Dependency Dashboard

[forking-renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

• chore(deps): update submodules (github/codeql-action, ossf/osv-schema)
• fix(deps): update go-libraries (charm.land/bubbletea/v2, google.golang.org/api, google.golang.org/grpc)
• chore(deps): update dependency grpcio-tools to v1.84.0
• chore(deps): update dependency protobuf to v7
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• 🔐 Create all awaiting schedule PRs at once 🔐

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

• chore(deps): update docker (gcr.io/distroless/base-debian12, gcr.io/distroless/static-debian12, gcr.io/endpoints-release/endpoints-runtime-serverless, gcr.io/google.com/cloudsdktool/google-cloud-cli)
• fix(deps): update github.com/google/osv.dev/vulnfeeds digest to 3f15cc9
• fix(deps): update github.com/ossf/osv-schema/bindings/go digest to 65280fa
• chore(deps): update website (pnpm, sass)
• fix(deps): update docs (github.com/grpc-ecosystem/grpc-gateway/v2, jekyll-default-layout, jekyll-feed, jekyll-optional-front-matter, jekyll-readme-index, jekyll-relative-links, jekyll-titles-from-headings)
• fix(deps): update gcp-indexer-go (cloud.google.com/go/datastore, cloud.google.com/go/storage)
• fix(deps): update tools (cloud.google.com/go/datastore, github.com/tidwall/pretty, google-cloud-ndb, google-cloud-storage, pylint)
• fix(deps): update vulnfeeds-go (cloud.google.com/go/secretmanager, cloud.google.com/go/storage)

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• fix(deps): update gcp-services-python (cryptography, google-api-python-client, google-auth-httplib2, google-cloud-ndb, google-cloud-pubsub, google-cloud-secret-manager, google-cloud-storage, osv, pygit2, requests, vanir)
• chore(deps): update terraform to v8 (google, google-beta)
• fix(deps): update module github.com/yuin/goldmark to v2
• fix(deps): update module gopkg.in/yaml.v2 to v3
• Click on this checkbox to rebase all open PRs at once

PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

• chore(deps): update dependency protobuf to v7

Detected Dependencies

bundler (1)

docs/Gemfile (16)

• ruby ~> 4
• jekyll "~> 4.4.0"
• csv lock file @ 3.3.6
• base64 lock file @ 0.3.0
• jekyll-feed "~> 0.15" → [Updates: "~> 0.15"]
• jekyll-relative-links lock file @ 0.9.0 → [Updates: undefined]
• jekyll-optional-front-matter lock file @ 0.3.3 → [Updates: undefined]
• jekyll-readme-index lock file @ 0.5.0 → [Updates: undefined]
• jekyll-default-layout lock file @ 0.2.0 → [Updates: undefined]
• jekyll-titles-from-headings lock file @ 0.5.5 → [Updates: undefined]
• just-the-docs lock file @ 0.12.0
• jekyll-github-metadata lock file @ 2.16.1
• tzinfo ">= 1", "< 3"
• wdm "~> 0.2.0"
• http_parser.rb "~> 0.8.0"
• webrick "~> 1.7"

cloudbuild (9)

bindings/cloudbuild.yaml

cloudbuild.yaml

docker/terraform/cloudbuild.yaml

external/pypi/cloudbuild.yaml

go/cloudbuild.yaml

osv/cloudbuild.yaml

tools/apitester/cloudbuild.yaml

vulnfeeds/cloudbuild.yaml

vulnfeeds/pypi/cloudbuild.yaml

dockerfile (23)

actions/analyze/Dockerfile

docker/ci/Dockerfile

docker/deployment/Dockerfile (1)

• ubuntu 26.04@sha256:da6fc2be547864451aa253836dd926da33623312df4a9a243e35dc877c378a78

docker/esp/Dockerfile (1)

• gcr.io/endpoints-release/endpoints-runtime 2

docker/terraform/Dockerfile (2)

• golang 1.27.1-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb → [Updates: alpine]

docker/worker-base/Dockerfile (1)

