Description of the patch:
This update for vexctl fixes the following issues:
- CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in
golang.org/x/crypto (bsc#1234486).
- CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2
(bsc#1239186).
- CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
(bsc#1239323).
- CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238683).
- CVE-2025-27144: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Go JOSE's Parsing Vulnerable to Denial of
Service (bsc#1237611).
- CVE-2025-30204: github.com/golang-jwt/jwt/v4: jwt-go allows excessive memory allocation during header parsing
(bsc#1240444).
- CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption
(bsc#1253802).
- CVE-2026-22772: github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to arbitrary
internal services (bsc#1256535).
- CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes with target
cache path traversal (bsc#1257138).
Changes for vexctl:
- Update to version 0.4.4+git20.5d61136:
- build(deps): Bump github.com/sigstore/cosign/v2
- build(deps): Bump actions/setup-go from 6.5.0 to 7.0.0
- build(deps): Bump the all group across 1 directory with 5 updates
- build(deps): Bump github.com/sigstore/rekor in the all group
- build(deps): Bump the all group with 4 updates
- build(deps): Bump github.com/google/go-containerregistry
- build(deps): Bump actions/setup-go from 6.4.0 to 6.5.0 in the all group
- build(deps): Bump the all group across 1 directory with 2 updates
- build(deps): Bump actions/checkout from 6.0.3 to 7.0.0
- build(deps): Bump chainguard-dev/actions in the all group