We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing with: cosign-release and strongly discourage using cosign-release unless you have a specific reason to use an older version of Cosign.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/pangolin/pull/2656
**Author:** [@dependabot[bot]](https://github.com/apps/dependabot)
**Created:** 3/16/2026
**Status:** ✅ Merged
**Merged:** 3/18/2026
**Merged by:** [@oschwartz10612](https://github.com/oschwartz10612)
**Base:** `main` ← **Head:** `dependabot/github_actions/sigstore/cosign-installer-4.1.0`
---
### 📝 Commits (1)
- [`1034993`](https://github.com/fosrl/pangolin/commit/10349932f44e0fe5e070cc3a38aa3446ae58436f) Bump sigstore/cosign-installer from 4.0.0 to 4.1.0
### 📊 Changes
**2 files changed** (+2 additions, -2 deletions)
<details>
<summary>View changed files</summary>
📝 `.github/workflows/cicd.yml` (+1 -1)
📝 `.github/workflows/mirror.yaml` (+1 -1)
</details>
### 📄 Description
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 4.0.0 to 4.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/sigstore/cosign-installer/releases">sigstore/cosign-installer's releases</a>.</em></p>
<blockquote>
<h2>v4.1.0</h2>
<h2>What's Changed</h2>
<p>We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing <code>with: cosign-release</code> and strongly discourage using <code>cosign-release</code> unless you have a specific reason to use an older version of Cosign.</p>
<ul>
<li>Bump cosign to 3.0.5 in <a href="https://redirect.github.com/sigstore/cosign-installer/pull/220">sigstore/cosign-installer#220</a></li>
<li>fix: add retry to curl downloads for transient network failures in <a href="https://redirect.github.com/sigstore/cosign-installer/pull/210">sigstore/cosign-installer#210</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/cosign-installer/compare/v4.0.0...v4.1.0">https://github.com/sigstore/cosign-installer/compare/v4.0.0...v4.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/sigstore/cosign-installer/commit/ba7bc0a3fef59531c69a25acd34668d6d3fe6f22"><code>ba7bc0a</code></a> fix: add retry to curl downloads for transient network failures (<a href="https://redirect.github.com/sigstore/cosign-installer/issues/210">#210</a>)</li>
<li><a href="https://github.com/sigstore/cosign-installer/commit/5a292e1504fdf08d68831aa1d265e92aee5701f9"><code>5a292e1</code></a> Bump cosign to 3.0.5 (<a href="https://redirect.github.com/sigstore/cosign-installer/issues/220">#220</a>)</li>
<li><a href="https://github.com/sigstore/cosign-installer/commit/351ea76151ae2dbbf52374c9dd639f4981de944f"><code>351ea76</code></a> Bump actions/checkout from 6.0.1 to 6.0.2 (<a href="https://redirect.github.com/sigstore/cosign-installer/issues/217">#217</a>)</li>
<li><a href="https://github.com/sigstore/cosign-installer/commit/c17565ff322a3403de48978f18d9ee0cfa7c2cd5"><code>c17565f</code></a> test with go 1.26 too (<a href="https://redirect.github.com/sigstore/cosign-installer/issues/221">#221</a>)</li>
<li><a href="https://github.com/sigstore/cosign-installer/commit/a6fdd19182ff7fb86ae39a9329ba29eb602cbabb"><code>a6fdd19</code></a> Bump actions/setup-go from 6.1.0 to 6.3.0 (<a href="https://redirect.github.com/sigstore/cosign-installer/issues/218">#218</a>)</li>
<li><a href="https://github.com/sigstore/cosign-installer/commit/430b6a704fe0c92f1b1261d84376a900f38d90ff"><code>430b6a7</code></a> docs: fix registry from gcr.io to ghcr.io (<a href="https://redirect.github.com/sigstore/cosign-installer/issues/213">#213</a>)</li>
<li><a href="https://github.com/sigstore/cosign-installer/commit/4d14d7f17e7112af04ea6108fbb4bfc714c00390"><code>4d14d7f</code></a> feat: update to v3.0.3 (<a href="https://redirect.github.com/sigstore/cosign-installer/issues/212">#212</a>)</li>
<li><a href="https://github.com/sigstore/cosign-installer/commit/f14800521ef377428f8fdd1f9ccc6b2f900212ad"><code>f148005</code></a> fix: use env vars for template expansions; show curl errors (<a href="https://redirect.github.com/sigstore/cosign-installer/issues/207">#207</a>)</li>
<li><a href="https://github.com/sigstore/cosign-installer/commit/c3f2d79008c81762e405a967f8aa7f8c5686c760"><code>c3f2d79</code></a> Bump actions/checkout from 6.0.0 to 6.0.1 (<a href="https://redirect.github.com/sigstore/cosign-installer/issues/208">#208</a>)</li>
<li><a href="https://github.com/sigstore/cosign-installer/commit/b9a9af4616125e37640447359ca8bd199a502d8d"><code>b9a9af4</code></a> drop tests with go1.24 as it cant build (<a href="https://redirect.github.com/sigstore/cosign-installer/issues/211">#211</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/sigstore/cosign-installer/compare/faadad0cce49287aee09b3a48701e75088a2c6ad...ba7bc0a3fef59531c69a25acd34668d6d3fe6f22">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/2656
Author: @dependabot[bot]
Created: 3/16/2026
Status: ✅ Merged
Merged: 3/18/2026
Merged by: @oschwartz10612
Base:
main← Head:dependabot/github_actions/sigstore/cosign-installer-4.1.0📝 Commits (1)
1034993Bump sigstore/cosign-installer from 4.0.0 to 4.1.0📊 Changes
2 files changed (+2 additions, -2 deletions)
View changed files
📝
.github/workflows/cicd.yml(+1 -1)📝
.github/workflows/mirror.yaml(+1 -1)📄 Description
Bumps sigstore/cosign-installer from 4.0.0 to 4.1.0.
Release notes
Sourced from sigstore/cosign-installer's releases.
Commits
ba7bc0afix: add retry to curl downloads for transient network failures (#210)5a292e1Bump cosign to 3.0.5 (#220)351ea76Bump actions/checkout from 6.0.1 to 6.0.2 (#217)c17565ftest with go 1.26 too (#221)a6fdd19Bump actions/setup-go from 6.1.0 to 6.3.0 (#218)430b6a7docs: fix registry from gcr.io to ghcr.io (#213)4d14d7ffeat: update to v3.0.3 (#212)f148005fix: use env vars for template expansions; show curl errors (#207)c3f2d79Bump actions/checkout from 6.0.0 to 6.0.1 (#208)b9a9af4drop tests with go1.24 as it cant build (#211)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.