• ubuntu 26.04@sha256:da6fc2be547864451aa253836dd926da33623312df4a9a243e35dc877c378a78

docs/docs.Dockerfile (1)

• ruby 4@sha256:342dd3092e25f9d16fc2a5c48c5bb2d9a93717d4f900d005d6e088e2c45d3d19

gcp/indexer/Dockerfile (2)

• golang 1.27.1-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414
• gcr.io/distroless/base-debian12 sha256:62730825d3cf03571e0a1b8f014748de94d0404500f063593b614c23da38841d → [Updates: undefined]

gcp/workers/cron/Dockerfile

gcp/workers/oss_fuzz_importer/Dockerfile

gcp/workers/oss_fuzz_worker/Dockerfile

gcp/workers/worker/Dockerfile

go/cmd/osv-linter-worker/Dockerfile (1)

• golang 1.27.1-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414

go/Dockerfile (14)

• golang 1.27.1-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414
• alpine 3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd → [Updates: undefined]
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd → [Updates: undefined]
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd → [Updates: undefined]
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd → [Updates: undefined]
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd → [Updates: undefined]
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd → [Updates: undefined]
• alpine 3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
• alpine 3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd → [Updates: undefined]
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd → [Updates: undefined]
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd → [Updates: undefined]
• gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd → [Updates: undefined]

vulnfeeds/cmd/combine-to-osv/Dockerfile (2)

• golang 1.27.1-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb → [Updates: alpine]

vulnfeeds/cmd/converters/alpine/Dockerfile (2)

• golang 1.27.1-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb → [Updates: alpine]

vulnfeeds/cmd/converters/cve/cve5/bulk-converter/Dockerfile (2)

• golang 1.27.1-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb → [Updates: alpine]

vulnfeeds/cmd/converters/cve/nvd-cve-osv/Dockerfile (2)

• golang 1.27.1-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb → [Updates: alpine]

vulnfeeds/cmd/converters/debian/Dockerfile (2)

• golang 1.27.1-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb → [Updates: alpine]

vulnfeeds/cmd/converters/dsa-dla-dtsa/Dockerfile (2)

• golang 1.27.1-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414
• alpine 3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6

vulnfeeds/cmd/mirrors/cpe-repo-gen/Dockerfile (2)

• golang 1.27.1-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb → [Updates: alpine]

vulnfeeds/cmd/mirrors/debian-copyright-mirror/Dockerfile (2)

• golang 1.27.1-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414
• alpine 3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6

vulnfeeds/cmd/mirrors/download-cves/Dockerfile (2)

• golang 1.27.1-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb → [Updates: alpine]

git-submodules (1)

.gitmodules (1)

• osv/osv-schema f3f826310aeca8e324baabd195632f2229952abe → [Updates: undefined]

github-actions (14)

.github/workflows/codeql-analysis.yml (4)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• github/codeql-action v4.38.1@1c5b675653bb5c22dbe9b12b556ec555138e09fd → [Updates: v4.38.2]
• github/codeql-action v4.38.1@1c5b675653bb5c22dbe9b12b556ec555138e09fd → [Updates: v4.38.2]
• github/codeql-action v4.38.1@1c5b675653bb5c22dbe9b12b556ec555138e09fd → [Updates: v4.38.2]

.github/workflows/docs-deploy.yml (5)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• ruby/setup-ruby v1.326.0@762794c140bbeda0f1224786aa33b4b46783a6c1 → [Updates: v1.327.0]
• actions/configure-pages v6.0.0@45bfe0192ca1faeb007ade9deae92b16b8254a0d
• actions/upload-pages-artifact v5@fc324d3547104276b827a68afc52ff2a11cc49c9
• actions/deploy-pages v5.0.1@368f82528645a54fb793d4d04e342629a3f51346

.github/workflows/generate-protos.yml (4)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-python v7.0.0@5fda3b95a4ea91299a34e894583c3862153e4b97
• actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1

.github/workflows/go-generate.yml (3)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1

.github/workflows/issue-signposting.yml

.github/workflows/links.yml (2)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• tcort/github-action-markdown-link-check v1.1.3@e047c5b37f24ab722bbef1a27b6fab7f96bc4068

.github/workflows/lint.yaml (5)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-python v7.0.0@5fda3b95a4ea91299a34e894583c3862153e4b97
• actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• hashicorp/setup-terraform v4.0.1@dfe3c3f87815947d99a8997f908cb6525fc44e9e

.github/workflows/osv-scanner-unified.yml (2)

• google/osv-scanner-action nightly
• google/osv-scanner-action nightly

.github/workflows/renovate-validator.yml (2)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020

.github/workflows/scorecards.yml (4)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• ossf/scorecard-action v2.4.4@2d1146689b8cda280b9bc96326124645441f03bc
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• github/codeql-action v4.38.1@1c5b675653bb5c22dbe9b12b556ec555138e09fd → [Updates: v4.38.2]

.github/workflows/snapshots.yml (3)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1

.github/workflows/staleness.yml (1)

• actions/stale v11.0.0@4391f3da665fdf50b6810c1a66712fb9ba21aa93

.github/workflows/title.yml (1)

• amannn/action-semantic-pull-request v6.1.1@48f256284bd46cdaab1048c3721360e808335d50

.github/workflows/zizmor.yml (2)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• zizmorcore/zizmor-action v0.6.4@cc914d7f3750a2d13d75c7f184a1060aa0e9d482

gomod (11)

bindings/go/go.mod (7)

• go 1.27.1
• github.com/google/go-cmp v0.7.0
• github.com/ossf/osv-schema/bindings/go v0.0.0-20260902031056-b388a18021a3@b388a18021a3 → [Updates: v0.0.0-20261001013203-65280faa676c]
• golang.org/x/sync v0.23.0
• google.golang.org/genproto/googleapis/api v0.0.0-20260706201446-f0a921348800@f0a921348800 → [Updates: v0.0.0-20260928230214-8a89bd6388cc]
• google.golang.org/grpc v1.83.2 → [Updates: v1.84.0]
• google.golang.org/protobuf v1.36.12

docs/go.mod (4)

• go 1.27.1
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 → [Updates: v2.31.0]
• google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2
• google.golang.org/protobuf v1.36.12

external/go.mod (6)

• go 1.27.1
• github.com/aquasecurity/go-pep440-version v0.0.1
• github.com/goccy/go-yaml v1.19.2
• github.com/google/osv.dev/vulnfeeds v0.0.0-20260812014536-918f43604b8d@918f43604b8d → [Updates: v0.0.0-20261001060034-3f15cc9776ee]
• github.com/ossf/osv-schema/bindings/go v0.0.0-20260806060209-f3f826310aec@f3f826310aec → [Updates: v0.0.0-20261001013203-65280faa676c]
• google.golang.org/protobuf v1.36.12

gcp/indexer/go.mod (10)

• go 1.27.1
• cloud.google.com/go/datastore v1.26.0 → [Updates: v1.27.0]
• cloud.google.com/go/pubsub/v2 v2.7.0
• cloud.google.com/go/storage v1.68.0 → [Updates: v1.69.0]
• github.com/go-git/go-git/v5 v5.19.2
• github.com/golang/glog v1.2.5
• github.com/google/go-cmp v0.7.0
• golang.org/x/sync v0.23.0
• google.golang.org/api v0.299.0
• gopkg.in/yaml.v3 v3.0.1

go/cmd/tools/reimport-tui/go.mod (6)

• go 1.27.1
• charm.land/bubbles/v2 v2.2.1
• charm.land/bubbletea/v2 v2.0.9 → [Updates: v2.0.10]
• charm.land/lipgloss/v2 v2.0.6
• cloud.google.com/go/datastore v1.26.0 → [Updates: v1.27.0]
• github.com/google/osv.dev/go v0.0.0-20260715030208-adbd23231c20@adbd23231c20 → [Updates: v0.0.0-20261001060034-3f15cc9776ee]

go/go.mod (44)

