This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.<br>[View this repository on the Mend.io Web Portal](https://developer.mend.io/github/google/osv.dev). ## Awaiting Schedule The following updates are awaiting their schedule. To get an update now, click on a checkbox below. - [ ] <!-- unschedule-branch=renovate/submodules -->chore(deps): update gcp/api/googleapis digest to 7f9e9ff - [ ] <!-- unschedule-branch=renovate/docker -->chore(deps): update gcr.io/distroless/base-debian12 docker digest to 9dce90e - [ ] <!-- unschedule-branch=renovate/git.832008.xyz-ossf-osv-schema-bindings-go-digest -->fix(deps): update github.com/ossf/osv-schema/bindings/go digest to 2a6a0b9 - [ ] <!-- unschedule-branch=renovate/osv-lib -->chore(deps): update dependency google-cloud-ndb to v2.4.2 - [ ] <!-- unschedule-branch=renovate/tools -->fix(deps): update tools (`google-cloud-ndb`, `google.golang.org/api`) - [ ] <!-- unschedule-branch=renovate/go-libraries -->fix(deps): update go-libraries (`cloud.google.com/go/monitoring`, `github.com/go-git/go-git/v6`, `google.golang.org/api`, `google.golang.org/grpc`) - [ ] <!-- unschedule-branch=renovate/gcp-indexer-go -->fix(deps): update module google.golang.org/api to v0.274.0 - [ ] <!-- unschedule-branch=renovate/vulnfeeds-go -->fix(deps): update vulnfeeds-go (`cloud.google.com/go/secretmanager`, `google.golang.org/api`) - [ ] <!-- unschedule-branch=renovate/lock-file-maintenance-website -->chore(deps): lock file maintenance - [ ] <!-- unschedule-branch=renovate/lock-file-maintenance-osv-lib -->chore(deps): lock file maintenance - [ ] <!-- unschedule-branch=renovate/lock-file-maintenance-tools -->chore(deps): lock file maintenance - [ ] <!-- unschedule-branch=renovate/lock-file-maintenance-terraform -->chore(deps): lock file maintenance - [ ] <!-- create-all-awaiting-schedule-prs -->🔐 **Create all awaiting schedule PRs at once** 🔐 ## Pending Status Checks The following updates await pending status checks. To force their creation now, click on a checkbox below. - [ ] <!-- approvePr-branch=renovate/website -->fix(deps): update website (`google-auth`, `webpack`) - [ ] <!-- approvePr-branch=renovate/terraform -->[chore(deps): update terraform to ~> 7.27.0](../pull/4741) (`google`, `google-beta`) ## Open The following updates have all been created. To force a retry/rebase of any, click on a checkbox below. - [ ] <!-- rebase-branch=renovate/gcp-services-python -->[fix(deps): update gcp-services-python](../pull/5069) (`google-api-python-client`, `google-auth-httplib2`, `google-cloud-logging`, `google-cloud-ndb`, `google-cloud-pubsub`, `google-cloud-secret-manager`, `google-cloud-storage`, `pygit2`, `requests`) - [ ] <!-- rebase-branch=renovate/major-docs -->[chore(deps): update dependency ruby to v4](../pull/5005) - [ ] <!-- rebase-branch=renovate/major-gcp-indexer-go -->[fix(deps): update module cloud.google.com/go/pubsub to v2](../pull/5166) - [ ] <!-- rebase-branch=renovate/major-vulnfeeds-go-major -->[fix(deps): update module gopkg.in/yaml.v2 to v3](../pull/4790) - [ ] <!-- rebase-branch=renovate/lock-file-maintenance-docs -->[chore(deps): lock file maintenance](../pull/4834) - [ ] <!-- rebase-branch=renovate/lock-file-maintenance-gcp-services-python -->[chore(deps): lock file maintenance](../pull/5168) - [ ] <!