Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.
[View this repository on the Mend.io Web Portal](https://developer.mend.io/github/cds-snc/github-secret-scanning).

## Pending Approval

The following branches are pending approval. To create them, click on a checkbox below.

- [ ] chore(deps): update actions/checkout action to v7
- [ ] chore(deps): update actions/dependency-review-action action to v5
- [ ] chore(deps): update actions/setup-python action to v7
- [ ] chore(deps): update aws-actions/configure-aws-credentials action to v6
- [ ] chore(deps): update cds-snc/security-tools action to v4
- [ ] chore(deps): update cds-snc/terraform-plan action to v5
- [ ] chore(deps): update dorny/paths-filter action to v4
- [ ] chore(deps): update terraform github.com/cds-snc/terraform-modules to v11
- [ ] 🔐 **Create all pending approval PRs at once** 🔐

## Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

- [ ] chore(deps): update mcr.microsoft.com/devcontainers/python:3.14 docker digest to 3b3c455
- [ ] chore(deps): update dependency uvicorn to v0.53.0
- [ ] chore(deps): update github/codeql-action action to v4.38.0

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [chore(deps): update dependency boto3 to v1.43.89](../pull/581)
- [ ] [chore(deps): lock file maintenance](../pull/582)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## Detected Dependencies

devcontainer (1)

.devcontainer/devcontainer.json (1)

- `mcr.microsoft.com/devcontainers/python 3.14@sha256:1c3a6304ca90d6843915738d1adfbc4db1a660a65fa96948b88048357cc3811a` → [Updates: `3.14`]

dockerfile (1)

api/Dockerfile (2)

- `python 3.13-alpine3.19@sha256:8287ca207e905649e9f399b5f91a119e5e9051d8cd110d5f8c3b4bd9458ebd1d`
- `python 3.13-alpine3.19@sha256:8287ca207e905649e9f399b5f91a119e5e9051d8cd110d5f8c3b4bd9458ebd1d`

github-actions (11)

.github/workflows/ci-code.yml (3)

- `actions/checkout v5.1.0@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` → [Updates: `v7.0.1`]
- `actions/setup-python v6.3.0@ece7cb06caefa5fff74198d8649806c4678c61a1` → [Updates: `v7.0.0`]
- `python 3.14`

.github/workflows/code-scanning.yml (3)

- `actions/checkout v5.1.0@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` → [Updates: `v7.0.1`]
- `github/codeql-action v4.37.9@cdf488f595d80d6e07e03d4674febd5ab45fa938` → [Updates: `v4.38.0`]
- `github/codeql-action v4.37.9@cdf488f595d80d6e07e03d4674febd5ab45fa938` → [Updates: `v4.38.0`]

.github/workflows/dependency-review.yml (2)

- `actions/checkout v5.1.0@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` → [Updates: `v7.0.1`]
- `actions/dependency-review-action v4.9.0@2031cfc080254a8a887f58cffee85186f0e49e48` → [Updates: `v5.0.0`]

.github/workflows/docker-build-push-production.yml (6)

- `actions/checkout v5.1.0@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` → [Updates: `v7.0.1`]
- `dorny/paths-filter v3.0.4@0e4a8c6effa4802afeda77dc8d303f8176d7dfad` → [Updates: `v4.0.3`]
- `actions/checkout v5.1.0@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` → [Updates: `v7.0.1`]
- `aws-actions/configure-aws-credentials v5.1.1@61815dcd50bd041e203e49132bacad1fd04d2708` → [Updates: `v6.2.4`]
- `aws-actions/amazon-ecr-login v2.1.7@03f1aad4c6c7ffd436567f42f9384779290529bd`
- `cds-snc/security-tools v4.0.4@d123fa2b895f7ef5b400fad333d2101b103b2e64`

.github/workflows/docker-build.yml (3)

- `actions/checkout v5.1.0@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` → [Updates: `v7.0.1`]
- `dorny/paths-filter v3.0.4@0e4a8c6effa4802afeda77dc8d303f8176d7dfad` → [Updates: `v4.0.3`]
- `actions/checkout v5.1.0@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` → [Updates: `v7.0.1`]