• go 1.27.1
• charm.land/lipgloss/v2 v2.0.6
• cloud.google.com/go/compute/metadata v0.9.1 → [Updates: v0.10.0]
• cloud.google.com/go/datastore v1.26.0 → [Updates: v1.27.0]
• cloud.google.com/go/monitoring v1.30.0 → [Updates: v1.31.0]
• cloud.google.com/go/pubsub/v2 v2.7.0
• cloud.google.com/go/storage v1.68.0 → [Updates: v1.69.0]
• github.com/alicebob/miniredis/v2 v2.39.0
• github.com/dgraph-io/ristretto/v2 v2.4.2
• github.com/dustin/go-humanize v1.1.0
• github.com/go-git/go-git/v6 v6.0.0-alpha.5
• github.com/google/go-cmp v0.7.0
• github.com/google/osv-scalibr v0.5.3
• github.com/hashicorp/go-retryablehttp v0.7.8
• github.com/klauspost/compress v1.20.0 → [Updates: v1.20.1]
• github.com/microcosm-cc/bluemonday v1.0.27
• github.com/nikolalohinski/gonja/v2 v2.9.0 → [Updates: v2.9.1]
• github.com/ossf/osv-schema/bindings/go v0.0.0-20260902031056-b388a18021a3@b388a18021a3 → [Updates: v0.0.0-20261001013203-65280faa676c]
• github.com/package-url/packageurl-go v0.1.7
• github.com/pandatix/go-cvss v0.6.4
• github.com/prometheus/client_golang v1.24.1
• github.com/redis/go-redis/v9 v9.22.0
• github.com/tidwall/gjson v1.19.0
• github.com/xeipuuv/gojsonschema v1.2.0
• github.com/yuin/goldmark v1.8.6 → [Updates: v2.1.5]
• go.opentelemetry.io/contrib/detectors/gcp v1.46.0
• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0
• go.opentelemetry.io/otel v1.46.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0
• go.opentelemetry.io/otel/sdk v1.46.0
• go.opentelemetry.io/otel/trace v1.46.0
• golang.org/x/oauth2 v0.37.0
• golang.org/x/sync v0.23.0
• golang.org/x/text v0.42.0
• google.golang.org/api v0.298.0 → [Updates: v0.299.0]
• google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688@08b0e4226688 → [Updates: v0.0.0-20260928230214-8a89bd6388cc]
• google.golang.org/grpc v1.83.2 → [Updates: v1.84.0]
• google.golang.org/protobuf v1.36.12
• gopkg.in/dnaeon/go-vcr.v4 v4.0.7
• k8s.io/apimachinery v0.37.1
• mvdan.cc/sh/v3 v3.14.1
• osv.dev/bindings/go v0.0.0-20260527044221-c1c72c1b0158@c1c72c1b0158 → [Updates: v0.0.0-20261001060034-3f15cc9776ee]
• sigs.k8s.io/yaml v1.6.0

tools/apitester/go.mod (7)

• go 1.27.1
• github.com/gkampitakis/go-snaps v0.5.23
• github.com/google/go-cmp v0.7.0
• github.com/tidwall/gjson v1.19.0
• github.com/tidwall/pretty v1.2.1 → [Updates: v1.2.2]
• github.com/tidwall/sjson v1.2.5
• gopkg.in/dnaeon/go-vcr.v4 v4.0.7

tools/datastore-remover/go.mod (3)

• go 1.27.1
• cloud.google.com/go/datastore v1.26.0 → [Updates: v1.27.0]
• google.golang.org/api v0.299.0

tools/indexer-api-caller/go.mod (1)

• go 1.27.1

tools/repo-allowlist-sync/go.mod (4)

• go 1.27.1
• cloud.google.com/go/datastore v1.26.0 → [Updates: v1.27.0]
• github.com/google/osv.dev/go v0.0.0
• go.yaml.in/yaml/v4 v4.0.0-rc.6

vulnfeeds/go.mod (28)