-- rebase-all-open-prs -->**Click on this checkbox to rebase all open PRs at once** ## Detected Dependencies <details><summary>bundler (1)</summary> <blockquote> <details><summary>docs/Gemfile (7)</summary> - `ruby ~> 3` → [Updates: `~> 4`] - `github-pages lock file @ 232` - `jekyll-feed "~> 0.12"` - `tzinfo ">= 1", "< 3"` - `wdm "~> 0.2.0"` - `http_parser.rb "~> 0.8.0"` - `webrick "~> 1.7"` </details> </blockquote> </details> <details><summary>cloudbuild (10)</summary> <blockquote> <details><summary>bindings/cloudbuild.yaml</summary> </details> <details><summary>cloudbuild.yaml</summary> </details> <details><summary>docker/terraform/cloudbuild.yaml</summary> </details> <details><summary>gcp/api/cloudbuild.yaml</summary> </details> <details><summary>gcp/website/cloudbuild.yaml</summary> </details> <details><summary>gcp/workers/cloudbuild.yaml</summary> </details> <details><summary>go/cloudbuild.yaml</summary> </details> <details><summary>osv/cloudbuild.yaml</summary> </details> <details><summary>vulnfeeds/cloudbuild.yaml</summary> </details> <details><summary>vulnfeeds/pypi/cloudbuild.yaml</summary> </details> </blockquote> </details> <details><summary>dockerfile (36)</summary> <blockquote> <details><summary>actions/analyze/Dockerfile</summary> </details> <details><summary>docker/ci/Dockerfile</summary> </details> <details><summary>docker/deployment/Dockerfile (1)</summary> - `ubuntu 24.04@sha256:84e77dee7d1bc93fb029a45e3c6cb9d8aa4831ccfcc7103d36e876938d28895b` </details> <details><summary>docker/terraform/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:3293540b35a930023e12066437a939a7ad6f27f01c6e65f52558534682f57ca5` </details> <details><summary>docker/worker-base/Dockerfile (1)</summary> - `ubuntu 24.04@sha256:84e77dee7d1bc93fb029a45e3c6cb9d8aa4831ccfcc7103d36e876938d28895b` </details> <details><summary>docs/docs.Dockerfile (1)</summary> - `ruby 3` → [Updates: `4`] </details> <details><summary>gcp/api/Dockerfile</summary> </details> <details><summary>gcp/api/Dockerfile.esp (1)</summary> - `gcr.io/endpoints-release/endpoints-runtime 2` </details> <details><summary>gcp/indexer/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `gcr.io/distroless/base-debian12 sha256:937c7eaaf6f3f2d38a1f8c4aeff326f0c56e4593ea152e9e8f74d976dde52f56` → [Updates: `undefined`] </details> <details><summary>gcp/website/Dockerfile (1)</summary> - `node 24.14@sha256:80fc934952c8f1b2b4d39907af7211f8a9fff1a4c2cf673fb49099292c251cec` </details> <details><summary>gcp/workers/cron/Dockerfile</summary> </details> <details><summary>gcp/workers/importer/Dockerfile</summary> </details> <details><summary>gcp/workers/linter/Dockerfile (1)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` </details> <details><summary>gcp/workers/oss_fuzz_importer/Dockerfile</summary> </details> <details><summary>gcp/workers/oss_fuzz_worker/Dockerfile</summary> </details> <details><summary>gcp/workers/recoverer/Dockerfile</summary> </details> <details><summary>gcp/workers/staging_api_test/Dockerfile</summary> </details> <details><summary>gcp/workers/vanir_signatures/Dockerfile</summary> </details> <details><summary>gcp/workers/worker/Dockerfile</summary> </details> <details><summary>go/cmd/custommetrics/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `gcr.io/distroless/static-debian12 sha256:20bc6c0bc4d625a22a8fde3e55f6515709b32055ef8fb9cfbddaa06d1760f838` </details> <details><summary>go/cmd/exporter/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `gcr.io/distroless/static-debian12 sha256:20bc6c0bc4d625a22a8fde3e55f6515709b32055ef8fb9cfbddaa06d1760f838` </details> <details><summary>go/cmd/first_package_finder/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `alpine 