Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Config Migration Needed

• Select this checkbox to let Renovate create an automated Config Migration PR.

Awaiting Schedule

These updates are awaiting their schedule. Click on a checkbox to get an update now.

• Update dependency com.google.http-client:google-http-client-bom to v1.45.1
• Update actions/setup-java action to v4.5.0
• Update bouncycastle to v1.79 (org.bouncycastle:bcpkix-jdk18on, org.bouncycastle:bcutil-jdk18on)
• Update gradle/actions action to v4.2.0

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update sigstore/community digest to 417452c
• Update actions/checkout action to v4.2.2
• Update dependency com.google.errorprone:error_prone_core to v2.35.1
• Update dependency gradle to v8.11
• Update dependency org.apache.maven.plugin-tools:maven-plugin-annotations to v3.15.1
• Update dependency no.nav.security:mock-oauth2-server to v2
• Update dependency org.eclipse.jetty:jetty-server to v12
• Click on this checkbox to rebase all open PRs at once

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

• Update plugin org.jsonschema2dataclass to v6

Detected dependencies

github-actions

.github/workflows/byob-slsa.yaml

.github/workflows/ci.yaml

• actions/checkout v4.2.1@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
• actions/setup-java v4.4.0@b36c23c0d998641eff861008f374ee103c25ac73
• actions/setup-go v5.1.0@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed
• gradle/actions v4.1.0@d156388eb19639ec20ade50009f3d199ce1e2808

.github/workflows/cifuzz.yaml

• actions/upload-artifact v4

.github/workflows/conformance.yml

• actions/checkout v4.2.1@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
• actions/setup-java v4.4.0@b36c23c0d998641eff861008f374ee103c25ac73
• gradle/actions v4.1.0@d156388eb19639ec20ade50009f3d199ce1e2808
• sigstore/sigstore-conformance v0.0.11@ee4de0e602873beed74cf9e49d5332529fe69bf6

.github/workflows/depsreview.yml

• sigstore/community dcc3c0187ce2f10b6edeee240a99360042c7408e

.github/workflows/examples.yaml

• actions/checkout v4.2.1@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
• actions/setup-java v4.4.0@b36c23c0d998641eff861008f374ee103c25ac73
• gradle/actions v4.1.0@d156388eb19639ec20ade50009f3d199ce1e2808

.github/workflows/gradle-wrapper-validation.yaml

• actions/checkout v4.2.1@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
• gradle/wrapper-validation-action v3

.github/workflows/release-sigstore-gradle-plugin-from-tag.yaml

• actions/checkout v4.2.1@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
• actions/checkout v4.2.1@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
• actions/setup-java v4.4.0@b36c23c0d998641eff861008f374ee103c25ac73
• gradle/actions v4.1.0@d156388eb19639ec20ade50009f3d199ce1e2808

.github/workflows/release-sigstore-java-from-tag.yaml

• actions/checkout v4.2.1@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
• actions/checkout v4.2.1@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
• actions/setup-java v4.4.0@b36c23c0d998641eff861008f374ee103c25ac73
• gradle/actions v4.1.0@d156388eb19639ec20ade50009f3d199ce1e2808
• softprops/action-gh-release v2.1.0@01570a1f39cb168c169c802c3bceb9e93fb10974

.github/workflows/tuf-conformance.yml

• actions/checkout v4.2.1@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
• actions/setup-java v4.4.0@b36c23c0d998641eff861008f374ee103c25ac73
• gradle/actions v4.1.0@d156388eb19639ec20ade50009f3d199ce1e2808
• theupdateframework/tuf-conformance v2

gradle

gradle.properties

• dev.sigstore:sigstore-java 1.1.0

settings.gradle.kts

build.gradle.kts

build-logic/gradle.properties

build-logic/settings.gradle.kts

build-logic-commons/gradle.properties

build-logic-commons/settings.gradle.kts

build-logic-commons/gradle-plugin/build.gradle.kts

build-logic-commons/gradle-plugin/src/main/kotlin/build-logic.kotlin-dsl-gradle-plugin.gradle.kts

build-logic/basics/build.gradle.kts

build-logic/basics/src/main/kotlin/build-logic.repositories.gradle.kts

build-logic/basics/src/main/kotlin/build-logic.reproducible-builds.gradle.kts

build-logic/jvm/build.gradle.kts

• com.diffplug.spotless:com.diffplug.spotless.gradle.plugin 6.25.0
• com.github.vlsi.gradle-extensions:com.github.vlsi.gradle-extensions.gradle.plugin 1.90
• de.thetaphi.forbiddenapis:de.thetaphi.forbiddenapis.gradle.plugin 3.8
• org.jetbrains.dokka:org.jetbrains.dokka.gradle.plugin 1.9.20
• com.github.autostyle:com.github.autostyle.gradle.plugin 4.0
• net.ltgt.errorprone:net.ltgt.errorprone.gradle.plugin 4.1.0

build-logic/jvm/src/main/kotlin/build-logic.build-info.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.dokka-javadoc.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.errorprone.gradle.kts

