diff --git a/go.mod b/go.mod
index 3d7426b534..a4b1ac5090 100644
--- a/go.mod
+++ b/go.mod
@@ -276,7 +276,7 @@ require (
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/sassoftware/relic v7.2.1+incompatible // indirect
-	github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.10.0 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/sigstore/fulcio v1.8.5 // indirect
 	github.com/sigstore/protobuf-specs v0.5.0 // indirect
@@ -298,7 +298,7 @@ require (
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
 	github.com/thales-e-security/pool v0.0.2 // indirect
-	github.com/theupdateframework/go-tuf/v2 v2.3.0 // indirect
+	github.com/theupdateframework/go-tuf/v2 v2.3.1 // indirect
 	github.com/tidwall/gjson v1.14.2 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.0 // indirect
diff --git a/go.sum b/go.sum
index 6a97d470b1..f3ab768ab7 100644
--- a/go.sum
+++ b/go.sum
@@ -1159,8 +1159,8 @@ github.com/sassoftware/relic v7.2.1+incompatible/go.mod h1:CWfAxv73/iLZ17rbyhIEq
 github.com/sassoftware/relic/v7 v7.6.2 h1:rS44Lbv9G9eXsukknS4mSjIAuuX+lMq/FnStgmZlUv4=
 github.com/sassoftware/relic/v7 v7.6.2/go.mod h1:kjmP0IBVkJZ6gXeAu35/KCEfca//+PKM6vTAsyDPY+k=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
-github.com/secure-systems-lab/go-securesystemslib v0.9.1 h1:nZZaNz4DiERIQguNy0cL5qTdn9lR8XKHf4RUyG1Sx3g=
-github.com/secure-systems-lab/go-securesystemslib v0.9.1/go.mod h1:np53YzT0zXGMv6x4iEWc9Z59uR+x+ndLwCLqPYpLXVU=
+github.com/secure-systems-lab/go-securesystemslib v0.10.0 h1:l+H5ErcW0PAehBNrBxoGv1jjNpGYdZ9RcheFkB2WI14=
+github.com/secure-systems-lab/go-securesystemslib v0.10.0/go.mod h1:MRKONWmRoFzPNQ9USRF9i1mc7MvAVvF1LlW8X5VWDvk=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
@@ -1281,8 +1281,8 @@ github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gt
 github.com/thales-e-security/pool v0.0.2/go.mod h1:qtpMm2+thHtqhLzTwgDBj/OuNnMpupY8mv0Phz0gjhU=
 github.com/theupdateframework/go-tuf v0.7.0 h1:CqbQFrWo1ae3/I0UCblSbczevCCbS31Qvs5LdxRWqRI=
 github.com/theupdateframework/go-tuf v0.7.0/go.mod h1:uEB7WSY+7ZIugK6R1hiBMBjQftaFzn7ZCDJcp1tCUug=
-github.com/theupdateframework/go-tuf/v2 v2.3.0 h1:gt3X8xT8qu/HT4w+n1jgv+p7koi5ad8XEkLXXZqG9AA=
-github.com/theupdateframework/go-tuf/v2 v2.3.0/go.mod h1:xW8yNvgXRncmovMLvBxKwrKpsOwJZu/8x+aB0KtFcdw=
+github.com/theupdateframework/go-tuf/v2 v2.3.1 h1:fReZUTLvPdqIL8Rd9xEKPmaxig8GIXe0kS4RSEaRfaM=
+github.com/theupdateframework/go-tuf/v2 v2.3.1/go.mod h1:9S0Srkf3c13FelsOyt5OyG3ZZDq9OJDA4IILavrt72Y=
 github.com/tidwall/gjson v1.14.2 h1:6BBkirS0rAHjumnjHF6qgy5d2YAJ1TLIaFE2lzfOLqo=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
diff --git a/vendor/github.com/secure-systems-lab/go-securesystemslib/cjson/canonicaljson.go b/vendor/github.com/secure-systems-lab/go-securesystemslib/cjson/canonicaljson.go
index abc860a491..a94e739f2c 100644
--- a/vendor/github.com/secure-systems-lab/go-securesystemslib/cjson/canonicaljson.go
+++ b/vendor/github.com/secure-systems-lab/go-securesystemslib/cjson/canonicaljson.go
@@ -96,7 +96,6 @@ func encodeCanonical(obj interface{}, result *strings.Builder) (err error) {
 			if i < (len(mapKeys) - 1) {
 				result.WriteString(",")
 			}
-			i++
 		}
 		result.WriteString("}")
 
diff --git a/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/envelope.go b/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/envelope.go
index ed223e90b5..8e48cc6fe1 100644
--- a/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/envelope.go
+++ b/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/envelope.go
@@ -38,7 +38,7 @@ type Signature struct {
 }
 
