Repository: sigstore/fulcio
Pull request #1970 (2025-03-17 02:13:58)

Bump protocolbuffers/protobuf from 29.3 to 30.1
Bumps [protocolbuffers/protobuf](https://github.com/protocolbuffers/protobuf) from 29.3 to 30.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/protocolbuffers/protobuf/releases">protocolbuffers/protobuf's releases</a>.</em></p>
<blockquote>
<h2>Protocol Buffers v30.1</h2>
<h1>Announcements</h1>
<ul>
<li><a href="https://protobuf.dev/news/">Protobuf News</a> may include additional announcements or pre-announcements for upcoming changes.</li>
</ul>
<h1>Bazel</h1>
<ul>
<li>Loosen py_proto_library check to be on the import path instead of full directory (i.e. excluding external/module-name prefix). (<a href="https://redirect.github.com/protocolbuffers/protobuf/issues/20569">#20569</a>) (<a href="https://github.com/protocolbuffers/protobuf/commit/3576a1f8732c4a42df90e406e07326198182b6fb">https://github.com/protocolbuffers/protobuf/commit/3576a1f8732c4a42df90e406e07326198182b6fb</a>)</li>
</ul>
<h1>Compiler</h1>
<ul>
<li>Fix python codegen crash when C++ features are used. (<a href="https://redirect.github.com/protocolbuffers/protobuf/issues/20577">#20577</a>) (<a href="https://github.com/protocolbuffers/protobuf/commit/250c5502fa436e82fca50937db7d28f43855b09e">https://github.com/protocolbuffers/protobuf/commit/250c5502fa436e82fca50937db7d28f43855b09e</a>)</li>
</ul>
<h1>C++</h1>
<ul>
<li>Fix python codegen crash when C++ features are used. (<a href="https://redirect.github.com/protocolbuffers/protobuf/issues/20577">#20577</a>) (<a href="https://github.com/protocolbuffers/protobuf/commit/250c5502fa436e82fca50937db7d28f43855b09e">https://github.com/protocolbuffers/protobuf/commit/250c5502fa436e82fca50937db7d28f43855b09e</a>)</li>
</ul>
<h1>Java</h1>
<ul>
<li>Remove Java runtime classes from kotlin release. (<a href="https://redirect.github.com/protocolbuffers/protobuf/issues/20607">#20607</a>) (<a href="https://github.com/protocolbuffers/protobuf/commit/4747628cce300d58e3bb0da4f3ee7cbfa1ac853b">https://github.com/protocolbuffers/protobuf/commit/4747628cce300d58e3bb0da4f3ee7cbfa1ac853b</a>)</li>
</ul>
<h3>Kotlin</h3>
<ul>
<li>Remove Java runtime classes from kotlin release. (<a href="https://redirect.github.com/protocolbuffers/protobuf/issues/20607">#20607</a>) (<a href="https://github.com/protocolbuffers/protobuf/commit/4747628cce300d58e3bb0da4f3ee7cbfa1ac853b">https://github.com/protocolbuffers/protobuf/commit/4747628cce300d58e3bb0da4f3ee7cbfa1ac853b</a>)</li>
</ul>
<h1>Python</h1>
<ul>
<li>Fix python codegen crash when C++ features are used. (<a href="https://redirect.github.com/protocolbuffers/protobuf/issues/20577">#20577</a>) (<a href="https://github.com/protocolbuffers/protobuf/commit/250c5502fa436e82fca50937db7d28f43855b09e">https://github.com/protocolbuffers/protobuf/commit/250c5502fa436e82fca50937db7d28f43855b09e</a>)</li>
</ul>
<h1>Other</h1>
<ul>
<li>Re-add <code>system_python</code> repo alias to MODULE.bazel (<a href="https://redirect.github.com/protocolbuffers/protobuf/issues/20662">#20662</a>) (<a href="https://github.com/protocolbuffers/protobuf/commit/ebb5224493150126861ce2e192d7ae244bfea1df">https://github.com/protocolbuffers/protobuf/commit/ebb5224493150126861ce2e192d7ae244bfea1df</a>)</li>
</ul>
<h2>Protocol Buffers v30.0</h2>
<h1>Announcements</h1>
<ul>
<li><strong>This version includes breaking changes to: Objective-C, Python, C++.</strong>
<ul>
<li>[Objective-C] Remove legacy WKT headers. (<a href="https://github.com/protocolbuffers/protobuf/commit/d9caebc313256ea2f5c6922113c1f3edf14b24ad">https://github.com/protocolbuffers/protobuf/commit/d9caebc313256ea2f5c6922113c1f3edf14b24ad</a>)</li>
<li>[Objective-C] Remove deprecated apis. (<a href="https://github.com/protocolbuffers/protobuf/commit/2a52b900a1b71d57fc68624a989145f57abefdf1">https://github.com/protocolbuffers/protobuf/commit/2a52b900a1b71d57fc68624a989145f57abefdf1</a>)</li>
<li>[Objective-C] Remove support for older generated code. (<a href="https://github.com/protocolbuffers/protobuf/commit/cffa5902606ee3ebf23214b80251722b3654d5be">https://github.com/protocolbuffers/protobuf/commit/cffa5902606ee3ebf23214b80251722b3654d5be</a>)</li>
