Dependency Dashboard
Author: renovate-sh-app[bot]Created Oct 10, 2025Updated Sep 18, 2026
> ℹ️ **Note**
>
> This PR body was truncated due to platform limits.
This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.
## Abandoned Dependencies
The following dependencies have not received updates for an extended period and may be unmaintained.
View abandoned dependencies (93)
> [!NOTE]
Packages are marked as abandoned when they exceed the [`abandonmentThreshold`](https://docs.renovatebot.com/configuration-options/#abandonmentthreshold) since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity.
>
| Datasource | Package | Last Updated |
|------------|------|-------------|
| gomod | [github.com/alecthomas/kingpin/v2](https://redirect.github.com/alecthomas/kingpin) | `2023-11-16` |
| gomod | [github.com/aliyun/aliyun-oss-go-sdk](https://redirect.github.com/aliyun/aliyun-oss-go-sdk) | `2023-12-28` |
| gomod | [github.com/bahlo/generic-list-go](https://redirect.github.com/bahlo/generic-list-go) | `2022-02-08` |
| gomod | [github.com/basgys/goxml2json](https://redirect.github.com/basgys/goxml2json) | `2017-07-12` |
| gomod | [github.com/bboreham/go-loser](https://redirect.github.com/bboreham/go-loser) | `2023-09-20` |
| gomod | [github.com/benbjohnson/immutable](https://redirect.github.com/benbjohnson/immutable) | `2023-02-04` |
| gomod | [github.com/beorn7/perks](https://redirect.github.com/beorn7/perks) | `2019-07-31` |
| gomod | [github.com/cespare/xxhash/v2](https://redirect.github.com/cespare/xxhash) | `2024-04-04` |
| gomod | [github.com/chainguard-dev/git-urls](https://redirect.github.com/chainguard-dev/git-urls) | `2023-12-21` |
| gomod | [github.com/clbanning/mxj](https://redirect.github.com/clbanning/mxj) | `2023-07-24` |
| gomod | [github.com/colega/go-yaml-yaml](https://redirect.github.com/colega/go-yaml-yaml) | `2022-05-27` |
| gomod | [github.com/colega/zeropool](https://redirect.github.com/colega/zeropool) | `2023-05-05` |
| gomod | [github.com/coreos/etcd](https://redirect.github.com/coreos/etcd) | `2021-10-15` |
| gomod | [github.com/coreos/go-semver](https://redirect.github.com/coreos/go-semver) | `2023-01-16` |
| gomod | [github.com/coreos/go-systemd](https://redirect.github.com/coreos/go-systemd) | `2019-11-04` |
| gomod | [github.com/coreos/pkg](https://redirect.github.com/coreos/pkg) | `2024-01-22` |
| gomod | [github.com/davecgh/go-spew](https://redirect.github.com/davecgh/go-spew) | `2018-02-21` |
| gomod | [github.com/dennwc/varint](https://redirect.github.com/dennwc/varint) | `2019-06-16` |
| gomod | [github.com/dgryski/go-groupvarint](https://redirect.github.com/dgryski/go-groupvarint) | `2023-06-30` |
| gomod | [github.com/dolthub/maphash](https://redirect.github.com/dolthub/maphash) | `2023-04-03` |
| gomod | [github.com/dolthub/swiss](https://redirect.github.com/dolthub/swiss) | `2023-08-28` |
| gomod | [github.com/drone/envsubst](https://redirect.github.com/drone/envsubst) | `2021-06-16` |
| gomod | [github.com/efficientgo/core](https://redirect.github.com/efficientgo/core) | `2024-08-29` |
| gomod | [github.com/efficientgo/e2e](https://redirect.github.com/efficientgo/e2e) | `2022-11-28` |
