chore(deps): bump the go group with 9 updates

[dependabot]

Bumps the go group with 9 updates:

Package	From	To
github.com/aws/aws-sdk-go-v2/config	1.32.29	1.32.30
github.com/aws/aws-sdk-go-v2/credentials	1.19.28	1.19.29
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager	0.3.1	0.3.4
github.com/aws/aws-sdk-go-v2/service/ecr	1.59.0	1.59.1
github.com/aws/aws-sdk-go-v2/service/s3	1.105.0	1.105.2
github.com/aws/smithy-go	1.27.3	1.27.4
github.com/docker/cli	29.6.1+incompatible	29.6.2+incompatible
github.com/go-openapi/strfmt	0.26.4	0.27.0
github.com/sigstore/cosign/v3	3.1.1	3.1.2

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.29 to 1.32.30

Commits

• 2704503 Release 2026-07-13
• 2475fc6 Regenerated Clients
• 89ce46e Update endpoints model
• 97a7b55 Update API model
• 472756a add response snapshot tests for new wave 1 (partial cbor) (#3471)
• 3133b1d Release 2026-07-10
• 2d7d0f8 Regenerated Clients
• cdc7fe3 Update endpoints model
• d41266e Update API model
• d7ac1fc Release 2026-07-09
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.19.28 to 1.19.29

Commits

• 2704503 Release 2026-07-13
• 2475fc6 Regenerated Clients
• 89ce46e Update endpoints model
• 97a7b55 Update API model
• 472756a add response snapshot tests for new wave 1 (partial cbor) (#3471)
• 3133b1d Release 2026-07-10
• 2d7d0f8 Regenerated Clients
• cdc7fe3 Update endpoints model
• d41266e Update API model
• d7ac1fc Release 2026-07-09
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.3.1 to 0.3.4

Commits

• f4fd272 Release 2026-07-17
• 8e4cbc8 Regenerated Clients
• 25e01e0 Update endpoints model
• 947fccf Update API model
• 769233f Fix transfermanager GetObject ContentRange to use HTTP format (#3473)
• 0ffbcb9 Release 2026-07-16
• 2a0ecfb Regenerated Clients
• 20ba39f Update endpoints model
• 8925213 Update API model
• 47e09a2 add replace annotations for new generic client auth/endpoints (#3477)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/ecr from 1.59.0 to 1.59.1

Commits

• 4344501 Release 2025-06-06
• 20a068e Regenerated Clients
• d8fdf86 Update endpoints model
• 73f0a46 Update API model
• 8238069 Release 2025-06-05
• 80bbf28 Regenerated Clients
• a209c7a Update endpoints model
• f882ffa Update API model
• 6d549a5 add sep-based query-compatible tests for both jsonrpc10 and rpcv2cbor (#3106)
• f82629c Release 2025-06-04
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.105.0 to 1.105.2

Commits

• 0ffbcb9 Release 2026-07-16
• 2a0ecfb Regenerated Clients
• 20ba39f Update endpoints model
• 8925213 Update API model
• 47e09a2 add replace annotations for new generic client auth/endpoints (#3477)
• 1dc42b2 Release 2026-07-15
• b945893 Regenerated Clients
• ccbf00c Update API model
• b8df6dc enable schema-serde cbor wave 1 (#3478)
• 00daf36 Release 2026-07-14
• Additional commits viewable in compare view

Updates github.com/aws/smithy-go from 1.27.3 to 1.27.4

Commits

• 870555a Release 2026-07-16
• b06f353 changelogs
• 25d4f57 add temporary maven manual publish
• 90775c9 make generic clients work mostly (#687)
• da34ee1 add maven staging artifact
• 1eb963b add serde response snapshot gen (#685)
• a349439 replace literal unicodes with escaped forms (#684)
• 82c5631 generate serde snapshot tests (#682)
• See full diff in compare view