<li>[Objective-C] Remove GPBUnknownFieldSet. (<a href="https://github.com/protocolbuffers/protobuf/commit/2b93422f7eea500b26d1a9aaf7d07b3120f83d39">https://github.com/protocolbuffers/protobuf/commit/2b93422f7eea500b26d1a9aaf7d07b3120f83d39</a>)</li>
<li>[Python] Fix closed enum validation under editions (<a href="https://github.com/protocolbuffers/protobuf/commit/72b3eda2ec385863d7416f067f6cd0cefeed72bb">https://github.com/protocolbuffers/protobuf/commit/72b3eda2ec385863d7416f067f6cd0cefeed72bb</a>)</li>
<li>[Python] Remove deprecated GetDebugString() from protobuf python cpp extension. (<a href="https://github.com/protocolbuffers/protobuf/commit/721a45265b4e1d0f18d6775a0f1bafffdfc3088e">https://github.com/protocolbuffers/protobuf/commit/721a45265b4e1d0f18d6775a0f1bafffdfc3088e</a>)</li>
<li>[Python] Remove deprecated reflection methods (<a href="https://github.com/protocolbuffers/protobuf/commit/292f9646797d9e23fc66ba70fbda5903f2301ff0">https://github.com/protocolbuffers/protobuf/commit/292f9646797d9e23fc66ba70fbda5903f2301ff0</a>)</li>
<li>[Python] Remove deprecated GetPrototype MessageFactory.GetPrototype(), (<a href="https://github.com/protocolbuffers/protobuf/commit/c261b49a9575226efc9e5d269f6e5319a05d526e">https://github.com/protocolbuffers/protobuf/commit/c261b49a9575226efc9e5d269f6e5319a05d526e</a>)</li>
<li>[Python] Python nested message class <strong>qualname</strong> now contains the outer message name. (Previous <strong>qualname</strong> has the same result with <strong>name</strong> for nested message that outer message name was not included) (<a href="https://github.com/protocolbuffers/protobuf/commit/0720536eca20ca2f801127869d7f1211bceb3865">https://github.com/protocolbuffers/protobuf/commit/0720536eca20ca2f801127869d7f1211bceb3865</a>)</li>
<li>[Python] Remove deprecated Python RPC Service Interfaces (<a href="https://github.com/protocolbuffers/protobuf/commit/5ba74b11e8d2bd5e9b22e972beb572668bf6191c">https://github.com/protocolbuffers/protobuf/commit/5ba74b11e8d2bd5e9b22e972beb572668bf6191c</a>)</li>
<li>[Python] Python setdefault behavior change for map field. (<a href="https://github.com/protocolbuffers/protobuf/commit/81da6b999a8229942436f6c203a20633c65ebd26">https://github.com/protocolbuffers/protobuf/commit/81da6b999a8229942436f6c203a20633c65ebd26</a>)</li>
<li>[Python] Remove deprecated py_proto_library macro.</li>
<li>[C++] Prohibit using Bazel+MSVC to build protobuf (<a href="https://github.com/protocolbuffers/protobuf/commit/117e7bbe74ac7c7faa9b6f44c1b22de366302854">https://github.com/protocolbuffers/protobuf/commit/117e7bbe74ac7c7faa9b6f44c1b22de366302854</a>)</li>
<li>[C++] Remove deprecated Arena::CreateMessage. (<a href="https://github.com/protocolbuffers/protobuf/commit/d83a5365d16cff4be7da7d9a34eef14b24cc8733">https://github.com/protocolbuffers/protobuf/commit/d83a5365d16cff4be7da7d9a34eef14b24cc8733</a>)</li>
<li>[C++] Remove CMake submodule support in favor of fetched or installed dependencies. (<a href="https://github.com/protocolbuffers/protobuf/commit/3f06ca4306a682e6ee631d8ea94b82baaafb14f0">https://github.com/protocolbuffers/protobuf/commit/3f06ca4306a682e6ee631d8ea94b82baaafb14f0</a>)</li>
<li>[C++] Flip default behavior for handling cmake dependencies. (<a href="https://github.com/protocolbuffers/protobuf/commit/9cc685edf867acf5024a94502a3cbd7afa7a3daa">https://github.com/protocolbuffers/protobuf/commit/9cc685edf867acf5024a94502a3cbd7afa7a3daa</a>)</li>
<li>[C++] Add ASAN poisoning after clearing oneof messages on arena. (<a href="https://github.com/protocolbuffers/protobuf/commit/54d068e11c77ed387b97a60f435998b384e36e34">https://github.com/protocolbuffers/protobuf/commit/54d068e11c77ed387b97a60f435998b384e36e34</a>)</li>
<li>[C++] Upgrade return type of <code>type_name()</code> and <code>cpp_type_name()</code> from <code>const char*</code> to <code>absl::string_view</code>. (<a href="https://github.com/protocolbuffers/protobuf/commit/a9ad51f5b6a19eacc934bcb51db6282ec1fabb8c">https://github.com/protocolbuffers/protobuf/commit/a9ad51f5b6a19eacc934bcb51db6282ec1fabb8c</a>)</li>
