v0.7.0

Changelog

Breaking

Hello,

As a continuation of #485, we are starting the process of deprecating the existing https://github.com/theupdateframework/go-tuf code base in favour of https://github.com/rdimitrov/go-tuf-metadata.

Reasoning:

• The reasoning behind this is explained in #485, but essentially the new code base is much simpler, easier to work with and last but not least, easier to maintain and contribute to. The last two have been longstanding issues for go-tuf and we are looking forward to address them with this change.
• Deep thank you to all of the people that helped shaping this effort!

Details:

• This will not happen straight away!
• We'll continue to support this version in a separate branch(v0.7.0) until the migration process is considered as completed.
• We advise all users to pin their dependencies of go-tuf to a certain release version (in case they haven't already) so they don't experience any inconveniences.
• We'll continue to use the https://github.com/theupdateframework/go-tuf repository, but its content will be updated to accommodate the changes. We'll start introducing the go-tuf-metadata code base to the master branch of go-tuf, so technically there will be times where the master branch might be considered unstable (which is a general practice).
• Even though go-tuf is pre-v1.0.0 and technically there are no API commitments to be followed, we won't release a v1.0.0 either with the new code base until it is well tested and we are sure of its stability.

Apologies for the disruption and thank you in advance for the understanding!

Yours,
The go-tuf maintainers team.

---

Features

• 14ed751: feat: Add-Signature to support new formats of input (#538) (@ChevronTango)
• 70d3a54: feat: #528 Add-Key to a role (#535) (@ChevronTango)
• 6e07500: feat: 536 Add Gitpod config to project (#537) (@ChevronTango)

Bug fixes

• 9570146: fix: Set sig to Array when empty (#533) (@ChevronTango)
• 582126a: fix: add-signature to read from stdin (#534) (@ChevronTango)
• 58f321a: fix(localMeta): Ignore deleted delegated targets (#522) (@BaptisteFoy)

Others

• f205b79: chore(deps): bump actions/setup-go from 4.0.1 to 4.1.0 (#542) (@dependabot[bot])
• cdae812: chore(deps): bump shogo82148/actions-goveralls from 1.7.0 to 1.8.0 (#544) (@dependabot[bot])
• 3ff5aa7: chore(deps): bump goreleaser/goreleaser-action from 4.3.0 to 4.4.0 (#543) (@dependabot[bot])
• fe99435: chore(deps): bump golangci/golangci-lint-action from 3.6.0 to 3.7.0 (#547) (@dependabot[bot])
• 9099aaa: chore(deps): bump golang.org/x/term from 0.11.0 to 0.12.0 (#548) (@dependabot[bot])
• 3a50777: chore(deps): bump arnested/go-version-action from 1.1.12 to 1.1.13 (#549) (@dependabot[bot])
• 308e63e: chore(deps): bump golang.org/x/crypto from 0.12.0 to 0.13.0 (#553) (@dependabot[bot])
• 0107a72: chore(deps): bump securesystemslib from 0.28.0 to 0.29.0 (#552) (@dependabot[bot])
• 057cf19: chore(deps): bump goreleaser/goreleaser-action from 4.4.0 to 4.6.0 (#550) (@dependabot[bot])
• 1f8a2d8: chore(deps): bump actions/checkout from 3 to 4 (#551) (@dependabot[bot])
• 35c71e4: chore(deps): bump goreleaser/goreleaser-action from 4.6.0 to 5.0.0 (#554) (@dependabot[bot])
• ca61fb0: chore(deps): bump securesystemslib from 0.29.0 to 0.30.0 (#557) (@dependabot[bot])
• 257ce1a: chore(deps): bump golang.org/x/term from 0.12.0 to 0.13.0 (#559) (@dependabot[bot])
• dde2ad4: chore(deps): bump golang.org/x/crypto from 0.13.0 to 0.14.0 (#560) (@dependabot[bot])
• c544d32: chore(deps): bump actions/setup-python from 4.7.0 to 4.7.1 (#561) (@dependabot[bot])
• c9be819: chore(deps): bump amannn/action-semantic-pull-request from 5.2.0 to 5.3.0 (#555) (@dependabot[bot])
• dfef2ca: chore(deps): bump tuf from 3.0.0 to 3.1.0 (#562) (@dependabot[bot])
• 2258ee1: chore(deps): bump iso8601 from 2.0.0 to 2.1.0 (#558) (@dependabot[bot])
• 9301e5a: chore(deps): bump amannn/action-semantic-pull-request from 5.3.0 to 5.4.0 (#563) (@dependabot[bot])
• 17b6205: chore(deps): bump arnested/go-version-action from 1.1.13 to 1.1.14 (#564) (@dependabot[bot])
• beddac2: chore(deps): bump golang.org/x/term from 0.13.0 to 0.14.0 (#565) (@dependabot[bot])
• 6ad7fe5: chore(deps): bump golang.org/x/crypto from 0.14.0 to 0.16.0 (#568) (@dependabot[bot])

