Merge branch main into fix-issue-8540

Author: aarongable

.github/dependabot.yml

@@ -31,6 +31,10 @@ updates:
     open-pull-requests-limit: 1
     cooldown:
       default-days: 7
+    groups:
+      docker-compose:
+        patterns:
+          - "*"
     allow:
       - dependency-name: "ghcr.io/pkimetal/pkimetal"
       - dependency-name: "jaegertracing/all-in-one"

.github/workflows/codeql.yml

@@ -22,8 +22,8 @@ jobs:
         with:
           persist-credentials: false
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
       - name: Autobuild
-        uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

ca/ca_test.go

@@ -124,7 +124,7 @@ func newCAArgs(t *testing.T) *caArgs {
 	features.Reset()
 
 	fc := clock.NewFake()
-	fc.Add(1 * time.Hour)
+	fc.Set(time.Date(2020, 01, 01, 12, 00, 00, 0, time.UTC))
 
 	pa, err := policy.New(map[identifier.IdentifierType]bool{"dns": true}, nil, blog.NewMock())
 	test.AssertNotError(t, err, "Couldn't create PA")
@@ -134,7 +134,11 @@ func newCAArgs(t *testing.T) *caArgs {
 	legacy, err := issuance.NewProfile(issuance.ProfileConfig{
 		MaxValidityPeriod:   config.Duration{Duration: time.Hour * 24 * 90},
 		MaxValidityBackdate: config.Duration{Duration: time.Hour},
-		IgnoredLints:        []string{"w_subject_common_name_included"},
+		IgnoredLints: []string{
+			"e_sub_cert_aia_does_not_contain_ocsp_url",
+			"w_ct_sct_policy_count_unsatisfied",
+			"n_subject_common_name_included",
+		},
 	})
 	test.AssertNotError(t, err, "Loading test profile")
 	modern, err := issuance.NewProfile(issuance.ProfileConfig{
@@ -144,7 +148,11 @@ func newCAArgs(t *testing.T) *caArgs {
 		OmitSKID:            true,
 		MaxValidityPeriod:   config.Duration{Duration: time.Hour * 24 * 6},
 		MaxValidityBackdate: config.Duration{Duration: time.Hour},
-		IgnoredLints:        []string{"w_ext_subject_key_identifier_missing_sub_cert"},
+		IgnoredLints: []string{
+			"e_sub_cert_aia_does_not_contain_ocsp_url",
+			"w_ct_sct_policy_count_unsatisfied",
+			"w_ext_subject_key_identifier_missing_sub_cert",
+		},
 	})
 	test.AssertNotError(t, err, "Loading test profile")
 	profiles := map[string]*issuance.Profile{

cmd/cert-checker/main_test.go

@@ -594,6 +594,7 @@ func TestIgnoredLint(t *testing.T) {
 	template.DNSNames = []string{"zombo.com"}
 	template.KeyUsage = x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment
 	template.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth}
+	template.CRLDistributionPoints = []string{"http://crl.example.org"}
 	template.IsCA = false
 
 	subjectCertDer, err := x509.CreateCertificate(nil, template, issuerCert, testKey.Public(), testKey)

go.mod

@@ -27,9 +27,9 @@ require (
 	github.com/redis/go-redis/extra/redisotel/v9 v9.5.3
 	github.com/redis/go-redis/v9 v9.10.0
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399
-	github.com/weppos/publicsuffix-go v0.50.3
-	github.com/zmap/zcrypto v0.0.0-20250129210703-03c45d0bae98
-	github.com/zmap/zlint/v3 v3.6.6
+	github.com/weppos/publicsuffix-go v0.50.4-0.20260507075217-1bd47f85b3da
+	github.com/zmap/zcrypto v0.0.0-20260514033604-a1159eb3cad9
+	github.com/zmap/zlint/v3 v3.7.2-0.20260531191521-b88ecfaefc52
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0
 	go.opentelemetry.io/otel v1.43.0