<li>[C++] Remove deprecated RepeatedPtrField::ClearedCount(). (<a href="https://github.com/protocolbuffers/protobuf/commit/e8e3253f63f52d314af0e317d09642b9ceb1b40e">https://github.com/protocolbuffers/protobuf/commit/e8e3253f63f52d314af0e317d09642b9ceb1b40e</a>)</li>
<li>[C++] Upgrade return type of several string returning functions to <code>absl::string_view</code>. (<a href="https://github.com/protocolbuffers/protobuf/commit/d1990d968a54176eb9f4229abe7f7c97ece50cec">https://github.com/protocolbuffers/protobuf/commit/d1990d968a54176eb9f4229abe7f7c97ece50cec</a>)</li>
<li>[C++] Strip ctype from options in C++ (<a href="https://github.com/protocolbuffers/protobuf/commit/aebf8b9459f1da347a353c2fbbfe76230a457209">https://github.com/protocolbuffers/protobuf/commit/aebf8b9459f1da347a353c2fbbfe76230a457209</a>)</li>
<li>[C++] Remove <code>MutableRepeatedFieldRef::Reserve()</code> in reflection (<a href="https://github.com/protocolbuffers/protobuf/commit/913f7b0c6d3c3e9876aea913b0d83bbd7fffe22c">https://github.com/protocolbuffers/protobuf/commit/913f7b0c6d3c3e9876aea913b0d83bbd7fffe22c</a>)</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/protocolbuffers/protobuf/commit/0d815c5b74281f081c1ee4b431a4d5bbb1615c97"><code>0d815c5</code></a> Updating version.json and repo version numbers to: 30.1</li>
<li><a href="https://github.com/protocolbuffers/protobuf/commit/ebb5224493150126861ce2e192d7ae244bfea1df"><code>ebb5224</code></a> Re-add <code>system_python</code> repo alias to MODULE.bazel (<a href="https://redirect.github.com/protocolbuffers/protobuf/issues/20662">#20662</a>)</li>
<li><a href="https://github.com/protocolbuffers/protobuf/commit/4747628cce300d58e3bb0da4f3ee7cbfa1ac853b"><code>4747628</code></a> Remove Java runtime classes from kotlin release. (<a href="https://redirect.github.com/protocolbuffers/protobuf/issues/20607">#20607</a>)</li>
<li><a href="https://github.com/protocolbuffers/protobuf/commit/250c5502fa436e82fca50937db7d28f43855b09e"><code>250c550</code></a> Fix python codegen crash when C++ features are used. (<a href="https://redirect.github.com/protocolbuffers/protobuf/issues/20577">#20577</a>)</li>
<li><a href="https://github.com/protocolbuffers/protobuf/commit/3576a1f8732c4a42df90e406e07326198182b6fb"><code>3576a1f</code></a> Loosen py_proto_library check to be on the import path instead of full direct...</li>
<li><a href="https://github.com/protocolbuffers/protobuf/commit/efa65c59858cd83f348628a3c5cb350082f3199a"><code>efa65c5</code></a> Merge pull request <a href="https://redirect.github.com/protocolbuffers/protobuf/issues/20562">#20562</a> from protocolbuffers/30.x-202503042254</li>
<li><a href="https://github.com/protocolbuffers/protobuf/commit/63fc9d680507ceb41d4acbf17b138e4f6f85f86b"><code>63fc9d6</code></a> Updating version.json and repo version numbers to: 30.1-dev</li>
<li><a href="https://github.com/protocolbuffers/protobuf/commit/d295af5c3002c08e1bfd9d7f9e175d0a4d015f1e"><code>d295af5</code></a> Updating version.json and repo version numbers to: 30.0</li>
<li><a href="https://github.com/protocolbuffers/protobuf/commit/a5c906a6e70d9efbc82651e0ea88480545fb0105"><code>a5c906a</code></a> Split maven dependencies into dev vs local (<a href="https://redirect.github.com/protocolbuffers/protobuf/issues/20549">#20549</a>) (<a href="https://redirect.github.com/protocolbuffers/protobuf/issues/20558">#20558</a>)</li>
<li><a href="https://github.com/protocolbuffers/protobuf/commit/6059cb7bb921c7d8a84c0ada2dfa68f1fe7492bc"><code>6059cb7</code></a> Cherry-pick notices change for 30.x</li>
<li>Additional commits viewable in <a href="https://github.com/protocolbuffers/protobuf/compare/v29.3...v30.1">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=protocolbuffers/protobuf&package-manager=github_actions&previous-version=29.3&new-version=30.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index ac43eea..136183d 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -48,7 +48,7 @@ jobs:
     - name: Extract version of Go to use
       run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
 
