chore(deps): bump spin-expressions from v3.0.0 to v3.1.1

[dependabot]

Bumps spin-expressions from v3.0.0 to v3.1.1.

Release notes

Sourced from spin-expressions's releases.

v3.1.1

Spin 3.1.1

This is a patch release to fix a bug that was found in the deny-all adapter used to implement configuration inheritance for component dependencies.

Verifying the Release Signature

After downloading the v3.1.1 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v3.1.1 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-sha aa919ce36a5f6c45e6c9b66bcd94657281f44bf3 \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

Verified OK

Full Changelog: fermyon/spin@v3.1.0...v3.1.1

v3.1.0

Just in time for the holidays, Spin v3.1.0 brings the gift of key/value support backed by AWS DynamoDB and a bunch of housekeeping improvements. See the change log below for more details and let us know what you think in the GitHub issues.

As always, thanks to contributors old and new for helping improve Spin on a daily basis! Special thanks to @​ogghead for contributing AWS DynamoDB support for key/value. 🎉

Verifying the Release Signature

After downloading the release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v3.1.0 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-sha 1aa89dab04600e18dc4227f22a68e71b246f8553 \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

... (truncated)

Commits

• aa919ce Merge pull request #2973 from fibonacci1729/v3.1
• e11a5cf Bump version for patch release
• d30a79c Merge pull request #2972 from fermyon/backport-2971-to-v3.1
• b3d7bf5 Fix deny-all adapter for socket imports
• 1aa89da Merge pull request #2966 from michelleN/versionupdate
• a319a88 bump versions to v3.1
• a66fea3 Merge pull request #2949 from michelleN/gosdk
• 16d5225 Merge pull request #2963 from kate-goldenring/disable-unwind-on-musl
• 3c36953 Merge pull request #2960 from itowlson/vcruntime-static-link-terror
• 6e9883e Merge pull request #2957 from itowlson/templates-install-from-remote-tar
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)