Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.
[View this repository on the Mend.io Web Portal](https://developer.mend.io/github/google/osv-scanner).

## Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

- [ ] chore(deps): update codecov/codecov-action action to v7.1.0
- [ ] [fix(deps): update osv-scanner minor](../pull/3067) (`github.com/modelcontextprotocol/go-sdk`, `github.com/ossf/osv-schema/bindings/go`, `github.com/urfave/cli/v3`, `osv.dev/bindings/go`)

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [chore(deps): update workflows](../pull/3084) (`actions/deploy-pages`, `docker/setup-qemu-action`, `github/codeql-action`, `zizmorcore/zizmor-action`)
- [ ] [fix(deps): update module github.com/gobwas/glob to v1](../pull/3048)
- [ ] [chore(deps): lock file maintenance](../pull/3085)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

- [ ] [chore(deps): update dependency system.text.regularexpressions to 4.3.1 [security]](../pull/2845)
- [ ] [chore(deps): update dependency newtonsoft.json to v13 [security]](../pull/2838)

## Detected Dependencies

bundler (1)

docs/Gemfile (16)

- `ruby ~> 4`
- `jekyll "~> 4.4.0"`
- `csv lock file @ 3.3.6`
- `base64 lock file @ 0.3.0`
- `jekyll-feed "~> 0.15"`
- `jekyll-relative-links lock file @ 0.8.0`
- `jekyll-optional-front-matter lock file @ 0.3.3`
- `jekyll-readme-index lock file @ 0.4.0`
- `jekyll-default-layout lock file @ 0.2.0`
- `jekyll-titles-from-headings lock file @ 0.5.4`
- `just-the-docs lock file @ 0.12.0`
- `jekyll-github-metadata lock file @ 2.16.1`
- `tzinfo ">= 1", "< 3"`
- `wdm "~> 0.2.0"`
- `http_parser.rb "~> 0.8.0"`
- `webrick "~> 1.7"`

dockerfile (6)

action.dockerfile (2)

- `golang 1.27.1-alpine3.23@sha256:d9e2f2f07b10cc922da3e80e035c3058810b328d5aef82d2c63680967c5e2ec9`
- `alpine 3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b`

Dockerfile (2)

- `golang 1.27.1-alpine3.23@sha256:d9e2f2f07b10cc922da3e80e035c3058810b328d5aef82d2c63680967c5e2ec9`
- `alpine 3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b`

docs/docs.Dockerfile (1)

- `ruby 4@sha256:8dc3950712ad2078bdd275b890419ba2fd3aab5a0653b291a7325f0d8a24ca05`

goreleaser-action.dockerfile (1)

- `golang 1.27.1-alpine3.23@sha256:d9e2f2f07b10cc922da3e80e035c3058810b328d5aef82d2c63680967c5e2ec9`

goreleaser.dockerfile (1)

- `golang 1.27.1-alpine3.23@sha256:d9e2f2f07b10cc922da3e80e035c3058810b328d5aef82d2c63680967c5e2ec9`

scripts/test_env.dockerfile (1)

- `golang 1.27.1-alpine3.23@sha256:d9e2f2f07b10cc922da3e80e035c3058810b328d5aef82d2c63680967c5e2ec9`

github-actions (21)

.github/workflows/cassettes.yml (3)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1`

.github/workflows/checks.yml (7)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`

.github/workflows/codeql-analysis.yml (5)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `github/codeql-action v4.37.9@cdf488f595d80d6e07e03d4674febd5ab45fa938` → [Updates: `v4.38.0`]
- `github/codeql-action v4.37.9@cdf488f595d80d6e07e03d4674febd5ab45fa938` → [Updates: `v4.38.0`]
- `github/codeql-action v4.37.9@cdf488f595d80d6e07e03d4674febd5ab45fa938` → [Updates: `v4.38.0`]

.github/workflows/dependencies.yml (3)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1`

.github/workflows/docs-deploy.yml (6)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `ruby/setup-ruby v1.321.0@95ef2b042f9d7a56d8268cba8559e2842e2ad01b` → [Updates: `v1.323.0`]
- `actions/configure-pages v6.0.0@45bfe0192ca1faeb007ade9deae92b16b8254a0d`
- `actions/upload-pages-artifact v5@fc324d3547104276b827a68afc52ff2a11cc49c9`
- `actions/deploy-pages v5.0.0@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128` → [Updates: `v5.0.1`]
- `ruby 4.0.6` → [Updates: `4.0.7`]

.github/workflows/goreleaser-nightly.yml (7)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` → [Updates: `v4.3.0`]
- `docker/setup-buildx-action v4.3.0@37fe631027851001ddb9b187196cc803df7f5f0e` → [Updates: `v4.4.1`]
- `docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f`
- `goreleaser/goreleaser-action v7.2.3@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94`
- `goreleaser/goreleaser ~> v2`

.github/workflows/goreleaser.yml (8)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` → [Updates: `v4.3.0`]
- `docker/setup-buildx-action v4.3.0@37fe631027851001ddb9b187196cc803df7f5f0e` → [Updates: `v4.4.1`]
- `docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f`
- `goreleaser/goreleaser-action v7.2.3@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94`
- `slsa-framework/slsa-github-generator v2.1.0`
- `goreleaser/goreleaser ~> v2`