-    - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+    - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
       with:
         go-version: ${{ env.GOVERSION }}
         check-latest: true
diff --git a/.github/workflows/container-build.yml b/.github/workflows/container-build.yml
index 83e79eb..fdca8d0 100644
--- a/.github/workflows/container-build.yml
+++ b/.github/workflows/container-build.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
 
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
           go-version: '${{ env.GOVERSION }}'
           check-latest: true
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 16b83e0..5724bb4 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -36,7 +36,7 @@ jobs:
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
 
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
           go-version: ${{ env.GOVERSION }}
           check-latest: true
@@ -44,7 +44,7 @@ jobs:
       - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
         name: Install protobuf
         with:
-          version: '29.3'
+          version: '30.1'
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build
diff --git a/.github/workflows/protoc-dependabot-hack.yml b/.github/workflows/protoc-dependabot-hack.yml
index 4726208..e3e3cc2 100644
--- a/.github/workflows/protoc-dependabot-hack.yml
+++ b/.github/workflows/protoc-dependabot-hack.yml
@@ -15,4 +15,4 @@ jobs:
     steps:
       # update the version in these places manually when Dependabot proposes a change to it here:
       # 1. the version in main.yml used to install protoc
-      - uses: protocolbuffers/protobuf@v29.3
+      - uses: protocolbuffers/protobuf@v30.1
diff --git a/.github/workflows/scorecard_action.yml b/.github/workflows/scorecard_action.yml
index f47e61d..85c91ee 100644
--- a/.github/workflows/scorecard_action.yml
+++ b/.github/workflows/scorecard_action.yml
@@ -44,7 +44,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: SARIF file
           path: results.sarif
diff --git a/.github/workflows/validate-release.yml b/.github/workflows/validate-release.yml
index 85b8cb4..13afa06 100644
--- a/.github/workflows/validate-release.yml
+++ b/.github/workflows/validate-release.yml
@@ -33,9 +33,9 @@ jobs:
     steps:
       - name: Check Signature
         run: |
-          cosign verify ghcr.io/gythialy/golang-cross:v1.24.0-0@sha256:5a528c7ccfb6db79769f79a09120141a6f251ba0660046dac2108bd14eedb82d \
+          cosign verify ghcr.io/gythialy/golang-cross:v1.24.1-0@sha256:dcc12fa4a35c7cda162cfbaa3f612b4209d5e2e78093e7c3fd7168d258432706 \
           --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-          --certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.24.0-0"
+          --certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.24.1-0"
         env:
           TUF_ROOT: /tmp
 
@@ -44,7 +44,7 @@ jobs:
     needs:
       - check-signature
     container:
-      image: ghcr.io/gythialy/golang-cross:v1.24.0-0@sha256:5a528c7ccfb6db79769f79a09120141a6f251ba0660046dac2108bd14eedb82d
+      image: ghcr.io/gythialy/golang-cross:v1.24.1-0@sha256:dcc12fa4a35c7cda162cfbaa3f612b4209d5e2e78093e7c3fd7168d258432706
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
diff --git a/.github/workflows/verify-k8s.yml b/.github/workflows/verify-k8s.yml
index 19fa7ee..ae930f9 100644
--- a/.github/workflows/verify-k8s.yml
+++ b/.github/workflows/verify-k8s.yml
@@ -32,7 +32,7 @@ jobs:
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
 
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
           go-version: '${{ env.GOVERSION }}'
           check-latest: true
@@ -76,7 +76,7 @@ jobs:
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
 
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
           go-version: '${{ env.GOVERSION }}'
           check-latest: true
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 079c37f..07e9068 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -36,7 +36,7 @@ jobs:
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
 
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
           go-version: '${{ env.GOVERSION }}'
           check-latest: true
@@ -64,13 +64,13 @@ jobs:
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
 
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
           go-version: '${{ env.GOVERSION }}'
           check-latest: true
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837 # v6.5.0
+        uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
         with:
           version: v1.64
 
@@ -85,7 +85,7 @@ jobs:
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
 
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
           go-version: '${{ env.GOVERSION }}'
           check-latest: true
diff --git a/Dockerfile b/Dockerfile
index a6d93f7..78e2491 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.24.1@sha256:c5adecdb7b3f8c5ca3c88648a861882849cc8b02fed68ece31e25de88ad13418 AS builder
+FROM golang:1.24.1@sha256:52ff1b35ff8de185bf9fd26c70077190cd0bed1e9f16a2d498ce907e5c421268 AS builder
 ENV APP_ROOT=/opt/app-root
 ENV GOPATH=$APP_ROOT
 
@@ -28,7 +28,7 @@ RUN go build -o server main.go
 RUN CGO_ENABLED=1 go build -gcflags "all=-N -l" -o server_debug main.go
 
 # Multi-Stage production build
-FROM golang:1.24.1@sha256:c5adecdb7b3f8c5ca3c88648a861882849cc8b02fed68ece31e25de88ad13418 AS deploy
+FROM golang:1.24.1@sha256:52ff1b35ff8de185bf9fd26c70077190cd0bed1e9f16a2d498ce907e5c421268 AS deploy
 
 # Retrieve the binary from the previous stage
 COPY --from=builder /opt/app-root/src/server /usr/local/bin/fulcio-server
diff --git a/Dockerfile.ctfe_init b/Dockerfile.ctfe_init
index 4bf6535..3409fe0 100644
--- a/Dockerfile.ctfe_init
+++ b/Dockerfile.ctfe_init
@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.24.1@sha256:c5adecdb7b3f8c5ca3c88648a861882849cc8b02fed68ece31e25de88ad13418 AS builder
+FROM golang:1.24.1@sha256:52ff1b35ff8de185bf9fd26c70077190cd0bed1e9f16a2d498ce907e5c421268 AS builder
 
 WORKDIR /root/
 
diff --git a/Dockerfile.dex-idp b/Dockerfile.dex-idp
index b383977..b594c23 100644
--- a/Dockerfile.dex-idp
+++ b/Dockerfile.dex-idp
@@ -13,6 +13,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM dexidp/dex:v2.30.0@sha256:63fc6ee14bcf1868ebfba90885aec76597e0f27bc8e89d1fd238b1f2ee3dea6e
+FROM dexidp/dex:v2.42.0@sha256:1b4a6eee8550240b0faedad04d984ca939513650e1d9bd423502c67355e3822f
 
 COPY ./config/dex /etc/config/
diff --git a/cmd/app/grpc.go b/cmd/app/grpc.go
index 4ec902f..3439db4 100644
--- a/cmd/app/grpc.go
+++ b/cmd/app/grpc.go
@@ -29,7 +29,6 @@ import (
 	"github.com/sigstore/sigstore/pkg/signature"
 
