Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Awaiting Schedule

These updates are awaiting their schedule. Click on a checkbox to get an update now.

• chore(deps): update sigstore/community digest to 912e2d0
• chore(deps): update actions/checkout action to v4.1.6
• chore(deps): update softprops/action-gh-release action to v2.0.5
• fix(deps): update dependency com.google.api.grpc:proto-google-common-protos to v2.39.1
• fix(deps): update dependency com.google.http-client:google-http-client-bom to v1.44.2
• fix(deps): update dependency dev.sigstore:protobuf-specs to v0.3.2
• fix(deps): update dependency org.eclipse.jetty:jetty-server to v11.0.21
• fix(deps): update picocli to v4.7.6 (info.picocli:picocli-codegen, info.picocli:picocli)
• fix(deps): update dependency com.google.code.gson:gson to v2.11.0
• fix(deps): update dependency com.google.oauth-client:google-oauth-client-bom to v1.36.0
• fix(deps): update dependency org.assertj:assertj-core to v3.26.0
• fix(deps): update dependency org.mockito:mockito-bom to v5.12.0
• fix(deps): update protobuf_grpc (io.grpc:protoc-gen-grpc-java, com.google.protobuf:protoc, io.grpc:grpc-bom, com.google.protobuf:protobuf-bom)

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• fix(deps): update dependency no.nav.security:mock-oauth2-server to v2
• fix(deps): update dependency org.eclipse.jetty:jetty-server to v12

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

• chore(deps): update plugin org.jsonschema2dataclass to v6

Detected dependencies

github-actions

.github/workflows/byob-slsa.yaml

.github/workflows/ci.yaml

• actions/checkout v4.1.4@0ad4b8fadaa221de15dcec353f45205ec38ea70b
• actions/setup-java v4
• actions/setup-go v5.0.1@cdcb36043654635271a94b9a6d1392de5bb323a7
• gradle/actions v3.3.2@db19848a5fa7950289d3668fb053140cf3028d43

.github/workflows/cifuzz.yaml

• actions/upload-artifact v4

.github/workflows/conformance.yml

• actions/checkout v4.1.4@0ad4b8fadaa221de15dcec353f45205ec38ea70b
• actions/setup-java v4.2.1@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9
• gradle/actions v3
• sigstore/sigstore-conformance v0.0.11@ee4de0e602873beed74cf9e49d5332529fe69bf6

.github/workflows/depsreview.yml

• sigstore/community 684c2ac5176533d8b264915f8e5793be8734d608

.github/workflows/gradle-wrapper-validation.yaml

• actions/checkout v4.1.4@0ad4b8fadaa221de15dcec353f45205ec38ea70b
• gradle/wrapper-validation-action v3

.github/workflows/release-sigstore-gradle-plugin-from-tag.yaml

• actions/checkout v4.1.4@0ad4b8fadaa221de15dcec353f45205ec38ea70b
• actions/checkout v4.1.4@0ad4b8fadaa221de15dcec353f45205ec38ea70b
• actions/setup-java v4.2.1@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9
• gradle/actions v3.3.2@db19848a5fa7950289d3668fb053140cf3028d43
• softprops/action-gh-release v2.0.4@9d7c94cfd0a1f3ed45544c887983e9fa900f0564

.github/workflows/release-sigstore-java-from-tag.yaml

• actions/checkout v4.1.4@0ad4b8fadaa221de15dcec353f45205ec38ea70b
• actions/checkout v4.1.4@0ad4b8fadaa221de15dcec353f45205ec38ea70b
• actions/setup-java v4.2.1@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9
• gradle/actions v3.3.2@db19848a5fa7950289d3668fb053140cf3028d43
• softprops/action-gh-release v2.0.4@9d7c94cfd0a1f3ed45544c887983e9fa900f0564

gradle

gradle.properties

• dev.sigstore:sigstore-java 0.10.0

settings.gradle.kts

build.gradle.kts

build-logic/gradle.properties

build-logic/settings.gradle.kts

build-logic-commons/gradle.properties

build-logic-commons/settings.gradle.kts

build-logic-commons/gradle-plugin/build.gradle.kts

build-logic-commons/gradle-plugin/src/main/kotlin/build-logic.kotlin-dsl-gradle-plugin.gradle.kts

build-logic/basics/build.gradle.kts

build-logic/basics/src/main/kotlin/build-logic.repositories.gradle.kts

build-logic/basics/src/main/kotlin/build-logic.reproducible-builds.gradle.kts

build-logic/jvm/build.gradle.kts

• com.diffplug.spotless:com.diffplug.spotless.gradle.plugin 6.25.0
• com.github.vlsi.gradle-extensions:com.github.vlsi.gradle-extensions.gradle.plugin 1.90
• de.thetaphi.forbiddenapis:de.thetaphi.forbiddenapis.gradle.plugin 3.7
• org.jetbrains.dokka:org.jetbrains.dokka.gradle.plugin 1.9.20
• com.github.autostyle:com.github.autostyle.gradle.plugin 4.0
• net.ltgt.errorprone:net.ltgt.errorprone.gradle.plugin 3.1.0

build-logic/jvm/src/main/kotlin/build-logic.dokka-javadoc.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.errorprone.gradle.kts

