Dependency Dashboard

[forking-renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Awaiting Schedule

These updates are awaiting their schedule. Click on a checkbox to get an update now.

• fix(deps): update module github.com/go-git/go-git/v5 to v5.14.0
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• fix(deps): lock file maintenance vulnfeeds (undefined, github.com/go-git/go-git/v5, golang)
• fix(deps): lock file maintenance workers (undefined, google-api-python-client)

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

• chore(deps): update golang docker tag to v1.24.0

Detected dependencies

bundler

docs/Gemfile

• github-pages undefined
• jekyll-feed "~> 0.12"
• tzinfo ">= 1", "< 3"
• wdm "~> 0.2.0"
• http_parser.rb "~> 0.6.0"
• webrick "~> 1.7"

cloudbuild

cloudbuild.yaml

docker/terraform/cloudbuild.yaml

vulnfeeds/cloudbuild.yaml

vulnfeeds/pypi/cloudbuild.yaml

dockerfile

actions/analyze/Dockerfile

docker/ci/Dockerfile

docker/deployment/Dockerfile

• ubuntu 22.04@sha256:ed1544e454989078f5dec1bfdabd8c5cc9c48e0705d07b678ab6ae3fb61952d2

docker/terraform/Dockerfile

• golang 1.23.6-alpine@sha256:f8113c4b13e2a8b3a168dceaee88ac27743cc84e959f43b9dbd2291e9c3f57a0
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:f16707c13f8dc6190a4bf140705789d6e770dada9e35705064b259a7e243291b

docker/worker-base/Dockerfile

• ubuntu 20.04@sha256:8e5c4f0285ecbb4ead070431d29b576a530d3166df73ec44affc1cd27555141b

gcp/api/Dockerfile

gcp/api/Dockerfile.esp

• gcr.io/endpoints-release/endpoints-runtime 2

gcp/indexer/Dockerfile

• golang 1.23.6-alpine@sha256:f8113c4b13e2a8b3a168dceaee88ac27743cc84e959f43b9dbd2291e9c3f57a0
• gcr.io/distroless/base-debian12 sha256:74ddbf52d93fafbdd21b399271b0b4aac1babf8fa98cab59e5692e01169a1348

gcp/website/Dockerfile

• node 20.18@sha256:bcf90f85634194bc51e92f8add1221c7fdeeff94b7f1ff360aeaa7498086d641

gcp/workers/alias/Dockerfile

gcp/workers/cron/Dockerfile

gcp/workers/exporter/Dockerfile

gcp/workers/importer/Dockerfile

gcp/workers/staging_api_test/Dockerfile

gcp/workers/worker/Dockerfile

vulnfeeds/cmd/alpine/Dockerfile

• golang 1.23.6-alpine@sha256:2c49857f2295e89b23b28386e57e018a86620a8fede5003900f2d138ba9c4037
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/combine-to-osv/Dockerfile

• golang 1.23.6-alpine@sha256:2c49857f2295e89b23b28386e57e018a86620a8fede5003900f2d138ba9c4037
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/cpe-repo-gen/Dockerfile

• golang 1.23.6-alpine@sha256:2c49857f2295e89b23b28386e57e018a86620a8fede5003900f2d138ba9c4037
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/debian-copyright-mirror/Dockerfile

• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/debian/Dockerfile

• golang 1.23.6-alpine@sha256:2c49857f2295e89b23b28386e57e018a86620a8fede5003900f2d138ba9c4037
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/download-cves/Dockerfile

• golang 1.23.6-alpine@sha256:2c49857f2295e89b23b28386e57e018a86620a8fede5003900f2d138ba9c4037
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/nvd-cve-osv/Dockerfile

• golang 1.23.6-alpine@sha256:2c49857f2295e89b23b28386e57e018a86620a8fede5003900f2d138ba9c4037
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/tools/debian/Dockerfile

• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

github-actions

.github/workflows/codeql-analysis.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• github/codeql-action v3.28.10@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d
• github/codeql-action v3.28.10@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d
• github/codeql-action v3.28.10@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d

.github/workflows/issue-signposting.yml

.github/workflows/link-checker-on-push.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• gaurav-nelson/github-action-markdown-link-check 1b916f2cf6c36510a6059943104e3c42ce6c16bc

.github/workflows/link-checker.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• gaurav-nelson/github-action-markdown-link-check 1b916f2cf6c36510a6059943104e3c42ce6c16bc

.github/workflows/lint.yaml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-python v5.4.0@42375524e23c412d93fb67b49958b491fce71c38
• actions/setup-go v5.3.0@f111f3307d8850f501ac008e886eec1fd1932a34
• hashicorp/setup-terraform v3.1.2@b9cd54a3c349d3f38e8881555d616ced269862dd

.github/workflows/osv-scanner-unified.yml

.github/workflows/pr-check.yml

• amannn/action-semantic-pull-request v5.5.3@0723387faaf9b38adef4775cd42cfd5155ed6017

.github/workflows/publish-to-pypi.yaml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-python v5.4.0@42375524e23c412d93fb67b49958b491fce71c38
• pypa/gh-action-pypi-publish v1.12.4@76f52bc884231f62b9a034ebfe128415bbaabdfc

.github/workflows/renovate-validator.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-node v4.2.0@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a

.github/workflows/scorecards.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• ossf/scorecard-action v2.4.1@f49aabe0b5af0936a0987cfb85d86b75731b0186
• actions/upload-artifact v4.6.1@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1
• github/codeql-action v2.28.1@b8d3b6e8af63cde30bdc382c0bc28114f4346c88

.github/workflows/staleness.yml

• actions/stale v9.1.0@5bef64f19d7facfb25b37b414482c7164d639639

gomod

docs/go.mod

• go 1.23.6
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1
• google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
• google.golang.org/protobuf v1.36.5

gcp/indexer/go.mod

• go 1.23.6
• cloud.google.com/go/datastore v1.20.0
• cloud.google.com/go/pubsub v1.47.0
• cloud.google.com/go/storage v1.50.0
• github.com/go-git/go-git/v5 v5.13.2
• github.com/golang/glog v1.2.4
• github.com/google/go-cmp v0.7.0
• golang.org/x/sync v0.11.0
• google.golang.org/api v0.223.0
• gopkg.in/yaml.v3 v3.0.1

tools/datastore-remover/go.mod

• go 1.23.6
• cloud.google.com/go/datastore v1.20.0
• google.golang.org/api v0.223.0

tools/indexer-api-caller/go.mod

• go 1.23.6

vulnfeeds/go.mod

• go 1.23.6
• cloud.google.com/go/logging v1.13.0
• cloud.google.com/go/secretmanager v1.14.5
• github.com/aquasecurity/go-pep440-version v0.0.1
• github.com/atombender/go-jsonschema v0.17.0
• github.com/go-git/go-git/v5 v5.13.2
• github.com/google/go-cmp v0.7.0
• github.com/google/osv-scanner v1.9.2
• github.com/knqyf263/go-cpe v0.0.0-20230627041855-cb0794d06872@cb0794d06872
• github.com/sethvargo/go-retry v0.3.0
• golang.org/x/exp v0.0.0-20250218142911-aa4b98e5adaa@aa4b98e5adaa
• gopkg.in/yaml.v2 v2.4.0

npm

gcp/website/frontend3/package.json

• @github/clipboard-copy-element 1.3.0
• @hotwired/turbo 7.3.0
• @material/data-table 13.0.0
• @material/layout-grid 13.0.0
• @material/theme 13.0.0
• @material/web ^1.5.0
• lit 2.8.0
• spicy-sections c3aae99dbf1e627cdf03a35c913d7f6e970de22b
• copy-webpack-plugin 10.2.4
• css-loader 6.11.0
• html-webpack-plugin 5.6.3
• mini-css-extract-plugin 2.9.2
• raw-loader 4.0.2
• sass 1.85.1
• sass-loader 12.6.0
• style-loader 3.3.4
• webpack 5.98.0
• webpack-bundle-analyzer 4.10.2
• webpack-cli 4.10.0
• webpack-dev-server 4.15.2