 	"github.com/fsnotify/fsnotify"
-	"github.com/goadesign/goa/grpc/middleware"
 	ctclient "github.com/google/certificate-transparency-go/client"
 	grpcmw "github.com/grpc-ecosystem/go-grpc-middleware"
 	grpc_zap "github.com/grpc-ecosystem/go-grpc-middleware/logging/zap"
@@ -44,6 +43,7 @@ import (
 	"github.com/sigstore/fulcio/pkg/log"
 	"github.com/sigstore/fulcio/pkg/server"
 	"github.com/spf13/viper"
+	"goa.design/goa/v3/grpc/middleware"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	health "google.golang.org/grpc/health/grpc_health_v1"
diff --git a/cmd/app/serve.go b/cmd/app/serve.go
index 0932e97..b2651cb 100644
--- a/cmd/app/serve.go
+++ b/cmd/app/serve.go
@@ -37,7 +37,6 @@ import (
 	"github.com/sigstore/sigstore/pkg/signature"
 
 	"chainguard.dev/go-grpc-kit/pkg/duplex"
-	"github.com/goadesign/goa/grpc/middleware"
 	ctclient "github.com/google/certificate-transparency-go/client"
 	"github.com/google/certificate-transparency-go/jsonclient"
 	grpcmw "github.com/grpc-ecosystem/go-grpc-middleware"
@@ -65,6 +64,7 @@ import (
 	"github.com/spf13/pflag"
 	"github.com/spf13/viper"
 	"go.uber.org/zap"
+	"goa.design/goa/v3/grpc/middleware"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/keepalive"
diff --git a/go.mod b/go.mod
index b5e8ec6..5b53d0f 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/sigstore/fulcio
 
 go 1.23.3
 
-toolchain go1.23.4
+toolchain go1.24.1
 
 require (
 	chainguard.dev/go-grpc-kit v0.17.7
@@ -14,13 +14,12 @@ require (
 	github.com/coreos/go-oidc/v3 v3.12.0
 	github.com/fsnotify/fsnotify v1.8.0
 	github.com/go-jose/go-jose/v4 v4.0.5
-	github.com/goadesign/goa v2.2.5+incompatible
 	github.com/google/certificate-transparency-go v1.3.1
 	github.com/google/go-cmp v0.7.0
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.1-0.20210315223345-82c243799c99
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.0
-	github.com/hashicorp/golang-lru v1.0.2
+	github.com/hashicorp/golang-lru/v2 v2.0.7
 	github.com/magiconair/properties v1.8.9
 	github.com/prometheus/client_golang v1.20.5
 	github.com/prometheus/client_model v0.6.1
@@ -42,6 +41,7 @@ require (
 	github.com/tink-crypto/tink-go/v2 v2.3.0
 	go.step.sm/crypto v0.57.0
 	go.uber.org/zap v1.27.0
+	goa.design/goa/v3 v3.20.0
 	google.golang.org/api v0.218.0
 	google.golang.org/genproto/googleapis/api v0.0.0-20250115164207-1a7da9e5054f
 	google.golang.org/grpc v1.70.0
@@ -95,7 +95,7 @@ require (
 	github.com/go-jose/go-jose/v3 v3.0.4 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/go-containerregistry v0.20.3 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
@@ -155,7 +155,6 @@ require (
 	go.opentelemetry.io/otel/trace v1.33.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	goa.design/goa v2.2.5+incompatible // indirect
 	golang.org/x/crypto v0.35.0 // indirect
 	golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
 	golang.org/x/net v0.36.0 // indirect
@@ -166,7 +165,7 @@ require (
 	golang.org/x/text v0.22.0 // indirect
 	golang.org/x/time v0.9.0 // indirect
 	google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250219182151-9fdb1cabc7b2 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 )
diff --git a/go.sum b/go.sum
index 7d54409..8a82aa3 100644
--- a/go.sum
+++ b/go.sum
@@ -140,12 +140,10 @@ github.com/go-rod/rod v0.116.2/go.mod h1:H+CMO9SCNc2TJ2WfrG+pKhITz57uGNYU43qYHh4
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/goadesign/goa v2.2.5+incompatible h1:SLgzk0V+QfFs7MVz9sbDHelbTDI9B/d4W7Hl5udTynY=
-github.com/goadesign/goa v2.2.5+incompatible/go.mod h1:d/9lpuZBK7HFi/7O0oXfwvdoIl+nx2bwKqctZe/lQao=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
-github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -198,8 +196,8 @@ github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
 github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
 github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
-github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
-github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hashicorp/vault/api v1.15.0 h1:O24FYQCWwhwKnF7CuSqP30S51rTV7vz1iACXE/pj5DA=
@@ -414,8 +412,8 @@ go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN8
 go.uber.org/zap v1.18.1/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
-goa.design/goa v2.2.5+incompatible h1:mjAtiy7ZdZIkj974hpFxCR6bL69qprfV00Veu3Vybts=
-goa.design/goa v2.2.5+incompatible/go.mod h1:NnzBwdNktihbNek+pPiFMQP9PPFsUt8MMPPyo9opDSo=
+goa.design/goa/v3 v3.20.0 h1:mYYNqCBg9SSxe2jxvPJFOPmJqqKkSAUSU84jpczky3s=
+goa.design/goa/v3 v3.20.0/go.mod h1:g8sT4ioTaRt8BZKwZ1YOQe7UgWqkZMx+q6NWgQfzLUU=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -522,8 +520,8 @@ google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 h1:ToEetK57OidYuqD
 google.golang.org/genproto v0.0.0-20241118233622-e639e219e697/go.mod h1:JJrvXBWRZaFMxBufik1a4RpFw4HhgVtBBWQeQgUj2cc=
 google.golang.org/genproto/googleapis/api v0.0.0-20250115164207-1a7da9e5054f h1:gap6+3Gk41EItBuyi4XX/bp4oqJ3UwuIMl25yGinuAA=
 google.golang.org/genproto/googleapis/api v0.0.0-20250115164207-1a7da9e5054f/go.mod h1:Ic02D47M+zbarjYYUlK57y316f2MoN0gjAwI3f2S95o=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f h1:OxYkA3wjPsZyBylwymxSHa7ViiW1Sml4ToBrncvFehI=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f/go.mod h1:+2Yz8+CLJbIfL9z73EW45avw8Lmge3xVElCP9zEKi50=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250219182151-9fdb1cabc7b2 h1:DMTIbak9GhdaSxEjvVzAeNZvyc03I61duqNbnm3SU0M=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250219182151-9fdb1cabc7b2/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I=
 google.golang.org/grpc v1.18.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
diff --git a/hack/tools/go.mod b/hack/tools/go.mod
index 19573a1..1308b87 100644
--- a/hack/tools/go.mod
+++ b/hack/tools/go.mod
@@ -1,7 +1,7 @@
 module github.com/sigstore/fulcio/hack/tools
 
