Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.
[View this repository on the Mend.io Web Portal](https://developer.mend.io/github/crossplane-contrib/provider-gitlab).

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [fix(deps): update all minor and patch](../pull/409) (`gitlab.com/gitlab-org/api/client-go/v2`, `golang.org/x/oauth2`, `golang.org/x/sync`, `sigs.k8s.io/controller-runtime`)
- [ ] [fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v3](../pull/410)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## Detected Dependencies

dockerfile (1)

cluster/images/provider-gitlab/Dockerfile (1)

- `gcr.io/distroless/static sha256:d5f030ca7c5793784e9ea4178a116da360250411d13921a5af27c6cb5a5949bf` → [Updates: `undefined`]

github-actions (5)

.github/workflows/backport.yaml (3)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `zeebe-io/backport-action v4.6.0@2e830a1d0b8269505846ddd407a70876913ad1f8`
- `ubuntu 24.04`

.github/workflows/ci.yaml (49)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `fkirc/skip-duplicate-actions v5.3.2@b974a9395958c231af965b70070979a577efa578`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `golangci/golangci-lint-action v9@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `aquasecurity/trivy-action v0.36.0@ed142fd0673e97e23eac54620cfb913e5ce36c25`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `codecov/codecov-action v7.0.0@fb8b3582c8e4def4969c97caa2f19720cb33a72f`
- `docker/setup-qemu-action v4.3.0@1f40c72289eff860ee54a304f1438e3cff362e0a`
- `docker/setup-buildx-action v4.3.0@37fe631027851001ddb9b187196cc803df7f5f0e`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `jlumbroso/free-disk-space v1.3.1@54081f138730dfa15788a46383842cd2f914a1be`
- `docker/setup-qemu-action v4.3.0@1f40c72289eff860ee54a304f1438e3cff362e0a`
- `docker/setup-buildx-action v4.3.0@37fe631027851001ddb9b187196cc803df7f5f0e`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`
- `docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f`
- `docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f`
- `docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f`
- `ubuntu 24.04`
- `go ${{ env.GO_VERSION }}`
- `ubuntu 24.04`
- `ubuntu 24.04`
- `go ${{ env.GO_VERSION }}`
- `golangci/golangci-lint ${{ env.GOLANGCI_VERSION }}`
- `ubuntu 24.04`
- `ubuntu 24.04`
- `go ${{ env.GO_VERSION }}`
- `ubuntu 24.04`
- `buildx ${{ env.DOCKER_BUILDX_VERSION }}`
- `go ${{ env.GO_VERSION }}`
- `ubuntu 24.04`
- `buildx ${{ env.DOCKER_BUILDX_VERSION }}`
- `go ${{ env.GO_VERSION }}`

.github/workflows/commands.yaml (7)

- `xt0rted/slash-command-action v2@bf51f8f5f4ea3d58abc7eca58f77104182b23e88`
- `actions/github-script v9@3a2844b7e9c422d3c10d287c895573f7108da1b3`
- `xt0rted/slash-command-action v2@bf51f8f5f4ea3d58abc7eca58f77104182b23e88`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `zeebe-io/backport-action v4.6.0@2e830a1d0b8269505846ddd407a70876913ad1f8`
- `ubuntu 24.04`
- `ubuntu 24.04`

.github/workflows/promote.yaml (5)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f`
- `ubuntu 24.04`
- `go ${{ env.GO_VERSION }}`

.github/workflows/tag.yaml (3)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `negz/create-tag v2@8dce6c9d9b12d161abe01c02d2b03f19e2e9e9bb`
- `ubuntu 24.04`

gomod (2)

go.mod (19)

- `go 1.26.0`
- `github.com/crossplane/crossplane-runtime/v2 v2.4.0`
- `github.com/crossplane/crossplane/apis/v2 v2.4.0`
- `github.com/google/go-cmp v0.7.0`
- `github.com/hashicorp/go-cleanhttp v0.5.2`
- `github.com/pkg/errors v0.9.1`
- `gitlab.com/gitlab-org/api/client-go/v2 v2.62.0` → [Updates: `v2.64.0`, `v3.9.0`]
- `go.uber.org/zap v1.28.0`
- `golang.org/x/oauth2 v0.36.0` → [Updates: `v0.37.0`]
- `k8s.io/api v0.37.0`
- `k8s.io/apiextensions-apiserver v0.37.0`
- `k8s.io/apimachinery v0.37.0`
- `k8s.io/client-go v0.37.0`
- `sigs.k8s.io/controller-runtime v0.24.1` → [Updates: `v0.25.0`]
- `github.com/alecthomas/kingpin/v2 v2.4.0`
- `github.com/go-logr/logr v1.4.4`
- `github.com/hashicorp/go-retryablehttp v0.7.8`
- `golang.org/x/sync v0.22.0` → [Updates: `v0.23.0`]
- `k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3@cf1189d6abe3`

tools/go.mod (4)

- `go 1.26.0`
- `github.com/crossplane/crossplane-tools v0.0.0-20260719180100-659f1dc036c5@659f1dc036c5`
- `sigs.k8s.io/controller-tools v0.22.0`
- `github.com/floric/crossplane-tools v0.0.0-20260529090112-242321a25263@242321a25263` → [Updates: `v0.0.0-20260529090112-242321a25263`]

---

- [ ] Check this box to trigger a request for Renovate to run again on this repository

Start by reviewing pull requests 409 and 410, then inspect go.mod, tools/go.mod, cluster/images/provider-gitlab/Dockerfile, and the listed .github/workflows files. Done means the selected dependency updates are validated by the repository's CI and the corresponding dashboard entries no longer require action.

Written by the indexing model from the issue text.