Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Config Migration Needed

• Select this checkbox to let Renovate create an automated Config Migration PR.

Awaiting Schedule

These updates are awaiting their schedule. Click on a checkbox to get an update now.

• Update dependency org.mockito:mockito-bom to v5.15.2
• Update gradle/actions action to v4.3.0
• Update dependency com.diffplug.spotless:com.diffplug.spotless.gradle.plugin to v7
• Update dependency org.eclipse.jetty:jetty-server to v12
• Update dependency org.jetbrains.dokka:org.jetbrains.dokka.gradle.plugin to v2

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update sigstore/community digest to 2a0d9dc
• Update dependency com.gradle.plugin-publish:com.gradle.plugin-publish.gradle.plugin to v1.3.1
• Update dependency com.google.errorprone:error_prone_core to v2.36.0
• Update dependency commons-codec:commons-codec to v1.18.0
• Update dependency dev.sigstore:protobuf-specs to v0.4.0
• Update dependency gradle to v8.12.1
• Update dependency org.apache.maven.plugin-tools:maven-plugin-annotations to v3.15.1
• Update dependency no.nav.security:mock-oauth2-server to v2
• Click on this checkbox to rebase all open PRs at once

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

• Update plugin org.jsonschema2dataclass to v6

Detected dependencies

github-actions

.github/workflows/byob-slsa.yaml

.github/workflows/ci.yaml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-java v4.7.0@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12
• actions/setup-go v5.3.0@f111f3307d8850f501ac008e886eec1fd1932a34
• gradle/actions v4.2.2@0bdd871935719febd78681f197cd39af5b6e16a6

.github/workflows/cifuzz.yaml

• actions/upload-artifact v4.6.0@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08

.github/workflows/conformance.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-java v4.7.0@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12
• gradle/actions v4.2.2@0bdd871935719febd78681f197cd39af5b6e16a6
• sigstore/sigstore-conformance v0.0.16@d658ea74a060aeabae78f8a379167f219dc38c38

.github/workflows/depsreview.yml

• sigstore/community 9ce432264c32d8e55d8ee8810cc3317ffd43f3a7

.github/workflows/examples.yaml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-java v4.7.0@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12
• gradle/actions v4.2.2@0bdd871935719febd78681f197cd39af5b6e16a6

.github/workflows/gradle-wrapper-validation.yaml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• gradle/actions v4.2.2@0bdd871935719febd78681f197cd39af5b6e16a6

.github/workflows/release-sigstore-gradle-plugin-from-tag.yaml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-java v4.7.0@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12
• gradle/actions v4.2.2@0bdd871935719febd78681f197cd39af5b6e16a6

.github/workflows/release-sigstore-java-from-tag.yaml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-java v4.7.0@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12
• gradle/actions v4.2.2@0bdd871935719febd78681f197cd39af5b6e16a6

.github/workflows/tuf-conformance.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-java v4.7.0@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12
• gradle/actions v4.2.2@0bdd871935719febd78681f197cd39af5b6e16a6
• theupdateframework/tuf-conformance v2.2.0@dee4e23533d7a12a6394d96b59b3ea0aa940f9bf

gradle

gradle.properties

• dev.sigstore:sigstore-java 1.3.0

settings.gradle.kts

build.gradle.kts

build-logic/gradle.properties

build-logic/settings.gradle.kts

build-logic-commons/gradle.properties

build-logic-commons/settings.gradle.kts

build-logic-commons/gradle-plugin/build.gradle.kts

build-logic-commons/gradle-plugin/src/main/kotlin/build-logic.kotlin-dsl-gradle-plugin.gradle.kts

build-logic/basics/build.gradle.kts

build-logic/basics/src/main/kotlin/build-logic.repositories.gradle.kts

build-logic/basics/src/main/kotlin/build-logic.reproducible-builds.gradle.kts

build-logic/jvm/build.gradle.kts

• com.diffplug.spotless:com.diffplug.spotless.gradle.plugin 6.25.0
• com.github.vlsi.gradle-extensions:com.github.vlsi.gradle-extensions.gradle.plugin 1.90
• de.thetaphi.forbiddenapis:de.thetaphi.forbiddenapis.gradle.plugin 3.8
• org.jetbrains.dokka:org.jetbrains.dokka.gradle.plugin 1.9.20
• com.github.autostyle:com.github.autostyle.gradle.plugin 4.0
• net.ltgt.errorprone:net.ltgt.errorprone.gradle.plugin 4.1.0

build-logic/jvm/src/main/kotlin/build-logic.build-info.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.dokka-javadoc.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.errorprone.gradle.kts