pep621

gcp/api/pyproject.toml

• google-cloud-ndb ==2.3.2
• google-cloud-logging ==3.11.4
• packaging ==20.9
• requests ==2.32.3
• google-cloud-profiler ==4.1.0
• poetry-core >=2.0.0

gcp/functions/pypi/pyproject.toml

• cryptography ==44.0.1
• google-cloud-secret-manager ==2.23.1
• osv ==0.0.22
• requests ==2.32.3
• poetry-core >=2.0.0

gcp/website/pyproject.toml

• Flask ==2.3.3
• Flask-Caching ==2.3.1
• Flask-Compress ==1.17
• werkzeug ==3.1.3
• google-auth ==2.38.0
• google-cloud-ndb ==2.3.2
• google-cloud-logging ==3.11.4
• jinja2 ==3.1.5
• markdown2 ==2.5.3
• markupsafe ==2.1.5
• packageurl-python ==0.16.0
• redis ==4.6.0
• requests ==2.32.3
• gunicorn ==22.0.0
• whitenoise ==6.9.0
• cvss ==3.4
• poetry-core >=2.0.0

gcp/workers/worker/pyproject.toml

• google-auth-httplib2 ==0.2.0
• google-api-python-client ==2.161.0
• google-cloud-pubsub ==2.28.0
• google-cloud-ndb ==2.3.2
• google-cloud-storage ==2.19.0
• pyyaml ==6.0.2
• redis ==5.2.1
• packageurl-python ==0.16.0
• pygit2 ==1.17.0
• requests ==2.32.3
• jsonschema ==4.23.0
• poetry-core >=2.0.0

pyproject.toml

• google-cloud-ndb >=2.3
• google-cloud-logging >=3.10
• google-cloud-storage >=2.17
• semver >=3.0
• packageurl-python ==0.16.0
• pyyaml >=6.0
• pygit2 >=1.14.0
• attrs >=23.2
• jsonschema >=4.0
• grpcio >=1.0
• packaging <22.0
• requests >=2.32
• poetry-core >=2.0.0

tools/datafix/pyproject.toml

• google-cloud-ndb ==2.3.2
• google-cloud-storage ==2.19.0
• pyyaml ==6.0.2
• google-cloud-pubsub >=2.25.2
• poetry-core >=2.0.0

vulnfeeds/tools/debian/debian_converter/pyproject.toml

• markdownify ==0.14.1
• pandas ==2.2.3
• python-dateutil ==2.9.0.post0
• poetry-core >=2.0.0

poetry

gcp/api/pyproject.toml

• mypy-protobuf ^3.6.0
• yapf *
• pylint *

gcp/website/pyproject.toml

• yapf *
• pylint *

gcp/workers/worker/pyproject.toml

• yapf *
• pylint *

pyproject.toml

• yapf *
• pylint *
• grpcio-tools *
• mypy-protobuf ^3.6.0

tools/datafix/pyproject.toml

• yapf *
• pylint *

vulnfeeds/tools/debian/debian_converter/pyproject.toml

• yapf *
• pylint *

terraform

deployment/terraform/environments/oss-vdb-test/main.tf

• external ~> 2.3.3
• google ~> 5.45.0
• google-beta ~> 5.45.0
• null ~> 3.2.2

deployment/terraform/environments/oss-vdb/main.tf

• external ~> 2.3.3
• google ~> 5.45.0
• google-beta ~> 5.45.0
• null ~> 3.2.2

deployment/terraform/modules/osv/website.tf

• terraform-google-modules/lb-http/google ~> 10.0

---

• Check this box to trigger a request for Renovate to run again on this repository