 /*
-PAE implementes the DSSE Pre-Authentic Encoding
+PAE implements the DSSE Pre-Authentic Encoding
 https://github.com/secure-systems-lab/dsse/blob/master/protocol.md#signature-definition
 */
 func PAE(payloadType string, payload []byte) []byte {
diff --git a/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/sign.go b/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/sign.go
index 244a806774..427ef5686f 100644
--- a/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/sign.go
+++ b/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/sign.go
@@ -47,7 +47,7 @@ algorithms to sign the data. The threshold parameter is legacy and is ignored.
 Deprecated: This function simply calls NewEnvelopeSigner, and that function should
 be preferred.
 */
-func NewMultiEnvelopeSigner(threshold int, p ...Signer) (*EnvelopeSigner, error) {
+func NewMultiEnvelopeSigner(_ int, p ...Signer) (*EnvelopeSigner, error) {
 	return NewEnvelopeSigner(p...)
 }
 
diff --git a/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/verify.go b/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/verify.go
index d04246747c..034e4faaf3 100644
--- a/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/verify.go
+++ b/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/verify.go
@@ -43,8 +43,8 @@ func (ev *EnvelopeVerifier) Verify(ctx context.Context, e *Envelope) ([]Accepted
 	// If *any* signature is found to be incorrect, it is skipped
 	var acceptedKeys []AcceptedKey
 	usedKeyids := make(map[string]string)
-	unverified_providers := make([]Verifier, len(ev.providers))
-	copy(unverified_providers, ev.providers)
+	unverifiedProviders := make([]Verifier, len(ev.providers))
+	copy(unverifiedProviders, ev.providers)
 	for _, s := range e.Signatures {
 		sig, err := b64Decode(s.Sig)
 		if err != nil {
@@ -55,7 +55,7 @@ func (ev *EnvelopeVerifier) Verify(ctx context.Context, e *Envelope) ([]Accepted
 		// If provider and signature include key IDs but do not match skip.
 		// If a provider recognizes the key, we exit
 		// the loop and use the result.
-		providers := unverified_providers
+		providers := unverifiedProviders
 		for i, v := range providers {
 			keyID, err := v.KeyID()
 
@@ -81,7 +81,7 @@ func (ev *EnvelopeVerifier) Verify(ctx context.Context, e *Envelope) ([]Accepted
 				KeyID:  keyID,
 				Sig:    s,
 			}
-			unverified_providers = removeIndex(providers, i)
+			unverifiedProviders = removeIndex(providers, i)
 
 			// See https://github.com/in-toto/in-toto/pull/251
 			if _, ok := usedKeyids[keyID]; ok {
diff --git a/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ecdsa.go b/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ecdsa.go
index 691091af99..4227941d96 100644
--- a/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ecdsa.go
+++ b/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ecdsa.go
@@ -57,7 +57,7 @@ func NewECDSASignerVerifierFromSSLibKey(key *SSLibKey) (*ECDSASignerVerifier, er
 }
 
 // Sign creates a signature for `data`.
-func (sv *ECDSASignerVerifier) Sign(ctx context.Context, data []byte) ([]byte, error) {
+func (sv *ECDSASignerVerifier) Sign(_ context.Context, data []byte) ([]byte, error) {
 	if sv.private == nil {
 		return nil, ErrNotPrivateKey
 	}
@@ -68,7 +68,7 @@ func (sv *ECDSASignerVerifier) Sign(ctx context.Context, data []byte) ([]byte, e
 }
 
 // Verify verifies the `sig` value passed in against `data`.
-func (sv *ECDSASignerVerifier) Verify(ctx context.Context, data []byte, sig []byte) error {
+func (sv *ECDSASignerVerifier) Verify(_ context.Context, data []byte, sig []byte) error {
 	hashedData := getECDSAHashedData(data, sv.curveSize)
 
 	if ok := ecdsa.VerifyASN1(sv.public, hashedData, sig); !ok {
@@ -93,8 +93,7 @@ func (sv *ECDSASignerVerifier) Public() crypto.PublicKey {
 // LoadECDSAKeyFromFile returns an SSLibKey instance for an ECDSA key stored in
 // a file in the custom securesystemslib format.
 //
-// Deprecated: use LoadKey(). The custom serialization format has been
-// deprecated. Use
+// Deprecated: use LoadKey(). The custom serialization format is deprecated. Use
 // https://github.com/secure-systems-lab/securesystemslib/blob/main/docs/migrate_key.py
 // to convert your key.
 func LoadECDSAKeyFromFile(path string) (*SSLibKey, error) {
diff --git a/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ed25519.go b/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ed25519.go
index d954e14b74..348351e8cd 100644
--- a/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ed25519.go
+++ b/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ed25519.go
@@ -57,7 +57,7 @@ func NewED25519SignerVerifierFromSSLibKey(key *SSLibKey) (*ED25519SignerVerifier
 }
 
 // Sign creates a signature for `data`.
-func (sv *ED25519SignerVerifier) Sign(ctx context.Context, data []byte) ([]byte, error) {
+func (sv *ED25519SignerVerifier) Sign(_ context.Context, data []byte) ([]byte, error) {
 	if len(sv.private) == 0 {
 		return nil, ErrNotPrivateKey
 	}
@@ -67,7 +67,7 @@ func (sv *ED25519SignerVerifier) Sign(ctx context.Context, data []byte) ([]byte,
 }
 
 // Verify verifies the `sig` value passed in against `data`.
-func (sv *ED25519SignerVerifier) Verify(ctx context.Context, data []byte, sig []byte) error {
+func (sv *ED25519SignerVerifier) Verify(_ context.Context, data []byte, sig []byte) error {
 	if ok := ed25519.Verify(sv.public, data, sig); ok {
 		return nil
 	}
@@ -89,8 +89,7 @@ func (sv *ED25519SignerVerifier) Public() crypto.PublicKey {
 // LoadED25519KeyFromFile returns an SSLibKey instance for an ED25519 key stored
 // in a file in the custom securesystemslib format.
 //
-// Deprecated: use LoadKey(). The custom serialization format has been
-// deprecated. Use
+// Deprecated: use LoadKey(). The custom serialization format is deprecated. Use
 // https://github.com/secure-systems-lab/securesystemslib/blob/main/docs/migrate_key.py
 // to convert your key.
 func LoadED25519KeyFromFile(path string) (*SSLibKey, error) {
diff --git a/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/rsa.go b/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/rsa.go
index 2abfcb27c4..8aaa531c06 100644
--- a/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/rsa.go
+++ b/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/rsa.go
@@ -59,7 +59,7 @@ func NewRSAPSSSignerVerifierFromSSLibKey(key *SSLibKey) (*RSAPSSSignerVerifier,
 }
 
 // Sign creates a signature for `data`.
-func (sv *RSAPSSSignerVerifier) Sign(ctx context.Context, data []byte) ([]byte, error) {
+func (sv *RSAPSSSignerVerifier) Sign(_ context.Context, data []byte) ([]byte, error) {
 	if sv.private == nil {
 		return nil, ErrNotPrivateKey
 	}
@@ -70,7 +70,7 @@ func (sv *RSAPSSSignerVerifier) Sign(ctx context.Context, data []byte) ([]byte,
 }
 
 // Verify verifies the `sig` value passed in against `data`.
-func (sv *RSAPSSSignerVerifier) Verify(ctx context.Context, data []byte, sig []byte) error {
+func (sv *RSAPSSSignerVerifier) Verify(_ context.Context, data []byte, sig []byte) error {
 	hashedData := hashBeforeSigning(data, sha256.New())
 
 	if err := rsa.VerifyPSS(sv.public, crypto.SHA256, hashedData, sig, &rsa.PSSOptions{SaltLength: sha256.Size, Hash: crypto.SHA256}); err != nil {
@@ -95,8 +95,7 @@ func (sv *RSAPSSSignerVerifier) Public() crypto.PublicKey {
 // LoadRSAPSSKeyFromFile returns an SSLibKey instance for an RSA key stored in a
 // file.
 //
-// Deprecated: use LoadKey(). The custom serialization format has been
-// deprecated. Use
+// Deprecated: use LoadKey(). The custom serialization format is deprecated. Use
 // https://github.com/secure-systems-lab/securesystemslib/blob/main/docs/migrate_key.py
 // to convert your key.
 func LoadRSAPSSKeyFromFile(path string) (*SSLibKey, error) {
diff --git a/vendor/github.com/theupdateframework/go-tuf/v2/metadata/metadata.go b/vendor/github.com/theupdateframework/go-tuf/v2/metadata/metadata.go
index 0d0afd850e..40ca2570d5 100644
--- a/vendor/github.com/theupdateframework/go-tuf/v2/metadata/metadata.go
+++ b/vendor/github.com/theupdateframework/go-tuf/v2/metadata/metadata.go
@@ -292,6 +292,13 @@ func (meta *Metadata[T]) VerifyDelegate(delegatedRole string, delegatedMetadata
 	if len(roleKeyIDs) == 0 {
 		return &ErrValue{Msg: fmt.Sprintf("no delegation found for %s", delegatedRole)}
 	}
+
+	if roleThreshold < 1 {
+		return &ErrValue{Msg: fmt.Sprintf("insufficient threshold (%d) configured for %s",
+			roleThreshold,
+			delegatedRole)}
+	}
+
 	// loop through each role keyID
 	for _, keyID := range roleKeyIDs {
 		key, ok := keys[keyID]
@@ -619,7 +626,7 @@ func (role *SuccinctRoles) GetRoles() []string {
 	res := []string{}
 	suffixLen, numberOfBins := role.GetSuffixLen()
 
-	for binNumber := 0; binNumber < numberOfBins; binNumber++ {
+	for binNumber := range numberOfBins {
 		suffix := fmt.Sprintf("%0*x", suffixLen, binNumber)
 		res = append(res, fmt.Sprintf("%s-%s", role.NamePrefix, suffix))
 	}
@@ -900,7 +907,15 @@ func checkType[T Roles](data []byte) error {
 	if err := json.Unmarshal(data, &m); err != nil {
 		return err
 	}
-	signedType := m["signed"].(map[string]any)["_type"].(string)
+	signed, ok := m["signed"].(map[string]any)
+	if !ok {
+		return &ErrValue{Msg: "metadata 'signed' field is missing or not an object"}
+	}
+	signedType, ok := signed["_type"].(string)
+	if !ok {
+		return &ErrValue{Msg: "no _type found in signed"}
+	}
+
 	switch i.(type) {
 	case *RootType:
 		if ROOT != signedType {
diff --git a/vendor/github.com/theupdateframework/go-tuf/v2/metadata/updater/updater.go b/vendor/github.com/theupdateframework/go-tuf/v2/metadata/updater/updater.go
index bd533b63c3..dd9b484bf5 100644
--- a/vendor/github.com/theupdateframework/go-tuf/v2/metadata/updater/updater.go
+++ b/vendor/github.com/theupdateframework/go-tuf/v2/metadata/updater/updater.go
@@ -570,7 +570,7 @@ func (update *Updater) preOrderDepthFirstWalk(targetFilePath string) (*metadata.
 			// onto delegationsToVisit. Roles are popped from the end of
 			// the list
 			slices.Reverse(childRolesToVisit)
-			delegationsToVisit = append(delegationsToVisit, childRolesToVisit...)
+			delegationsToVisit = slices.Concat(delegationsToVisit, childRolesToVisit)
 		}
 	}
 	if len(delegationsToVisit) > 0 {
@@ -605,7 +605,7 @@ func (update *Updater) persistMetadata(roleName string, data []byte) error {
 		if errRemove != nil {
 			log.Info("Failed to delete temporary file", "name", file.Name())
 		}
-		return err
+		return errors.Join(err, errRemove)
 	}
 	// write the data content to the temporary file
 	_, err = file.Write(data)
@@ -616,7 +616,7 @@ func (update *Updater) persistMetadata(roleName string, data []byte) error {
 		if errRemove != nil {
 			log.Info("Failed to delete temporary file", "name", file.Name())
 		}
-		return err
+		return errors.Join(err, errRemove)
 	}
 
 	// can't move/rename an open file on windows, so close it first
diff --git a/vendor/modules.txt b/vendor/modules.txt
index de38da7569..844ebfd93d 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1287,8 +1287,8 @@ github.com/sagikazarmark/locafero
 ## explicit
 github.com/sassoftware/relic/lib/pkcs7
 github.com/sassoftware/relic/lib/x509tools
-# github.com/secure-systems-lab/go-securesystemslib v0.9.1
-## explicit; go 1.23.0
+# github.com/secure-systems-lab/go-securesystemslib v0.10.0
+## explicit; go 1.24.0
 github.com/secure-systems-lab/go-securesystemslib/cjson
 github.com/secure-systems-lab/go-securesystemslib/dsse
 github.com/secure-systems-lab/go-securesystemslib/encrypted
@@ -1714,8 +1714,8 @@ github.com/theupdateframework/go-tuf/pkg/targets
 github.com/theupdateframework/go-tuf/sign
 github.com/theupdateframework/go-tuf/util
 github.com/theupdateframework/go-tuf/verify
-# github.com/theupdateframework/go-tuf/v2 v2.3.0
-## explicit; go 1.24.9
+# github.com/theupdateframework/go-tuf/v2 v2.3.1
+## explicit; go 1.25.5
 github.com/theupdateframework/go-tuf/v2/metadata
 github.com/theupdateframework/go-tuf/v2/metadata/config
 github.com/theupdateframework/go-tuf/v2/metadata/fetcher