• com.google.errorprone:error_prone_core 2.31.0
• com.google.guava:guava-beta-checker 1.0

build-logic/jvm/src/main/kotlin/build-logic.forbidden-apis.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.java-library.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.java.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.kotlin.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.spotless-base.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.test-junit5.gradle.kts

build-logic/jvm/src/main/kotlin/build-logic.testing.gradle.kts

build-logic/publishing/build.gradle.kts

• dev.sigstore:sigstore-gradle-sign-plugin 1.2.0
• com.gradle.plugin-publish:com.gradle.plugin-publish.gradle.plugin 1.3.0

build-logic/publishing/src/main/kotlin/build-logic.depends-on-local-sigstore-java-repo.gradle.kts

build-logic/publishing/src/main/kotlin/build-logic.depends-on-local-sigstore-maven-plugin-repo.gradle.kts

build-logic/publishing/src/main/kotlin/build-logic.java-published-library.gradle.kts

build-logic/publishing/src/main/kotlin/build-logic.kotlin-dsl-published-gradle-plugin.gradle.kts

build-logic/publishing/src/main/kotlin/build-logic.publish-to-central.gradle.kts

build-logic/publishing/src/main/kotlin/build-logic.publish-to-tmp-maven-repo.gradle.kts

build-logic/publishing/src/main/kotlin/build-logic.signing.gradle.kts

build-logic/root-build/build.gradle.kts

build-logic/root-build/src/main/kotlin/build-logic.root-build.gradle.kts

fuzzing/build.gradle.kts

• com.code-intelligence:jazzer-api 0.24.0
• com.google.guava:guava 33.4.0-jre

sandbox/settings.gradle.kts

sandbox/gradle-precompiled-plugin/build.gradle.kts

sandbox/gradle-precompiled-plugin/src/main/kotlin/sigstore-conventions.gradle.kts

sandbox/gradle-sign-file/build.gradle.kts

sandbox/gradle-sign-java-library/build.gradle.kts

sigstore-cli/build.gradle.kts

• info.picocli:picocli 4.7.6
• com.google.guava:guava 33.4.0-jre
• com.google.oauth-client:google-oauth-client-bom 1.37.0
• info.picocli:picocli-codegen 4.7.6

sigstore-gradle/sigstore-gradle-sign-base-plugin/build.gradle.kts

sigstore-gradle/sigstore-gradle-sign-base-plugin/src/main/kotlin/dev.sigstore.sign-base.gradle.kts

sigstore-gradle/sigstore-gradle-sign-plugin/build.gradle.kts

sigstore-gradle/sigstore-gradle-sign-plugin/src/main/kotlin/dev.sigstore.sign.gradle.kts

sigstore-java/build.gradle.kts

• org.jsonschema2dataclass 5.0.0
• com.google.protobuf 0.9.4
• org.immutables:gson 2.10.1
• org.immutables:value-annotations 2.10.1
• org.immutables:value 2.10.1
• com.google.http-client:google-http-client-bom 1.46.1
• io.github.erdtman:java-json-canonicalization 1.1
• dev.sigstore:protobuf-specs 0.3.3
• com.google.protobuf:protobuf-bom 4.29.3
• io.grpc:grpc-bom 1.70.0
• org.apache.tomcat:annotations-api 6.0.53
• commons-codec:commons-codec 1.17.2
• com.google.code.gson:gson 2.12.1
• org.bouncycastle:bcutil-jdk18on 1.80
• org.bouncycastle:bcpkix-jdk18on 1.80
• com.google.oauth-client:google-oauth-client-bom 1.37.0
• org.junit:junit-bom 5.11.4
• org.mockito:mockito-bom 5.14.2
• no.nav.security:mock-oauth2-server 0.5.10
• com.squareup.okhttp3:mockwebserver 4.12.0
• net.sourceforge.htmlunit:htmlunit 2.70.0
• org.eclipse.jetty:jetty-server 11.0.24
• io.github.netmikey.logunit:logunit-core 2.0.0
• io.github.netmikey.logunit:logunit-jul 2.0.0
• com.google.protobuf:protoc 4.29.3
• io.grpc:protoc-gen-grpc-java 1.70.0

sigstore-maven-plugin/build.gradle.kts

• de.benediktritter.maven-plugin-development 0.4.3
• org.apache.maven:maven-plugin-api 3.9.9
• org.apache.maven:maven-core 3.9.9
• org.apache.maven.plugin-tools:maven-plugin-annotations 3.14.0
• org.bouncycastle:bcutil-jdk18on 1.80
• org.apache.maven.plugins:maven-gpg-plugin 3.2.7
• org.apache.maven.shared:maven-verifier 1.8.0

sigstore-testkit/build.gradle.kts

• com.google.code.gson:gson 2.12.1
• com.google.guava:guava 33.4.0-jre
• org.junit:junit-bom 5.11.4
• org.assertj:assertj-core 3.27.3

tuf-cli/build.gradle.kts

• info.picocli:picocli 4.7.6
• com.google.guava:guava 33.4.0-jre
• com.google.oauth-client:google-oauth-client-bom 1.37.0
• info.picocli:picocli-codegen 4.7.6

gradle-wrapper

gradle/wrapper/gradle-wrapper.properties

• gradle 8.10

sandbox/gradle/wrapper/gradle-wrapper.properties

• gradle 8.10

---

• Check this box to trigger a request for Renovate to run again on this repository