| gomod | [github.com/facette/natsort](https://redirect.github.com/facette/natsort) | `2018-12-10` |
| gomod | [github.com/felixge/fgprof](https://redirect.github.com/felixge/fgprof) | `2024-08-30` |
| gomod | [github.com/go-kit/log](https://redirect.github.com/go-kit/log) | `2022-05-14` |
| gomod | [github.com/go-logr/stdr](https://redirect.github.com/go-logr/stdr) | `2021-12-15` |
| gomod | [github.com/gogo/googleapis](https://redirect.github.com/gogo/googleapis) | `2021-03-16` |
| gomod | [github.com/gogo/protobuf](https://redirect.github.com/gogo/protobuf) | `2021-01-10` |
| gomod | [github.com/gogo/status](https://redirect.github.com/gogo/status) | `2022-06-15` |
| gomod | [github.com/golang/protobuf](https://redirect.github.com/golang/protobuf) | `2024-03-06` |
| gomod | [github.com/google/btree](https://redirect.github.com/google/btree) | `2024-08-21` |
| gomod | [github.com/google/uuid](https://redirect.github.com/google/uuid) | `2024-01-23` |
| gomod | [github.com/gorilla/mux](https://redirect.github.com/gorilla/mux) | `2023-11-05` |
| gomod | [github.com/grafana/memberlist](https://redirect.github.com/grafana/memberlist) | `2021-11-12` |
| gomod | [github.com/hashicorp/errwrap](https://redirect.github.com/hashicorp/errwrap) | `2020-07-14` |
| gomod | [github.com/hashicorp/go-cleanhttp](https://redirect.github.com/hashicorp/go-cleanhttp) | `2021-02-03` |
| gomod | [github.com/hashicorp/go-hclog](https://redirect.github.com/hashicorp/go-hclog) | `2024-04-01` |
| gomod | [github.com/hashicorp/go-immutable-radix](https://redirect.github.com/hashicorp/go-immutable-radix) | `2023-11-21` |
| gomod | [github.com/hashicorp/go-multierror](https://redirect.github.com/hashicorp/go-multierror) | `2021-03-11` |
| gomod | [github.com/hashicorp/go-rootcerts](https://redirect.github.com/hashicorp/go-rootcerts) | `2019-12-10` |
| gomod | [github.com/hashicorp/golang-lru](https://redirect.github.com/hashicorp/golang-lru) | `2023-09-29` |
| gomod | [github.com/hashicorp/golang-lru/v2](https://redirect.github.com/hashicorp/golang-lru) | `2023-09-29` |
| gomod | [github.com/jpillora/backoff](https://redirect.github.com/jpillora/backoff) | `2019-10-03` |
| gomod | [github.com/json-iterator/go](https://redirect.github.com/json-iterator/go) | `2021-09-11` |
| gomod | [github.com/julienschmidt/httprouter](https://redirect.github.com/julienschmidt/httprouter) | `2019-09-30` |
| gomod | [github.com/kr/pretty](https://redirect.github.com/kr/pretty) | `2022-08-29` |
| gomod | [github.com/kr/text](https://redirect.github.com/kr/text) | `2020-02-14` |
| gomod | [github.com/kylelemons/godebug](https://redirect.github.com/kylelemons/godebug) | `2019-05-05` |
| gomod | [github.com/minio/md5-simd](https://redirect.github.com/minio/md5-simd) | `2021-02-16` |
| gomod | [github.com/mitchellh/copystructure](https://redirect.github.com/mitchellh/copystructure) | `2021-05-05` |
| gomod | [github.com/mitchellh/go-homedir](https://redirect.github.com/mitchellh/go-homedir) | `2019-01-27` |
| gomod | [github.com/mitchellh/go-wordwrap](https://redirect.github.com/mitchellh/go-wordwrap) | `2020-09-25` |