v0.6.1

Changelog

Bug fixes

• ca0c316: fix: fail to load deprecated ecdsa verifier (#541) (@rdimitrov)

Others

• 8efd6cd: test: add python-tuf v3.0.0 support (#515) (@rdimitrov)
• 7b85661: chore: add govulncheck and bump Go to 1.20 (#523) (@rdimitrov)
• 4e4f7f3: chore(deps): bump actions/setup-python from 4.6.1 to 4.7.0 (#519) (@dependabot[bot])
• ad706ed: chore(deps): bump golang.org/x/crypto from 0.11.0 to 0.12.0 (#539) (@dependabot[bot])

v0.6.0

Changelog

Breaking changes

• 9774d79: feat!: add deprecating message for the encrypted package (#521) (@rdimitrov)

Features

• 6aa3072: feat: increase scrypt parameters (#470) (@Zenithar)

Bug fixes

• 5a019c3: fix: golangci-lint failures when tested against Go 1.20 (#457) (@rdimitrov)
• 6b93a5a: fix: sign-payload shouldn't recanonicalize payload (#479) (@znewman01)
• 2adcfe7: fix: Update the ecdsa key type to the latest spec (1.0.32). (#508) (@kommendorkapten)

Others

• 2cea368: chore(deps): bump goreleaser/goreleaser-action from 4.1.0 to 4.2.0 (#453) (@dependabot[bot])
• f077110: chore(deps): bump golangci/golangci-lint-action from 3.3.1 to 3.4.0 (#451) (@dependabot[bot])
• 0cd000c: chore(deps): bump arnested/go-version-action from 1.1.6 to 1.1.7 (#454) (@dependabot[bot])
• fab805a: chore(deps): bump amannn/action-semantic-pull-request from 5.0.2 to 5.1.0 (#458) (@dependabot[bot])
• 96a25a4: chore(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 (#466) (@dependabot[bot])
• 075e800: chore(deps): bump golang.org/x/term from 0.0.0-20210927222741-03fcf44c2211 to 0.5.0 (#465) (@dependabot[bot])
• 7b0f249: chore(deps): bump golang.org/x/crypto from 0.0.0-20211117183948-ae814b36b871 to 0.6.0 (#464) (@dependabot[bot])
• c386074: chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.4.0 to 0.5.0 (#459) (@dependabot[bot])
• ad9ad10: chore(deps): bump golang.org/x/term from 0.5.0 to 0.6.0 (#468) (@dependabot[bot])
• ba794d1: chore(deps): bump golang.org/x/crypto from 0.6.0 to 0.7.0 (#469) (@dependabot[bot])
• d271873: chore(deps): bump securesystemslib from 0.26.0 to 0.27.0 (#471) (@dependabot[bot])
• 493ab6c: chore(deps): bump actions/setup-go from 3.5.0 to 4.0.0 (#472) (@dependabot[bot])
• 7f231b3: chore(deps): bump amannn/action-semantic-pull-request from 5.1.0 to 5.2.0 (#473) (@dependabot[bot])
• 7cddf58: docs: Update install instructions in README (#474) (@haydentherapper)
• 30b7aae: chore(deps): bump golang.org/x/term from 0.6.0 to 0.7.0 (#477) (@dependabot[bot])
• ab35782: chore(deps): bump golang.org/x/crypto from 0.7.0 to 0.8.0 (#478) (@dependabot[bot])
• c7d649b: ci(build): Add arm64 to build (#463) (@udf2457)
• 7986772: chore(deps): bump arnested/go-version-action from 1.1.7 to 1.1.8 (#480) (@dependabot[bot])
• 7a57438: chore(deps): bump securesystemslib from 0.27.0 to 0.28.0 (#481) (@dependabot[bot])
• c79b5e6: chore(deps): bump actions/setup-python from 4.5.0 to 4.6.0 (#482) (@dependabot[bot])
• 8edc996: chore(deps): bump shogo82148/actions-goveralls from 1.6.0 to 1.7.0 (#483) (@dependabot[bot])
