Renovate Dashboard 🤖

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.
[View this repository on the Mend.io Web Portal](https://developer.mend.io/github/defenseunicorns/uds-cli).

## Config Migration Needed

- [ ] Select this checkbox to let Renovate create an automated Config Migration PR.

## Repository Problems

These problems occurred while renovating this repository. [View logs](https://developer.mend.io//github/defenseunicorns/uds-cli).

- ⚠️ WARN: Error obtaining docker token
- ⚠️ WARN: Package lookup failures

---

> [!WARNING]
> Renovate failed to look up the following dependencies: `Failed to look up docker package cgr.dev/chainguard/static@sha256: no-result`, `Failed to look up docker package localhost:888/nginx: no-result`, `Failed to look up docker package localhost:889/podinfo: no-result`, `Failed to look up docker package localhost:888/output-var: no-result`, `Failed to look up docker package localhost:888/receive-var: no-result`, `Failed to look up docker package localhost:888/helm-overrides: no-result`, `Failed to look up docker package localhost:888/prometheus: no-result`, `Failed to look up docker package localhost:888/multi-platform-image: no-result`.
>
> Files affected: `testdata/legacy/packages/multi-platform-image/zarf.yaml`, `testdata/legacy/bundles/01-uds-bundle/uds-bundle.yaml`, `testdata/legacy/bundles/02-variables/remote/uds-bundle.yaml`, `testdata/legacy/bundles/07-helm-overrides/duplicate/uds-bundle.yaml`, `testdata/legacy/bundles/10-package-naming/uds-bundle.yaml`, `testdata/legacy/bundles/13-composable-component/uds-bundle.yaml`, `testdata/legacy/bundles/14-optional-components/uds-bundle.yaml`, `testdata/legacy/bundles/23-multi-platform-image/uds-bundle.yaml`

---

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [chore(deps): update application-deps](../pull/1542) (`github.com/google/go-containerregistry`, `go`, `golang.org/x/mod`, `golang.org/x/sync`, `helm.sh/helm/v4`, `k8s.io/api`, `k8s.io/apimachinery`, `k8s.io/client-go`)
- [ ] [chore(deps): update support dependencies to v2026.9.8](../pull/1556)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## Detected Dependencies

github-actions (14)

.github/actions/install-tools/action.yaml (3)

- `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6`
- `anchore/sbom-action v0.24.2@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26`
- `docker/setup-buildx-action v4.3.0@37fe631027851001ddb9b187196cc803df7f5f0e`

.github/actions/mise/action.yaml (3)

- `jdx/mise-action v4.3.0@c2a87611a18de5b3828c5652fe268e992400cb5c`
- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `jdx/mise 2026.9.7` → [Updates: `2026.9.8`]

.github/actions/save-logs/action.yaml (1)

- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`

.github/actions/setup-uds-e2e/action.yaml (1)

- `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c`

.github/workflows/commitlint.yaml (1)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`

.github/workflows/dependency-check.yml (8)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/dependency-review-action v5.0.0@a1d282b36b6f3519aa1f3fc636f609c47dddb294`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `anchore/scan-action v7.4.2@27805bf3b4e84b4a5c980df22ed233c00390a439`
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `golang/govulncheck-action v1.1.0@032d45514ae346b1db93c04b0c90b841c370344f`
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`

.github/workflows/docs-shim.yaml (2)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`

.github/workflows/release-please.yaml (1)

- `googleapis/release-please-action v5.0.0@45996ed1f6d02564a971a2fa1b5860e934307cf7`

.github/workflows/release.yaml (3)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1`
- `goreleaser/goreleaser-action v7.2.3@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94`

.github/workflows/scan-codeql.yaml (3)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `github/codeql-action v4.38.0@b96794f015dfd88f77b49b1c93e0fa7110f94c63`
- `github/codeql-action v4.38.0@b96794f015dfd88f77b49b1c93e0fa7110f94c63`

.github/workflows/scorecard.yaml (4)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `ossf/scorecard-action v2.4.4@2d1146689b8cda280b9bc96326124645441f03bc`
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`
- `github/codeql-action v4.38.0@b96794f015dfd88f77b49b1c93e0fa7110f94c63`

