Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.
[View this repository on the Mend.io Web Portal](https://developer.mend.io/github/GoogleCloudPlatform/key-protection-module).

## Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

- [ ] Update go toolchain directive to v1.26.3
- [ ] Update golang Docker tag to v1.26
- [ ] Update golangci/golangci-lint-action action to v6.5.2
- [ ] Update goreleaser/goreleaser-action action to v6.4.0
- [ ] Update module buf.build/go/protovalidate to v1.2.0
- [ ] Update module google.golang.org/grpc to v1.81.1
- [ ] Update taiki-e/install-action action to v2.78.1
- [ ] Update tokio-prost monorepo to 0.14 (`prost`, `prost-build`)
- [ ] Update actions/checkout action to v6
- [ ] Update actions/setup-go action to v6
- [ ] Update actions/upload-artifact action to v7
- [ ] Update dependency golangci/golangci-lint to v2
- [ ] Update github/codeql-action action to v4
- [ ] Update golangci/golangci-lint-action action to v9
- [ ] Update goreleaser/goreleaser-action action to v7
- [ ] 🔐 **Create all rate-limited PRs at once** 🔐

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [Update github.com/google/go-tpm-tools digest to 9b030a6](../pull/21)
- [ ] [Update github.com/google/go-tpm-tools/agent digest to 9b030a6](../pull/22)
- [ ] [Update github.com/google/go-tpm-tools/verifier digest to 9b030a6](../pull/25)
- [ ] [Update github.com/GoogleCloudPlatform/confidential-space/server digest to 5adc77d](../pull/26)
- [ ] [Update github.com/GoogleCloudPlatform/key-protection-module digest to adf2ef8](../pull/42)
- [ ] [Update actions/upload-artifact action to v4.6.2](../pull/32)
- [ ] [Update module buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go to v1.36.11-20260415201107-50325440f8f2.1](../pull/34)
- [ ] [Update ossf/scorecard-action action to v2.4.3](../pull/35)
- [ ] [Update actions/checkout action to v4.3.1](../pull/36)
- [ ] [Update actions/setup-go action to v5.6.0](../pull/37)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## Detected Dependencies

cargo (8)

Cargo.toml (10)

- `uuid 1.20.0`
- `zeroize 1.8.2`
- `prost 0.13` → [Updates: `0.14`]
- `libc 0.2.180`
- `memmap2 0.9.9`
- `thiserror 2.0`
- `clear_on_drop 0.2`
- `hex 0.4`
- `prost-build 0.13` → [Updates: `0.14`]
- `protoc-bin-vendored 3.2.0`

key_protection_service/key_custody_core/Cargo.toml

key_protection_service/key_custody_core/fuzz/Cargo.toml (3)

- `libfuzzer-sys 0.4`
- `uuid 1.20.0`
- `prost 0.13` → [Updates: `0.14`]

km_common/Cargo.toml

third_party/bssl-crypto/Cargo.toml

third_party/bssl-sys/Cargo.toml (1)

- `cmake 0.1`

workload_service/key_custody_core/Cargo.toml

workload_service/key_custody_core/fuzz/Cargo.toml (3)

- `libfuzzer-sys 0.4`
- `uuid 1.20.0`
- `prost 0.13` → [Updates: `0.14`]

cloudbuild (2)

cloudbuild.yaml

image/cloudbuild.yaml (1)

- `golang 1.25-rc-bullseye`

dockerfile (1)

Dockerfile (1)

- `golang 1.24-bookworm` → [Updates: `1.26-bookworm`]

github-actions (3)

.github/workflows/ci.yml (20)

