fix(deps): update osv-scalibr minor - autoclosed

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
deps.dev/api/v3	v3.0.0-20250616031631-419a06b41f9b -> v3.0.0-20250729065307-991cf8720f82			require	patch
deps.dev/api/v3alpha	419a06b -> 991cf87			require	digest
deps.dev/util/maven	419a06b -> 991cf87			require	digest
deps.dev/util/pypi	419a06b -> 991cf87			require	digest
deps.dev/util/resolve	419a06b -> 991cf87			require	digest
deps.dev/util/semver	1c74ed2 -> 991cf87			require	digest
github.com/charmbracelet/bubbletea	v1.3.5 -> v1.3.6			require	patch
github.com/docker/docker	v28.2.2+incompatible -> v28.3.3+incompatible			require	minor
github.com/michaelkedar/xml	021a7b1 -> 4ec9e09			require	digest
github.com/ossf/osv-schema/bindings/go	6624686 -> 0fc8769			require	digest
go.etcd.io/bbolt	v1.4.1 -> v1.4.2			require	patch
golang.org/x/crypto	v0.39.0 -> v0.40.0			require	minor
golang.org/x/mod	v0.25.0 -> v0.26.0			require	minor
golang.org/x/net	v0.41.0 -> v0.42.0			require	minor
golang.org/x/sync	v0.15.0 -> v0.16.0			require	minor
golang.org/x/sys	v0.33.0 -> v0.34.0			require	minor
golang.org/x/term	v0.32.0 -> v0.33.0			require	minor
golang.org/x/text	v0.26.0 -> v0.27.0			require	minor
google.golang.org/grpc	v1.73.0 -> v1.74.2			require	minor
modernc.org/sqlite	v1.38.0 -> v1.38.2			require	patch

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

charmbracelet/bubbletea (github.com/charmbracelet/bubbletea)

v1.3.6

Compare Source

This version fixes some important issues regarding tea.Exec output after resuming from the executed program, and Windows losing input character on successive program execution.

Big thanks to @​raphaelvigee and @​joshallenit for working on these issues, you're the best!

Changelog

Bug fixes

• 0a63003: fix: Windows: first character input lost on successive programs (#​1368) (@​joshallenit)
• 78ed49b: fix: maintain exec output (#​1276) (@​raphaelvigee)

Documentation updates

• 1b0f489: docs(readme): cleanup badges (@​meowgorithm)

Other work

• ca9473b: ci: sync golangci-lint config (#​1431) (@​github-actions[bot])

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.

docker/docker (github.com/docker/docker)

v28.3.3+incompatible

Compare Source

v28.3.2+incompatible

Compare Source

v28.3.1+incompatible

Compare Source

v28.3.0+incompatible

Compare Source

etcd-io/bbolt (go.etcd.io/bbolt)

v1.4.2

Compare Source

See the CHANGELOG/v1.4.2 for more details.

grpc/grpc-go (google.golang.org/grpc)

v1.74.2: Release 1.74.2

Compare Source

API Changes

• balancer: add ExitIdle method to Balancer interface. Earlier, implementing this method was optional. (#​8367)

Behavior Changes

• xds: Remove the GRPC_EXPERIMENTAL_ENABLE_LEAST_REQUEST environment variable that allows disabling the least request balancer with xDS. Least request was made available by default with xDS in v1.72.0. (#​8248)
  • Special Thanks: @​atollena
• server: allow 0s grpc-timeout header values, which older gRPC-Java versions could send. This restores the behavior of grpc-go before v1.73.0. (#​8439)

Bug Fixes

• googledirectpath: avoid logging the error message Attempt to set a bootstrap configuration... when creating multiple directpath channels. (#​8419)

Performance Improvements

• transport: reduce heap allocations by pooling objects and avoiding method-to-closure conversions. (#​8361)
• transport: reduce heap allocations by re-using mem.Reader objects. (#​8360)

Documentation

• examples: add examples to demonstrate enabling experimental metrics using the OpenTelemetry plugin. (#​8388)
  • Special Thanks: @​vinothkumarr227

v1.74.1: Release 1.74.1

Compare Source

Version 1.74.1 retracts release v1.74.0 and itself. Release 1.74.0 was accidentally tagged on the wrong commit and should not be used. Version 1.73.0 should be used until 1.74.2 is released.

v1.74.0: Release 1.74.0

Compare Source

Release 1.74.0 was accidentally tagged on the wrong commit and should not be used. Version 1.73.0 should be used until 1.74.1 is released.

cznic/sqlite (modernc.org/sqlite)

v1.38.2

Compare Source

v1.38.1

Compare Source

---

Configuration

📅 Schedule: Branch creation - "before 6am on monday" in timezone Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[forking-renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 5 additional dependencies were updated

Details:

Package	Change
github.com/charmbracelet/x/ansi	v0.8.0 -> v0.9.3
golang.org/x/exp	v0.0.0-20250408133849-7e4ce0ab07d0 -> v0.0.0-20250620022241-b7579e27df2b
google.golang.org/genproto/googleapis/api	v0.0.0-20250324211829-b45e905df463 -> v0.0.0-20250528174236-200df99c418a
google.golang.org/genproto/googleapis/rpc	v0.0.0-20250324211829-b45e905df463 -> v0.0.0-20250528174236-200df99c418a
modernc.org/libc	v1.65.10 -> v1.66.3