From 50cba807bb51ec23dd91f78f6134a40d1173ebe9 Mon Sep 17 00:00:00 2001 From: "octo-sts[bot]" <157150467+octo-sts@users.noreply.github.com> Date: Mon, 8 Dec 2025 09:37:24 +0000 Subject: [PATCH] vexctl/0.4.1-r3: fix GHSA-4qg8-fj49-pxjh --- vexctl.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/vexctl.yaml b/vexctl.yaml index 123d2eab92d..096ad87dd38 100644 --- a/vexctl.yaml +++ b/vexctl.yaml @@ -1,7 +1,7 @@ package: name: vexctl version: "0.4.1" - epoch: 3 # GHSA-j5w8-q4qc-rx2x + epoch: 4 # GHSA-4qg8-fj49-pxjh description: A tool to create, transform and attest VEX metadata copyright: - license: Apache-2.0 @@ -17,6 +17,7 @@ pipeline: with: deps: |- golang.org/x/crypto@v0.45.0 + github.com/sigstore/timestamp-authority@v2.0.3 - uses: go/build with: