Dependency Dashboard

[forking-renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

• chore(deps): update pnpm to v11.17.0
• chore(deps): update terraform to ~> 7.41.0 (google, google-beta)
• fix(deps): update gcp-indexer-go (cloud.google.com/go/datastore, google.golang.org/api)
• fix(deps): update go-libraries (cloud.google.com/go/datastore, github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace)
• fix(deps): update tools (cloud.google.com/go/datastore, google.golang.org/api)
• fix(deps): update vulnfeeds-go (github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace, google.golang.org/api)
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• 🔐 Create all awaiting schedule PRs at once 🔐

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

• fix(deps): update github.com/google/osv/vulnfeeds digest to 42f5047
• fix(deps): update github.com/ossf/osv-schema/bindings/go digest to 9509daa
• chore(deps): update docker (gcr.io/endpoints-release/endpoints-runtime-serverless, node)
• chore(deps): update dependency hypothesis to v6.164.0
• chore(deps): update docs to v0.2.0 (jekyll-default-layout, jekyll-optional-front-matter, jekyll-readme-index, jekyll-relative-links, jekyll-titles-from-headings)
• fix(deps): update dependency cryptography to v50

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): update submodules (actions/checkout, actions/setup-node, actions/stale, github/codeql-action, ossf/osv-schema, ossf/scorecard-action, ruby/setup-ruby, zizmorcore/zizmor-action)
• fix(deps): update gcp-services-python (google-api-python-client, google-auth-httplib2, google-cloud-logging, google-cloud-ndb, google-cloud-pubsub, google-cloud-secret-manager, google-cloud-storage, osv, packaging, pygit2, requests, vanir)
• chore(deps): update submodules to v7 (actions/setup-go, actions/setup-node, actions/setup-python)
• fix(deps): update module gopkg.in/yaml.v2 to v3
• Click on this checkbox to rebase all open PRs at once

Detected Dependencies

bundler (1)

docs/Gemfile (16)

• ruby ~> 4
• jekyll "~> 4.4.0"
• csv lock file @ 3.3.6
• base64 lock file @ 0.3.0
• jekyll-feed "~> 0.15"
• jekyll-relative-links lock file @ 0.7.0 → [Updates: undefined]
• jekyll-optional-front-matter lock file @ 0.3.2 → [Updates: undefined]
• jekyll-readme-index lock file @ 0.3.0 → [Updates: undefined]
• jekyll-default-layout lock file @ 0.1.5 → [Updates: undefined]
• jekyll-titles-from-headings lock file @ 0.5.3 → [Updates: undefined]
• just-the-docs lock file @ 0.12.0
• jekyll-github-metadata lock file @ 2.16.1
• tzinfo ">= 1", "< 3"
• wdm "~> 0.2.0"
• http_parser.rb "~> 0.8.0"
• webrick "~> 1.7"

cloudbuild (11)

bindings/cloudbuild.yaml

cloudbuild.yaml

docker/terraform/cloudbuild.yaml

external/pypi/cloudbuild.yaml

gcp/api/cloudbuild.yaml

gcp/website/cloudbuild.yaml

gcp/workers/cloudbuild.yaml

go/cloudbuild.yaml

osv/cloudbuild.yaml

vulnfeeds/cloudbuild.yaml

vulnfeeds/pypi/cloudbuild.yaml

dockerfile (29)

actions/analyze/Dockerfile

docker/ci/Dockerfile

docker/deployment/Dockerfile (1)

• ubuntu 26.04@sha256:3131b4cc82a783df6c9df078f86e01819a13594b865c2cad47bd1bca2b7063bb

docker/terraform/Dockerfile (2)

• golang 1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb

docker/worker-base/Dockerfile (1)

• ubuntu 26.04@sha256:3131b4cc82a783df6c9df078f86e01819a13594b865c2cad47bd1bca2b7063bb

docs/docs.Dockerfile (1)

• ruby 4@sha256:d9a5d26be31a40fb043069f816ba39139c1f38758aea530341eb7e2c153e4ab4

gcp/api/Dockerfile

gcp/api/Dockerfile.esp (1)

• gcr.io/endpoints-release/endpoints-runtime 2

gcp/indexer/Dockerfile (2)

• golang 1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2
• gcr.io/distroless/base-debian12 sha256:62730825d3cf03571e0a1b8f014748de94d0404500f063593b614c23da38841d

gcp/website/Dockerfile (1)

• node 24.18@sha256:5711a0d445a1af54af9589066c646df387d1831a608226f4cd694fc59e745059 → [Updates: 24.18]

gcp/workers/cron/Dockerfile

gcp/workers/importer/Dockerfile

gcp/workers/oss_fuzz_importer/Dockerfile

gcp/workers/oss_fuzz_worker/Dockerfile

gcp/workers/recoverer/Dockerfile

gcp/workers/staging_api_test/Dockerfile

gcp/workers/vanir_signatures/Dockerfile

gcp/workers/worker/Dockerfile

go/cmd/osv-linter-worker/Dockerfile (2)

• docker/dockerfile 1
• golang 1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2

go/Dockerfile (12)

• docker/dockerfile 1
• golang 1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2
• alpine 3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd
• alpine 3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
• alpine 3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd

vulnfeeds/cmd/combine-to-osv/Dockerfile (2)

• golang 1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb

vulnfeeds/cmd/converters/alpine/Dockerfile (2)

• golang 1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb

vulnfeeds/cmd/converters/cve/cve5/bulk-converter/Dockerfile (2)

• golang 1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb

vulnfeeds/cmd/converters/cve/nvd-cve-osv/Dockerfile (2)

• golang 1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb

vulnfeeds/cmd/converters/debian/Dockerfile (2)

• golang 1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb

vulnfeeds/cmd/converters/dsa-dla-dtsa/Dockerfile (2)

• golang 1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2
• alpine 3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b

vulnfeeds/cmd/mirrors/cpe-repo-gen/Dockerfile (2)

• golang 1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb

vulnfeeds/cmd/mirrors/debian-copyright-mirror/Dockerfile (1)

• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb

vulnfeeds/cmd/mirrors/download-cves/Dockerfile (2)

• golang 1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb

git-submodules (1)

.gitmodules (2)

• gcp/api/googleapis 300fb478d0334baeefd134eba6ea30277477509b → [Updates: undefined]
• osv/osv-schema 2e9e1cc3ece6cb5f38d85d7a67db176d59b131cc → [Updates: undefined]

github-actions (14)

.github/workflows/codeql-analysis.yml (4)

• actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]
• github/codeql-action v4.37.0@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 → [Updates: v4.37.3]
• github/codeql-action v4.37.0@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 → [Updates: v4.37.3]
• github/codeql-action v4.37.0@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 → [Updates: v4.37.3]

.github/workflows/docs-deploy.yml (5)

• actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]
• ruby/setup-ruby v1.316.0@d45b1a4e94b71acab930e56e79c6aa188764e7f9 → [Updates: v1.321.0]
• actions/configure-pages v6.0.0@45bfe0192ca1faeb007ade9deae92b16b8254a0d
• actions/upload-pages-artifact v5@fc324d3547104276b827a68afc52ff2a11cc49c9
• actions/deploy-pages v5.0.0@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128

.github/workflows/generate-protos.yml (4)

• actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]
• actions/setup-python v6.3.0@ece7cb06caefa5fff74198d8649806c4678c61a1 → [Updates: v7.0.0]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1

.github/workflows/go-generate.yml (3)

• actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1

.github/workflows/issue-signposting.yml

.github/workflows/links.yml (2)

• actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]
• tcort/github-action-markdown-link-check v1.1.2@e7c7a18363c842693fadde5d41a3bd3573a7a225 → [Updates: v1.1.3]

.github/workflows/lint.yaml (5)

• actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]
• actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]
• actions/setup-python v6.3.0@ece7cb06caefa5fff74198d8649806c4678c61a1 → [Updates: v7.0.0]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• hashicorp/setup-terraform v4.0.1@dfe3c3f87815947d99a8997f908cb6525fc44e9e

.github/workflows/osv-scanner-unified.yml (2)

• google/osv-scanner-action nightly
• google/osv-scanner-action nightly

.github/workflows/renovate-validator.yml (2)

• actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]
• actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e → [Updates: v6.5.0, v7.0.0]

.github/workflows/scorecards.yml (4)

• actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]
• ossf/scorecard-action v2.4.3@4eaacf0543bb3f2c246792bd56e8cdeffafb205a → [Updates: v2.4.4]
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• github/codeql-action v4.37.0@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 → [Updates: v4.37.3]

.github/workflows/snapshots.yml (3)

• actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1

.github/workflows/staleness.yml (1)

• actions/stale v10.3.0@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 → [Updates: v10.4.0, v11.0.0]

.github/workflows/title.yml (1)

• amannn/action-semantic-pull-request v6.1.1@48f256284bd46cdaab1048c3721360e808335d50

.github/workflows/zizmor.yml (2)

• actions/checkout v7.0.0@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7.0.1]
• zizmorcore/zizmor-action v0.5.7@192e21d79ab29983730a13d1382995c2307fbcaa → [Updates: v0.6.1]

gomod (10)

bindings/go/go.mod (7)

• go 1.26.5
• github.com/google/go-cmp v0.7.0
• github.com/ossf/osv-schema/bindings/go v0.0.0-20260716013833-d4a00c3e2a47@d4a00c3e2a47 → [Updates: v0.0.0-20260730052020-9509daabeece]
• golang.org/x/sync v0.22.0
• google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa@3dc84a4a5aaa → [Updates: v0.0.0-20260729162451-8efbd57d26e0]
• google.golang.org/grpc v1.82.1 → [Updates: v1.83.0]
• google.golang.org/protobuf v1.36.11

docs/go.mod (4)

• go 1.26.5
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0
• google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2
• google.golang.org/protobuf v1.36.11

external/go.mod (6)

• go 1.26.5
• github.com/aquasecurity/go-pep440-version v0.0.1
• github.com/goccy/go-yaml v1.19.2
• github.com/google/osv/vulnfeeds v0.0.0-20260713032857-33beb5f74ac6@33beb5f74ac6 → [Updates: v0.0.0-20260731065109-42f5047e22a6]
• github.com/ossf/osv-schema/bindings/go v0.0.0-20260716013833-d4a00c3e2a47@d4a00c3e2a47 → [Updates: v0.0.0-20260730052020-9509daabeece]
• google.golang.org/protobuf v1.36.11

gcp/indexer/go.mod (10)

• go 1.26.5
• cloud.google.com/go/datastore v1.25.0 → [Updates: v1.26.0]
• cloud.google.com/go/pubsub/v2 v2.6.1
• cloud.google.com/go/storage v1.64.0
• github.com/go-git/go-git/v5 v5.19.1 → [Updates: v5.19.2]
• github.com/golang/glog v1.2.5
• github.com/google/go-cmp v0.7.0
• golang.org/x/sync v0.22.0
• google.golang.org/api v0.289.0 → [Updates: v0.290.0]
• gopkg.in/yaml.v3 v3.0.1

go/cmd/tools/reimport-tui/go.mod (6)

• go 1.26.5
• charm.land/bubbles/v2 v2.1.1
• charm.land/bubbletea/v2 v2.0.8
• charm.land/lipgloss/v2 v2.0.5
• cloud.google.com/go/datastore v1.25.0 → [Updates: v1.26.0]
• github.com/google/osv.dev/go v0.0.0-20260715030208-adbd23231c20@adbd23231c20 → [Updates: v0.0.0-20260731065109-42f5047e22a6]

go/go.mod (34)

• go 1.26.5
• charm.land/lipgloss/v2 v2.0.5
• cloud.google.com/go/compute/metadata v0.9.0
• cloud.google.com/go/datastore v1.25.0 → [Updates: v1.26.0]
• cloud.google.com/go/monitoring v1.30.0
• cloud.google.com/go/pubsub/v2 v2.6.1
• cloud.google.com/go/storage v1.64.0
• github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.34.0 → [Updates: v1.35.0]
• github.com/dgraph-io/ristretto/v2 v2.4.2
• github.com/dustin/go-humanize v1.0.1
• github.com/go-git/go-git/v6 v6.0.0-alpha.4 → [Updates: v6.0.0-alpha.5]
• github.com/google/go-cmp v0.7.0
• github.com/google/osv-scalibr v0.4.5
• github.com/hashicorp/go-retryablehttp v0.7.8
• github.com/klauspost/compress v1.19.1
• github.com/ossf/osv-schema/bindings/go v0.0.0-20260716013833-d4a00c3e2a47@d4a00c3e2a47 → [Updates: v0.0.0-20260730052020-9509daabeece]
• github.com/package-url/packageurl-go v0.1.6
• github.com/tidwall/gjson v1.19.0
• github.com/xeipuuv/gojsonschema v1.2.0
• go.opentelemetry.io/contrib/detectors/gcp v1.44.0
• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0
• go.opentelemetry.io/otel v1.44.0
• go.opentelemetry.io/otel/sdk v1.44.0
• go.opentelemetry.io/otel/trace v1.44.0
• golang.org/x/sync v0.22.0
• google.golang.org/api v0.290.0 → [Updates: v0.291.0]
• google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7@925bb5da69e7 → [Updates: v0.0.0-20260729162451-8efbd57d26e0]
• google.golang.org/grpc v1.82.1 → [Updates: v1.83.0]
• google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af@f2248ac996af
• gopkg.in/dnaeon/go-vcr.v4 v4.0.7
• k8s.io/apimachinery v0.36.3
• mvdan.cc/sh/v3 v3.13.1
• osv.dev/bindings/go v0.0.0-20260527044221-c1c72c1b0158@c1c72c1b0158 → [Updates: v0.0.0-20260731065109-42f5047e22a6]

tools/apitester/go.mod (7)

• go 1.26.5
• github.com/gkampitakis/go-snaps v0.5.23
• github.com/google/go-cmp v0.7.0
• github.com/tidwall/gjson v1.19.0
• github.com/tidwall/pretty v1.2.1
• github.com/tidwall/sjson v1.2.5
• gopkg.in/dnaeon/go-vcr.v4 v4.0.7

tools/datastore-remover/go.mod (3)

• go 1.26.5
• cloud.google.com/go/datastore v1.25.0 → [Updates: v1.26.0]
• google.golang.org/api v0.289.0 → [Updates: v0.290.0]

tools/indexer-api-caller/go.mod (1)

• go 1.26.5

vulnfeeds/go.mod (27)

• go 1.26.5
• charm.land/lipgloss/v2 v2.0.5
• cloud.google.com/go/secretmanager v1.21.0
• cloud.google.com/go/storage v1.64.0
• github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.34.0 → [Updates: v1.35.0]
• github.com/JohannesKaufmann/html-to-markdown/v2 v2.5.2
• github.com/aquasecurity/go-pep440-version v0.0.1
• github.com/atombender/go-jsonschema v0.23.1 → [Updates: v0.24.0]
• github.com/fsouza/fake-gcs-server v1.55.1
• github.com/gkampitakis/go-snaps v0.5.23
• github.com/go-git/go-git/v5 v5.19.1 → [Updates: v5.19.2]
• github.com/goccy/go-yaml v1.19.2
• github.com/google/go-cmp v0.7.0
• github.com/knqyf263/go-cpe v0.0.0-20230627041855-cb0794d06872@cb0794d06872
• github.com/ossf/osv-schema/bindings/go v0.0.0-20260716013833-d4a00c3e2a47@d4a00c3e2a47 → [Updates: v0.0.0-20260730052020-9509daabeece]
• github.com/redis/go-redis/v9 v9.21.0
• github.com/sethvargo/go-retry v0.4.0
• go.opentelemetry.io/contrib/detectors/gcp v1.44.0
• go.opentelemetry.io/otel v1.44.0
• go.opentelemetry.io/otel/sdk v1.44.0
• go.opentelemetry.io/otel/trace v1.44.0
• golang.org/x/sync v0.22.0
• golang.org/x/text v0.40.0
• google.golang.org/api v0.289.0 → [Updates: v0.290.0]
• google.golang.org/protobuf v1.36.11
• gopkg.in/dnaeon/go-vcr.v4 v4.0.7
• gopkg.in/yaml.v2 v2.4.0 → [Updates: v3.0.1]

npm (2)

gcp/website/frontend3/package.json (21)

• @github/clipboard-copy-element 1.3.2
• @hotwired/turbo 8.0.23
• @material/data-table 14.0.0
• @material/layout-grid 14.0.0
• @material/theme 14.0.0
• @material/web ^2.0.0
• json-formatter-js ^2.5.23
• lit 3.3.3
• copy-webpack-plugin ^14.0.0
• css-loader ^7.1.3
• html-webpack-plugin ^5.6.6
• mini-css-extract-plugin ^2.10.0
• raw-loader ^4.0.2
• sass ^1.97.3
• sass-loader ^17.0.0
• style-loader ^4.0.0
• webpack ^5.105.4 → [Updates: ^5.105.4]
• webpack-bundle-analyzer ^5.0.0
• webpack-cli ^7.0.0 → [Updates: ^7.0.0]
• webpack-dev-server ^6.0.0
• pnpm 11.15.1 → [Updates: 11.17.0]

gcp/website/frontend3/pnpm-workspace.yaml

poetry (7)

gcp/api/pyproject.toml (8)

• poetry-core >=2.0.0
• mypy-protobuf ^5.0.0
• yapf *
• pylint *
• google-cloud-ndb ==2.4.0 → [Updates: ==2.5.0]
• google-cloud-logging ==3.13.0 → [Updates: ==3.16.1]
• packaging ==26.0 → [Updates: ==26.2]
• requests ==2.33.0 → [Updates: ==2.34.2]

gcp/functions/pypi/pyproject.toml (5)

• poetry-core >=2.0.0
• cryptography ==49.0.0 → [Updates: ==50.0.0]
• google-cloud-secret-manager ==2.26.0 → [Updates: ==2.30.0]
• osv ==0.1.2 → [Updates: ==0.1.3]
• requests ==2.33.0 → [Updates: ==2.34.2]

gcp/website/pyproject.toml (21)

• poetry-core >=2.0.0
• yapf *
• pylint *
• Flask ==3.1.3
• Flask-Caching ==2.4.1
• Flask-Compress ==1.24
• werkzeug ==3.1.8
• google-auth ==2.56.2
• google-cloud-ndb ==2.5.0
• google-cloud-logging ==3.16.1
• google-cloud-storage ==3.13.0
• jinja2 ==3.1.6
• markdown2 ==2.5.5
• markupsafe ==3.0.3
• packageurl-python ==0.17.6
• redis ==6.4.0
• requests ==2.34.2
• gunicorn ==26.0.0
• whitenoise ==6.12.0
• cvss ==3.6
• pyopenssl >=26.3.0,<27.0.0

gcp/workers/oss_fuzz_worker/pyproject.toml (15)

• poetry-core >=2.0.0
• yapf *
• pylint *
• google-auth-httplib2 ==0.3.0 → [Updates: ==0.4.0]
• google-api-python-client ==2.192.0 → [Updates: ==2.198.0]
• google-cloud-pubsub ==2.35.0 → [Updates: ==2.39.0]
• google-cloud-ndb ==2.4.0 → [Updates: ==2.5.0]
• google-cloud-storage ==3.9.0 → [Updates: ==3.13.0]
• pyyaml ==6.0.3
• redis ==6.4.0
• packageurl-python ==0.17.6
• pygit2 ==1.19.1 → [Updates: ==1.19.3]
• requests ==2.33.0 → [Updates: ==2.34.2]
• jsonschema ==4.26.0
• vanir ==1.0.2 → [Updates: ==1.1.0]

gcp/workers/worker/pyproject.toml (15)

• poetry-core >=2.0.0
• yapf *
• pylint *
• google-auth-httplib2 ==0.3.0 → [Updates: ==0.4.0]
• google-api-python-client ==2.192.0 → [Updates: ==2.198.0]
• google-cloud-pubsub ==2.35.0 → [Updates: ==2.39.0]
• google-cloud-ndb ==2.4.0 → [Updates: ==2.5.0]
• google-cloud-storage ==3.9.0 → [Updates: ==3.13.0]
• pyyaml ==6.0.3
• redis ==6.4.0
• packageurl-python ==0.17.6
• pygit2 ==1.19.1 → [Updates: ==1.19.3]
• requests ==2.33.1 → [Updates: ==2.34.2]
• jsonschema ==4.26.0
• vanir ==1.1.0

pyproject.toml (20)

• poetry-core >=2.0.0
• yapf *
• pylint *
• grpcio-tools *
• mypy-protobuf ^5.0.0
• vcrpy *
• hypothesis * → [Updates: *]
• google-cloud-ndb >=2.3
• google-cloud-logging >=3.10
• google-cloud-pubsub >=2.31.1
• google-cloud-storage >=2.17
• semver >=3.0
• packageurl-python >=0.17.0
• pyyaml >=6.0
• pygit2 >=1.14.0
• attrs >=23.2
• jsonschema >=4.0
• grpcio >=1.0
• packaging-legacy >=23.0.post0
• requests >=2.33

tools/datafix/pyproject.toml (7)

• poetry-core >=2.0.0
• yapf *
• pylint *
• google-cloud-ndb ==2.5.0
• google-cloud-storage ==3.13.0
• pyyaml ==6.0.3
• google-cloud-pubsub >=2.25.2

regex (3)

deployment/terraform/environments/oss-vdb-test/main.tf (1)

• gcr.io/endpoints-release/endpoints-runtime-serverless 2.55.3 → [Updates: 2.55.6]

deployment/terraform/environments/oss-vdb/main.tf (1)

• gcr.io/endpoints-release/endpoints-runtime-serverless 2.55.3 → [Updates: 2.55.6]

osv/models.py (1)

• ossf/osv-schema 1.7.5 → [Updates: 1.8.0]

terraform (4)

deployment/terraform/environments/oss-vdb-test/main.tf (4)

• external ~> 2.4.0
• google ~> 7.40.0 → [Updates: ~> 7.41.0]
• google-beta ~> 7.40.0 → [Updates: ~> 7.41.0]
• null ~> 3.3.0

deployment/terraform/environments/oss-vdb/main.tf (4)

• external ~> 2.4.0
• google ~> 7.40.0 → [Updates: ~> 7.41.0]
• google-beta ~> 7.40.0 → [Updates: ~> 7.41.0]
• null ~> 3.3.0

deployment/terraform/environments/private-osv/main.tf (2)

• google ~> 7.40.0 → [Updates: ~> 7.41.0]
• google-beta ~> 7.40.0 → [Updates: ~> 7.41.0]

deployment/terraform/modules/osv/website.tf (1)

• terraform-google-modules/lb-http/google ~> 14.0

---

• Check this box to trigger a request for Renovate to run again on this repository