• com.google.errorprone:error_prone_core 2.31.0
• com.google.guava:guava-beta-checker 1.0

build-logic/jvm/src/main/kotlin/build-logic.forbidden-apis.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.java-library.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.java.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.kotlin.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.spotless-base.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.test-junit5.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.testing.gradle.kts

build-logic/publishing/build.gradle.kts

• dev.sigstore:sigstore-gradle-sign-plugin 1.0.0
• com.gradle.plugin-publish:com.gradle.plugin-publish.gradle.plugin 1.3.0

build-logic/publishing/src/main/kotlin/build-logic.depends-on-local-sigstore-java-repo.gradle.kts

build-logic/publishing/src/main/kotlin/build-logic.depends-on-local-sigstore-maven-plugin-repo.gradle.kts

build-logic/publishing/src/main/kotlin/build-logic.java-published-library.gradle.kts

build-logic/publishing/src/main/kotlin/build-logic.kotlin-dsl-published-gradle-plugin.gradle.kts

build-logic/publishing/src/main/kotlin/build-logic.publish-to-central.gradle.kts

build-logic/publishing/src/main/kotlin/build-logic.publish-to-tmp-maven-repo.gradle.kts

build-logic/publishing/src/main/kotlin/build-logic.signing.gradle.kts

build-logic/root-build/build.gradle.kts

build-logic/root-build/src/main/kotlin/build-logic.root-build.gradle.kts

fuzzing/build.gradle.kts

• com.code-intelligence:jazzer-api 0.22.1
• com.google.guava:guava 33.3.1-jre

sandbox/settings.gradle.kts

sandbox/gradle-precompiled-plugin/build.gradle.kts

sandbox/gradle-precompiled-plugin/src/main/kotlin/sigstore-conventions.gradle.kts

sandbox/gradle-sign-file/build.gradle.kts

sandbox/gradle-sign-java-library/build.gradle.kts

sigstore-cli/build.gradle.kts

• info.picocli:picocli 4.7.6
• com.google.guava:guava 33.3.1-jre
• com.google.oauth-client:google-oauth-client-bom 1.36.0
• info.picocli:picocli-codegen 4.7.6

sigstore-gradle/sigstore-gradle-sign-base-plugin/build.gradle.kts

sigstore-gradle/sigstore-gradle-sign-base-plugin/src/main/kotlin/dev.sigstore.sign-base.gradle.kts

sigstore-gradle/sigstore-gradle-sign-plugin/build.gradle.kts

sigstore-gradle/sigstore-gradle-sign-plugin/src/main/kotlin/dev.sigstore.sign.gradle.kts

sigstore-java/build.gradle.kts

• org.jsonschema2dataclass 5.0.0
• com.google.protobuf 0.9.4
• org.immutables:gson 2.10.1
• org.immutables:value-annotations 2.10.1
• org.immutables:value 2.10.1
• com.google.http-client:google-http-client-bom 1.45.0
• io.github.erdtman:java-json-canonicalization 1.1
• dev.sigstore:protobuf-specs 0.3.2
• com.google.protobuf:protobuf-bom 4.28.3
• io.grpc:grpc-bom 1.68.1
• org.apache.tomcat:annotations-api 6.0.53
• commons-codec:commons-codec 1.17.1
• com.google.code.gson:gson 2.11.0
• org.bouncycastle:bcutil-jdk18on 1.78.1
• org.bouncycastle:bcpkix-jdk18on 1.78.1
• com.google.oauth-client:google-oauth-client-bom 1.36.0
• org.junit:junit-bom 5.11.3
• org.mockito:mockito-bom 5.14.2
• no.nav.security:mock-oauth2-server 0.5.10
• com.squareup.okhttp3:mockwebserver 4.12.0
• net.sourceforge.htmlunit:htmlunit 2.70.0
• org.eclipse.jetty:jetty-server 11.0.24
• io.github.netmikey.logunit:logunit-core 2.0.0
• io.github.netmikey.logunit:logunit-jul 2.0.0
• com.google.protobuf:protoc 4.28.3
• io.grpc:protoc-gen-grpc-java 1.68.1

sigstore-maven-plugin/build.gradle.kts

• de.benediktritter.maven-plugin-development 0.4.3
• org.apache.maven:maven-plugin-api 3.9.9
• org.apache.maven:maven-core 3.9.9
• org.apache.maven.plugin-tools:maven-plugin-annotations 3.14.0
• org.bouncycastle:bcutil-jdk18on 1.78.1
• org.apache.maven.plugins:maven-gpg-plugin 3.2.7
• org.apache.maven.shared:maven-verifier 1.8.0

sigstore-testkit/build.gradle.kts

• com.google.code.gson:gson 2.11.0
• com.google.guava:guava 33.3.1-jre
• org.junit:junit-bom 5.11.3
• org.assertj:assertj-core 3.26.3

tuf-cli/build.gradle.kts

• info.picocli:picocli 4.7.6
• com.google.guava:guava 33.3.1-jre
• com.google.oauth-client:google-oauth-client-bom 1.36.0
• info.picocli:picocli-codegen 4.7.6

gradle-wrapper

gradle/wrapper/gradle-wrapper.properties

• gradle 8.10

sandbox/gradle/wrapper/gradle-wrapper.properties

• gradle 8.10

---

• Check this box to trigger a request for Renovate to run again on this repository