3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659` </details> <details><summary>go/cmd/generatesitemap/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `gcr.io/distroless/static-debian12 sha256:20bc6c0bc4d625a22a8fde3e55f6515709b32055ef8fb9cfbddaa06d1760f838` </details> <details><summary>go/cmd/gitter/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `alpine 3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659` </details> <details><summary>go/cmd/importer/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `alpine 3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659` </details> <details><summary>go/cmd/recordchecker/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `gcr.io/distroless/static-debian12 sha256:20bc6c0bc4d625a22a8fde3e55f6515709b32055ef8fb9cfbddaa06d1760f838` </details> <details><summary>go/cmd/relations/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `gcr.io/distroless/static-debian12 sha256:20bc6c0bc4d625a22a8fde3e55f6515709b32055ef8fb9cfbddaa06d1760f838` </details> <details><summary>vulnfeeds/cmd/combine-to-osv/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:3293540b35a930023e12066437a939a7ad6f27f01c6e65f52558534682f57ca5` </details> <details><summary>vulnfeeds/cmd/converters/alpine/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:3293540b35a930023e12066437a939a7ad6f27f01c6e65f52558534682f57ca5` </details> <details><summary>vulnfeeds/cmd/converters/cve/cve5/bulk-converter/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:3293540b35a930023e12066437a939a7ad6f27f01c6e65f52558534682f57ca5` </details> <details><summary>vulnfeeds/cmd/converters/cve/nvd-cve-osv/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:3293540b35a930023e12066437a939a7ad6f27f01c6e65f52558534682f57ca5` </details> <details><summary>vulnfeeds/cmd/converters/debian/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:3293540b35a930023e12066437a939a7ad6f27f01c6e65f52558534682f57ca5` </details> <details><summary>vulnfeeds/cmd/converters/dsa-dla-dtsa/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `alpine 3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659` </details> <details><summary>vulnfeeds/cmd/mirrors/cpe-repo-gen/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:3293540b35a930023e12066437a939a7ad6f27f01c6e65f52558534682f57ca5` </details> <details><summary>vulnfeeds/cmd/mirrors/debian-copyright-mirror/Dockerfile (1)</summary> - `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:3293540b35a930023e12066437a939a7ad6f27f01c6e65f52558534682f57ca5` </details> <details><summary>vulnfeeds/cmd/mirrors/download-cves/Dockerfile (2)</summary> - `golang 1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166` - `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:3293540b35a930023e12066437a939a7ad6f27f01c6e65f52558534682f57ca5` </details> </blockquote> </details> <details><summary>git-submodules (1)</summary> <blockquote> <details><summary>.gitmodules (2)</summary> - `gcp/api/googleapis 9a832ccde3f3ca4d4e1c39593b1cbf9aa62a75b3` → [Updates: `undefined`] - `osv/osv-schema 2a6a0b9b0ccd8b91eeec05081b2642f53cfbe81e` </details> </blockquote> </details> <details><summary>github-actions (13)</summary> <blockquote> <details><summary>.github/workflows/codeql-analysis.yml (4)</summary> - `actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd` - `github/codeql-action v4.35.1@c10b8064de6f491fea524254123dbe5e09572f13` - `github/codeql-action v4.35.1@c10b8064de6f491fea524254123dbe5e09572f13` - `github/codeql-action