Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.
[View this repository on the Mend.io Web Portal](https://developer.mend.io/github/cds-snc/security-tools).

## Pending Approval

The following branches are pending approval. To create them, click on a checkbox below.

- [ ] chore(deps): update actions/checkout action to v7
- [ ] chore(deps): update actions/dependency-review-action action to v5
- [ ] chore(deps): update aws-actions/configure-aws-credentials action to v6
- [ ] chore(deps): update dependency flake8 to v7
- [ ] chore(deps): update dependency pandas to v3
- [ ] chore(deps): update dependency pandas-stubs to v3
- [ ] chore(deps): update dependency pyarrow to v25
- [ ] chore(deps): update dorny/paths-filter action to v4
- [ ] chore(deps): update github/codeql-action action to v4
- [ ] chore(deps): update oras-project/setup-oras action to v2
- [ ] chore(deps): update terraform aws to v6
- [ ] chore(deps): update terraform github.com/cds-snc/terraform-modules to v11
- [ ] 🔐 **Create all pending approval PRs at once** 🔐

## Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

- [ ] chore(deps): update mcr.microsoft.com/devcontainers/python:3-3.14-bookworm docker digest to 8179b9d
- [ ] chore(deps): update github/codeql-action action to v3.38.0
- [ ] chore(deps): update ghcr.io/devcontainers/features/docker-in-docker docker tag to v4
- [ ] chore(deps): update terraform github.com/cds-snc/terraform-modules to v12

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [chore(deps): update terraform github.com/cds-snc/terraform-modules to v11.4.7](../pull/637)
- [ ] [chore(deps): lock file maintenance](../pull/638)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## Detected Dependencies

devcontainer (1)

.devcontainer/devcontainer.json (6)

- `mcr.microsoft.com/devcontainers/python 3-3.14-bookworm@sha256:0fdcf958b64fd9ffe19972b4afb1337d1c57596442fb2424130bae8e093b9fcc` → [Updates: `3-3.14-bookworm`]
- `ghcr.io/devcontainers/features/docker-in-docker 3` → [Updates: `4`]
- `ghcr.io/devcontainers/features/aws-cli 1`
- `ghcr.io/devcontainers/features/github-cli 1`
- `ghcr.io/devcontainers/features/terraform 1`
- `ghcr.io/devcontainers/features/python 1`

dockerfile (1)

images/csp_violation_report_service/Dockerfile (2)

- `python 3.11.2-alpine3.16@sha256:beae3986f2c26f415a02664d03e2a7780ae4b521da8309cbfe80ff2d30fa44c7`
- `python 3.11.2-alpine3.16@sha256:beae3986f2c26f415a02664d03e2a7780ae4b521da8309cbfe80ff2d30fa44c7`

github-actions (26)

.github/actions/cccs-security-controls/action.yml (1)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]

.github/actions/docker-scan/action.yml (1)

- `github/codeql-action v3.37.9@6f5948dfacef28e207b48d0905cf90c03365536d` → [Updates: `v3.38.0`, `v4.37.9`]

.github/actions/security-controls/action.yml (1)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]

.github/workflows/bandit_security_scan.yml (1)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]

.github/workflows/base-terragrunt-apply.yml (4)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `cds-snc/terraform-tools-setup v1.3.0@36df0d7572a15921998170395475093c183d720a`
- `cds-snc/paths-filter v2.10.4@b316143212d841aed668b7b29240c719d603a9b9`
- `aws-actions/configure-aws-credentials master@ffc08eae7350b1061d7de219e2135c75561fb680`

.github/workflows/base-terragrunt-plan.yml (5)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `cds-snc/terraform-tools-setup v1.3.0@36df0d7572a15921998170395475093c183d720a`
- `cds-snc/paths-filter v2.10.4@b316143212d841aed668b7b29240c719d603a9b9`
- `aws-actions/configure-aws-credentials v6.2.4@cbe3b392738ccf3f987d68400dafcf4b0624a56c`
- `cds-snc/terraform-plan v5.0.4@529b272050a8f718d14c59e62b59c124eead7efc`

.github/workflows/build_and_push.yml (6)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `dorny/paths-filter v2.12.0@7267a8516b6f92bdb098633497bad573efdbf271` → [Updates: `v4.0.3`]
- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `aws-actions/configure-aws-credentials master@ffc08eae7350b1061d7de219e2135c75561fb680`
- `aws-actions/amazon-ecr-login v2.1.7@03f1aad4c6c7ffd436567f42f9384779290529bd`
- `cds-snc/security-tools v4.0.4@d123fa2b895f7ef5b400fad333d2101b103b2e64`

.github/workflows/cartography-sentinel-forward.yml (3)

