Dependency Dashboard

[forking-renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): update alpine:3.23 docker digest to fd791d7
• chore(deps): update golang:1.26.4-alpine3.23 docker digest to 18b460d
• chore(deps): update ruby:4 docker digest to a30f432
• chore(deps): update golang docker tag to v1.26.5
• chore(deps): update workflows (actions/checkout, actions/setup-go, actions/stale, actions/upload-artifact, docker/login-action, docker/setup-buildx-action, docker/setup-qemu-action, github/codeql-action, goreleaser/goreleaser-action, ruby/setup-ruby, zizmorcore/zizmor-action)
• fix(deps): update osv-scanner minor (charm.land/glamour/v2, charm.land/lipgloss/v2, deps.dev/api/v3, deps.dev/api/v3alpha, github.com/gkampitakis/go-snaps, github.com/jedib0t/go-pretty/v6, github.com/urfave/cli/v3, go.yaml.in/yaml/v4, golang.org/x/sync, golang.org/x/term, google.golang.org/grpc, gopkg.in/dnaeon/go-vcr.v4)
• chore(deps): update alpine docker tag to v3.24
• chore(deps): update golangci/golangci-lint-action action to v9.3.0
• chore(deps): update actions/checkout action to v7
• chore(deps): lock file maintenance
• Click on this checkbox to rebase all open PRs at once

PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

• chore(deps): update dependency system.text.regularexpressions to 4.3.1 [security]
• chore(deps): update dependency newtonsoft.json to v13 [security]

Detected Dependencies

bundler (1)

docs/Gemfile (16)

• ruby ~> 4
• jekyll "~> 4.4.0"
• csv lock file @ 3.3.5
• base64 lock file @ 0.3.0
• jekyll-feed "~> 0.15"
• jekyll-relative-links lock file @ 0.7.0
• jekyll-optional-front-matter lock file @ 0.3.2
• jekyll-readme-index lock file @ 0.3.0
• jekyll-default-layout lock file @ 0.1.5
• jekyll-titles-from-headings lock file @ 0.5.3
• just-the-docs lock file @ 0.12.0
• jekyll-github-metadata lock file @ 2.16.1
• tzinfo ">= 1", "< 3"
• wdm "~> 0.2.0"
• http_parser.rb "~> 0.8.0"
• webrick "~> 1.7"

dockerfile (6)

action.dockerfile (2)

• golang 1.26.4-alpine3.23@sha256:f23e8b227fb4493eabe03bede4d5a32d04092da71962f1fb79b5f7d1e6c2a17f → [Updates: 1.26.5-alpine3.23, 1.26.4-alpine3.23]
• alpine 3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 → [Updates: 3.24, 3.23]

Dockerfile (2)

• golang 1.26.4-alpine3.23@sha256:f23e8b227fb4493eabe03bede4d5a32d04092da71962f1fb79b5f7d1e6c2a17f → [Updates: 1.26.5-alpine3.23, 1.26.4-alpine3.23]
• alpine 3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 → [Updates: 3.24, 3.23]

docs/docs.Dockerfile (1)

• ruby 4@sha256:5e3c937aeac53f58a84bf212f7762aecf69221af0159451845ac9b67b79ff234 → [Updates: 4]

goreleaser-action.dockerfile (1)

• golang 1.26.4-alpine3.23@sha256:f23e8b227fb4493eabe03bede4d5a32d04092da71962f1fb79b5f7d1e6c2a17f → [Updates: 1.26.5-alpine3.23, 1.26.4-alpine3.23]

goreleaser.dockerfile (1)

• golang 1.26.4-alpine3.23@sha256:f23e8b227fb4493eabe03bede4d5a32d04092da71962f1fb79b5f7d1e6c2a17f → [Updates: 1.26.5-alpine3.23, 1.26.4-alpine3.23]

scripts/test_env.dockerfile (1)

• golang 1.26.4-alpine3.23@sha256:f23e8b227fb4493eabe03bede4d5a32d04092da71962f1fb79b5f7d1e6c2a17f → [Updates: 1.26.5-alpine3.23, 1.26.4-alpine3.23]

github-actions (21)

.github/workflows/cassettes.yml (3)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c → [Updates: v6.5.0, v7.0.0]
• peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1