 go 1.22.0
-toolchain go1.23.7
+toolchain go1.24.1
 
 require (
 	github.com/googleapis/api-linter v1.68.0
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 04b9346..3eda753 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -32,7 +32,7 @@ import (
 	"time"
 
 	"github.com/coreos/go-oidc/v3/oidc"
-	lru "github.com/hashicorp/golang-lru"
+	lru "github.com/hashicorp/golang-lru/v2"
 	"github.com/sigstore/fulcio/pkg/certificate"
 	fulciogrpc "github.com/sigstore/fulcio/pkg/generated/protobuf"
 	"github.com/sigstore/fulcio/pkg/log"
@@ -72,7 +72,7 @@ type FulcioConfig struct {
 	// verifiers is a fixed mapping from our OIDCIssuers to their OIDC verifiers.
 	verifiers map[string][]*verifierWithConfig
 	// lru is an LRU cache of recently used verifiers for our meta issuers.
-	lru *lru.TwoQueueCache
+	lru *lru.TwoQueueCache[string, []*verifierWithConfig]
 }
 
 type IssuerMetadata struct {
@@ -193,9 +193,8 @@ func (fc *FulcioConfig) GetVerifier(issuerURL string, opts ...InsecureOIDCConfig
 	}
 
 	// Look in the LRU cache for a verifier
-	untyped, ok := fc.lru.Get(issuerURL)
+	v, ok = fc.lru.Get(issuerURL)
 	if ok {
-		v := untyped.([]*verifierWithConfig)
 		for _, c := range v {
 			if reflect.DeepEqual(c.Config, cfg) {
 				return c.IDTokenVerifier, true
@@ -238,7 +237,7 @@ func (fc *FulcioConfig) GetVerifier(issuerURL string, opts ...InsecureOIDCConfig
 	}
 
 	vwf := &verifierWithConfig{provider.Verifier(cfg), cfg}
-	if untyped == nil {
+	if v == nil {
 		v = []*verifierWithConfig{vwf}
 	} else {
 		v = append(v, vwf)
@@ -327,7 +326,7 @@ func (fc *FulcioConfig) prepare() error {
 		}
 	}
 
-	cache, err := lru.New2Q(100 /* size */)
+	cache, err := lru.New2Q[string, []*verifierWithConfig](100 /* size */)
 	if err != nil {
 		return fmt.Errorf("lru: %w", err)
 	}
diff --git a/pkg/generated/protobuf/fulcio.pb.go b/pkg/generated/protobuf/fulcio.pb.go
index e76ed4c..8c80783 100644
--- a/pkg/generated/protobuf/fulcio.pb.go
+++ b/pkg/generated/protobuf/fulcio.pb.go
@@ -16,7 +16,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.3
-// 	protoc        v5.29.3
+// 	protoc        v6.30.1
 // source: fulcio.proto
 
 package protobuf
diff --git a/pkg/generated/protobuf/fulcio_grpc.pb.go b/pkg/generated/protobuf/fulcio_grpc.pb.go
index 778df82..5652116 100644
--- a/pkg/generated/protobuf/fulcio_grpc.pb.go
+++ b/pkg/generated/protobuf/fulcio_grpc.pb.go
@@ -16,7 +16,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.5.1
-// - protoc             v5.29.3
+// - protoc             v6.30.1
 // source: fulcio.proto
 
 package protobuf
diff --git a/pkg/generated/protobuf/legacy/fulcio_legacy.pb.go b/pkg/generated/protobuf/legacy/fulcio_legacy.pb.go
index d9ab6d1..03816f3 100644
--- a/pkg/generated/protobuf/legacy/fulcio_legacy.pb.go
+++ b/pkg/generated/protobuf/legacy/fulcio_legacy.pb.go
@@ -16,7 +16,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.3
-// 	protoc        v5.29.3
+// 	protoc        v6.30.1
 // source: fulcio_legacy.proto
 
 package legacy
diff --git a/pkg/generated/protobuf/legacy/fulcio_legacy_grpc.pb.go b/pkg/generated/protobuf/legacy/fulcio_legacy_grpc.pb.go
index 106856e..1bdb8bd 100644
--- a/pkg/generated/protobuf/legacy/fulcio_legacy_grpc.pb.go
+++ b/pkg/generated/protobuf/legacy/fulcio_legacy_grpc.pb.go
@@ -16,7 +16,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.5.1
-// - protoc             v5.29.3
+// - protoc             v6.30.1
 // source: fulcio_legacy.proto
 
 package legacy
diff --git a/pkg/log/log.go b/pkg/log/log.go
index aa91558..baaa8b2 100644
--- a/pkg/log/log.go
+++ b/pkg/log/log.go
@@ -19,11 +19,11 @@ import (
 	"context"
 	"log"
 