- `aws-actions/configure-aws-credentials v4.3.1@7474bc4690e29a8392af63c5b98e7449536d5c3a` → [Updates: `v6.2.4`]
- `aws-actions/configure-aws-credentials v4.3.1@7474bc4690e29a8392af63c5b98e7449536d5c3a` → [Updates: `v6.2.4`]
- `aws-actions/configure-aws-credentials v4.3.1@7474bc4690e29a8392af63c5b98e7449536d5c3a` → [Updates: `v6.2.4`]

.github/workflows/ci_build_containers.yml (5)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `dorny/paths-filter v2.12.0@7267a8516b6f92bdb098633497bad573efdbf271` → [Updates: `v4.0.3`]
- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `aws-actions/configure-aws-credentials master@ffc08eae7350b1061d7de219e2135c75561fb680`
- `aws-actions/amazon-ecr-login v2.1.7@03f1aad4c6c7ffd436567f42f9384779290529bd`

.github/workflows/ci_tools.yml (3)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `dorny/paths-filter v2.12.0@7267a8516b6f92bdb098633497bad573efdbf271` → [Updates: `v4.0.3`]
- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]

.github/workflows/cloud-asset-inventory-terragrunt-apply.yml (4)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `cds-snc/terraform-tools-setup v1.3.0@36df0d7572a15921998170395475093c183d720a`
- `cds-snc/paths-filter v2.10.4@b316143212d841aed668b7b29240c719d603a9b9`
- `aws-actions/configure-aws-credentials master@ffc08eae7350b1061d7de219e2135c75561fb680`

.github/workflows/cloud-asset-inventory-terragrunt-plan.yml (5)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `cds-snc/terraform-tools-setup v1.3.0@36df0d7572a15921998170395475093c183d720a`
- `cds-snc/paths-filter v2.10.4@b316143212d841aed668b7b29240c719d603a9b9`
- `aws-actions/configure-aws-credentials v6.2.4@cbe3b392738ccf3f987d68400dafcf4b0624a56c`
- `cds-snc/terraform-plan v5.0.4@529b272050a8f718d14c59e62b59c124eead7efc`

.github/workflows/csp-reports-terragrunt-apply.yml (4)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `cds-snc/terraform-tools-setup v1.3.0@36df0d7572a15921998170395475093c183d720a`
- `cds-snc/paths-filter v2.10.4@b316143212d841aed668b7b29240c719d603a9b9`
- `aws-actions/configure-aws-credentials master@ffc08eae7350b1061d7de219e2135c75561fb680`

.github/workflows/csp-reports-terragrunt-plan.yml (5)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `cds-snc/terraform-tools-setup v1.3.0@36df0d7572a15921998170395475093c183d720a`
- `cds-snc/paths-filter v2.10.4@b316143212d841aed668b7b29240c719d603a9b9`
- `aws-actions/configure-aws-credentials v6.2.4@cbe3b392738ccf3f987d68400dafcf4b0624a56c`
- `cds-snc/terraform-plan v5.0.4@529b272050a8f718d14c59e62b59c124eead7efc`

.github/workflows/dependency-review.yml (2)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `actions/dependency-review-action v4.9.0@2031cfc080254a8a887f58cffee85186f0e49e48` → [Updates: `v5.0.0`]

.github/workflows/docker-vulnerability-scan.yml (4)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `aws-actions/configure-aws-credentials v4.3.1@7474bc4690e29a8392af63c5b98e7449536d5c3a` → [Updates: `v6.2.4`]
- `aws-actions/amazon-ecr-login v2.1.7@03f1aad4c6c7ffd436567f42f9384779290529bd`
- `cds-snc/security-tools v4.0.4@d123fa2b895f7ef5b400fad333d2101b103b2e64`

.github/workflows/generate-sbom-terragrunt-apply.yml (4)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `cds-snc/terraform-tools-setup v1.3.0@36df0d7572a15921998170395475093c183d720a`
- `cds-snc/paths-filter v2.10.4@b316143212d841aed668b7b29240c719d603a9b9`
- `aws-actions/configure-aws-credentials master@ffc08eae7350b1061d7de219e2135c75561fb680`

.github/workflows/generate-sbom-terragrunt-plan.yml (5)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `cds-snc/terraform-tools-setup v1.3.0@36df0d7572a15921998170395475093c183d720a`
- `cds-snc/paths-filter v2.10.4@b316143212d841aed668b7b29240c719d603a9b9`
- `aws-actions/configure-aws-credentials v6.2.4@cbe3b392738ccf3f987d68400dafcf4b0624a56c`
- `cds-snc/terraform-plan v5.0.4@529b272050a8f718d14c59e62b59c124eead7efc`

.github/workflows/json-lint.yml (1)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]

.github/workflows/labels.yml (1)