.github/workflows/links.yml (2)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `tcort/github-action-markdown-link-check v1.1.3@e047c5b37f24ab722bbef1a27b6fab7f96bc4068`

.github/workflows/osv-scanner-reusable-pr.yml

.github/workflows/osv-scanner-reusable.yml

.github/workflows/osv-scanner-unified-action.yml (2)

- `google/osv-scanner-action nightly`
- `google/osv-scanner-action nightly`

.github/workflows/prerelease-check.yml (16)

- `google/osv-scanner-action main`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `tcort/github-action-markdown-link-check v1.1.3@e047c5b37f24ab722bbef1a27b6fab7f96bc4068`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`

.github/workflows/renovate-validator.yml (2)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020`

.github/workflows/scorecards.yml (4)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `ossf/scorecard-action v2.4.4@2d1146689b8cda280b9bc96326124645441f03bc`
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`
- `github/codeql-action v4.37.9@cdf488f595d80d6e07e03d4674febd5ab45fa938` → [Updates: `v4.38.0`]

.github/workflows/snapshots.yml (3)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1`

.github/workflows/staleness.yml (1)

- `actions/stale v11.0.0@4391f3da665fdf50b6810c1a66712fb9ba21aa93`

.github/workflows/tests.yml (14)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `dorny/paths-filter v4.0.3@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` → [Updates: `v4.3.0`]
- `docker/setup-buildx-action v4.3.0@37fe631027851001ddb9b187196cc803df7f5f0e` → [Updates: `v4.4.1`]
- `goreleaser/goreleaser-action v7.2.3@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94`
- `goreleaser/goreleaser ~> v2`

.github/workflows/title.yml (1)

- `amannn/action-semantic-pull-request v6.1.1@48f256284bd46cdaab1048c3721360e808335d50`

.github/workflows/zizmor.yml (2)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `zizmorcore/zizmor-action v0.6.2@3dc1ecc9bcb9e94e9b2c709687979e1298497054` → [Updates: `v0.6.4`]

actions/internal/lint-action/action.yml (1)

- `golangci/golangci-lint-action v9.3.0@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a`

actions/internal/test-action/action.yml (1)

- `codecov/codecov-action v7.0.0@fb8b3582c8e4def4969c97caa2f19720cb33a72f` → [Updates: `v7.1.0`]

gomod (1)

go.mod (27)

- `go 1.27.0`
- `charm.land/glamour/v2 v2.0.1`
- `charm.land/lipgloss/v2 v2.0.6`
- `github.com/BurntSushi/toml v1.6.0`
- `github.com/CycloneDX/cyclonedx-go v0.12.0`
- `github.com/gkampitakis/go-snaps v0.5.23`
- `github.com/go-git/go-git/v5 v5.19.2`
- `github.com/gobwas/glob v0.2.3` → [Updates: `v1.0.0`]
- `github.com/google/go-cmp v0.7.0`
- `github.com/ianlancetaylor/demangle v0.0.0-20260724033716-83e58baca724@83e58baca724`
- `github.com/jedib0t/go-pretty/v6 v6.8.3`
- `github.com/modelcontextprotocol/go-sdk v1.7.0` → [Updates: `v1.8.0`]
- `github.com/opencontainers/go-digest v1.0.0`
- `github.com/ossf/osv-schema/bindings/go v0.0.0-20260902031056-b388a18021a3@b388a18021a3` → [Updates: `v0.0.0-20260915070347-423306dd97fb`]
- `github.com/owenrumney/go-sarif/v3 v3.3.1`
- `github.com/package-url/packageurl-go v0.1.7`
- `github.com/pandatix/go-cvss v0.6.4`
- `github.com/tidwall/gjson v1.19.0`
- `github.com/tidwall/pretty v1.2.1`
- `github.com/tidwall/sjson v1.2.5`
- `github.com/urfave/cli/v3 v3.11.0` → [Updates: `v3.12.0`]
- `go.yaml.in/yaml/v4 v4.0.0-rc.6`
- `golang.org/x/term v0.46.0`
- `google.golang.org/grpc v1.83.2`
- `google.golang.org/protobuf v1.36.12`
- `gopkg.in/dnaeon/go-vcr.v4 v4.0.7`
- `osv.dev/bindings/go v0.0.0-20260805021707-3a57b89df3b6@3a57b89df3b6` → [Updates: `v0.0.0-20260916060645-3af979d03add`]

nuget (2)

cmd/osv-scanner/scan/source/testdata/locks-dotnet/Directory.Packages.props (1)

- `System.Text.RegularExpressions 4.3.0` → [Updates: `4.3.1`]

cmd/osv-scanner/scan/source/testdata/locks-dotnet/test.csproj (1)

- `Newtonsoft.Json 12.0.1` → [Updates: `13.0.1`]

---

- [ ] Check this box to trigger a request for Renovate to run again on this repository