• e077a68: chore(deps): bump requests from 2.28.2 to 2.29.0 (#484) (@dependabot[bot])
• 39f588c: chore(deps): bump golang.org/x/term from 0.7.0 to 0.8.0 (#487) (@dependabot[bot])
• dfbd21a: chore(deps): bump requests from 2.29.0 to 2.30.0 (#488) (@dependabot[bot])
• 56698a3: chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.5.0 to 0.6.0 (#486) (@dependabot[bot])
• b4feccd: chore(deps): bump golang.org/x/crypto from 0.8.0 to 0.9.0 (#489) (@dependabot[bot])
• ed58d45: chore(deps): bump actions/setup-go from 4.0.0 to 4.0.1 (#491) (@dependabot[bot])
• e9da9a9: chore(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.3 (#493) (@dependabot[bot])
• d1450a5: chore: Bump spec version (#495) (@znewman01)
• 401f689: chore(deps): bump requests from 2.30.0 to 2.31.0 (#496) (@dependabot[bot])
• a41f2d2: chore(deps): bump actions/setup-python from 4.6.0 to 4.6.1 (#497) (@dependabot[bot])
• 1f98392: chore(deps): bump github.com/stretchr/testify from 1.8.3 to 1.8.4 (#498) (@dependabot[bot])
• 6e5284c: chore(deps): bump arnested/go-version-action from 1.1.8 to 1.1.9 (#499) (@dependabot[bot])
• c95b553: chore(deps): bump golangci/golangci-lint-action from 3.4.0 to 3.5.0 (#501) (@dependabot[bot])
• 0bf668e: ci: Disable daily checking for version but not security updates (#500) (@trishankatdatadog)
• 44727bf: chore(deps): bump golangci/golangci-lint-action from 3.5.0 to 3.6.0 (#502) (@dependabot[bot])
• 4e506c4: chore(deps): bump iso8601 from 1.1.0 to 2.0.0 (#503) (@dependabot[bot])
• c844873: docs: add go-tuf security assessment report (#504) (@rdimitrov)
• 842dc87: chore(deps): bump golang.org/x/term from 0.8.0 to 0.9.0 (#505) (@dependabot[bot])
• caa9677: chore(deps): bump goreleaser/goreleaser-action from 4.2.0 to 4.3.0 (#507) (@dependabot[bot])
• f21355b: chore(deps): bump golang.org/x/crypto from 0.9.0 to 0.10.0 (#506) (@dependabot[bot])
• 31dbaec: docs: added myself (kommendorkapten) as a maintainer (#510) (@kommendorkapten)
• 6adc195: chore(deps): bump arnested/go-version-action from 1.1.9 to 1.1.11 (#511) (@dependabot[bot])
• 4b9fd32: docs: add list with alternative implementations (#169) (@mnm678)
• aa1a857: chore(deps): bump golang.org/x/term from 0.9.0 to 0.10.0 (#513) (@dependabot[bot])
• 5ed6239: chore(deps): bump golang.org/x/crypto from 0.10.0 to 0.11.0 (#514) (@dependabot[bot])
• 030ef07: chore(deps): bump arnested/go-version-action from 1.1.11 to 1.1.12 (#520) (@dependabot[bot])
• e2f53d9: chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.6.0 to 0.7.0 (#518) (@dependabot[bot])

v0.5.2

Changelog

Features

• 3890c1e: feat: Add Filesystem based remote store to support airgap. (#397) (@vaikas)

Bug fixes

• f75cbcc: fix(cmd): fix logging of help message (#395) (@asraa)
• adbdc7d: fix(data): add back SnapshotFileMeta.Custom (#373) (@arbll)
• 4705874: fix: fix delegation null json value interoperability (#410) (@asraa)
• 047cdb3: fix: fix verification to continue on invalid sigs (#418) (@asraa)
• 7e86441: fix(localMeta): Add delegated targets back to localMeta (#384) (@BaptisteFoy)