Updates github.com/docker/cli from 29.6.1+incompatible to 29.6.2+incompatible

Commits

• dfc4efb Merge pull request #7109 from vvoland/update-docker
• dba8675 Bump to 29.6.2
• d9aefe5 Merge tag 'v29.6.1' into 29.x
• 9182b35 Merge tag 'v29.6.0' into 29.x
• 0ae55a3 Merge tag 'v29.5.3' into 29.x
• 029a4b2 Merge tag 'v29.5.2' into 29.x
• e596fea Merge tag 'v29.5.1' into 29.x
• 0c72f45 Merge tag 'v29.5.0' into 29.x
• 26f2736 Merge tag 'v29.4.1' into 29.x
• ac4c4df Merge tag 'v29.4.0' into 29.x
• Additional commits viewable in compare view

Updates github.com/go-openapi/strfmt from 0.26.4 to 0.27.0

Release notes

Sourced from github.com/go-openapi/strfmt's releases.

v0.27.0

0.27.0 - 2026-07-16

Full Changelog: go-openapi/strfmt@v0.26.4...v0.27.0

11 commits in this release.

---

Implemented enhancements

• feat: new formats for currencies (ISO-4217 alpha-3) and countries (ISO-3166 alpha-3 & alpha-2) by @​fredbi in #285 ...
• feat(duration): add ISO 8601 / RFC 3339 duration format (duration-iso8601) by @​fredbi in #284 ...

Fixed bugs

• fix(base64): use standard RFC 4648 alphabet on the text path (#87) by @​fredbi in #283 ...
• fix(duration): fix panic with trailing space, added fuzz by @​fredbi in #281 ...

Documentation

• Doc: typo in Readme by @​fredbi ...
• doc: updated contributors file by @​bot-go-openapi[bot] in #275 ...

Testing

• test(fuzz): added systematic fuzzing of formats by @​fredbi in #282 ...

Miscellaneous tasks

• chore: prepare release v0.27.0 by @​bot-go-openapi[bot] in #286 ...

Updates

• build(deps): bump the other-dependencies group across 3 directories with 1 update by @​dependabot[bot] in #277 ...
• build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 in the golang-org-dependencies group across 1 directory by @​dependabot[bot] in #276 ...

Other (technical)

• Add comments for ISO 3166 countries source data by @​fredbi ...

---

People who contributed to this release

• @​fredbi

... (truncated)

Commits

• 8364821 chore: prepare release v0.27.0
• a98cfd0 Add comments for ISO 3166 countries source data
• 09c6110 Doc: typo in Readme
• 12fcdc1 feat: new formats for currencies (ISO-4217 alpha-3) and countries (ISO-3166 a...
• a9ba012 feat(duration): add ISO 8601 / RFC 3339 duration format (duration-iso8601) (#...
• 4de561f fix(base64): use standard RFC 4648 alphabet on the text path (#87) (#283)
• 7f8ff38 test(fuzz): added systematic fuzzing of formats (#282)
• f33c701 fix(duration): fix panic with trailing space, added fuzz (#281)
• 9f0fa2d build(deps): bump the other-dependencies group across 3 directories with 1 up...
• 5be05e6 build(deps): bump golang.org/x/net
• Additional commits viewable in compare view

Updates github.com/sigstore/cosign/v3 from 3.1.1 to 3.1.2

Release notes

Sourced from github.com/sigstore/cosign/v3's releases.

v3.1.2

This may be the last Cosign v3.1 release, as we finish deprecations and removing unused functionality. Soon we'll start work on Cosign v4 where we will remove things that are currently deprecated. We'll continue to support Cosign v3, with it's opt-in backwards compatibility, as described in our versioning policy.

If you haven't already, now is an excellent time to move to the bundle format that has been supported since Cosign v2.6.

We have received a ton of fixes over the past month from folks using Cosign in a variety of environments - thank you all!

