chore(deps)(deps): bump the operator-minor-patch group in /operator with 3 updates

[dependabot]

Bumps the operator-minor-patch group in /operator with 3 updates: github.com/sigstore/cosign/v3, golang.org/x/crypto and golang.org/x/mod.

Updates github.com/sigstore/cosign/v3 from 3.1.2 to 3.1.3

Release notes

Sourced from github.com/sigstore/cosign/v3's releases.

v3.1.3

What's Changed

This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle.

• Auto-detect default digest algorithm for public keys in sigstore/cosign#5019
• fix(pkcs11key): return an error instead of panicking when no key pair matches in sigstore/cosign#5022
• Supporting OCI Signing with X.509 Certificate Chain in sigstore/cosign#4614
• test(inspect): replace mock TSA client usage with local timestamp response generator in sigstore/cosign#5021
• fix: prevent shell completions for various options not taking filenames in sigstore/cosign#5032
• fix(blob): compare file checksums case-insensitively in sigstore/cosign#5036
• Verification bypass via public key in legacy bundle (GHSA-fx35-mq7g-6g98) in sigstore/cosign#5040

Full Changelog: sigstore/cosign@v3.1.2...v3.1.3

Commits

• 11926fa Verification bypass via public key in legacy bundle (GHSA-fx35-mq7g-6g98) (#5...
• 4d589ba fix(blob): compare file checksums case-insensitively (#5036)
• 83d9ec8 fix: prevent shell completions for various options not taking filenames (#5032)
• 0238975 test(inspect): replace mock TSA client usage with local timestamp response ge...
• d6d86c2 Supporting OCI Signing with X.509 Certificate Chain (#4614)
• a3ee83c fix(pkcs11key): return an error instead of panicking when no key pair matches...
• d6857f2 Auto-detect default digest algorithm for public keys (#5019)
• See full diff in compare view

Updates golang.org/x/crypto from 0.57.0 to 0.58.0

Commits

• 8fdf07b go.mod: update golang.org/x dependencies
• 2437861 salsa20: fix keystream reuse in LoongArch LSX tail
• c3db4df acme: prefer test log helpers in test contexts
• 4e01a84 acme: adds support for profiles draft
• 8f0f111 ssh: check that no Unicode-aware string function is used
• b39ff6d ssh: add certificate algorithms for ML-DSA keys
• 4465db3 ssh: add the ML-DSA public key algorithms
• 83e695b ssh: implement ETM mode for CBC ciphers
• 946083a ssh: only drop a trailing carriage return
• 543dde9 ssh: accept known_hosts entries with a multi-word comment
• Additional commits viewable in compare view

Updates golang.org/x/mod from 0.41.0 to 0.42.0

Commits

• b5136e5 sumdb/tlog: use recorded responses in TestCertificateTransparency
• 1e9a5ae go.mod: update golang.org/x dependencies
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: GameplanePanel/Gameplane/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 24d84b09-f083-494a-901f-e21034530bb1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

CI Report - c0c730a

run 38487559046 - attempt 1

0 failed - 23 passed - 8 skipped - 95m40s elapsed

Coverage

no coverage/* commit statuses found on c0c730a

Changed

Area	Files	+/-
operator/	2	+18/-18

Slowest jobs

Job	Duration
e2e telemetry / amd64 (kind)	22m40s
e2e telemetry / arm64 (kind)	21m53s
e2e multicluster / amd64 (kind x2)	10m55s
build e2e images (arm64)	10m44s
e2e game bot / TestGameServer_GarrysModBot_Query (kind)	9m41s

e2e buckets run

api-agent, api-auth, api-mods, api-rbac, api-roles, bot-fast, multicluster, operator, ratelimit, telemetry, upgrade