Others

• 8a4aabf: test: update lint CI parameters (#394) (@znewman01)
• 6ea14f5: chore: update TUF spec version to 1.0.31 (#393) (@znewman01)
• e56ccf6: chore(deps): bump amannn/action-semantic-pull-request from 4.5.0 to 4.6.0 (#398) (@dependabot[bot])
• b611a26: docs: fix broken link (#401) (@znewman01)
• 4f55897: test: Do not fail-fast when CI runs. (#403) (@vaikas)
• 22f95c0: chore(deps): bump iso8601 from 1.0.2 to 1.1.0 (#404) (@dependabot[bot])
• 2541d68: docs: fix broken link (#405) (@abs007)
• b4b954d: chore(deps): bump arnested/go-version-action from 1.1.5 to 1.1.6 (#408) (@dependabot[bot])
• 14853e3: chore: update release notes breaking change regex (#409) (@znewman01)
• 0f8d7fe: docs: mention breaking changes in PR template (#413) (@znewman01)
• 6f22146: chore(deps): bump actions/setup-python from 4.2.0 to 4.3.0 (#414) (@dependabot[bot])
• b4c6f5a: chore(deps): bump amannn/action-semantic-pull-request from 4.6.0 to 5.0.0 (#415) (@dependabot[bot])
• 3f725e2: docs: add security.md (#412) (@asraa)
• 39613e3: chore(deps): bump amannn/action-semantic-pull-request from 5.0.0 to 5.0.1 (#416) (@dependabot[bot])
• 81884a3: chore(deps): bump amannn/action-semantic-pull-request from 5.0.1 to 5.0.2 (#419) (@dependabot[bot])
• fff5e69: chore(deps): bump actions/setup-go from 3.3.0 to 3.3.1 (#421) (@dependabot[bot])
• 680a077: chore(deps): bump goreleaser/goreleaser-action from 3.1.0 to 3.2.0 (#420) (@dependabot[bot])
• 7d83cf2: chore(deps): bump golangci/golangci-lint-action from 3.2.0 to 3.3.0 (#423) (@dependabot[bot])
• 64bd805: chore(deps): bump github.com/stretchr/testify from 1.8.0 to 1.8.1 (#424) (@dependabot[bot])
• cfd009d: docs: Remove ethan-lowman-dd from maintainers (#428) (@ethan-lowman-dd)
• 2ac63f7: docs: Update MAINTAINERS (#430) (@trishankatdatadog)
• 901213d: chore(deps): bump golangci/golangci-lint-action from 3.3.0 to 3.3.1 (#433) (@dependabot[bot])
• 535756a: chore: Update interop tests for new python-tuf release 2.0.0 (#434) (@joshuagl)
• 00e8129: docs: Use Github's vulnerability reporting (#432) (@mnm678)
• c803c81: chore(deps): bump actions/setup-go from 3.3.1 to 3.4.0 (#435) (@dependabot[bot])
• 9cb61d6: chore: elevate GitHub token permissions for release.yml workflow (#437) (@rdimitrov)
• 3889ddd: chore(deps): bump actions/setup-python from 4.3.0 to 4.4.0 (#443) (@dependabot[bot])
• f310d5e: chore(deps): bump actions/setup-go from 3.4.0 to 3.5.0 (#441) (@dependabot[bot])
• a6e32be: chore(deps): bump goreleaser/goreleaser-action from 3.2.0 to 4.1.0 (#442) (@dependabot[bot])
• 5f964cf: chore(deps): bump actions/setup-python from 4.4.0 to 4.5.0 (#445) (@dependabot[bot])
• 8f585b5: chore(deps): bump requests from 2.28.1 to 2.28.2 (#446) (@dependabot[bot])
• 66a4473: chore(deps): bump securesystemslib from 0.25.0 to 0.26.0 (#448) (@dependabot[bot])
• 2b21357: chore(deps): bump github.com/dustin/go-humanize from 1.0.0 to 1.0.1 (#447) (@dependabot[bot])
• 91c85a0: test: add tests for rollback protection on snapshot, targets, delegations (#450) (@asraa)

v0.5.1

Changelog

Features

• 7097fd8: feat: Adds a new raw file metadata storage for clients (#347) (@kommendorkapten)
• f237d7c: feat: pass logger into repo and client (#385) (@asraa)