Deprecations

• 816f2b6634821cefe6ceabbffdd5ff7ffc00d0a4 Deprecate --payload for sign and verify commands (#4991)

Features

• 5121398c0ae6f4444d8ffd10447d7b765184f304 docs: add OVHcloud KMS in available external plugins (#4962)
• 38f73bb8fd949fad71e7086bd122080b2d47ceeb Add insecure registry flag to ko publish in kind-verify-attestation workflow (#4970)
• 2e0749ac11c7326299f6af65ae6a3ab6a6750586 Deprecate --output-attestation (#4958)
• 2233166935e2940a530e5a740adc095f4ca4863d Add bundle inspect command (#4842)

Fixes

• eb3bb86f712a1163591b6663bbc434afb6fad467 Guard against empty certificate PEM in mutate.Signature (#4998)
• 089731c31f750153e9d91ec248c990e3b1991c2b fix(download): Validate predicate type for new bundle format
• d996ce12df6967bb5bf81e3244bfbbe1c2665f34 Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)
• 8ca5b2002f5cd43614c476665e2055e59392b59d Fix Makefile: fall back to "unknown" version info when built outside a git repo (#5000)
• df78bf67985f09e431f88b69be5842b7d0f5f4eb fix(verify): skip identity validation for security keys (#5012)
• aebdc3a232083841b9c957fbba6b80b41df8caad fix: include artifactType in OCI 1.1 signature referrer manifest
• c0edaac063a90b1dcacdabc7fc23e6c6f8ade90d Allow attestation download to handle both bundle types (#4996)
• a8642c7b8611d557b4a592e6b94b188bd9427d7c Fix panic in dockerfile verify on malformed FROM lines (#4979)
• ef3e3b446a011852929a08f51095ecc67495bfe7 fix(release): restore signing-step auth and fail on image signing errors (#4978)
• 16ddbcf9040b75e2329f2436b65ba3ed340dac88 feat(signing-config): add --base-config flag to override services from base config (#4977)
• f17f812494b558499d89a37a6c9161657d2371e9 fix: pass NewBundleFormat to KeyOpts in sign command (#4981)
• 6ef8d9d040a481e26e065349c292799615ea7e7b fix: ignore build stage references in dockerfile verify (#4961)
• 8dbdef561622178f453d64d83faa02b1744a19f7 fix: allow '=' in annotation values (#4957)

Cleanup

• 193d2153431f8bb0d945a4c1ee721872f73add67 Remove unused policy evaluation code (#4936)
• 0fc9811059a037c32599e133ec4cc9fead4f354e Remove unused signing code (#4918)
• 95dceda0e7ea0b8d1f1a1d2b9a98c9fb2a6e5b74 Remove unused OCI code (#4935)
• b1dd2e9524daf7406b350cbbfa7f4cd7b8ea0973 Remove unused ephemeral signer (#4938)

Documentation

• 81841260820bdddef3ea65c6f0824caca0cf2715 feat: improve verify flag shell completions (#4965)
• ed0efe8cb464c1bae4711f87b552b1f2e602c816 docs: fix Short style and add Example fields to piv-tool subcommands (#4942)
• d41b86c63cfd2653c263962a9225691c5774c228 docs: add Example fields to env and bundle create commands (#4941)
• 8a7174a1d462b3bb5a2722c7e1cf3a24fd1d3896 docs: fix Short style and add Example fields to pkcs11-tool subcommands

Thanks to all contributors!

Commits

• 193d215 Remove unused policy evaluation code (#4936)
• eb3bb86 Guard against empty certificate PEM in mutate.Signature (#4998)
• 089731c fix(download): Validate predicate type for new bundle format
• d996ce1 Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)
• 8ca5b20 Fix Makefile: fall back to "unknown" version info when built outside a git re...
• df78bf6 fix(verify): skip identity validation for security keys (#5012)
• ee51b53 chore(deps): bump golang in the all group across 1 directory (#4950)
• aebdc3a fix: include artifactType in OCI 1.1 signature referrer manifest
• 816f2b6 Deprecate --payload for sign and verify commands (#4991)
• c0edaac Allow attestation download to handle both bundle types (#4996)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[frewilhelm]

cosign introduces a breaking change that we need to fix before bumping it to 3.1.2. This is why I created #2047 so we can merge the other bumps first and take a look on how to fix cosign after

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

[frewilhelm]

This is not finished yet. We need to find a way to fix the cosign bump

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.