| gomod | [github.com/mitchellh/mapstructure](https://redirect.github.com/mitchellh/mapstructure) | `2022-04-20` |
| gomod | [github.com/mitchellh/reflectwalk](https://redirect.github.com/mitchellh/reflectwalk) | `2021-05-03` |
| gomod | [github.com/modern-go/concurrent](https://redirect.github.com/modern-go/concurrent) | `2018-03-06` |
| gomod | [github.com/modern-go/reflect2](https://redirect.github.com/modern-go/reflect2) | `2021-09-11` |
| gomod | [github.com/mozillazg/go-httpheader](https://redirect.github.com/mozillazg/go-httpheader) | `2023-06-29` |
| gomod | [github.com/munnerz/goautoneg](https://redirect.github.com/munnerz/goautoneg) | `2019-10-10` |
| gomod | [github.com/mwitkow/go-conntrack](https://redirect.github.com/mwitkow/go-conntrack) | `2019-07-16` |
| gomod | [github.com/opentracing/opentracing-go](https://redirect.github.com/opentracing/opentracing-go) | `2020-07-01` |
| gomod | [github.com/philhofer/fwd](https://redirect.github.com/philhofer/fwd) | `2024-09-16` |
| gomod | [github.com/pkg/browser](https://redirect.github.com/pkg/browser) | `2024-01-02` |
| gomod | [github.com/pkg/errors](https://redirect.github.com/pkg/errors) | `2020-01-14` |
| gomod | [github.com/planetscale/vtprotobuf](https://redirect.github.com/planetscale/vtprotobuf) | `2024-01-29` |
| gomod | [github.com/pmezard/go-difflib](https://redirect.github.com/pmezard/go-difflib) | `2016-01-10` |
| gomod | [github.com/rivo/uniseg](https://redirect.github.com/rivo/uniseg) | `2024-02-08` |
| gomod | [github.com/rs/xid](https://redirect.github.com/rs/xid) | `2024-08-23` |
| gomod | [github.com/sean-/seed](https://redirect.github.com/sean-/seed) | `2017-03-13` |
| gomod | [github.com/simonswine/tempopb](https://redirect.github.com/simonswine/tempopb) | `2024-01-26` |
| gomod | [github.com/uber/jaeger-client-go](https://redirect.github.com/uber/jaeger-client-go) | `2021-12-07` |
| gomod | [github.com/uber/jaeger-lib](https://redirect.github.com/uber/jaeger-lib) | `2021-03-29` |
| gomod | [github.com/valyala/bytebufferpool](https://redirect.github.com/valyala/bytebufferpool) | `2016-08-17` |
| gomod | [github.com/x448/float16](https://redirect.github.com/x448/float16) | `2020-01-17` |
| gomod | [github.com/xlab/treeprint](https://redirect.github.com/xlab/treeprint) | `2023-03-09` |
| gomod | [go.opentelemetry.io/otel/exporters/jaeger](https://redirect.github.com/open-telemetry/opentelemetry-go) | `2023-08-28` |
| gomod | [go.uber.org/goleak](https://redirect.github.com/uber-go/goleak) | `2023-10-24` |
| gomod | [go.uber.org/multierr](https://redirect.github.com/uber-go/multierr) | `2023-03-29` |
| gomod | [gopkg.in/check.v1](https://redirect.github.com/go-check/check) | `2020-11-30` |
| gomod | [gopkg.in/inf.v0](https://redirect.github.com/go-inf/inf) | `2018-03-26` |
| gomod | [gopkg.in/yaml.v2](https://redirect.github.com/go-yaml/yaml) | `2022-05-27` |
| gomod | [gopkg.in/yaml.v3](https://redirect.github.com/go-yaml/yaml) | `2022-05-27` |
| npm | [@types/tinycolor2](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped) | `2023-11-07` |
| npm | [tinycolor2](https://redirect.github.com/bgrins/TinyColor) | `2023-02-03` |
## Open
The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.