v4.35.1@c10b8064de6f491fea524254123dbe5e09572f13` </details> <details><summary>.github/workflows/generate-protos.yml (4)</summary> - `actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd` - `actions/setup-python v6.2.0@a309ff8b426b58ec0e2a45f0f869d46889d02405` - `actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c` - `peter-evans/create-pull-request v8.1.0@c0f553fe549906ede9cf27b5156039d195d2ece0` </details> <details><summary>.github/workflows/issue-signposting.yml</summary> </details> <details><summary>.github/workflows/links.yml (2)</summary> - `actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd` - `tcort/github-action-markdown-link-check v1.1.2@e7c7a18363c842693fadde5d41a3bd3573a7a225` </details> <details><summary>.github/workflows/lint.yaml (5)</summary> - `actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd` - `actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd` - `actions/setup-python v6.2.0@a309ff8b426b58ec0e2a45f0f869d46889d02405` - `actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c` - `hashicorp/setup-terraform v4.0.0@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85` </details> <details><summary>.github/workflows/osv-scanner-unified.yml (2)</summary> - `google/osv-scanner-action nightly` - `google/osv-scanner-action nightly` </details> <details><summary>.github/workflows/publish-to-pypi.yaml (3)</summary> - `actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd` - `actions/setup-python v6.2.0@a309ff8b426b58ec0e2a45f0f869d46889d02405` - `pypa/gh-action-pypi-publish v1.13.0@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e` → [Updates: `v1.14.0`] </details> <details><summary>.github/workflows/renovate-validator.yml (2)</summary> - `actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd` - `actions/setup-node v6.3.0@53b83947a5a98c8d113130e565377fae1a50d02f` </details> <details><summary>.github/workflows/scorecards.yml (4)</summary> - `actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd` - `ossf/scorecard-action v2.4.3@4eaacf0543bb3f2c246792bd56e8cdeffafb205a` - `actions/upload-artifact v7.0.0@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f` - `github/codeql-action v4.35.1@c10b8064de6f491fea524254123dbe5e09572f13` </details> <details><summary>.github/workflows/snapshots.yml (3)</summary> - `actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd` - `actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c` - `peter-evans/create-pull-request v8.1.0@c0f553fe549906ede9cf27b5156039d195d2ece0` </details> <details><summary>.github/workflows/staleness.yml (1)</summary> - `actions/stale v10.2.0@b5d41d4e1d5dceea10e7104786b73624c18a190f` </details> <details><summary>.github/workflows/title.yml (1)</summary> - `amannn/action-semantic-pull-request v6.1.1@48f256284bd46cdaab1048c3721360e808335d50` </details> <details><summary>.github/workflows/zizmor.yml (2)</summary> - `actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd` - `zizmorcore/zizmor-action v0.5.2@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8` </details> </blockquote> </details> <details><summary>gomod (8)</summary> <blockquote> <details><summary>bindings/go/go.mod (7)</summary> - `go 1.26.2` - `github.com/google/go-cmp v0.7.0` - `github.com/ossf/osv-schema/bindings/go v0.0.0-20260331231022-2a6a0b9b0ccd@2a6a0b9b0ccd` - `golang.org/x/sync v0.20.0` - `google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9@9d38bb4040a9` → [Updates: `v0.0.0-20260406210006-6f92a3bedf2d`] - `google.golang.org/grpc v1.79.3` → [Updates: `v1.80.0`] - `google.golang.org/protobuf