Bug fixes

• a9ddd89: fix: fix IsTopLevelManifest calculation for versioned manifests (#381) (@asraa)
• 040092c: fix: abandon updates if timestamp.json isn't new (#387) (@znewman01)

Others

• 13eff30: chore(deps): bump securesystemslib from 0.22.0 to 0.24.0 (#383) (@dependabot[bot])
• 0e33cdf: docs: Add docs for adding and rotating root keys (#389) (@mnm678)
• 7f9beab: chore: update TUF spec version (#392) (@znewman01)

v0.5.0

Changelog

Features

• 61872a3: feat: Support ecdsa and RSA keys (#270 with backwards compatibility) (#357) (@asraa)

v0.3.2

Changelog

Bug fixes

• b6695e4: fix(verify): backport "Fix a vulnerability in the verification of threshold si… (#375) (@znewman01)

v0.4.0

Changelog

Features

• af3c7d6: feat: Add new status command (#342) (@doanac)
• 4febe4c: feat(keys): JSON unmarshal hardening. (#275) (@Zenithar)

Bug fixes

• 9020b3c: fix: Remove typo in Alternate signing flow (#344) (@elfotografo007)
• 9334b3f: fix: Redirect passphrase output to Standard error (#343) (@elfotografo007)
• 2e6c621: fix: require length and hashes for target metadata (#345) (@asraa)
• 37601e1: fix: filesystemStore fails to prepend target file hashes on Windows (#274) (@torin-carey)
• 2b415d0: fix: update leveldb dependency (#350) (@mfmarche)
• 1b070ee: fix: add leveldb recover ability (#352) (@mfmarche)
• 64ded18: fix(verify): Fix a vulnerability in the verification of threshold signatures (due to handling of keys with multiple IDs) (#369) (@cedricvanrompay-datadog)

Others

• 529fcca: chore(deps): bump arnested/go-version-action from 1.1.3 to 1.1.4 (#334) (@dependabot[bot])
• f5f12b1: docs: Misc. docs fixes (#337) (@znewman01)
• 0f17236: docs: Add release process info for maintainers (#336) (@znewman01)
• 40b67d2: chore(deps): bump actions/setup-python from 4.0.0 to 4.1.0 (#340) (@dependabot[bot])
• 9d0031b: chore(deps): bump actions/setup-go from 3.2.0 to 3.2.1 (#339) (@dependabot[bot])
• 768b63a: chore(deps): bump actions/setup-python from 4.1.0 to 4.2.0 (#351) (@dependabot[bot])
• 8124e8a: chore!: Remove deprecated client Init() function (#353) (@znewman01)
• 8b2d2ab: ci: Fix typo in Pull Request template (#355) (@znewman01)
• f3a48f7: refactor!: rename "InitLocal" to "Init" (#354) (@znewman01)
• ebbc6b8: chore(deps): bump arnested/go-version-action from 1.1.4 to 1.1.5 (#359) (@dependabot[bot])
• 9b6c503: chore(deps): bump actions/setup-go from 3.2.1 to 3.3.0 (#361) (@dependabot[bot])
• d7ff71b: test: Update Python interop tests to python-tuf v1.0.0 (#228) (@znewman01)
• ac7b5d7: chore(deps): bump goreleaser/goreleaser-action from 3.0.0 to 3.1.0 (#366) (@dependabot[bot])
• 06ed599: build: Use Go 1.17 for golangci linting and update golangci/golangci-lint-action (#364) (@ethan-lowman-dd)

v0.3.1

Changelog

Features

• 4bf58eb: feat: add payload and add-signature commands. (#214) (@znewman01)
• 39c23cb: feat: add workflow responsible for notifying of new TUF spec release (#287) (@rdimitrov)
• 355e39c: feat: Implement TAP-12 support (#310) (@znewman01)

Bug fixes

• 9a41055: fix: check root metadata verification before snapshotting (#293) (@asraa)
• e3efe98: fix: verify length and hashes of fetched bytes before parsing (#325) (@joshuagl)

