From 87726831825f9c2920f10a1d18715e235c8e298b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 21:17:34 +0000
Subject: [PATCH] Bump sigstore from 4.0.0 to 4.2.0

Bumps [sigstore](https://github.com/sigstore/sigstore-python) from 4.0.0 to 4.2.0.
- [Release notes](https://github.com/sigstore/sigstore-python/releases)
- [Changelog](https://github.com/sigstore/sigstore-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sigstore/sigstore-python/compare/v4.0.0...v4.2.0)

---
updated-dependencies:
- dependency-name: sigstore
  dependency-version: 4.2.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 mypy-requirements.txt | 2 +-
 requirements.in       | 2 +-
 requirements.txt      | 8 ++++----
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/mypy-requirements.txt b/mypy-requirements.txt
index 78c8a5f3..3596f497 100644
--- a/mypy-requirements.txt
+++ b/mypy-requirements.txt
@@ -5,6 +5,6 @@ pyfakefs
 pytest
 pytest-mock
 python-gnupg  # untyped :(
-sigstore==4.0.0
+sigstore==4.2.0
 types-paramiko
 types-requests
diff --git a/requirements.in b/requirements.in
index 7a519a75..43fddcbc 100644
--- a/requirements.in
+++ b/requirements.in
@@ -5,4 +5,4 @@ alive_progress>=3.3.0
 python-gnupg
 aiohttp
 blurb>=1.2.1
-sigstore>=4
+sigstore>=4.2.0
diff --git a/requirements.txt b/requirements.txt
index eb00f381..31e47633 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -924,11 +924,11 @@ rich==13.9.4 \
 securesystemslib==1.2.0 \
     --hash=sha256:fa63abcb1cf4dba4f2df964f623baa45bc39029980d7a0a2119d90731942afc6
     # via tuf
-sigstore==4.0.0 \
-    --hash=sha256:922840fcd184ffa88806d76c78c88f9403b5af0c6cb8815f2af997a00d9280c3
+sigstore==4.2.0 \
+    --hash=sha256:ed2e0f50aae85148a8aa4fc0f57c298927fce430ad1f988f38611ce90c85829f
     # via -r requirements.in
-sigstore-models==0.0.5 \
-    --hash=sha256:ac3ca1554d5dd509a6710699d83a035a09ba112d1fa180959cbfcdd5d97633b7
+sigstore-models==0.0.6 \
+    --hash=sha256:5201a68f4d7d0f8bec1e2f4378eb646b084c52609a4e31db8c385095fff68b2e
     # via sigstore
 sigstore-rekor-types==0.0.18 \
     --hash=sha256:b62bf38c5b1a62bc0d7fe0ee51a0709e49311d137c7880c329882a8f4b2d1d78