build(deps): bump the dependencies group across 1 directory with 4 updates

[dependabot]

Updates the requirements on cryptography, sigstore, boto3 and botocore to permit the latest version.
Updates cryptography from 46.0.2 to 46.0.3

Changelog

Sourced from cryptography's changelog.

46.0.3 - 2025-10-15

* Fixed compilation when using LibreSSL 4.2.0.
.. _v46-0-2:

Commits

• c0af4dd release 46.0.3 (#13681)
• See full diff in compare view

Updates sigstore from 3.6.6 to 4.1.0

Release notes

Sourced from sigstore's releases.

v4.1.0

Added

• cli: Support using other Sigstore instances with --instance URL. New instances are trusted with new top level command trust-instance ROOTFILE. #1548

Changed

• Added cryptography 46 to list of compatible cryptography releases (#1544)
• Improved error message when verifying bundles with unsupported log entry versions (#1569)

Fixed

• cli: Always read/write UTF-8. This fixes an issue on Windows where the platform default encoding was used: the issue has existed for a while, but became more visible with signature bundles that contain rekor2 entries. #1553

v4.0.0

This is a major release with a host of API and functionality changes. The major new feature is Rekor v2 support but many other changes are also included, see list below.

Added

• cli: Add --rekor-version to sign command arguments: This can be useful if Sigstore instance provides multiple Rekor versions and user wants to override the default choice #1471
• cli: Support parallel signing. When multiple artifacts are signed, the Rekor requests are submitted in parallel: this is especially useful with Rekor v2. #1468, #1478, #1485
• oidc (API): Allow custom audience claims via API #1402
• rekor (API): Support Rekor v2 (aka rekor-tiles) in both verification and signing. #1370, #1422, #1432
• trust (API): Make TrustedRoot, SigningConfig and ClientTrustConfig public API #1496

Changed

• cli: Improve verify UX when wrong instance is used #1510
• deps: replace sigstore_protobuf_specs dependency with sigstore-models #1470

... (truncated)

Changelog

Sourced from sigstore's changelog.

[4.1.0]

Added

• cli: Support using other Sigstore instances with --instance URL. New instances are trusted with new top level command trust-instance ROOTFILE. #1548

Changed

• Added cryptography 46 to list of compatible cryptography releases (#1544)
• Improved error message when verifying bundles with unsupported log entry versions (#1569)

Fixed

• cli: Always read/write UTF-8. This fixes an issue on Windows where the platform default encoding was used: the issue has existed for a while, but became more visible with signature bundles that contain rekor2 entries. #1553

[4.0.0]

This is a major release with a host of API and functionality changes. The major new feature is Rekor v2 support but many other changes are also included, see list below.

Added

• cli: Add --rekor-version to sign command arguments: This can be useful if Sigstore instance provides multiple Rekor versions and user wants to override the default choice #1471
• cli: Support parallel signing. When multiple artifacts are signed, the Rekor requests are submitted in parallel: this is especially useful with Rekor v2. #1468, #1478, #1485
• oidc (API): Allow custom audience claims via API #1402
• rekor (API): Support Rekor v2 (aka rekor-tiles) in both verification and signing. #1370, #1422, #1432
• trust (API): Make TrustedRoot, SigningConfig and ClientTrustConfig public API #1496

Changed

• cli: Improve verify UX when wrong instance is used #1510
• deps: replace sigstore_protobuf_specs dependency with sigstore-models

... (truncated)

Commits

• 3447f96 Forward port entry kindversion error improvement, bump version to 4.1.0 (#1569)
• 2dbe03a build(deps): bump github/codeql-action in the actions group (#1572)
• 02daa69 build(deps): bump rich from 14.1.0 to 14.2.0 (#1571)
• 1615939 build(deps): bump the actions group with 2 updates (#1568)
• 72b6581 build(deps): update ruff requirement from <0.13.4 to <0.14.1 (#1567)
• 64dbeba cli: Support using other Sigstore instances (#1548)
• 508b0e7 build(deps): bump softprops/action-gh-release in the actions group (#1563)
• e31f481 build(deps): update ruff requirement from <0.13.3 to <0.13.4 (#1562)
• dec897b build(deps): bump github/codeql-action in the actions group (#1561)
• 0a54b4f build(deps): bump cryptography from 46.0.1 to 46.0.2 (#1558)
• Additional commits viewable in compare view

Updates boto3 to 1.40.55

Commits

• eb5f827 Merge branch 'release-1.40.55'
• 52a3496 Bumping version to 1.40.55
• 0c90e25 Add changelog entries from botocore
• 2f92c15 Merge branch 'release-1.40.54'
• eaf0158 Merge branch 'release-1.40.54' into develop
• 574a0d4 Bumping version to 1.40.54
• 1ada209 Add changelog entries from botocore
• 9a9288a Merge branch 'release-1.40.53'
• 7d581c3 Merge branch 'release-1.40.53' into develop
• 312bc51 Bumping version to 1.40.53
• Additional commits viewable in compare view

Updates botocore to 1.40.55

Commits

• 9bc6c28 Merge branch 'release-1.40.55'
• 6339a67 Bumping version to 1.40.55
• b636f85 Update endpoints model
• 8426d19 Update to latest models
• 03982ad Merge branch 'release-1.40.54'
• 229850c Merge branch 'release-1.40.54' into develop
• 9a242ce Bumping version to 1.40.54
• be422f1 Update to latest models
• a0f9cb4 Merge branch 'release-1.40.53'
• eea6862 Merge branch 'release-1.40.53' into develop
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
sigstore	[>= 4.0.dev0, < 4.1]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[jku]

blocked by #1035

[dependabot]

Superseded by #1039.