7 Pull requests merged by 1 person

• chore(deps): bump sigs.k8s.io/release-utils from 0.11.1 to 0.12.0

  #4313 merged Jul 29, 2025

• chore(deps): bump the gomod group with 4 updates

  #4311 merged Jul 28, 2025

• chore(deps): bump github.com/buildkite/agent/v3 from 3.102.1 to 3.103.0

  #4310 merged Jul 28, 2025

• chore(deps): bump github.com/go-piv/piv-go/v2 from 2.3.0 to 2.4.0

  #4312 merged Jul 28, 2025

• chore(deps): bump gitlab.com/gitlab-org/api/client-go from 0.134.0 to 0.137.0

  #4314 merged Jul 28, 2025

• chore(deps): bump google.golang.org/api from 0.241.0 to 0.243.0

  #4315 merged Jul 28, 2025

• chore(deps): bump the actions group with 4 updates

  #4309 merged Jul 28, 2025

4 Pull requests opened by 2 people

• Have cosign sign support bundle format

  #4316 opened Jul 29, 2025

• Default to using the new protobuf format

  #4318 opened Jul 31, 2025

• Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2

  #4319 opened Aug 1, 2025

• Verify subject with bundle only when checking claims

  #4320 opened Aug 1, 2025

1 Issue closed by 1 person

• Attest --type vuln with standard json but verify-attestation predicate content is wrong

  #4317 closed Jul 31, 2025

2 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• `cosign sign --payload` hardcodes layer MIME to `application/vnd.dev.cosign.simplesigning.v1+json`

  #4300 commented on Jul 29, 2025 • 0 new comments

• chore(deps): bump cuelang.org/go from 0.12.1 to 0.13.2

  #4270 commented on Jul 28, 2025 • 0 new comments