v1.36.11` </details> <details><summary>docs/go.mod (4)</summary> - `go 1.26.2` - `github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0` - `google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1` - `google.golang.org/protobuf v1.36.11` </details> <details><summary>gcp/indexer/go.mod (10)</summary> - `go 1.26.2` - `cloud.google.com/go/datastore v1.22.0` - `cloud.google.com/go/pubsub v1.50.2` → [Updates: `v2.5.1`] - `cloud.google.com/go/storage v1.61.3` → [Updates: `v1.62.0`] - `github.com/go-git/go-git/v5 v5.17.2` - `github.com/golang/glog v1.2.5` - `github.com/google/go-cmp v0.7.0` - `golang.org/x/sync v0.20.0` - `google.golang.org/api v0.273.1` → [Updates: `v0.274.0`] - `gopkg.in/yaml.v3 v3.0.1` </details> <details><summary>go/go.mod (28)</summary> - `go 1.26.2` - `charm.land/lipgloss/v2 v2.0.2` - `cloud.google.com/go/datastore v1.22.0` - `cloud.google.com/go/monitoring v1.24.3` → [Updates: `v1.25.0`] - `cloud.google.com/go/pubsub/v2 v2.5.1` - `cloud.google.com/go/storage v1.61.3` → [Updates: `v1.62.0`] - `github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.31.0` → [Updates: `v1.32.0`] - `github.com/dgraph-io/ristretto/v2 v2.4.0` - `github.com/dustin/go-humanize v1.0.1` - `github.com/go-git/go-git/v6 v6.0.0-20260331140939-8126d61b3452@8126d61b3452` → [Updates: `v6.0.0-alpha.1`] - `github.com/google/go-cmp v0.7.0` - `github.com/google/osv-scalibr v0.4.5` - `github.com/hashicorp/go-retryablehttp v0.7.8` - `github.com/klauspost/compress v1.18.5` - `github.com/ossf/osv-schema/bindings/go v0.0.0-20260331231022-2a6a0b9b0ccd@2a6a0b9b0ccd` - `github.com/tidwall/gjson v1.18.0` - `github.com/xeipuuv/gojsonschema v1.2.0` - `go.opentelemetry.io/contrib/detectors/gcp v1.42.0` → [Updates: `v1.43.0`] - `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0` → [Updates: `v0.68.0`] - `go.opentelemetry.io/otel v1.43.0` - `go.opentelemetry.io/otel/sdk v1.43.0` - `go.opentelemetry.io/otel/trace v1.43.0` - `golang.org/x/sync v0.20.0` - `google.golang.org/api v0.273.1` → [Updates: `v0.274.0`] - `google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9@9d38bb4040a9` → [Updates: `v0.0.0-20260406210006-6f92a3bedf2d`] - `google.golang.org/protobuf v1.36.11` - `gopkg.in/dnaeon/go-vcr.v4 v4.0.6` - `k8s.io/apimachinery v0.35.3` </details> <details><summary>tools/apitester/go.mod (7)</summary> - `go 1.26.2` - `github.com/gkampitakis/go-snaps v0.5.21` - `github.com/google/go-cmp v0.7.0` - `github.com/tidwall/gjson v1.18.0` - `github.com/tidwall/pretty v1.2.1` - `github.com/tidwall/sjson v1.2.5` - `gopkg.in/dnaeon/go-vcr.v4 v4.0.6` </details> <details><summary>tools/datastore-remover/go.mod (3)</summary> - `go 1.26.2` - `cloud.google.com/go/datastore v1.22.0` - `google.golang.org/api v0.273.0` → [Updates: `v0.274.0`] </details> <details><summary>tools/indexer-api-caller/go.mod (1)</summary> - `go 1.26.2` </details> <details><summary>vulnfeeds/go.mod (25)</summary> - `go 1.26.2` - `charm.land/lipgloss/v2 v2.0.2` - `cloud.google.com/go/secretmanager v1.16.0` → [Updates: `v1.17.0`] - `cloud.google.com/go/storage v1.61.3` → [Updates: `v1.62.0`] - `github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.31.0` → [Updates: `v1.32.0`] - `github.com/JohannesKaufmann/html-to-markdown/v2 v2.5.0` - `github.com/aquasecurity/go-pep440-version v0.0.1` - `github.com/atombender/go-jsonschema v0.23.0` - `github.com/fsouza/fake-gcs-server v1.54.0` - `github.com/gkampitakis/go-snaps v0.5.21` - `github.com/go-git/go-git/v5 v5.17.2` - `github.com/goccy/go-yaml v1.19.2` - `github.com/google/go-cmp