chore(deps): bump the cargo-minor-and-patch group across 1 directory with 23 updates (#8855)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Lifei Zhou <lifei@squareup.com>

crates/goose-cli/Cargo.toml

@@ -56,13 +56,13 @@ webbrowser = { workspace = true }
 indicatif = "0.18.1"
 tokio-util = { workspace = true, features = ["compat", "rt"] }
 anstream = "1.0.0"
-open = "5.3.2"
+open = "5.3.4"
 url = { workspace = true }
 urlencoding = { workspace = true }
-clap_complete = "4.5.62"
+clap_complete = "4.6.2"
 comfy-table = "7.2.2"
 sha2 = { workspace = true }
-sigstore-verify = { version = "0.6", default-features = false }
+sigstore-verify = { version = "=0.6.5", default-features = false }
 axum.workspace = true
 
 [target.'cfg(target_os = "windows")'.dependencies]

crates/goose-cli/src/commands/update.rs

@@ -1,6 +1,6 @@
 use anyhow::{bail, Context, Result};
 use sha2::{Digest, Sha256};
-use sigstore_verify::trust_root::TrustedRoot;
+use sigstore_verify::trust_root::{TrustedRoot, SIGSTORE_PRODUCTION_TRUSTED_ROOT};
 use sigstore_verify::types::{Bundle, Sha256Hash};
 use sigstore_verify::VerificationPolicy;
 use std::env;
@@ -165,7 +165,8 @@ async fn verify_provenance(archive_data: &[u8], tag: &str) -> Result<bool> {
         }
     };
 
-    let trusted_root = TrustedRoot::production().context("Failed to load Sigstore trusted root")?;
+    let trusted_root = TrustedRoot::from_json(SIGSTORE_PRODUCTION_TRUSTED_ROOT)
+        .context("Failed to load Sigstore trusted root")?;
     let policy = VerificationPolicy::with_issuer(GITHUB_ACTIONS_ISSUER);
     let artifact_digest =
         Sha256Hash::from_hex(&digest).context("Failed to parse artifact digest")?;