[dependabot]

Bumps sigstore from 4.5.0 to 4.5.1.

Release notes

Sourced from sigstore's releases.

v4.5.1

Changed

• Removed the pyasn1 dependency and raised the minimum cryptography version from 42 to 47. (#1866)
• Certificate chain verification now uses cryptography, removing the pyOpenSSL dependency. (#1867)
• Switched the build backend from flit_core to uv_build. (#1892)

Fixed

• Parsing a malformed in-toto statement now includes the underlying validation error, instead of discarding it. StatementBuilder.build() already did this; Statement(contents=...) did not, so a rejected digest algorithm, a missing field and a bad _type were indistinguishable. (#1846)
• Verifier now raises VerificationError when the trusted root contains no transparency log instances, instead of leaking a raw IndexError (#1880)

Changelog

Sourced from sigstore's changelog.

[4.5.1]

Changed

• Removed the pyasn1 dependency and raised the minimum cryptography version from 42 to 47. (#1866)
• Certificate chain verification now uses cryptography, removing the pyOpenSSL dependency. (#1867)
• Switched the build backend from flit_core to uv_build. (#1892)

Fixed

• Parsing a malformed in-toto statement now includes the underlying validation error, instead of discarding it. StatementBuilder.build() already did this; Statement(contents=...) did not, so a rejected digest algorithm, a missing field and a bad _type were indistinguishable. (#1846)
• Verifier now raises VerificationError when the trusted root contains no transparency log instances, instead of leaking a raw IndexError (#1880)

Commits

• ddc59cf Prepare 4.5.1 (#1948)
• 2718631 Bump certifi (#1947)
• eec80b3 build(deps): bump actions/upload-artifact (#1937)
• 93165d4 build(deps): bump astral-sh/setup-uv (#1943)
• 7ee385a build(deps): bump github/codeql-action/upload-sarif (#1941)
• fb47d2f Group minor and patch updates for "uv" (#1939)
• a48e430 build(deps): bump the actions group with 2 updates (#1938)
• dbe933f build(deps): bump github/codeql-action/upload-sarif (#1926)
• a4db212 build(deps): bump urllib3 from 2.7.0 to 2.8.0 (#1931)
• 6adf8c7 build(deps): bump urllib3 from 2.7.0 to 2.8.0 in /install (#1930)
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: AOSSIE-Org/OpenVerifiableLLM
• Branch: main
• File: .coderabbit.yaml
• Commit: 93211ec
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: b5aa3589-5c03-4b4b-86aa-ece989288b05

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​sigstore@​4.5.0 ⏵ 4.5.1

View full report

[ryoari]

Closing: the Python dependencies are pinned by hash in requirements/preparation.lock, which is evidence for the published run and is updated by hand. This changes the input file without the lock. Dependabot no longer opens pip updates (see the linked PR). (#284)