.github/workflows/docker-vulnerability-scan.yml (4)

- `actions/checkout v5.1.0@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` → [Updates: `v7.0.1`]
- `aws-actions/configure-aws-credentials v5.1.1@61815dcd50bd041e203e49132bacad1fd04d2708` → [Updates: `v6.2.4`]
- `aws-actions/amazon-ecr-login v2.1.7@03f1aad4c6c7ffd436567f42f9384779290529bd`
- `cds-snc/security-tools v3.2.1@5a93d1deec72d4cb2737cb8418364fedba1c695c` → [Updates: `v4.0.4`]

.github/workflows/labels.yml (1)

- `cds-snc/labels v1`

.github/workflows/shellcheck.yml (1)

- `actions/checkout v5.1.0@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` → [Updates: `v7.0.1`]

.github/workflows/terraform-security-scan.yml (1)

- `actions/checkout v5.1.0@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` → [Updates: `v7.0.1`]

.github/workflows/tf_apply_production.yml (3)

- `actions/checkout v5.1.0@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` → [Updates: `v7.0.1`]
- `cds-snc/terraform-tools-setup v1.3.0@36df0d7572a15921998170395475093c183d720a`
- `aws-actions/configure-aws-credentials v5.1.1@61815dcd50bd041e203e49132bacad1fd04d2708` → [Updates: `v6.2.4`]

.github/workflows/tf_plan_production.yml (4)

- `actions/checkout v5.1.0@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` → [Updates: `v7.0.1`]
- `cds-snc/terraform-tools-setup v1.3.0@36df0d7572a15921998170395475093c183d720a`
- `aws-actions/configure-aws-credentials v5.1.1@61815dcd50bd041e203e49132bacad1fd04d2708` → [Updates: `v6.2.4`]
- `cds-snc/terraform-plan v3.7.0@39b0058bcf977fbd8b067b84d5a9f6165e356c32` → [Updates: `v5.0.4`]

pip_requirements (3)

api/requirements_dev.txt (7)

- `black ==26.5.1`
- `coverage ==7.16.0` → [Updates: `==7.16.1`]
- `flake8 ==7.3.0`
- `httpx ==0.28.1`
- `pytest ==9.1.1`
- `pytest-env ==1.7.0` → [Updates: `==1.7.1`]
- `uvicorn ==0.52.4` → [Updates: `==0.53.0`]

api/requirements.txt (7)

- `boto3 ==1.43.86` → [Updates: `==1.43.89`]
- `cryptography ==50.0.1`
- `fastapi ==0.141.1`
- `mangum ==0.22.0`
- `python-dotenv ==1.2.3`
- `requests ==2.34.2`
- `urllib3 ==2.7.0`

terragrunt/aws/alert_compromise/functions/requirements_dev.txt (4)

- `black ==26.5.1`
- `boto3 ==1.43.86` → [Updates: `==1.43.89`]
- `flake8 ==7.3.0`
- `pytest ==9.1.1`

renovate-config (1)

renovate.json

terraform (3)

terragrunt/aws/api/lambda.tf (1)

- `github.com/cds-snc/terraform-modules v10.11.4` → [Updates: `v11.4.7`]

terragrunt/aws/api/sentinel.tf (1)

- `github.com/cds-snc/terraform-modules v10.11.4` → [Updates: `v11.4.7`]

terragrunt/env/common/provider.tf (1)

- `aws ~> 6.0`

terragrunt (10)

terragrunt/env/production/alarms/terragrunt.hcl

terragrunt/env/production/alert_compromise/terragrunt.hcl

terragrunt/env/production/api/terragrunt.hcl

terragrunt/env/production/cloudfront/terragrunt.hcl

terragrunt/env/production/hosted_zone/terragrunt.hcl

terragrunt/env/staging/alarms/terragrunt.hcl

terragrunt/env/staging/alert_compromise/terragrunt.hcl

terragrunt/env/staging/api/terragrunt.hcl

terragrunt/env/staging/cloudfront/terragrunt.hcl

terragrunt/env/staging/hosted_zone/terragrunt.hcl

---

- [ ] Check this box to trigger a request for Renovate to run again on this repository