Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.
[View this repository on the Mend.io Web Portal](https://developer.mend.io/github/google/osv-scanner). ## Pending Status Checks The following updates await pending status checks. To force their creation now, click on a checkbox below. - [ ] chore(deps): update alpine:3.24 docker digest to 294b683 - [ ] chore(deps): update golang:1.27.1-alpine3.23 docker digest to 96a6b03 - [ ] chore(deps): update codecov/codecov-action action to v7.1.1 - [ ] [fix(deps): update osv-scanner minor](../pull/3067) (`github.com/modelcontextprotocol/go-sdk`, `github.com/ossf/osv-schema/bindings/go`, `github.com/urfave/cli/v3`, `google.golang.org/grpc`, `osv.dev/bindings/go`) ## Open The following updates have all been created. To force a retry/rebase of any, click on a checkbox below. - [ ] [chore(deps): update workflows](../pull/3084) (`actions/deploy-pages`, `docker/setup-qemu-action`, `github/codeql-action`, `zizmorcore/zizmor-action`) - [ ] [fix(deps): update module github.com/gobwas/glob to v1](../pull/3048) - [ ] [chore(deps): lock file maintenance](../pull/3085) - [ ] **Click on this checkbox to rebase all open PRs at once** ## PR Closed (Blocked) The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below. - [ ] [chore(deps): update dependency system.text.regularexpressions to 4.3.1 [security]](../pull/2845) - [ ] [chore(deps): update dependency newtonsoft.json to v13 [security]](../pull/2838) ## Detected Dependencies bundler (1)

docs/Gemfile (16) - `ruby ~> 4` - `jekyll "~> 4.4.0"` - `csv lock file @ 3.3.6` - `base64 lock file @ 0.3.0` - `jekyll-feed "~> 0.15"` - `jekyll-relative-links lock file @ 0.8.0` - `jekyll-optional-front-matter lock file @ 0.3.3` - `jekyll-readme-index lock file @ 0.4.0` - `jekyll-default-layout lock file @ 0.2.0` - `jekyll-titles-from-headings lock file @ 0.5.4` - `just-the-docs lock file @ 0.12.0` - `jekyll-github-metadata lock file @ 2.16.1` - `tzinfo ">= 1", "< 3"` - `wdm "~> 0.2.0"` - `http_parser.rb "~> 0.8.0"` - `webrick "~> 1.7"`

dockerfile (6)

action.dockerfile (2) - `golang 1.27.1-alpine3.23@sha256:d9e2f2f07b10cc922da3e80e035c3058810b328d5aef82d2c63680967c5e2ec9` → [Updates: `1.27.1-alpine3.23`] - `alpine 3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b` → [Updates: `3.24`] Dockerfile (2) - `golang 1.27.1-alpine3.23@sha256:d9e2f2f07b10cc922da3e80e035c3058810b328d5aef82d2c63680967c5e2ec9` → [Updates: `1.27.1-alpine3.23`] - `alpine 3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b` → [Updates: `3.24`] docs/docs.Dockerfile (1) - `ruby 4@sha256:8dc3950712ad2078bdd275b890419ba2fd3aab5a0653b291a7325f0d8a24ca05` goreleaser-action.dockerfile (1) - `golang 1.27.1-alpine3.23@sha256:d9e2f2f07b10cc922da3e80e035c3058810b328d5aef82d2c63680967c5e2ec9` → [Updates: `1.27.1-alpine3.23`] goreleaser.dockerfile (1) - `golang 1.27.1-alpine3.23@sha256:d9e2f2f07b10cc922da3e80e035c3058810b328d5aef82d2c63680967c5e2ec9` → [Updates: `1.27.1-alpine3.23`] scripts/test_env.dockerfile (1) - `golang 1.27.1-alpine3.23@sha256:d9e2f2f07b10cc922da3e80e035c3058810b328d5aef82d2c63680967c5e2ec9` → [Updates: `1.27.1-alpine3.23`]

github-actions (21)