• com.google.errorprone:error_prone_core 2.27.1
• com.google.guava:guava-beta-checker 1.0

build-logic/jvm/src/main/kotlin/build-logic.forbidden-apis.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.java-library.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.java.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.kotlin.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.spotless-base.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.test-junit5.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.testing.gradle.kts

build-logic/publishing/build.gradle.kts

• dev.sigstore:sigstore-gradle-sign-plugin 0.9.0
• com.gradle.plugin-publish:com.gradle.plugin-publish.gradle.plugin 1.2.1

build-logic/publishing/src/main/kotlin/build-logic.java-published-library.gradle.kts

build-logic/publishing/src/main/kotlin/build-logic.kotlin-dsl-published-gradle-plugin.gradle.kts

build-logic/publishing/src/main/kotlin/build-logic.publish-to-central.gradle.kts

build-logic/publishing/src/main/kotlin/build-logic.publish-to-tmp-maven-repo.gradle.kts

build-logic/publishing/src/main/kotlin/build-logic.signing.gradle.kts

build-logic/root-build/build.gradle.kts

build-logic/root-build/src/main/kotlin/build-logic.root-build.gradle.kts

fuzzing/build.gradle.kts

• com.code-intelligence:jazzer-api 0.22.1
• com.google.guava:guava 33.2.0-jre

sandbox/settings.gradle.kts

sandbox/gradle-precompiled-plugin/build.gradle.kts

sandbox/gradle-precompiled-plugin/src/main/kotlin/sigstore-conventions.gradle.kts

sandbox/gradle-sign-file/build.gradle.kts

sandbox/gradle-sign-java-library/build.gradle.kts

sigstore-cli/build.gradle.kts

• info.picocli:picocli 4.7.5
• com.google.guava:guava 33.2.0-jre
• com.google.oauth-client:google-oauth-client-bom 1.35.0
• info.picocli:picocli-codegen 4.7.5

sigstore-gradle/sigstore-gradle-sign-base-plugin/build.gradle.kts

sigstore-gradle/sigstore-gradle-sign-base-plugin/src/main/kotlin/dev.sigstore.sign-base.gradle.kts

sigstore-gradle/sigstore-gradle-sign-plugin/build.gradle.kts

sigstore-gradle/sigstore-gradle-sign-plugin/src/main/kotlin/dev.sigstore.sign.gradle.kts

sigstore-java/build.gradle.kts

• org.jsonschema2dataclass 5.0.0
• com.google.protobuf 0.9.4
• org.immutables:gson 2.10.1
• org.immutables:value-annotations 2.10.1
• org.immutables:value 2.10.1
• com.google.http-client:google-http-client-bom 1.44.1
• io.github.erdtman:java-json-canonicalization 1.1
• dev.sigstore:protobuf-specs 0.3.1
• com.google.api.grpc:proto-google-common-protos 2.39.0
• com.google.protobuf:protobuf-bom 4.26.1
• io.grpc:grpc-bom 1.63.0
• org.apache.tomcat:annotations-api 6.0.53
• commons-codec:commons-codec 1.17.0
• com.google.code.gson:gson 2.10.1
• org.bouncycastle:bcutil-jdk18on 1.78.1
• org.bouncycastle:bcpkix-jdk18on 1.78.1
• com.google.oauth-client:google-oauth-client-bom 1.35.0
• org.junit:junit-bom 5.10.2
• org.mockito:mockito-bom 5.11.0
• no.nav.security:mock-oauth2-server 0.5.10
• com.squareup.okhttp3:mockwebserver 4.12.0
• net.sourceforge.htmlunit:htmlunit 2.70.0
• org.eclipse.jetty:jetty-server 11.0.20
• io.github.netmikey.logunit:logunit-core 2.0.0
• io.github.netmikey.logunit:logunit-jul 2.0.0
• com.google.protobuf:protoc 4.26.1
• io.grpc:protoc-gen-grpc-java 1.63.0

sigstore-testkit/build.gradle.kts

• com.google.code.gson:gson 2.10.1
• com.google.guava:guava 33.2.0-jre
• org.junit:junit-bom 5.10.2
• org.assertj:assertj-core 3.25.3

gradle-wrapper

gradle/wrapper/gradle-wrapper.properties

• gradle 8.7

sandbox/gradle/wrapper/gradle-wrapper.properties

• gradle 8.7

---

• Check this box to trigger a request for Renovate to run again on this repository