.github/workflows/snapshot-release.yaml (5)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `goreleaser/goreleaser-action v7.2.3@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`

.github/workflows/test-shim.yaml

.github/workflows/test.yaml (18)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f`

gomod (1)

go.mod (32)

- `go 1.26.6`
- `charm.land/lipgloss/v2 v2.0.6`
- `github.com/AlecAivazis/survey/v2 v2.3.7`
- `github.com/alecthomas/jsonschema v0.0.0-20220216202328-9eeeec9d044b@9eeeec9d044b`
- `github.com/defenseunicorns/maru-runner v0.6.0`
- `github.com/defenseunicorns/pkg/exec v0.0.2`
- `github.com/defenseunicorns/pkg/helpers/v2 v2.0.4`
- `github.com/defenseunicorns/pkg/oci v1.3.2`
- `github.com/fsnotify/fsnotify v1.10.1`
- `github.com/goccy/go-yaml v1.19.2`
- `github.com/google/go-containerregistry v0.22.0` → [Updates: `v0.22.1`]
- `github.com/hashicorp/hcl/v2 v2.24.0`
- `github.com/mholt/archives v0.1.5`
- `github.com/opencontainers/go-digest v1.0.0`
- `github.com/opencontainers/image-spec v1.1.1`
- `github.com/phsym/console-slog v0.3.1`
- `github.com/pterm/pterm v0.12.83`
- `github.com/sigstore/cosign/v3 v3.1.3`
- `github.com/spf13/cobra v1.10.2`
- `github.com/spf13/pflag v1.0.10`
- `github.com/spf13/viper v1.21.0`
- `github.com/stretchr/testify v1.12.1`
- `github.com/zarf-dev/zarf v0.85.0`
- `github.com/zclconf/go-cty v1.19.0`
- `golang.org/x/mod v0.40.0` → [Updates: `v0.41.0`]
- `golang.org/x/sync v0.22.0` → [Updates: `v0.23.0`]
- `gopkg.in/yaml.v3 v3.0.1`
- `helm.sh/helm/v4 v4.2.4` → [Updates: `v4.3.0`]
- `k8s.io/api v0.36.4` → [Updates: `v0.37.0`]
- `k8s.io/apimachinery v0.36.4` → [Updates: `v0.37.0`]
- `k8s.io/client-go v0.36.4` → [Updates: `v0.37.0`]
- `oras.land/oras-go/v2 v2.6.2`

helm-values (4)

testdata/legacy/packages/gitrepo/refs/deployment.yaml (1)

- `docker.io/library/nginx 1.31.5`

testdata/legacy/packages/nginx-namespace-override/refs/deployment.yaml (1)

- `nginx 1.31.5`

testdata/legacy/packages/nginx/refs/deployment.yaml (1)

- `nginx 1.31.5`

tests/test_data/packages/operator-monitor/pods.yaml (2)

- `registry.k8s.io/e2e-test-images/busybox 1.29-4`
- `registry.k8s.io/e2e-test-images/busybox 1.29-4`

helmv3 (1)

testdata/legacy/packages/helm/unicorn-podinfo/Chart.yaml (1)

- `podinfo 6.15.0`

kubernetes (5)

testdata/legacy/packages/gitrepo/refs/deployment.yaml (2)

- `docker.io/library/nginx 1.31.5`
- `Deployment apps/v1`

testdata/legacy/packages/nginx-namespace-override/refs/deployment.yaml (2)

- `nginx 1.31.5`
- `Deployment apps/v1`

testdata/legacy/packages/nginx/refs/deployment.yaml (2)

- `nginx 1.31.5`
- `Deployment apps/v1`

tests/test_data/packages/operator-monitor/pods.yaml (2)

- `registry.k8s.io/e2e-test-images/busybox 1.29-4`
- `registry.k8s.io/e2e-test-images/busybox 1.29-4`

vendor/k8s.io/apimachinery/pkg/util/managedfields/pod.yaml

mise (1)

mise.toml (10)

