Does github.com/sigstore/timestamp-authority CVE-2025-66564 affect jfrog-cli?

[rathann]

CVE-2025-66564 was reported against github.com/sigstore/timestamp-authority , which is an indirect dependency of jfrog-cli. Fix is included in timestamp-authority v2.0.3 and newer, while jfrog-cli included v1.2.9. Is jfrog-cli affected?