Tosone 940ab15dd4 build(deps): bump grype, syft, buildkit and other dependencies ...

Update direct Go module dependencies to their latest patch/minor
releases, including security and bug fixes across registry,
scanning, storage and build backends. Align the grype, syft,
buildkit, cosign and swagger-ui versions pinned in the Dockerfile
with their upstream releases.

Direct upgrades:
- github.com/alicebob/miniredis/v2 v2.39.0 -> v2.40.0
- github.com/anchore/grype v0.120.0 -> v0.121.0
- github.com/anchore/syft v1.54.0 -> v1.55.0
- github.com/aws/aws-sdk-go-v2 v1.47.1 -> v1.47.3
- github.com/aws/aws-sdk-go-v2/config v1.33.6 -> v1.33.9
- github.com/aws/aws-sdk-go-v2/service/s3 v1.114.0 -> v1.114.3
- github.com/aws/smithy-go v1.28.2 -> v1.28.5
- github.com/docker/cli v29.8.2+incompatible -> v29.9.2+incompatible
- github.com/mark3labs/mcp-go v1.1.1 -> v1.2.1
- github.com/moby/buildkit v0.33.1 -> v0.34.1
- github.com/pressly/goose/v3 v3.28.0 -> v3.29.0
- github.com/prometheus/client_golang v1.24.1 -> v1.25.0
- github.com/sigstore/cosign/v3 v3.1.3 -> v3.1.4
- go.podman.io/podman/v6 v6.1.3 -> v6.1.4
- golang.org/x/crypto v0.57.0 -> v0.58.0
- golang.org/x/net v0.59.0 -> v0.61.0
- golang.org/x/sync v0.23.0 -> v0.24.0
- turso.tech/database/tursogo v0.8.2 -> v0.8.3

Dockerfile:
- build/Dockerfile: SYFT_VERSION 1.54.0 -> 1.55.0, GRYPE_VERSION
  0.120.0 -> 0.121.0, COSIGN_VERSION v3.1.3 -> v3.1.4,
  SWAGGER_UI_VERSION 5.33.1 -> 5.33.2, BUILDKIT_VERSION
  v0.33.1-rootless -> v0.34.1-rootless

Notable transitive bumps: grpc 1.83.2 -> 1.84.0, prometheus/common
0.70.1 -> 0.72.0, sigstore/sigstore 1.10.8 -> v1.11.1,
sigstore/sigstore-go v1.2.2 -> v1.3.0, rekor v1.5.3 -> v1.5.4,
go-openapi v0.x -> v1.0.0 across analysis/spec/validate,
google.golang.org/api v0.294.0 -> v0.301.0,
klauspost/compress 1.20.0 -> 1.20.1, and the podman buildah/storage
modules.

cloud.google.com/go/auth resolves to the pseudo-version
v0.24.1-0.20261001053825-dbc26066f70a because the cosign KMS/GCS
dependency chain requires a commit that has no tagged release yet.

Verification:
- go build -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./...
- go vet -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./...
- golangci-lint v2.15.0 run --build-tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" (0 issues)
- go mod tidy

2026-10-21 19:32:35 +08:00

..

Dockerfile

build(deps): bump grype, syft, buildkit and other dependencies

2026-10-21 19:32:35 +08:00

entrypoint

ci: replace Minio with rs3 and make E2E CI run

2026-09-26 19:42:46 +08:00