- `go 1.27.0` → [Updates: `1.27.1`]
- `hk 1.58.1` → [Updates: `2.0.0`]
- `jq 1.8.2`
- `golangci-lint 2.13.2`
- `github:goreleaser/goreleaser 2.18.1`
- `github:gitleaks/gitleaks 8.30.1`
- `k3d 5.9.0`
- `node 24.21.0`
- `aqua:google/addlicense 1.2.0`
- `aqua:defenseunicorns/uds-cli 0.37.0`

regex (72)

.github/actions/install-tools/action.yaml

.github/actions/mise/action.yaml (1)

- `jdx/mise 2026.9.7` → [Updates: `2026.9.8`]

.github/workflows/release.yaml (1)

- `goreleaser/goreleaser v2.18.1`

.github/workflows/snapshot-release.yaml (1)

- `goreleaser/goreleaser v2.18.1`

docs/getting-started/next-quickstart.mdx (3)

- `ghcr.io/defenseunicorns/packages/uds-k3d 0.20.3`
- `ghcr.io/zarf-dev/packages/init v0.85.0`
- `ghcr.io/defenseunicorns/uds-cli/podinfo 0.0.2`

docs/getting-started/quickstart.mdx (2)

- `ghcr.io/zarf-dev/packages/init v0.85.0`
- `ghcr.io/zarf-dev/packages/dos-games 1.3.0`

docs/how-to-guides/verify-keyless-package-signatures.mdx (1)

- `ghcr.io/zarf-dev/packages/init v0.85.0`

docs/reference/next-mode.mdx (3)

- `ghcr.io/defenseunicorns/packages/uds-k3d 0.20.3`
- `ghcr.io/zarf-dev/packages/init v0.85.0`
- `ghcr.io/defenseunicorns/uds-cli/podinfo 0.0.2`

hack/generate-schema.sh (1)

- `zarf-dev/zarf 0.85.0`

README.md (2)

- `ghcr.io/zarf-dev/packages/init v0.85.0`
- `ghcr.io/defenseunicorns/uds-cli/podinfo 0.0.2`

README.md (3)

- `ghcr.io/defenseunicorns/packages/uds-k3d 0.20.3`
- `ghcr.io/zarf-dev/packages/init v0.85.0`
- `ghcr.io/defenseunicorns/uds-cli/podinfo 0.0.2`

release-please-config.json

tasks/lint.yaml (1)

- `defenseunicorns/uds-common v1.28.3`

testdata/legacy/bundles/01-uds-bundle/uds-bundle.yaml (2)

- `localhost:888/nginx 0.0.1`
- `localhost:889/podinfo 0.0.1`

testdata/legacy/bundles/02-variables/remote/uds-bundle.yaml (2)

- `localhost:888/output-var 0.0.1`
- `localhost:888/receive-var 0.0.1`

testdata/legacy/bundles/03-local-and-remote/uds-bundle.yaml (1)

- `ghcr.io/defenseunicorns/uds-cli/nginx 0.0.2`

testdata/legacy/bundles/04-init/uds-bundle.yaml (2)

- `zarf-dev/zarf v0.85.0`
- `zarf-dev/zarf v0.85.0`

testdata/legacy/bundles/04-init/uds-bundle.yaml (1)

- `ghcr.io/zarf-dev/packages/init v0.85.0`

testdata/legacy/bundles/06-ghcr/uds-bundle.yaml (2)

- `ghcr.io/defenseunicorns/uds-cli/podinfo 0.0.2`
- `ghcr.io/defenseunicorns/uds-cli/nginx 0.0.2`

testdata/legacy/bundles/07-helm-overrides/duplicate/uds-bundle.yaml (2)

- `localhost:888/helm-overrides 0.0.1`
- `localhost:888/helm-overrides 0.0.1`

testdata/legacy/bundles/10-package-naming/uds-bundle.yaml (2)

- `localhost:888/nginx 0.0.1`
- `localhost:889/podinfo 0.0.1`

testdata/legacy/bundles/13-composable-component/uds-bundle.yaml (1)

