Bump the gomod group across 1 directory with 2 updates - #197

Kusari Analysis Results:

✅ No Flagged Issues Detected
All values appear to be within acceptable risk parameters.

Both analyses are clean. The dependency analysis found only minor patch bumps (cosign/v3 3.1.3 to 3.1.4, sigs.k8s.io/release-sdk 0.13.0 to 0.13.1, github.com/policylabs/signer 0.6.6 to 0.6.7). No advisories were found on the old or new versions, none are blocked, deprecated, or end-of-life, and all are Apache-2.0 licensed. Scorecard shows Maintained 10/10 and Code Review 10/10 for each. cosign is a transitive dependency via release-sdk, which is updated in the same PR. The code analysis found no code issues, exposed secrets, or workflow issues. The combined risk profile is low and no action is required.

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: 1c045fb, performed at: 2026-11-09T04:45:26Z