- `actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683` → [Updates: `v4.3.1`, `v6.0.2`]
- `actions/setup-go v5.3.0@f111f3307d8850f501ac008e886eec1fd1932a34` → [Updates: `v5.6.0`, `v6.4.0`]
- `dtolnay/rust-toolchain stable@29eef336d9b2848a0b548edc03f92a220660cdb8`
- `taiki-e/install-action v2.77.0@7ea35f098a7369cd23488403f58be9c491a6c55f` → [Updates: `v2.78.1`]
- `actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683` → [Updates: `v4.3.1`, `v6.0.2`]
- `actions/setup-go v5.3.0@f111f3307d8850f501ac008e886eec1fd1932a34` → [Updates: `v5.6.0`, `v6.4.0`]
- `dtolnay/rust-toolchain stable@29eef336d9b2848a0b548edc03f92a220660cdb8`
- `golangci/golangci-lint-action v6.2.0@ec5d18412c0aeab7936cb16880d708ba2a64e1ae` → [Updates: `v6.5.2`, `v9.2.0`]
- `actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683` → [Updates: `v4.3.1`, `v6.0.2`]
- `actions/setup-go v5.3.0@f111f3307d8850f501ac008e886eec1fd1932a34` → [Updates: `v5.6.0`, `v6.4.0`]
- `dtolnay/rust-toolchain stable@29eef336d9b2848a0b548edc03f92a220660cdb8`
- `actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683` → [Updates: `v4.3.1`, `v6.0.2`]
- `bufbuild/buf-action v1.4.0@fd21066df7214747548607aaa45548ba2b9bc1ff`
- `actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683` → [Updates: `v4.3.1`, `v6.0.2`]
- `actions-rust-lang/audit v1.2.7@72c09e02f132669d52284a3323acdb503cfc1a24`
- `actions-rust-lang/audit v1.2.7@72c09e02f132669d52284a3323acdb503cfc1a24`
- `actions-rust-lang/audit v1.2.7@72c09e02f132669d52284a3323acdb503cfc1a24`
- `go 1.24.x` → [Updates: `1.26.x`]
- `golangci/golangci-lint v1.64.8` → [Updates: `v2.12.2`]
- `go 1.24.x` → [Updates: `1.26.x`]

.github/workflows/releaser.yml (4)

- `actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683` → [Updates: `v4.3.1`, `v6.0.2`]
- `actions/setup-go v5.3.0@f111f3307d8850f501ac008e886eec1fd1932a34` → [Updates: `v5.6.0`, `v6.4.0`]
- `dtolnay/rust-toolchain stable@29eef336d9b2848a0b548edc03f92a220660cdb8`
- `goreleaser/goreleaser-action v6.2.1@90a3faa9d0182683851fbfa97ca1a2cb983bfca3` → [Updates: `v6.4.0`, `v7.2.1`]

.github/workflows/scorecard.yml (4)

- `actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683` → [Updates: `v4.3.1`, `v6.0.2`]
- `ossf/scorecard-action v2.4.1@f49aabe0b5af0936a0987cfb85d86b75731b0186` → [Updates: `v2.4.3`]
- `actions/upload-artifact v4.6.1@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1` → [Updates: `v4.6.2`, `v7.0.1`]
- `github/codeql-action v3` → [Updates: `v4`]

gomod (2)

go.mod (7)

- `go 1.24.0`
- `go 1.24.13` → [Updates: `1.26.3`]
- `buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260209202127-80ab13bee0bf.1@80ab13bee0bf` → [Updates: `v1.36.11-20260415201107-50325440f8f2.1`]
- `buf.build/go/protovalidate v1.1.3` → [Updates: `v1.2.0`]
- `github.com/google/uuid v1.6.0`
- `google.golang.org/grpc v1.71.0` → [Updates: `v1.81.1`]
- `google.golang.org/protobuf v1.36.11`

keymanager/attestation_service/go.mod (9)

- `go 1.24.13`
- `github.com/GoogleCloudPlatform/confidential-space/server v0.0.0-20260410183711-07bdbfebb244@07bdbfebb244` → [Updates: `v0.0.0-20260513001127-5adc77d41486`]
- `github.com/GoogleCloudPlatform/key-protection-module v0.0.0-20260513054212-f2adec2162e7@f2adec2162e7` → [Updates: `v0.0.0-20260514133959-adf2ef87e7fa`]
- `github.com/google/go-tpm v0.9.8`
- `github.com/google/go-tpm-tools v0.4.9-0.20260325175049-22911efba9e5@22911efba9e5` → [Updates: `v0.4.9-0.20260325175049-22911efba9e5`]
- `github.com/google/go-tpm-tools/agent v0.0.0-20260424173438-cf6db90d8918@cf6db90d8918` → [Updates: `v0.0.0-20260514233918-9b030a617ffa`]
- `google.golang.org/grpc v1.80.0` → [Updates: `v1.81.1`]
- `google.golang.org/protobuf v1.36.11`
- `github.com/google/go-tpm-tools/verifier v0.0.0-20260424173438-cf6db90d8918@cf6db90d8918` → [Updates: `v0.0.0-20260514233918-9b030a617ffa`]

---

- [ ] Check this box to trigger a request for Renovate to run again on this repository

This is an automated Renovate dashboard rather than a single change. Review the open pull requests and rate-limited entries, starting with .github/workflows/ci.yml, go.mod, Cargo.toml, Dockerfile, and cloudbuild.yaml. Done would require determining which dependency updates are appropriate and confirming the listed updates are handled.

Written by the indexing model from the issue text.