• go 1.27.1
• charm.land/lipgloss/v2 v2.0.6
• cloud.google.com/go/secretmanager v1.21.0 → [Updates: v1.22.0]
• cloud.google.com/go/storage v1.68.0 → [Updates: v1.69.0]
• github.com/JohannesKaufmann/html-to-markdown/v2 v2.5.2
• github.com/aquasecurity/go-pep440-version v0.0.1
• github.com/atombender/go-jsonschema v0.24.1
• github.com/fsouza/fake-gcs-server v1.56.1
• github.com/gkampitakis/go-snaps v0.5.23
• github.com/go-git/go-git/v5 v5.19.2
• github.com/goccy/go-yaml v1.19.2
• github.com/google/go-cmp v0.7.0
• github.com/knqyf263/go-cpe v0.0.0-20230627041855-cb0794d06872@cb0794d06872
• github.com/ossf/osv-schema/bindings/go v0.0.0-20260806060209-f3f826310aec@f3f826310aec → [Updates: v0.0.0-20261001013203-65280faa676c]
• github.com/redis/go-redis/v9 v9.22.0
• github.com/sethvargo/go-retry v0.4.0
• go.opentelemetry.io/contrib/detectors/gcp v1.46.0
• go.opentelemetry.io/otel v1.46.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0
• go.opentelemetry.io/otel/sdk v1.46.0
• go.opentelemetry.io/otel/trace v1.46.0
• golang.org/x/sync v0.23.0
• golang.org/x/text v0.42.0
• google.golang.org/api v0.299.0
• google.golang.org/grpc v1.84.0
• google.golang.org/protobuf v1.36.12
• gopkg.in/dnaeon/go-vcr.v4 v4.0.7
• gopkg.in/yaml.v2 v2.4.0 → [Updates: v3.0.1]

npm (2)

website/frontend3/package.json (21)

• @github/clipboard-copy-element 1.3.2
• @hotwired/turbo 8.0.23
• @material/data-table 14.0.0
• @material/layout-grid 14.0.0
• @material/theme 14.0.0
• @material/web ^2.0.0
• json-formatter-js ^2.5.23
• lit 3.3.3
• copy-webpack-plugin ^14.0.0
• css-loader ^7.1.3
• html-webpack-plugin ^5.6.6
• mini-css-extract-plugin ^2.10.0
• raw-loader ^4.0.2
• sass ^1.97.3 → [Updates: ^1.97.3]
• sass-loader ^17.0.0
• style-loader ^4.0.0
• webpack ^5.105.4
• webpack-bundle-analyzer ^5.0.0
• webpack-cli ^7.0.0
• webpack-dev-server ^6.0.0
• pnpm 12.6.0 → [Updates: 12.8.1]

website/frontend3/pnpm-workspace.yaml

poetry (7)

gcp/functions/pypi/pyproject.toml (5)

• poetry-core >=2.0.0
• cryptography ==50.0.0 → [Updates: ==50.0.1]
• google-cloud-secret-manager ==2.26.0 → [Updates: ==2.30.0]
• osv ==0.1.2 → [Updates: ==0.1.3]
• requests ==2.33.0 → [Updates: ==2.34.2]

gcp/workers/oss_fuzz_worker/pyproject.toml (15)

• poetry-core >=2.0.0
• yapf *
• pylint * → [Updates: *]
• google-auth-httplib2 ==0.3.0 → [Updates: ==0.4.2]
• google-api-python-client ==2.192.0 → [Updates: ==2.200.0]
• google-cloud-pubsub ==2.35.0 → [Updates: ==2.41.0]
• google-cloud-ndb ==2.4.0 → [Updates: ==2.6.0]
• google-cloud-storage ==3.9.0 → [Updates: ==3.14.1]
• pyyaml ==6.0.3
• redis ==6.4.0
• packageurl-python ==0.17.6
• pygit2 ==1.19.1 → [Updates: ==1.20.1]
• requests ==2.33.0 → [Updates: ==2.34.2]
• jsonschema ==4.26.0
• vanir ==1.0.2 → [Updates: ==1.1.0]

gcp/workers/worker/pyproject.toml (15)

