fix(deps): BDSA-2026-1849 cosign transient dependency pinning

matthiasbruns · matthiasbruns · commit f39a13253cd6 · 2026-03-10T09:28:11.000+01:00
On-behalf-of: SAP &lt;matthias.bruns@sap.com&gt;
Signed-off-by: Matthias Bruns &lt;git@matthiasbruns.com&gt;
diff --git a/go.mod b/go.mod
@@ -93,6 +93,9 @@ require (
 	sigs.k8s.io/yaml v1.6.0
 )
 
+// until cosign pushes a release, we need to override its transient dependency on mongo-driver v1.17.6
+replace go.mongodb.org/mongo-driver => go.mongodb.org/mongo-driver v1.17.9 // BDSA-2026-1849
+
 require (
 	4d63.com/gocheckcompilerdirectives v1.3.0 // indirect
 	4d63.com/gochecknoglobals v0.2.2 // indirect

Original file line number	Diff line number	Diff line change
`@@ -93,6 +93,9 @@ require (`
`93`	`93`	`sigs.k8s.io/yaml v1.6.0`
`94`	`94`	`)`
`95`	`95`
	`96`	`+// until cosign pushes a release, we need to override its transient dependency on mongo-driver v1.17.6`
	`97`	`+replace go.mongodb.org/mongo-driver => go.mongodb.org/mongo-driver v1.17.9 // BDSA-2026-1849`
	`98`	`+`
`96`	`99`	`require (`
`97`	`100`	`4d63.com/gocheckcompilerdirectives v1.3.0 // indirect`
`98`	`101`	`4d63.com/gochecknoglobals v0.2.2 // indirect`