.github/workflows/checks.yml (7)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c → [Updates: v6.5.0, v7.0.0]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c → [Updates: v6.5.0, v7.0.0]

.github/workflows/codeql-analysis.yml (5)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c → [Updates: v6.5.0, v7.0.0]
• github/codeql-action v4.36.0@7211b7c8077ea37d8641b6271f6a365a22a5fbfa → [Updates: v4.37.0]
• github/codeql-action v4.36.0@7211b7c8077ea37d8641b6271f6a365a22a5fbfa → [Updates: v4.37.0]
• github/codeql-action v4.36.0@7211b7c8077ea37d8641b6271f6a365a22a5fbfa → [Updates: v4.37.0]

.github/workflows/dependencies.yml (3)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c → [Updates: v6.5.0, v7.0.0]
• peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1

.github/workflows/docs-deploy.yml (6)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• ruby/setup-ruby v1.310.0@afeafc3d1ab54a631816aba4c914a0081c12ff2f → [Updates: v1.316.0]
• actions/configure-pages v6.0.0@45bfe0192ca1faeb007ade9deae92b16b8254a0d
• actions/upload-pages-artifact v5@fc324d3547104276b827a68afc52ff2a11cc49c9
• actions/deploy-pages v5.0.0@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128
• ruby 4.0.5 → [Updates: 4.0.6]

.github/workflows/goreleaser-nightly.yml (6)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c → [Updates: v6.5.0, v7.0.0]
• docker/setup-qemu-action v4.0.0@ce360397dd3f832beb865e1373c09c0e9f86d70a → [Updates: v4.2.0]
• docker/setup-buildx-action v4.1.0@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 → [Updates: v4.2.0]
• docker/login-action v4.2.0@650006c6eb7dba73a995cc03b0b2d7f5ca915bee → [Updates: v4.4.0]
• goreleaser/goreleaser-action v7.2.2@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 → [Updates: v7.2.3]

.github/workflows/goreleaser.yml (7)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c → [Updates: v6.5.0, v7.0.0]
• docker/setup-qemu-action v4.0.0@ce360397dd3f832beb865e1373c09c0e9f86d70a → [Updates: v4.2.0]
• docker/setup-buildx-action v4.1.0@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 → [Updates: v4.2.0]
• docker/login-action v4.2.0@650006c6eb7dba73a995cc03b0b2d7f5ca915bee → [Updates: v4.4.0]
• goreleaser/goreleaser-action v7.2.2@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 → [Updates: v7.2.3]
• slsa-framework/slsa-github-generator v2.1.0

.github/workflows/links.yml (2)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• tcort/github-action-markdown-link-check v1.1.2@e7c7a18363c842693fadde5d41a3bd3573a7a225

.github/workflows/osv-scanner-reusable-pr.yml

.github/workflows/osv-scanner-reusable.yml

.github/workflows/osv-scanner-unified-action.yml (2)

• google/osv-scanner-action nightly
• google/osv-scanner-action nightly

.github/workflows/prerelease-check.yml (15)

• google/osv-scanner-action main
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• tcort/github-action-markdown-link-check v1.1.2@e7c7a18363c842693fadde5d41a3bd3573a7a225
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c → [Updates: v6.5.0, v7.0.0]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c → [Updates: v6.5.0, v7.0.0]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c → [Updates: v6.5.0, v7.0.0]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c → [Updates: v6.5.0, v7.0.0]

.github/workflows/renovate-validator.yml (2)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e → [Updates: v6.5.0, v7.0.0]

.github/workflows/scorecards.yml (4)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• ossf/scorecard-action v2.4.3@4eaacf0543bb3f2c246792bd56e8cdeffafb205a
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• github/codeql-action v4.36.0@7211b7c8077ea37d8641b6271f6a365a22a5fbfa → [Updates: v4.37.0]

.github/workflows/snapshots.yml (3)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c → [Updates: v6.5.0, v7.0.0]
• peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1

.github/workflows/staleness.yml (1)

• actions/stale v10.3.0@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 → [Updates: v10.4.0]