• poetry-core >=2.0.0
• yapf *
• pylint * → [Updates: *]
• google-auth-httplib2 ==0.3.0 → [Updates: ==0.4.2]
• google-api-python-client ==2.192.0 → [Updates: ==2.200.0]
• google-cloud-pubsub ==2.35.0 → [Updates: ==2.41.0]
• google-cloud-ndb ==2.4.0 → [Updates: ==2.6.0]
• google-cloud-storage ==3.9.0 → [Updates: ==3.14.1]
• pyyaml ==6.0.3
• redis ==6.4.0
• packageurl-python ==0.17.6
• pygit2 ==1.19.1 → [Updates: ==1.20.1]
• requests ==2.33.1 → [Updates: ==2.34.2]
• jsonschema ==4.26.0
• vanir ==1.1.0

go/cmd/vanir_signatures/osv/pyproject.toml (2)

• poetry-core >=2.0.0,<3.0.0
• protobuf >=6.33.6,<7.0.0 → [Updates: >=7.36.2,<7.37.0]

go/cmd/vanir_signatures/pyproject.toml (2)

• poetry-core >=2.0.0,<3.0.0
• vanir ==1.1.0

pyproject.toml (21)

• poetry-core >=2.0.0
• yapf *
• pylint * → [Updates: *]
• protobuf >=6.33.6,<7.0.0 → [Updates: >=7.36.2,<7.37.0]
• grpcio-tools * → [Updates: *]
• mypy-protobuf ^5.0.0
• vcrpy *
• hypothesis *
• google-cloud-ndb >=2.3 → [Updates: >=2.3]
• google-cloud-logging >=3.10
• google-cloud-pubsub >=2.31.1
• google-cloud-storage >=2.17 → [Updates: >=2.17]
• semver >=3.0
• packageurl-python >=0.17.0
• pyyaml >=6.0
• pygit2 >=1.14.0
• attrs >=23.2
• jsonschema >=4.0
• grpcio >=1.0
• packaging-legacy >=23.0.post0
• requests >=2.33

tools/datafix/pyproject.toml (7)

• poetry-core >=2.0.0
• yapf *
• pylint * → [Updates: *]
• google-cloud-ndb ==2.6.0 → [Updates: ==2.7.0]
• google-cloud-storage ==3.14.1 → [Updates: ==3.15.1]
• pyyaml ==6.0.3
• google-cloud-pubsub >=2.25.2

regex (3)

deployment/terraform/environments/oss-vdb-test/main.tf (1)

• gcr.io/endpoints-release/endpoints-runtime-serverless 2.55.3 → [Updates: 2.56.0]

deployment/terraform/environments/oss-vdb/main.tf (1)

• gcr.io/endpoints-release/endpoints-runtime-serverless 2.55.3 → [Updates: 2.56.0]

osv/models.py (1)

• ossf/osv-schema 1.9.0 → [Updates: 1.9.1]

terraform (4)

deployment/terraform/environments/oss-vdb-test/main.tf (4)

• external ~> 2.4.0
• google ~> 7.46.0 → [Updates: ~> 8.4.0]
• google-beta ~> 7.46.0 → [Updates: ~> 8.4.0]
• null ~> 3.3.0

deployment/terraform/environments/oss-vdb/main.tf (4)

• external ~> 2.4.0
• google ~> 7.46.0 → [Updates: ~> 8.4.0]
• google-beta ~> 7.46.0 → [Updates: ~> 8.4.0]
• null ~> 3.3.0

deployment/terraform/environments/private-osv/main.tf (2)

• google ~> 7.46.0 → [Updates: ~> 8.4.0]
• google-beta ~> 7.46.0 → [Updates: ~> 8.4.0]

deployment/terraform/modules/osv/website.tf (1)

• terraform-google-modules/lb-http/google ~> 14.0

---

• Check this box to trigger a request for Renovate to run again on this repository