-	"github.com/goadesign/goa/grpc/middleware"
 	grpc_zap "github.com/grpc-ecosystem/go-grpc-middleware/logging/zap"
 	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
 	"go.uber.org/zap"
 	"go.uber.org/zap/zapcore"
+	"goa.design/goa/v3/grpc/middleware"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
 )
diff --git a/pkg/server/error.go b/pkg/server/error.go
index 14b2821..36f6709 100644
--- a/pkg/server/error.go
+++ b/pkg/server/error.go
@@ -31,9 +31,9 @@ const (
 	failedToMarshalSCT     = "Error marshaling signed certificate timestamp"
 	failedToMarshalCert    = "Error marshaling code signing certificate"
 	insecurePublicKey      = "The public key supplied in the request is insecure"
-	//nolint
-	invalidCredentials = "There was an error processing the credentials for this request"
-	// nolint
+	// nolint:gosec // false positive G101
+	invalidCredentials = "There was an error processing the credentials for this request" //lint:ignore U1000 Used in past
+	// nolint:gosec // false positive G101
 	invalidIdentityToken                    = "There was an error processing the identity token"
 	genericCAError                          = "error communicating with CA backend"
 	retrieveTrustBundleCAError              = "error retrieving trust bundle from CA backend"
diff --git a/pkg/server/grpc_server.go b/pkg/server/grpc_server.go
index 3976d0e..fe304f5 100644
--- a/pkg/server/grpc_server.go
+++ b/pkg/server/grpc_server.go
@@ -163,7 +163,7 @@ func (g *grpcaCAServer) CreateSigningCertificate(ctx context.Context, request *f
 		return nil, handleFulcioGRPCError(ctx, codes.InvalidArgument, err, err.Error())
 	}
 	if !isPermitted {
-		err = fmt.Errorf("Signing algorithm not permitted: %T, %s", publicKey, hashFunc)
+		err = fmt.Errorf("signing algorithm not permitted: %T, %s", publicKey, hashFunc)
 		return nil, handleFulcioGRPCError(ctx, codes.InvalidArgument, err, err.Error())
 	}
 
@@ -179,7 +179,7 @@ func (g *grpcaCAServer) CreateSigningCertificate(ctx context.Context, request *f
 			if _, ok := err.(certauth.ValidationError); ok {
 				return nil, handleFulcioGRPCError(ctx, codes.InvalidArgument, err, err.Error())
 			}
-			err = fmt.Errorf("Error creating certificate: %w", err)
+			err = fmt.Errorf("error creating certificate: %w", err)
 			// otherwise return a 500 error to reflect that it is a transient server issue that the client can't resolve
 			return nil, handleFulcioGRPCError(ctx, codes.Internal, err, genericCAError)
 		}
@@ -230,7 +230,7 @@ func (g *grpcaCAServer) CreateSigningCertificate(ctx context.Context, request *f
 			if _, ok := err.(certauth.ValidationError); ok {
 				return nil, handleFulcioGRPCError(ctx, codes.InvalidArgument, err, err.Error())
 			}
-			err = fmt.Errorf("Error creating a pre-certificate and chain: %w", err)
+			err = fmt.Errorf("error creating a pre-certificate and chain: %w", err)
 			// otherwise return a 500 error to reflect that it is a transient server issue that the client can't resolve
 			return nil, handleFulcioGRPCError(ctx, codes.Internal, err, genericCAError)
 		}
@@ -241,7 +241,7 @@ func (g *grpcaCAServer) CreateSigningCertificate(ctx context.Context, request *f
 		}
 		csc, err = sctCa.IssueFinalCertificate(ctx, precert, sct)
 		if err != nil {
-			err = fmt.Errorf("Error issuing final certificate using the pre-certificate with CA backend: %w", err)
+			err = fmt.Errorf("error issuing final certificate using the pre-certificate with CA backend: %w", err)
 			return nil, handleFulcioGRPCError(ctx, codes.Internal, err, genericCAError)
 		}
 
diff --git a/release/cloudbuild.yaml b/release/cloudbuild.yaml
index ce481ca..d4c17c0 100644
--- a/release/cloudbuild.yaml
+++ b/release/cloudbuild.yaml
@@ -38,13 +38,13 @@ steps:
       - TUF_ROOT=/tmp
     args:
       - 'verify'
-      - 'ghcr.io/gythialy/golang-cross:v1.24.0-0@sha256:5a528c7ccfb6db79769f79a09120141a6f251ba0660046dac2108bd14eedb82d'
+      - 'ghcr.io/gythialy/golang-cross:v1.24.1-0@sha256:dcc12fa4a35c7cda162cfbaa3f612b4209d5e2e78093e7c3fd7168d258432706'
       - '--certificate-oidc-issuer'
       - "https://token.actions.githubusercontent.com"
       - '--certificate-identity'
-      - "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.23.6-0"
+      - "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.24.1-0"
 
