Update module github.com/sigstore/fulcio to v1.8.8

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/sigstore/fulcio	v1.8.3 → v1.8.8

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

sigstore/fulcio (github.com/sigstore/fulcio)

v1.8.8

Compare Source

Changelog

• a783aca Include CT log error body in logs (#​2393)
• 965cddd update builder to use go1.26.4 (#​2388)
• 80d8405 Add --ct-log-origin flag (#​2392)
• 7074b70 build(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#​2383)
• 16cc54e docs: clarify RSA_PSS algorithm and ignored field in proto (#​2378)
• 6b2c67d Update fulcio to have configurable hsm-caroot-id rather than hardcoded (#​2377)

Thanks for all contributors!

v1.8.7

Compare Source

Changelog

• 8254f95 Allow directly-configured Kubernetes issuers to use in-cluster auth path (#​2356)

Thanks for all contributors!

v1.8.6

Compare Source

Features

• Include raw subject in certificates (#​2307)

v1.8.5

Compare Source

Vulnerability Fixes

• GHSA-59jp-pj84-45mr - Server-side request forgery via MetaIssuer regex bypass (#​2263)

v1.8.4

Compare Source

Same changelog as v1.8.3, with a few dependency bumps to resolve a breaking API change

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 25 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.25.0 -> 1.26.0
github.com/sirupsen/logrus	v1.9.3 -> v1.9.4
google.golang.org/grpc	v1.77.0 -> v1.81.1
google.golang.org/protobuf	v1.36.10 -> v1.36.12-0.20260120151049-f2248ac996af
github.com/docker/go-connections	v0.6.0 -> v0.7.0
github.com/fsnotify/fsnotify	v1.9.0 -> v1.10.1
github.com/go-jose/go-jose/v4	v4.1.3 -> v4.1.4
github.com/google/go-containerregistry	v0.20.6 -> v0.21.7
github.com/klauspost/compress	v1.18.2 -> v1.18.6
github.com/miekg/pkcs11	v1.1.1 -> v1.1.2
github.com/secure-systems-lab/go-securesystemslib	v0.9.1 -> v0.11.0
github.com/sigstore/protobuf-specs	v0.5.0 -> v0.5.1
github.com/sigstore/sigstore	v1.10.0 -> v1.10.8
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.63.0 -> v0.69.0
go.opentelemetry.io/otel	v1.38.0 -> v1.44.0
go.opentelemetry.io/otel/metric	v1.38.0 -> v1.44.0
go.opentelemetry.io/otel/trace	v1.38.0 -> v1.44.0
golang.org/x/crypto	v0.45.0 -> v0.53.0
golang.org/x/mod	v0.29.0 -> v0.37.0
golang.org/x/net	v0.47.0 -> v0.56.0
golang.org/x/sync	v0.18.0 -> v0.21.0
golang.org/x/sys	v0.40.0 -> v0.46.0
golang.org/x/term	v0.37.0 -> v0.44.0
golang.org/x/text	v0.31.0 -> v0.38.0
google.golang.org/genproto/googleapis/api	v0.0.0-20251022142026-3a174f9686a8 -> v0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/genproto/googleapis/rpc	v0.0.0-20251103181224-f26f9409b101 -> v0.0.0-20260610212136-7ab31c22f7ad

[red-hat-konflux]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.