- `cds-snc/labels v1`

.github/workflows/mirror-ecr-images.yml (5)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `aws-actions/configure-aws-credentials v4.3.1@7474bc4690e29a8392af63c5b98e7449536d5c3a` → [Updates: `v6.2.4`]
- `aws-actions/amazon-ecr-login v2.1.7@03f1aad4c6c7ffd436567f42f9384779290529bd`
- `cds-snc/security-tools v4.0.4@d123fa2b895f7ef5b400fad333d2101b103b2e64`

.github/workflows/shellcheck.yml (1)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]

.github/workflows/sso-proxy-terragrunt-apply.yml (4)

- `actions/checkout v2.8.0@0717577d45739eb3c851188b29f50ed6c0b2194e` → [Updates: `v7.0.1`]
- `cds-snc/terraform-tools-setup v1.3.0@36df0d7572a15921998170395475093c183d720a`
- `cds-snc/paths-filter v2.10.4@b316143212d841aed668b7b29240c719d603a9b9`
- `aws-actions/configure-aws-credentials master@ffc08eae7350b1061d7de219e2135c75561fb680`

.github/workflows/sso-proxy-terragrunt-plan.yml (5)

- `actions/checkout v2.8.0@0717577d45739eb3c851188b29f50ed6c0b2194e` → [Updates: `v7.0.1`]
- `cds-snc/terraform-tools-setup v1.3.0@36df0d7572a15921998170395475093c183d720a`
- `cds-snc/paths-filter v2.10.4@b316143212d841aed668b7b29240c719d603a9b9`
- `aws-actions/configure-aws-credentials v6.2.4@cbe3b392738ccf3f987d68400dafcf4b0624a56c`
- `cds-snc/terraform-plan v5.0.4@529b272050a8f718d14c59e62b59c124eead7efc`

.github/workflows/terraform-security-scan.yml (1)

- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]

.github/workflows/trivy-db-refresh.yml (4)

- `oras-project/setup-oras v1.2.4@22ce207df3b08e061f537244349aac6ae1d214f6` → [Updates: `v2.0.1`]
- `actions/checkout v4.4.0@11d5960a326750d5838078e36cf38b85af677262` → [Updates: `v7.0.1`]
- `aws-actions/configure-aws-credentials v4.3.1@7474bc4690e29a8392af63c5b98e7449536d5c3a` → [Updates: `v6.2.4`]
- `aws-actions/amazon-ecr-login v2.1.7@03f1aad4c6c7ffd436567f42f9384779290529bd`

pip_requirements (4)

images/csp_violation_report_service/requirements_dev.txt (4)

- `black ==26.5.1`
- `coverage ==7.16.0` → [Updates: `==7.16.1`]
- `flake8 ==6.1.0` → [Updates: `==7.3.0`]
- `pytest ==9.1.1`

tools/cccs-cloud-control-issue-generator/requirements.txt (2)

- `pytest ==9.1.1`
- `requests ==2.34.2`

tools/itsg33-issue-generator/requirements.txt (2)

- `pytest ==9.1.1`
- `requests ==2.34.2`

tools/logs-analyzer/requirements.txt (4)

- `pandas ==2.3.3` → [Updates: `==3.0.5`]
- `pandas-stubs ==2.3.3.260113` → [Updates: `==3.0.5.260730`]
- `pyarrow ==23.0.1` → [Updates: `==25.0.1`]
- `netaddr ==1.3.0`

renovate-config (1)

renovate.json

terraform (6)

terragrunt/aws/base/vpc.tf (1)

- `github.com/cds-snc/terraform-modules v11.4.5` → [Updates: `v11.4.7`, `v12.0.0`]

terragrunt/aws/cloud_asset_inventory/iam.tf (1)

- `github.com/cds-snc/terraform-modules v11.4.5` → [Updates: `v11.4.7`, `v12.0.0`]

terragrunt/aws/cloud_asset_inventory/s3.tf (1)

- `github.com/cds-snc/terraform-modules v11.4.5` → [Updates: `v11.4.7`, `v12.0.0`]

terragrunt/aws/csp_violation_report_service/lambda.tf (1)

- `github.com/cds-snc/terraform-modules v10.11.4` → [Updates: `v11.4.7`]

terragrunt/aws/csp_violation_report_service/sentinel.tf (1)

- `github.com/cds-snc/terraform-modules v10.11.4` → [Updates: `v11.4.7`]

terragrunt/env/common/provider.tf (1)

- `aws ~> 5.0` → [Updates: `~> 6.0`]

terragrunt (5)

terragrunt/env/base/terragrunt.hcl

terragrunt/env/cloud_asset_inventory/terragrunt.hcl

terragrunt/env/csp_violation_report_service/terragrunt.hcl

terragrunt/env/generate_sbom/terragrunt.hcl

terragrunt/env/sso_proxy/terragrunt.hcl

---

- [ ] Check this box to trigger a request for Renovate to run again on this repository