-  - name: ghcr.io/gythialy/golang-cross:v1.24.0-0@sha256:5a528c7ccfb6db79769f79a09120141a6f251ba0660046dac2108bd14eedb82d
+  - name: ghcr.io/gythialy/golang-cross:v1.24.1-0@sha256:dcc12fa4a35c7cda162cfbaa3f612b4209d5e2e78093e7c3fd7168d258432706
     entrypoint: /bin/sh
     dir: "go/src/sigstore/fulcio"
     env:
@@ -67,7 +67,7 @@ steps:
         gcloud auth configure-docker \
         && make release
 
-  - name: ghcr.io/gythialy/golang-cross:v1.24.0-0@sha256:5a528c7ccfb6db79769f79a09120141a6f251ba0660046dac2108bd14eedb82d
+  - name: ghcr.io/gythialy/golang-cross:v1.24.1-0@sha256:dcc12fa4a35c7cda162cfbaa3f612b4209d5e2e78093e7c3fd7168d258432706
     entrypoint: 'bash'
     dir: "go/src/sigstore/fulcio"
     env:


Test patch:
diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go
index 7728216..067a4cf 100644
--- a/pkg/config/config_test.go
+++ b/pkg/config/config_test.go
@@ -36,7 +36,7 @@ import (
 	"time"
 
 	"github.com/coreos/go-oidc/v3/oidc"
-	lru "github.com/hashicorp/golang-lru"
+	lru "github.com/hashicorp/golang-lru/v2"
 	"github.com/sigstore/fulcio/pkg/generated/protobuf"
 )
 
@@ -649,7 +649,7 @@ func TestToIssuers(t *testing.T) {
 }
 
 func TestVerifierCache(t *testing.T) {
-	cache, err := lru.New2Q(100 /* size */)
+	cache, err := lru.New2Q[string, []*verifierWithConfig](100 /* size */)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -815,7 +815,7 @@ func TestVerifierCacheWithCustomCA(t *testing.T) {
 	server.StartTLS()
 	defer server.Close()
 
-	cache, err := lru.New2Q(100)
+	cache, err := lru.New2Q[string, []*verifierWithConfig](100)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/pkg/server/grpc_server_test.go b/pkg/server/grpc_server_test.go
index 8159486..7e9abe1 100644
--- a/pkg/server/grpc_server_test.go
+++ b/pkg/server/grpc_server_test.go
@@ -2555,7 +2555,7 @@ func TestAPIWithInvalidCSRPublicKey(t *testing.T) {
 			CertificateSigningRequest: pemCSR,
 		},
 	})
-	if err == nil || !strings.Contains(err.Error(), "Signing algorithm not permitted") {
+	if err == nil || !strings.Contains(err.Error(), "signing algorithm not permitted") {
 		t.Fatalf("expected signing algorithm not permitted, got %v", err)
 	}
 	if status.Code(err) != codes.InvalidArgument {
diff --git a/test/prometheus/main.go b/test/prometheus/main.go
index 22864cc..edaa47e 100644
--- a/test/prometheus/main.go
+++ b/test/prometheus/main.go
@@ -73,7 +73,7 @@ func main() {
 // Make sure latency is a Histogram, and it has a POST with a 201.
 func checkLatency(latency *dto.MetricFamily) error {
 	if *latency.Type != *dto.MetricType_HISTOGRAM.Enum() {
-		return fmt.Errorf("Wrong type, wanted %+v, got: %+v", dto.MetricType_HISTOGRAM.Enum(), latency.Type)
+		return fmt.Errorf("wrong type, wanted %+v, got: %+v", dto.MetricType_HISTOGRAM.Enum(), latency.Type)
 	}
 
 	for _, metric := range latency.Metric {
@@ -89,24 +89,24 @@ func checkLatency(latency *dto.MetricFamily) error {
 		}
 		if code == "201" && method == "post" {
 			if *metric.Histogram.SampleCount != 1 {
-				return fmt.Errorf("Unexpected samplecount, wanted 1, got %d", *metric.Histogram.SampleCount)
+				return fmt.Errorf("unexpected samplecount, wanted 1, got %d", *metric.Histogram.SampleCount)
 			}
 			return nil
 		}
 	}
 
-	return fmt.Errorf("Got multiple entries, or none for metric, wanted one, got: %+v", latency.Metric)
+	return fmt.Errorf("got multiple entries, or none for metric, wanted one, got: %+v", latency.Metric)
 }
 
 func checkCertCount(certCount *dto.MetricFamily) error {
 	if *certCount.Type != *dto.MetricType_COUNTER.Enum() {
-		return fmt.Errorf("Wrong type, wanted %+v, got: %+v", dto.MetricType_COUNTER.Enum(), certCount.Type)
+		return fmt.Errorf("wrong type, wanted %+v, got: %+v", dto.MetricType_COUNTER.Enum(), certCount.Type)
 	}
 	if len(certCount.Metric) != 1 {
-		return fmt.Errorf("Got multiple entries, or none for metric, wanted one, got: %+v", certCount.Metric)
+		return fmt.Errorf("got multiple entries, or none for metric, wanted one, got: %+v", certCount.Metric)
 	}
 	if *certCount.Metric[0].Counter.Value < 1 {
-		return fmt.Errorf("Got incorrect cert count, wanted one, got: %f", *certCount.Metric[0].Counter.Value)
+		return fmt.Errorf("got incorrect cert count, wanted one, got: %f", *certCount.Metric[0].Counter.Value)
 	}
 	return nil
 }