- `localhost:888/prometheus 0.0.1`

testdata/legacy/bundles/14-optional-components/uds-bundle.yaml (1)

- `zarf-dev/zarf v0.85.0`

testdata/legacy/bundles/14-optional-components/uds-bundle.yaml (2)

- `ghcr.io/zarf-dev/packages/init v0.85.0`
- `localhost:888/prometheus 0.0.1`

testdata/legacy/bundles/20-signed-no-key/uds-bundle.yaml (1)

- `ghcr.io/zarf-dev/packages/dos-games 1.3.0`

testdata/legacy/bundles/21-signed-with-key/uds-bundle.yaml (1)

- `ghcr.io/zarf-dev/packages/dos-games 1.3.0`

testdata/legacy/bundles/23-multi-platform-image/uds-bundle.yaml (1)

- `localhost:888/multi-platform-image 0.0.1`

testdata/legacy/packages/engine/zarf.yaml (1)

- `ghcr.io/stefanprodan/podinfo 6.15.0`

testdata/legacy/packages/engine/zarf.yaml (1)

- `https://github.com/stefanprodan/podinfo.git 6.15.0`

testdata/legacy/packages/gitrepo/zarf.yaml (1)

- `docker.io/library/nginx 1.31.5`

testdata/legacy/packages/helm/zarf.yaml (1)

- `stefanprodan/podinfo 6.15.0`

testdata/legacy/packages/helm/zarf.yaml (1)

- `ghcr.io/stefanprodan/podinfo 6.15.0`

testdata/legacy/packages/multi-platform-image/zarf.yaml (1)

- `cgr.dev/chainguard/static@sha256 399c8cb4858f05aaa33f43f02a2e75f28d40f016c0f86e5ba6075769e3303791`

testdata/legacy/packages/nginx-namespace-override/zarf.yaml (1)

- `nginx 1.31.5`

testdata/legacy/packages/nginx/refs/zarf.yaml (1)

- `nginx 1.31.5`

testdata/legacy/packages/nginx/zarf.yaml (1)

- `nginx 1.31.5`

testdata/legacy/packages/podinfo-refs/zarf.yaml

testdata/legacy/packages/podinfo-refs/zarf.yaml (2)

- `https://github.com/stefanprodan/podinfo.git 6.15.0`
- `https://github.com/stefanprodan/podinfo.git 6.15.0`

testdata/legacy/packages/podinfo/flavors/zarf.yaml (2)

- `ghcr.io/stefanprodan/podinfo 6.15.0`
- `ghcr.io/stefanprodan/podinfo 6.15.0`

testdata/legacy/packages/podinfo/flavors/zarf.yaml (2)

- `https://github.com/stefanprodan/podinfo.git 6.15.0`
- `https://github.com/stefanprodan/podinfo.git 6.15.0`

testdata/legacy/packages/podinfo/refs/zarf.yaml (1)

- `ghcr.io/stefanprodan/podinfo 6.15.0`

testdata/legacy/packages/podinfo/refs/zarf.yaml (1)

- `https://github.com/stefanprodan/podinfo.git 6.15.0`

testdata/legacy/packages/podinfo/zarf.yaml (2)

- `ghcr.io/stefanprodan/podinfo 6.15.0`
- `ghcr.io/stefanprodan/podinfo 6.15.0`

testdata/legacy/packages/podinfo/zarf.yaml (2)

- `https://github.com/stefanprodan/podinfo.git 6.15.0`
- `https://github.com/stefanprodan/podinfo.git 6.15.0`

testdata/legacy/packages/prometheus/images/zarf.yaml (1)

- `quay.io/prometheus/node-exporter v1.12.1`

testdata/legacy/packages/prometheus/zarf.yaml (1)

- `ghcr.io/kiwix/kiwix-serve 3.8.2`

testdata/legacy/packages/prometheus/zarf.yaml (2)

- `prometheus-node-exporter 4.57.0`
- `prometheus-node-exporter 4.57.0`

testdata/legacy/packages/zarf-bug/zarf.yaml (1)