Others

• ea0f98a: chore(deps): bump arnested/go-version-action from 1.0.67 to 1.0.69 (#288) (@dependabot[bot])
• 6722937: chore(deps): bump golangci/golangci-lint-action from 2.5.2 to 3.2.0 (#289) (@dependabot[bot])
• e2594e6: chore(deps): bump actions/setup-go from 3.0.0 to 3.1.0 (#290) (@dependabot[bot])
• 580db19: chore(deps): bump goreleaser/goreleaser-action from 2.9.1 to 3 (#294) (@dependabot[bot])
• 5884dab: chore(deps): bump actions/setup-go from 3.1.0 to 3.2.0 (#295) (@dependabot[bot])
• 3b26aed: chore(deps): bump arnested/go-version-action from 1.0.69 to 1.0.70 (#297) (@dependabot[bot])
• 041e818: chore(deps): bump github.com/secure-systems-lab/go-securesystemslib (#298) (@dependabot[bot])
• ad96eca: chore(deps): bump github.com/stretchr/testify from 1.7.1 to 1.7.2 (#299) (@dependabot[bot])
• 36633af: chore(deps): bump arnested/go-version-action from 1.0.70 to 1.1.0 (#300) (@dependabot[bot])
• e24b175: chore(deps): bump actions/setup-python from 3.1.2 to 4 (#311) (@dependabot[bot])
• 1684c68: docs: Update CONTRIBUTING.md, add MAINTAINERS.md (#309) (@znewman01)
• 4139c85: chore(deps): bump arnested/go-version-action from 1.1.0 to 1.1.3 (#316) (@dependabot[bot])
• 36a2930: build: update go version to 1.18 (#314) (@asraa)
• ae904d2: docs: Add DCO instructions (#319) (@znewman01)
• 81cd9b3: chore(deps): bump Python from 3.6 to 3.10 (#318) (@rdimitrov)
• 986a4c5: chore(deps): bump requests from 2.27.1 to 2.28.0 (#317) (@dependabot[bot])
• 439ce47: chore(deps): bump github.com/stretchr/testify from 1.7.2 to 1.7.4 (#324) (@dependabot[bot])
• 3bb077e: chore(deps): bump requests from 2.28.0 to 2.28.1 (#332) (@dependabot[bot])
• eed9e6c: chore(deps): bump github.com/stretchr/testify from 1.7.4 to 1.8.0 (#331) (@dependabot[bot])
• 0d40b25: test: fix flakey util test (#333) (@asraa)

v0.3.0

Changelog

Security

• ed6788e: security: implement protection against rollback attacks for roles other than root / Merge pull request from GHSA-66x3-6cw3-v5gj (@rdimitrov)

Features

• fd8ac04: feat: Support delegated targets roles in repo writer (#175) (@mnm678)
• ce6509c: feat: propose adding Zach Newman to list of maintainers (#271) (@trishankatdatadog)

Bug fixes

• 82f1929: fix: Fix JSON canonicalisation (#247) (@toby-jn)

Others

• 507e038: user int64 for version (#240) (@arbll)
• 5b81b7e: ci: Check PR title instead of commits for conventional format (#264) (@ethan-lowman-dd)
• e2fb0ae: chore: add rdimitrov as maintainer (#268) (@asraa)
• 3dfbeb2: chore(deps): bump actions/checkout from 2 to 3 (#253) (@dependabot[bot])
• 3f1f3d7: chore(deps): bump amannn/action-semantic-pull-request (#276) (@dependabot[bot])
• 520db05: chore(deps): bump github/codeql-action from 1 to 2 (#277) (@dependabot[bot])
• f42dfb3: chore: bump golangci-lint timeout (#280) (@znewman01)
• 0fa2537: chore(deps): bump actions/setup-python from 2.3.2 to 3.1.2 (#267) (@dependabot[bot])
• 57b9f1e: chore: remove GITHUB_TOKEN from arnested/go-version-action (#259) (@arnested)
• 5bbaae3: chore(deps): bump arnested/go-version-action from 1.0.65 to 1.0.67 (#281) (@dependabot[bot])
• 90f34f0: chore(deps): bump amannn/action-semantic-pull-request (#284) (@dependabot[bot])