- [ ] [fix(security/low/): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 [security] (main)](../pull/5644)
- [ ] [fix(security/low/): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc to v1.45.0 [security] (main)](../pull/5645)
- [ ] [fix(security/low/): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 [security] (main)](../pull/5646)
- [ ] [fix(security/low/): update module go.opentelemetry.io/otel/sdk to v1.45.0 [security] (main)](../pull/5647)
- [ ] [fix(security/medium/): update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc to v0.21.0 [security] (main)](../pull/5648)
- [ ] [chore(deps): lock file maintenance (main)](../pull/5632)
- [ ] [fix(security/low/): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 [security] (release/v2.3)](../pull/5649)
- [ ] [fix(security/low/): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc to v1.45.0 [security] (release/v2.3)](../pull/5650)
- [ ] [fix(security/low/): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 [security] (release/v2.3)](../pull/5651)
- [ ] [fix(security/low/): update module go.opentelemetry.io/otel/sdk to v1.45.0 [security] (release/v2.3)](../pull/5652)
- [ ] [fix(security/medium/): update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc to v0.21.0 [security] (release/v2.3)](../pull/5653)
- [ ] [chore(deps): lock file maintenance (release/v2.3)](../pull/5633)
- [ ] [fix(security/low/): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 [security] (release/v2.2)](../pull/5654)
- [ ] [fix(security/low/): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc to v1.45.0 [security] (release/v2.2)](../pull/5655)
- [ ] [fix(security/low/): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 [security] (release/v2.2)](../pull/5656)
- [ ] [fix(security/low/): update module go.opentelemetry.io/otel/sdk to v1.45.0 [security] (release/v2.2)](../pull/5657)
- [ ] [fix(security/medium/): update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc to v0.21.0 [security] (release/v2.2)](../pull/5658)
- [ ] [chore(deps): lock file maintenance (release/v2.2)](../pull/5634)
- [ ] **Click on this checkbox to rebase all open PRs at once**
## Vulnerabilities
> [!IMPORTANT]
> `5`/`6` CVEs have Renovate fixes.
gomod
go.mod## Detected Dependencies > [!NOTE] > Detected dependencies section has been truncated Branch maingo.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc- [GHSA-w34q-cm8f-9c5x](https://osv.dev/vulnerability/GHSA-w34q-cm8f-9c5x) (fixed in >= 0.21.0)go.opentelemetry.io/otel/exporters/otlp/otlptrace- [GHSA-8wmf-6v46-5gfg](https://osv.dev/vulnerability/GHSA-8wmf-6v46-5gfg) (fixed in >= 1.45.0)go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc- [GHSA-8wmf-6v46-5gfg](https://osv.dev/vulnerability/GHSA-8wmf-6v46-5gfg) (fixed in >= 1.45.0)go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp- [GHSA-8wmf-6v46-5gfg](https://osv.dev/vulnerability/GHSA-8wmf-6v46-5gfg) (fixed in >= 1.45.0)go.opentelemetry.io/otel/sdk- [GHSA-8wmf-6v46-5gfg](https://osv.dev/vulnerability/GHSA-8wmf-6v46-5gfg) (fixed in >= 1.45.0)golang.org/x/crypto- [GO-2026-5932](https://osv.dev/vulnerability/GO-2026-5932)