.github/workflows/cassettes.yml (3) - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1` .github/workflows/checks.yml (7) - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` .github/workflows/codeql-analysis.yml (5) - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `github/codeql-action v4.37.9@cdf488f595d80d6e07e03d4674febd5ab45fa938` → [Updates: `v4.38.0`] - `github/codeql-action v4.37.9@cdf488f595d80d6e07e03d4674febd5ab45fa938` → [Updates: `v4.38.0`] - `github/codeql-action v4.37.9@cdf488f595d80d6e07e03d4674febd5ab45fa938` → [Updates: `v4.38.0`] .github/workflows/dependencies.yml (3) - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1` .github/workflows/docs-deploy.yml (6) - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ruby/setup-ruby v1.321.0@95ef2b042f9d7a56d8268cba8559e2842e2ad01b` → [Updates: `v1.324.0`] - `actions/configure-pages v6.0.0@45bfe0192ca1faeb007ade9deae92b16b8254a0d` - `actions/upload-pages-artifact v5@fc324d3547104276b827a68afc52ff2a11cc49c9` - `actions/deploy-pages v5.0.0@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128` → [Updates: `v5.0.1`] - `ruby 4.0.6` → [Updates: `4.0.7`] .github/workflows/goreleaser-nightly.yml (7) - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` → [Updates: `v4.3.0`] - `docker/setup-buildx-action v4.3.0@37fe631027851001ddb9b187196cc803df7f5f0e` → [Updates: `v4.4.1`] - `docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f` - `goreleaser/goreleaser-action v7.2.3@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94` - `goreleaser/goreleaser ~> v2` .github/workflows/goreleaser.yml (8) - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` → [Updates: `v4.3.0`] - `docker/setup-buildx-action v4.3.0@37fe631027851001ddb9b187196cc803df7f5f0e` → [Updates: `v4.4.1`] - `docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f` - `goreleaser/goreleaser-action v7.2.3@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94` - `slsa-framework/slsa-github-generator v2.1.0` - `goreleaser/goreleaser ~> v2` .github/workflows/links.yml (2) - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `tcort/github-action-markdown-link-check v1.1.3@e047c5b37f24ab722bbef1a27b6fab7f96bc4068` .github/workflows/osv-scanner-reusable-pr.yml .github/workflows/osv-scanner-reusable.yml .github/workflows/osv-scanner-unified-action.yml (2) - `google/osv-scanner-action nightly` - `google/osv-scanner-action nightly` .github/workflows/prerelease-check.yml (16) - `google/osv-scanner-action main` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `tcort/github-action-markdown-link-check v1.1.3@e047c5b37f24ab722bbef1a27b6fab7f96bc4068` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` .github/workflows/renovate-validator.yml (2) - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020` .github/workflows/scorecards.yml (4) - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ossf/scorecard-action v2.4.4@2d1146689b8cda280b9bc96326124645441f03bc` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `github/codeql-action v4.37.9@cdf488f595d80d6e07e03d4674febd5ab45fa938` → [Updates: `v4.38.0`] .github/workflows/snapshots.yml (3) - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1` .github/workflows/staleness.yml (1) - `actions/stale v11.0.0@4391f3da665fdf50b6810c1a66712fb9ba21aa93` .github/workflows/tests.yml (14) - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `dorny/paths-filter v4.0.3@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` → [Updates: `v4.3.0`] - `docker/setup-buildx-action v4.3.0@37fe631027851001ddb9b187196cc803df7f5f0e` → [Updates: `v4.4.1`] - `goreleaser/goreleaser-action v7.2.3@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94` - `goreleaser/goreleaser ~> v2` .github/workflows/title.yml (1) - `amannn/action-semantic-pull-request v6.1.1@48f256284bd46cdaab1048c3721360e808335d50` .github/workflows/zizmor.yml (2) - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `zizmorcore/zizmor-action v0.6.2@3dc1ecc9bcb9e94e9b2c709687979e1298497054` → [Updates: `v0.6.4`] actions/internal/lint-action/action.yml (1) - `golangci/golangci-lint-action v9.3.0@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a` actions/internal/test-action/action.yml (1) - `codecov/codecov-action v7.0.0@fb8b3582c8e4def4969c97caa2f19720cb33a72f` → [Updates: `v7.1.1`]

gomod (1)

go.mod (27) - `go 1.27.0` - `charm.land/glamour/v2 v2.0.1` - `charm.land/lipgloss/v2 v2.0.6` - `github.com/BurntSushi/toml v1.6.0` - `github.com/CycloneDX/cyclonedx-go v0.12.0` - `github.com/gkampitakis/go-snaps v0.5.23` - `github.com/go-git/go-git/v5 v5.19.2` - `github.com/gobwas/glob v0.2.3` → [Updates: `v1.0.0`] - `github.com/google/go-cmp v0.7.0` - `github.com/ianlancetaylor/demangle v0.0.0-20260724033716-83e58baca724@83e58baca724` - `github.com/jedib0t/go-pretty/v6 v6.8.3` - `github.com/modelcontextprotocol/go-sdk v1.7.0` → [Updates: `v1.8.0`] - `github.com/opencontainers/go-digest v1.0.0` - `github.com/ossf/osv-schema/bindings/go v0.0.0-20260902031056-b388a18021a3@b388a18021a3` → [Updates: `v0.0.0-20260915070347-423306dd97fb`] - `github.com/owenrumney/go-sarif/v3 v3.3.1` - `github.com/package-url/packageurl-go v0.1.7` - `github.com/pandatix/go-cvss v0.6.4` - `github.com/tidwall/gjson v1.19.0` - `github.com/tidwall/pretty v1.2.1` - `github.com/tidwall/sjson v1.2.5` - `github.com/urfave/cli/v3 v3.11.0` → [Updates: `v3.12.0`] - `go.yaml.in/yaml/v4 v4.0.0-rc.6` - `golang.org/x/term v0.46.0` - `google.golang.org/grpc v1.83.2` → [Updates: `v1.84.0`] - `google.golang.org/protobuf v1.36.12` - `gopkg.in/dnaeon/go-vcr.v4 v4.0.7` - `osv.dev/bindings/go v0.0.0-20260805021707-3a57b89df3b6@3a57b89df3b6` → [Updates: `v0.0.0-20260918051206-70c45ffb6785`]

nuget (2)

cmd/osv-scanner/scan/source/testdata/locks-dotnet/Directory.Packages.props (1) - `System.Text.RegularExpressions 4.3.0` → [Updates: `4.3.1`] cmd/osv-scanner/scan/source/testdata/locks-dotnet/test.csproj (1) - `Newtonsoft.Json 12.0.1` → [Updates: `13.0.1`]

--- - [ ] Check this box to trigger a request for Renovate to run again on this repository