- `stefanprodan/podinfo 6.15.0`

testdata/legacy/packages/zarf-bug/zarf.yaml (1)

- `ghcr.io/stefanprodan/podinfo 6.15.0`

testdata/legacy/tasks/remote-import-tasks.yaml

testdata/legacy/tasks/remote-tasks.yaml

tests/integration/cmd/bundle/create_integration_test.go

tests/integration/cmd/bundle/create_integration_test.go (1)

- `ghcr.io/defenseunicorns/packages/uds/core 1.12.0-upstream`

tests/test_data/bundles/create/init-k3s/bundle.uds.hcl (1)

- `ghcr.io/zarf-dev/packages/init v0.85.0`

tests/test_data/bundles/create/init-no-k3s/bundle.uds.hcl (1)

- `ghcr.io/zarf-dev/packages/init v0.85.0`

tests/test_data/bundles/create/init-with-defaults/bundle.uds.hcl (1)

- `ghcr.io/zarf-dev/packages/init v0.85.0`

tests/test_data/bundles/create/init/bundle.uds.hcl (2)

- `ghcr.io/defenseunicorns/packages/uds-k3d 0.20.3`
- `ghcr.io/zarf-dev/packages/init v0.85.0`

tests/test_data/bundles/deploy/init/bundle.uds.hcl (2)

- `ghcr.io/defenseunicorns/packages/uds-k3d 0.20.3`
- `ghcr.io/zarf-dev/packages/init v0.85.0`

tests/test_data/bundles/deploy/variables/bundle.uds.hcl (2)

- `ghcr.io/defenseunicorns/packages/uds-k3d 0.20.3`
- `ghcr.io/zarf-dev/packages/init v0.85.0`

tests/test_data/bundles/signature-verification/dos-games-public-key-invalid/bundle.uds.hcl (1)

- `ghcr.io/zarf-dev/packages/dos-games 1.3.0`

tests/test_data/bundles/signature-verification/dos-games-public-key/bundle.uds.hcl (1)

- `ghcr.io/zarf-dev/packages/dos-games 1.3.0`

tests/test_data/bundles/signature-verification/init-keyless-invalid/bundle.uds.hcl (1)

- `ghcr.io/zarf-dev/packages/init v0.85.0`

tests/test_data/bundles/signature-verification/init-keyless/bundle.uds.hcl (1)

- `ghcr.io/zarf-dev/packages/init v0.85.0`

tests/test_data/bundles/signature-verification/init-verification-disabled/bundle.uds.hcl (1)

- `ghcr.io/zarf-dev/packages/init v0.85.0`

tests/test_data/bundles/spec-compliant/bundle.uds.hcl (1)

- `ghcr.io/defenseunicorns/packages/uds/core 1.12.0-upstream`

tests/test_data/bundles/spec-compliant/bundle.uds.hcl (1)

- `ghcr.io/defenseunicorns/packages/uds/core 1.12.0-upstream`

tests/test_data/bundles/uds-core/standard/bundle.uds.hcl (4)

- `defenseunicorns/uds-core 1.12.0`
- `ghcr.io/defenseunicorns/packages/uds/core 1.12.0-upstream`
- `ghcr.io/defenseunicorns/packages/uds-k3d 0.20.3-airgap`
- `ghcr.io/zarf-dev/packages/init v0.85.0`

tests/test_data/bundles/uds-core/standard/bundle.uds.hcl (1)

- `defenseunicorns/uds-core 1.12.0`

tests/test_data/packages/operator-monitor/zarf.yaml

tests/test_data/packages/operator-monitor/zarf.yaml (1)

- `registry.k8s.io/e2e-test-images/busybox 1.29-4`

tests/test_data/packages/podinfo/zarf.yaml (1)

- `ghcr.io/stefanprodan/podinfo 6.15.0`

tests/test_data/packages/podinfo/zarf.yaml (1)

- `ghcr.io/stefanprodan/charts/podinfo 6.15.0`

renovate-config (1)

renovate.json

---

- [ ] Check this box to trigger a request for Renovate to run again on this repository