devcontainer (1).devcontainer/devcontainer.json (3) - `mcr.microsoft.com/devcontainers/go 1.25-bookworm` → [Updates: `1.27-bookworm`, `2.3-bookworm`] - `ghcr.io/devcontainers/features/node 2.1.0` - `ghcr.io/devcontainers/features/docker-in-docker 3.1.0` → [Updates: `4.1.1`]dockerfile (4)cmd/pyroscope/debug.Dockerfile (1) - `gcr.io/distroless/static debug@sha256:7dc183cc0aea6abd9d105135e49d37b7474a79391ebea7eb55557cd4486d2225` → [Updates: `debug`] cmd/pyroscope/Dockerfile (2) - `gcr.io/distroless/static debug@sha256:7dc183cc0aea6abd9d105135e49d37b7474a79391ebea7eb55557cd4486d2225` → [Updates: `debug`] - `gcr.io/distroless/static sha256:87bce11be0af225e4ca761c40babb06d6d559f5767fbf7dc3c47f0f1a466b92c` → [Updates: `undefined`] cmd/pyroscope/frontend.Dockerfile (1) - `node 24@sha256:bb20cf73b3ad7212834ec48e2174cdcb5775f6550510a5336b842ae32741ce6c` → [Updates: `24`] tools/update_examples.Dockerfile (2) - `node 25` → [Updates: `25`] - `ubuntu 22.04` → [Updates: `26.04`, `22.04`]github-actions (15).github/workflows/backport.yml (2) - `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` → [Updates: `create-github-app-token/v1.0`] - `actions/checkout v5.0.1@93cb6efe18208431cddfb8368fd83d5badbf9bfd` → [Updates: `v5.1.0`, `v7.0.1`] .github/workflows/ci.yml (30) - `actions/checkout v4@34e114876b0b11c390a56381ad16ebd13914f8d5` → [Updates: `v7`, `v4`] - `actions/setup-go v6.2.0@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5` → [Updates: `v6.5.0`, `v7.0.0`] - `actions/checkout v4@34e114876b0b11c390a56381ad16ebd13914f8d5` → [Updates: `v7`, `v4`] - `actions/setup-go v6.2.0@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5` → [Updates: `v6.5.0`, `v7.0.0`] - `actions/checkout v4@34e114876b0b11c390a56381ad16ebd13914f8d5` → [Updates: `v7`, `v4`] - `actions/setup-go v6.2.0@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5` → [Updates: `v6.5.0`, `v7.0.0`] - `actions/checkout v4@34e114876b0b11c390a56381ad16ebd13914f8d5` → [Updates: `v7`, `v4`] - `actions/setup-go v6.2.0@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5` → [Updates: `v6.5.0`, `v7.0.0`] - `actions/checkout v4@34e114876b0b11c390a56381ad16ebd13914f8d5` → [Updates: `v7`, `v4`] - `actions/setup-go v6.2.0@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5` → [Updates: `v6.5.0`, `v7.0.0`] - `actions/checkout v4@34e114876b0b11c390a56381ad16ebd13914f8d5` → [Updates: `v7`, `v4`] - `actions/setup-go v6.2.0@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5` → [Updates: `v6.5.0`, `v7.0.0`] - `actions/checkout v4@34e114876b0b11c390a56381ad16ebd13914f8d5` → [Updates: `v7`, `v4`] - `actions/checkout v4@34e114876b0b11c390a56381ad16ebd13914f8d5` → [Updates: `v7`, `v4`] - `docker/setup-qemu-action v3.7.0@c7c53464625b32c7a7e944ae62b3e17d2b600130` → [Updates: `v4.4.0`] - `docker/setup-buildx-action v3.12.0@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f` → [Updates: `v4.4.0`] - `actions/setup-go v6.2.0@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5` → [Updates: `v6.5.0`, `v7.0.0`] - `actions/checkout v4@34e114876b0b11c390a56381ad16ebd13914f8d5` → [Updates: `v7`, `v4`] - `docker/setup-qemu-action v3.7.0@c7c53464625b32c7a7e944ae62b3e17d2b600130` → [Updates: `v4.4.0`] - `docker/setup-buildx-action v3.12.0@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f` → [Updates: `v4.4.0`] - `actions/setup-go v6.2.0@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5` → [Updates: `v6.5.0`, `v7.0.0`] - `grafana/shared-workflows login-to-gar/v1.0.1@c7ad5f57693ac858c698d95783685a9cbfd91223` → [Updates: `login-to-gar/v1.0.3`] - `go 1.26.8` - `go 1.26.8` - `go 1.26.8` - `go 1.26.8` - `go 1.26.8` - `go 1.26.8` - `go 1.26.8` - `go 1.26.8` .github/workflows/frontend.yml (25) - `actions/checkout v5.0.1@93cb6efe18208431cddfb8368fd83d5badbf9bfd` → [Updates: `v5.1.0`, `v7.0.1`] - `actions/setup-node v5.0.0@a0853c24544627f65ddf259abe73b1d18a591444` → [Updates: `v7.0.0`] - `actions/cache v5.0.4@668228422ae6a00e4ad889ee87cd7109ec5666a7` → [Updates: `v5.1.0`, `v6.1.0`] - `actions/upload-artifact v7.0.0@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f` → [Updates
Source: grafana/pyroscope