build(deps): bump the dependencies group across 1 directory with 4 updates

[dependabot]

Updates the requirements on cryptography, sigstore, boto3 and botocore to permit the latest version.
Updates cryptography from 46.0.2 to 46.0.3

Changelog

Sourced from cryptography's changelog.

46.0.3 - 2025-10-15

* Fixed compilation when using LibreSSL 4.2.0.
.. _v46-0-2:

Commits

• c0af4dd release 46.0.3 (#13681)
• See full diff in compare view

Updates sigstore from 3.6.6 to 4.1.0

Release notes

Sourced from sigstore's releases.

v4.1.0

Added

• cli: Support using other Sigstore instances with --instance URL. New instances are trusted with new top level command trust-instance ROOTFILE. #1548

Changed

• Added cryptography 46 to list of compatible cryptography releases (#1544)
• Improved error message when verifying bundles with unsupported log entry versions (#1569)

Fixed

• cli: Always read/write UTF-8. This fixes an issue on Windows where the platform default encoding was used: the issue has existed for a while, but became more visible with signature bundles that contain rekor2 entries. #1553

v4.0.0

This is a major release with a host of API and functionality changes. The major new feature is Rekor v2 support but many other changes are also included, see list below.

Added

• cli: Add --rekor-version to sign command arguments: This can be useful if Sigstore instance provides multiple Rekor versions and user wants to override the default choice #1471
• cli: Support parallel signing. When multiple artifacts are signed, the Rekor requests are submitted in parallel: this is especially useful with Rekor v2. #1468, #1478, #1485
• oidc (API): Allow custom audience claims via API #1402
• rekor (API): Support Rekor v2 (aka rekor-tiles) in both verification and signing. #1370, #1422, #1432
• trust (API): Make TrustedRoot, SigningConfig and ClientTrustConfig public API #1496

Changed

• cli: Improve verify UX when wrong instance is used #1510
• deps: replace sigstore_protobuf_specs dependency with sigstore-models #1470

... (truncated)

Changelog

Sourced from sigstore's changelog.

[4.1.0]

Added

• cli: Support using other Sigstore instances with --instance URL. New instances are trusted with new top level command trust-instance ROOTFILE. #1548

Changed

• Added cryptography 46 to list of compatible cryptography releases (#1544)
• Improved error message when verifying bundles with unsupported log entry versions (#1569)

Fixed

• cli: Always read/write UTF-8. This fixes an issue on Windows where the platform default encoding was used: the issue has existed for a while, but became more visible with signature bundles that contain rekor2 entries. #1553

[4.0.0]

This is a major release with a host of API and functionality changes. The major new feature is Rekor v2 support but many other changes are also included, see list below.

Added

• cli: Add --rekor-version to sign command arguments: This can be useful if Sigstore instance provides multiple Rekor versions and user wants to override the default choice #1471
• cli: Support parallel signing. When multiple artifacts are signed, the Rekor requests are submitted in parallel: this is especially useful with Rekor v2. #1468, #1478, #1485
• oidc (API): Allow custom audience claims via API #1402
• rekor (API): Support Rekor v2 (aka rekor-tiles) in both verification and signing. #1370, #1422, #1432
• trust (API): Make TrustedRoot, SigningConfig and ClientTrustConfig public API #1496

Changed

• cli: Improve verify UX when wrong instance is used #1510
• deps: replace sigstore_protobuf_specs dependency with sigstore-models

... (truncated)

Commits

• 3447f96 Forward port entry kindversion error improvement, bump version to 4.1.0 (#1569)
• 2dbe03a build(deps): bump github/codeql-action in the actions group (#1572)
• 02daa69 build(deps): bump rich from 14.1.0 to 14.2.0 (#1571)
• 1615939 build(deps): bump the actions group with 2 updates (#1568)
• 72b6581 build(deps): update ruff requirement from <0.13.4 to <0.14.1 (#1567)
• 64dbeba cli: Support using other Sigstore instances (#1548)
• 508b0e7 build(deps): bump softprops/action-gh-release in the actions group (#1563)
• e31f481 build(deps): update ruff requirement from <0.13.3 to <0.13.4 (#1562)
• dec897b build(deps): bump github/codeql-action in the actions group (#1561)
• 0a54b4f build(deps): bump cryptography from 46.0.1 to 46.0.2 (#1558)
• Additional commits viewable in compare view

Updates boto3 to 1.40.60

Commits

• da0b18a Merge branch 'release-1.40.60'
• 54b724b Bumping version to 1.40.60
• 9dc2aee Add changelog entries from botocore
• 87655ba Test 3.14-dev to 3.14 (#4647)
• 0681062 Bump github/codeql-action from 4.30.8 to 4.31.0 (#4649)
• ba90489 Merge branch 'release-1.40.59'
• e8ddeb6 Merge branch 'release-1.40.59' into develop
• c5c73e9 Bumping version to 1.40.59
• 7194041 Add changelog entries from botocore
• 52cedfe Merge branch 'release-1.40.58'
• Additional commits viewable in compare view

Updates botocore to 1.40.60

Commits

• 9636e61 Merge branch 'release-1.40.60'
• a8eeaa0 Bumping version to 1.40.60
• 8d2dfe8 Update to latest models
• 8c27884 Merge pull request #3582 from boto/dependabot/github_actions/github/codeql-ac...
• 33444fc Bump github/codeql-action from 4.30.8 to 4.31.0
• 665b7c4 Merge branch 'release-1.40.59'
• 06ac0dc Merge branch 'release-1.40.59' into develop
• b5d4a03 Bumping version to 1.40.59
• 3e42da7 Update endpoints model
• d47eeff Update to latest models
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
sigstore	[>= 4.0.dev0, < 4.1]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Superseded by #1041.