v0.7.0` - `github.com/knqyf263/go-cpe v0.0.0-20230627041855-cb0794d06872@cb0794d06872` - `github.com/ossf/osv-schema/bindings/go v0.0.0-20260324022310-df534973d091@df534973d091` → [Updates: `v0.0.0-20260331231022-2a6a0b9b0ccd`] - `github.com/sethvargo/go-retry v0.3.0` - `go.opentelemetry.io/contrib/detectors/gcp v1.42.0` → [Updates: `v1.43.0`] - `go.opentelemetry.io/otel v1.43.0` - `go.opentelemetry.io/otel/sdk v1.43.0` - `go.opentelemetry.io/otel/trace v1.43.0` - `golang.org/x/text v0.35.0` → [Updates: `v0.36.0`] - `google.golang.org/api v0.273.1` → [Updates: `v0.274.0`] - `google.golang.org/protobuf v1.36.11` - `gopkg.in/dnaeon/go-vcr.v4 v4.0.6` - `gopkg.in/yaml.v2 v2.4.0` → [Updates: `v3.0.1`] </details> </blockquote> </details> <details><summary>npm (1)</summary> <blockquote> <details><summary>gcp/website/frontend3/package.json (19)</summary> - `@github/clipboard-copy-element 1.3.0` - `@hotwired/turbo 8.0.23` - `@material/data-table 14.0.0` - `@material/layout-grid 14.0.0` - `@material/theme 14.0.0` - `@material/web ^2.0.0` - `lit 3.3.2` - `copy-webpack-plugin ^14.0.0` - `css-loader ^7.1.3` - `html-webpack-plugin ^5.6.6` - `mini-css-extract-plugin ^2.10.0` - `raw-loader ^4.0.2` - `sass ^1.97.3` - `sass-loader ^16.0.0` - `style-loader ^4.0.0` - `webpack ^5.105.4` → [Updates: `^5.105.4`] - `webpack-bundle-analyzer ^5.0.0` - `webpack-cli ^7.0.0` - `webpack-dev-server ^5.2.3` </details> </blockquote> </details> <details><summary>poetry (7)</summary> <blockquote> <details><summary>gcp/api/pyproject.toml (8)</summary> - `google-cloud-ndb ==2.4.0` → [Updates: `==2.4.2`] - `google-cloud-logging ==3.13.0` → [Updates: `==3.15.0`] - `packaging ==26.0` - `requests ==2.33.0` → [Updates: `==2.33.1`] - `poetry-core >=2.0.0` - `mypy-protobuf ^5.0.0` - `yapf *` - `pylint *` </details> <details><summary>gcp/functions/pypi/pyproject.toml (5)</summary> - `cryptography ==46.0.7` - `google-cloud-secret-manager ==2.26.0` → [Updates: `==2.27.0`] - `osv ==0.1.2` - `requests ==2.33.0` → [Updates: `==2.33.1`] - `poetry-core >=2.0.0` </details> <details><summary>gcp/website/pyproject.toml (20)</summary> - `Flask ==3.1.3` - `Flask-Caching ==2.3.1` - `Flask-Compress ==1.24` - `werkzeug ==3.1.8` - `google-auth ==2.49.1` → [Updates: `==2.49.2`] - `google-cloud-ndb ==2.4.2` - `google-cloud-logging ==3.15.0` - `google-cloud-storage ==3.10.1` - `jinja2 ==3.1.6` - `markdown2 ==2.5.5` - `markupsafe ==3.0.3` - `packageurl-python ==0.17.6` - `redis ==6.4.0` - `requests ==2.33.1` - `gunicorn ==25.3.0` - `whitenoise ==6.12.0` - `cvss ==3.6` - `poetry-core >=2.0.0` - `yapf *` - `pylint *` </details> <details><summary>gcp/workers/oss_fuzz_worker/pyproject.toml (15)</summary> - `google-auth-httplib2 ==0.3.0` → [Updates: `==0.3.1`] - `google-api-python-client ==2.192.0` → [Updates: `==2.193.0`] - `google-cloud-pubsub ==2.35.0` → [Updates: `==2.36.0`] - `google-cloud-ndb ==2.4.0` → [Updates: `==2.4.2`] - `google-cloud-storage ==3.9.0` → [Updates: `==3.10.1`] - `pyyaml ==6.0.3` - `redis ==6.4.0` - `packageurl-python ==0.17.6` - `pygit2 ==1.19.1` → [Updates: `==1.19.2`] - `requests ==2.33.0` → [Updates: `==2.33.1`] - `jsonschema ==4.26.0` - `vanir ==1.0.2` - `poetry-core >=2.0.0` - `yapf *` - `pylint *` </details> <details><summary>gcp/workers/worker/pyproject.toml (15)</summary> - `google-auth-httplib2 ==0.3.0` → [Updates: `==0.3.1`] - `google-api-python-client ==2.192.0` → [Updates: `==2.193.0`] - `google-cloud-pubsub ==2.35.0` → [Updates: `==2.36.0`] - `google-cloud-ndb ==2.4.0` → [Updates: `==2.4.2`] - `google-cloud-storage ==3.9.0` → [Updates: `==3.10.1`] - `pyyaml ==6.0.3` - `redis ==6.4.0` - `packageurl-python ==0.17.6` - `pygit2 ==1.19.1` → [Updates: `==1.19.2`] - `requests ==2.33.0` → [Updates: `==2.33.1`] - `jsonschema ==4.26.0` - `vanir ==1.0.2` - `poetry-core >=2.0.0` - `yapf *` - `pylint *` </details> <details><summary>pyproject.toml (20)</summary> - `google-cloud-ndb >=2.3` → [Updates: `>=2.3`] - `google-cloud-logging >=3.10` - `google-cloud-pubsub >=2.31.1` → [Updates: `>=2.31.1`] - `google-cloud-storage >=2.17` - `semver >=3.0` - `packageurl-python >=0.17.0` - `pyyaml >=6.0` - `pygit2 >=1.14.0` - `attrs >=23.2` - `jsonschema >=4.0` - `grpcio >=1.0` - `packaging-legacy >=23.0.post0` - `requests >=2.33` - `poetry-core >=2.0.0` - `yapf *` - `pylint *` - `grpcio-tools *` - `mypy-protobuf ^5.0.0` - `vcrpy *` - `hypothesis *` → [Updates: `*`] </details> <details><summary>tools/datafix/pyproject.toml (7)</summary> - `google-cloud-ndb ==2.4.1` → [Updates: `==2.4.2`] - `google-cloud-storage ==3.10.1` - `pyyaml ==6.0.3` - `google-cloud-pubsub >=2.25.2` → [Updates: `>=2.25.2`] - `poetry-core >=2.0.0` - `yapf *` - `pylint *` </details> </blockquote> </details> <details><summary>regex (4)</summary> <blockquote> <details><summary>deployment/terraform/environments/oss-vdb-test/main.tf (1)</summary> - `gcr.io/endpoints-release/endpoints-runtime-serverless 2.55.1` </details> <details><summary>deployment/terraform/environments/oss-vdb/main.tf (1)</summary> - `gcr.io/endpoints-release/endpoints-runtime-serverless 2.55.1` </details> <details><summary>gcp/workers/linter/Dockerfile (1)</summary> - `osv-schema main@2a6a0b9b0ccd8b91eeec05081b2642f53cfbe81e` </details> <details><summary>osv/models.py (1)</summary> - `ossf/osv-schema 1.7.5` </details> </blockquote> </details> <details><summary>terraform (3)</summary> <blockquote> <details><summary>deployment/terraform/environments/oss-vdb-test/main.tf (4)</summary> - `external ~> 2.3.3` - `google ~> 7.17.0` → [Updates: `~> 7.27.0`] - `google-beta ~> 7.17.0` → [Updates: `~> 7.27.0`] - `null ~> 3.2.2` </details> <details><summary>deployment/terraform/environments/oss-vdb/main.tf (4)</summary> - `external ~> 2.3.3` - `google ~> 7.17.0` → [Updates: `~> 7.27.0`] - `google-beta ~> 7.17.0` → [Updates: `~> 7.27.0`] - `null ~> 3.2.2` </details> <details><summary>deployment/terraform/modules/osv/website.tf (1)</summary> - `terraform-google-modules/lb-http/google ~> 14.0` </details> </blockquote> </details> --- - [ ] <!-- manual job -->Check this box to trigger a request for Renovate to run again on this repository
This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.
Awaiting Schedule
The following updates are awaiting their schedule. To get an update now, click on a checkbox below.
google-cloud-ndb,google.golang.org/api)cloud.google.com/go/monitoring,github.com/go-git/go-git/v6,google.golang.org/api,google.golang.org/grpc)cloud.google.com/go/secretmanager,google.golang.org/api)Pending Status Checks
The following updates await pending status checks. To force their creation now, click on a checkbox below.
google-auth,webpack)google,google-beta)Open
The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.
google-api-python-client,google-auth-httplib2,google-cloud-logging,google-cloud-ndb,google-cloud-pubsub,google-cloud-secret-manager,google-cloud-storage,pygit2,requests)Detected Dependencies
bundler (1)
cloudbuild (10)
dockerfile (36)
git-submodules (1)
github-actions (13)
gomod (8)
npm (1)
poetry (7)
regex (4)
terraform (3)