)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by CodeRabbit

• Chores
  • Updated supporting components to newer versions.
  • Improved compatibility with current platform services and protocol specifications.
  • No changes to the application’s public functionality or user-facing behavior.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign aguidirh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Walkthrough

The pull request updates eight Go module dependency versions in go.mod, including container registry, CEL, grpc-gateway, Sigstore, time, GenProto RPC, and gRPC dependencies.

Changes

Go dependency updates

Layer / File(s)	Summary
Module dependency version updates go.mod	Updates direct and indirect dependency versions for container registry, CEL, grpc-gateway, Sigstore, x/time, GenProto RPC, and gRPC.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: r4f4, aguidirh

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR only modifies go.mod and go.sum files (dependency updates). No test files were changed. This custom check for Ginkgo test name stability does not apply to this PR.
Test Structure And Quality	✅ Passed	This PR contains only dependency version updates in go.mod and go.sum. No Ginkgo test code was added or modified, making the test structure review check not applicable to this PR.
Microshift Test Compatibility	✅ Passed	PR only modifies go.mod and go.sum files; no new Ginkgo e2e tests are added. Custom check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR only updates Go dependency versions in go.mod and go.sum files. No new Ginkgo e2e tests are added, so SNO test compatibility check does not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The commit changes only go.mod and go.sum dependency entries; it adds or modifies no deployment manifests, operator code, controllers, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	PR modifies only go.mod dependency versions; no source code changes exist that could violate OTE Binary Stdout Contract requirements for process-level stdout output.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only go.mod and go.sum; the diff adds no Ginkgo e2e tests, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto	✅ Passed	The PR changes only go.mod/go.sum dependency metadata; no weak-crypto or secret-comparison code is added, and the existing MD5 helper is unchanged from the parent.
Container-Privileges	✅ Passed	PR modifies only go.mod and go.sum files for dependency version updates. No Kubernetes or container manifest files are present in the changeset, so the container-privileges check does not apply.
No-Sensitive-Data-In-Logs	✅ Passed	The patch changes only go.mod and go.sum. It adds no source code, logging calls, or sensitive-data output.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately identifies the grouped dependency updates and states that three updates affect one directory.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/go_modules/oc-mirror-v2-security-updates-662d4b0074

---

_{Comment @coderabbitai help to get the list of available commands.}

[aguidirh]

/ok-to-test

[openshift-ci]

@dependabot[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.