.github/workflows/tests.yml (10)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/upload-artifact v7.0.0@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f → [Updates: v7.0.1]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
• actions/setup-go v6.3.0@4b73464bb391d4059bd26b0524d20df3927bd417 → [Updates: v6.5.0, v7.0.0]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• actions/setup-go v6.3.0@4b73464bb391d4059bd26b0524d20df3927bd417 → [Updates: v6.5.0, v7.0.0]
• docker/setup-qemu-action v4.0.0@ce360397dd3f832beb865e1373c09c0e9f86d70a → [Updates: v4.2.0]
• docker/setup-buildx-action v4.0.0@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd → [Updates: v4.2.0]
• goreleaser/goreleaser-action v7.0.0@ec59f474b9834571250b370d4735c50f8e2d1e29 → [Updates: v7.2.3]

.github/workflows/title.yml (1)

• amannn/action-semantic-pull-request v6.1.1@48f256284bd46cdaab1048c3721360e808335d50

.github/workflows/zizmor.yml (2)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.0.3, v7.0.0]
• zizmorcore/zizmor-action v0.5.6@5f14fd08f7cf1cb1609c1e344975f152c7ee938d → [Updates: v0.5.7]

actions/internal/lint-action/action.yml (1)

• golangci/golangci-lint-action v9.2.1@82606bf257cbaff209d206a39f5134f0cfbfd2ee → [Updates: v9.3.0]

actions/internal/test-action/action.yml (1)

• codecov/codecov-action v7.0.0@fb8b3582c8e4def4969c97caa2f19720cb33a72f

gomod (1)

go.mod (30)

• go 1.26.4
• charm.land/glamour/v2 v2.0.0 → [Updates: v2.0.1]
• charm.land/lipgloss/v2 v2.0.3 → [Updates: v2.0.5]
• deps.dev/api/v3 v3.0.0-20260422013440-90c27f84dd6f@90c27f84dd6f → [Updates: v3.0.0-20260708003622-ba1304923509]
• deps.dev/api/v3alpha v0.0.0-20260422013440-90c27f84dd6f@90c27f84dd6f → [Updates: v0.0.0-20260708003622-ba1304923509]
• github.com/BurntSushi/toml v1.6.0
• github.com/CycloneDX/cyclonedx-go v0.11.0
• github.com/gkampitakis/go-snaps v0.5.22 → [Updates: v0.5.23]
• github.com/go-git/go-git/v5 v5.19.1
• github.com/gobwas/glob v0.2.3
• github.com/google/go-cmp v0.7.0
• github.com/ianlancetaylor/demangle v0.0.0-20260505044615-1ff4bf46051f@1ff4bf46051f
• github.com/jedib0t/go-pretty/v6 v6.7.10 → [Updates: v6.8.2]
• github.com/modelcontextprotocol/go-sdk v1.6.1
• github.com/opencontainers/go-digest v1.0.0
• github.com/ossf/osv-schema/bindings/go v0.0.0-20260424063704-83285ce2a866@83285ce2a866 → [Updates: v0.0.0-20260716013833-d4a00c3e2a47]
• github.com/owenrumney/go-sarif/v3 v3.3.0
• github.com/package-url/packageurl-go v0.1.6
• github.com/pandatix/go-cvss v0.6.2
• github.com/tidwall/gjson v1.19.0
• github.com/tidwall/pretty v1.2.1
• github.com/tidwall/sjson v1.2.5
• github.com/urfave/cli/v3 v3.9.0 → [Updates: v3.10.1]
• go.yaml.in/yaml/v4 v4.0.0-rc.4 → [Updates: v4.0.0-rc.6]
• golang.org/x/sync v0.20.0 → [Updates: v0.22.0]
• golang.org/x/term v0.43.0 → [Updates: v0.45.0]
• google.golang.org/grpc v1.81.1 → [Updates: v1.82.0]
• google.golang.org/protobuf v1.36.11
• gopkg.in/dnaeon/go-vcr.v4 v4.0.6 → [Updates: v4.0.7]
• osv.dev/bindings/go v0.0.0-20260512064147-daa692bbd4ed@daa692bbd4ed → [Updates: v0.0.0-20260717032413-4bf647cb347c]

nuget (2)

cmd/osv-scanner/scan/source/testdata/locks-dotnet/Directory.Packages.props (1)

• System.Text.RegularExpressions 4.3.0 → [Updates: 4.3.1]

cmd/osv-scanner/scan/source/testdata/locks-dotnet/test.csproj (1)

• Newtonsoft.Json 12.0.1 → [Updates: 13.0.1]

---

• Check this box to trigger a request for Renovate to run again on this repository