Update module github.com/in-toto/in-toto-golang to v0.11.0 [SECURITY] (release-v0.8)

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/in-toto/in-toto-golang	v0.10.0 → v0.11.0

---

in-toto-golang and in-toto-python have inconsistent negation behavior

GHSA-pmwq-pjrm-6p5r

More information

Details

Impact

What kind of vulnerability is it? Who is impacted?

in-toto-golang and in-toto-python both support glob patterns in artifact rules to indicate the artifacts that a rule applies to. Both support negations in character classes to indicate what should not be matched, but they used different operators to indicate the negation. in-toto-python uses ! while in-toto-golang used ^. A layout authored with the expectations of one implementation can therefore exhibit different behavior in the other implementation.

This impacts users in a specific set of circumstances where two different implementations are used to verify the same layout + attestation bundle at different stages of the same pipeline. As a rule of thumb, we advise using a single implementation across all aspects of a pipeline, from layout creation to pipeline execution and verification to prevent this class of bugs.

Patches

Has the problem been patched? What versions should users upgrade to?

in-toto-golang has been updated to use ! instead of ^ to indicate negation. See https://github.com/in-toto/in-toto-golang/pull/462. This is part of v0.11.0.

Severity

• CVSS Score: 4.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/in-toto/in-toto-golang/security/advisories/GHSA-pmwq-pjrm-6p5r
• https://github.com/in-toto/in-toto-golang/pull/462
• https://github.com/in-toto/in-toto-golang/commit/36d782ffb2ca3adbffcdce1fd971c23319dd4469
• https://github.com/advisories/GHSA-pmwq-pjrm-6p5r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

in-toto/in-toto-golang (github.com/in-toto/in-toto-golang)

v0.11.0

Compare Source

What's Changed

• chore(deps): bump the all group with 2 updates by @​dependabot[bot] in #​453
• chore(deps): bump the all group across 1 directory with 2 updates by @​dependabot[bot] in #​452
• chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 by @​dependabot[bot] in #​457
• chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @​dependabot[bot] in #​459
• match: Replace ^ with ! for negation in character classes by @​adityasaky in #​462

Full Changelog: in-toto/in-toto-golang@v0.10.0...v0.11.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:04 AM UTC · Completed 11:10 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Looks good to me

---

Labels: Dependency version bump (go.mod/go.sum) addressing security advisory GHSA-pmwq-pjrm-6p5r

Previous run

Looks good to me

Previous run (2)

Looks good to me

Previous run (3)

Review

Verdict: Approve

This is a clean, well-scoped Renovate bot dependency bump of github.com/in-toto/in-toto-golang from v0.10.0 to v0.11.0, addressing security advisory GHSA-pmwq-pjrm-6p5r (CVSS 4.1, Medium). The fix changes glob pattern character class negation from ^ to ! for consistency with in-toto-python.

Analysis

• Correctness: The codebase uses in-toto-golang exclusively for attestation data types (Statement, Subject, ProvenanceStatement, SLSA provenance types) and string constants. No code in this repository imports or calls the match package where the behavioral change occurred. The upgrade is safe — no API-breaking changes between v0.10.0 and v0.11.0.
• Security: Diff contains only go.mod/go.sum version and hash changes. No secrets, credentials, permission changes, or injection patterns. The go.sum hashes are protected by Go's checksum database.
• Scope: Mechanical dependency bump by Renovate bot. Appropriately scoped to the security fix.
• Consistency: Both root go.mod and acceptance/go.mod are updated consistently.

Note

tools/go.mod still pins in-toto-golang at v0.10.0 as an indirect dependency (line 334). While the security-relevant match package is not exercised through any code path in this repository, updating tools/go.mod to v0.11.0 would keep all three Go modules consistent and fully remediate the advisory.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.86% <ø> (ø)
generative	18.14% <ø> (ø)
integration	26.99% <ø> (ø)
unit	68.66% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:17 AM UTC · Completed 1:24 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:19 PM UTC · Completed 1:27 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:49 PM UTC · Completed 7:56 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 11:45 AM UTC · Completed 12:03 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

Retro: PR #3296 — Renovate dependency bump of in-toto-golang v0.10.0 → v0.11.0 [SECURITY]

Workflow outcome: Correct. The review agent correctly classified this as a safe, mechanical dependency bump across all 4 review cycles and approved each time. The human reviewer (dheerajodha) approved and merged after 85 days.

Review quality: Good. The agent's most detailed review (run 3, SHA 78e9d1f) correctly identified that the codebase only uses in-toto-golang for attestation data types and does not import the match package where the behavioral change occurred. It also flagged that tools/go.mod still pins in-toto-golang at v0.10.0 — a useful observation that wasn't acted on (follow-up issue creation was disabled at the time).

Inefficiencies observed

1. 4 redundant review cycles (~$5.50 total): Each Renovate rebase triggered a full review run at ~$1.30–$1.47 per run. All four reached the same APPROVE verdict on effectively the same 6-line diff. Existing issues cover this: fullsend-ai/fullsend #4596, #4652, #1287, #963; fullsend-ai/agents #108.

2. 85-day time-to-merge for an XS security patch: The review agent first approved on July 12 (day 62). The PR sat with ready-for-merge for another 23 days before human merge on August 4. Existing issues: fullsend-ai/fullsend #966 (surface agent-approved PRs awaiting human review), #691 (enable Renovate auto-merge with agent approval); conforma/cli #3420 (skip fullsend dispatch for bot dependency PRs).

3. Systemic scale on this repo: This is not a one-off. There are currently 18 open Renovate PRs on conforma/cli with ~280+ cumulative bot reviews. Six PRs have hit 30 reviews each. PRs Update go modules (main) (patch) #3130, Update go modules (main) (minor) #3131, Update go modules (release-v0.7) (patch) #3146, Update go modules (release-v0.7) (minor) #3157 have been open 158+ days. This provides strong evidence for existing issues: fullsend-ai/fullsend #4825, #4975, #5067 (skip/fast-track agent dispatch for bot PRs); fullsend-ai/fullsend #2599 (per-PR review budget cap).

4. Sub-agent model failure: The style-conventions sub-agent failed due to sonnet model unavailability (treated as info-level, non-blocking). Existing issues: fullsend-ai/fullsend #1771 (model fallback), #1795 (qualify verdict on sub-agent failure); fullsend-ai/agents #379.

5. Autonomy readiness: The review agent matched or exceeded human review quality on this PR. The human approval had no comments and was consistent with the agent's prior APPROVE verdict. This adds evidence to fullsend-ai/fullsend #4882 (autonomy readiness tracking for conforma/cli Go dependency PRs).

No new proposals filed

All identified improvement areas are extensively covered by existing open issues across fullsend-ai/fullsend, fullsend-ai/agents, and conforma/cli. Filing new proposals would create duplicates. The conforma/cli repo is a particularly strong evidence case for prioritizing the redundant-review and bot-PR-skip issues given the scale of waste (280+ redundant reviews across 18 open PRs).