Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.
[View this repository on the Mend.io Web Portal](https://developer.mend.io/github/google/osv.dev).

## Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

- [ ] chore(deps): update zizmorcore/zizmor-action action to v0.6.4
- [ ] chore(deps): update dependency grpcio-tools to v1.83.1
- [ ] chore(deps): lock file maintenance
- [ ] chore(deps): lock file maintenance
- [ ] chore(deps): lock file maintenance
- [ ] chore(deps): lock file maintenance
- [ ] chore(deps): lock file maintenance
- [ ] chore(deps): lock file maintenance
- [ ] 🔐 **Create all awaiting schedule PRs at once** 🔐

## Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

- [ ] chore(deps): update docker (`gcr.io/distroless/base-debian12`, `gcr.io/distroless/static-debian12`, `gcr.io/endpoints-release/endpoints-runtime-serverless`, `gcr.io/google.com/cloudsdktool/google-cloud-cli`, `ubuntu`)
- [ ] fix(deps): update github.com/google/osv.dev/vulnfeeds digest to 3af979d
- [ ] fix(deps): update github.com/ossf/osv-schema/bindings/go digest to 423306d
- [ ] [chore(deps): update pnpm to v12.4.2](../pull/5993)
- [ ] chore(deps): update terraform (`external`, `null`)
- [ ] fix(deps): update module google.golang.org/api to v0.298.0
- [ ] fix(deps): update module google.golang.org/api to v0.298.0

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [fix(deps): update gcp-services-python](../pull/5069) (`cryptography`, `google-api-python-client`, `google-auth-httplib2`, `google-cloud-ndb`, `google-cloud-pubsub`, `google-cloud-secret-manager`, `google-cloud-storage`, `osv`, `pygit2`, `requests`, `vanir`)
- [ ] [fix(deps): update go-libraries](../pull/5998) (`cloud.google.com/go/storage`, `github.com/alicebob/miniredis/v2`, `github.com/klauspost/compress`, `github.com/yuin/goldmark`, `go`, `golang.org/x/oauth2`, `golang.org/x/sync`, `golang.org/x/text`, `google.golang.org/api`, `mvdan.cc/sh/v3`)
- [ ] [fix(deps): update vulnfeeds-go](../pull/5999) (`cloud.google.com/go/storage`, `go`, `golang.org/x/sync`, `golang.org/x/text`, `google.golang.org/api`)
- [ ] [chore(deps): update terraform to v8](../pull/5956) (`google`, `google-beta`)
- [ ] [fix(deps): update module github.com/yuin/goldmark to v2](../pull/5957)
- [ ] [fix(deps): update module gopkg.in/yaml.v2 to v3](../pull/5947)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

- [ ] [chore(deps): update dependency protobuf to v7](../pull/5912)

## Detected Dependencies

bundler (1)

docs/Gemfile (16)

- `ruby ~> 4`
- `jekyll "~> 4.4.0"`
- `csv lock file @ 3.3.6`
- `base64 lock file @ 0.3.0`
- `jekyll-feed "~> 0.15"`
- `jekyll-relative-links lock file @ 0.8.0`
- `jekyll-optional-front-matter lock file @ 0.3.3`
- `jekyll-readme-index lock file @ 0.4.0`
- `jekyll-default-layout lock file @ 0.2.0`
- `jekyll-titles-from-headings lock file @ 0.5.4`
- `just-the-docs lock file @ 0.12.0`
- `jekyll-github-metadata lock file @ 2.16.1`
- `tzinfo ">= 1", "< 3"`
- `wdm "~> 0.2.0"`
- `http_parser.rb "~> 0.8.0"`
- `webrick "~> 1.7"`

cloudbuild (10)

bindings/cloudbuild.yaml

cloudbuild.yaml

docker/terraform/cloudbuild.yaml

external/pypi/cloudbuild.yaml

gcp/workers/cloudbuild.yaml

go/cloudbuild.yaml

osv/cloudbuild.yaml

tools/apitester/cloudbuild.yaml

vulnfeeds/cloudbuild.yaml

vulnfeeds/pypi/cloudbuild.yaml

dockerfile (24)

actions/analyze/Dockerfile

docker/ci/Dockerfile

docker/deployment/Dockerfile (1)

- `ubuntu 26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b` → [Updates: `26.04`]

docker/esp/Dockerfile (1)

- `gcr.io/endpoints-release/endpoints-runtime 2`

docker/terraform/Dockerfile (2)

- `golang 1.27.1-alpine@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125`
- `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb` → [Updates: `alpine`]

docker/worker-base/Dockerfile (1)

- `ubuntu 26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b` → [Updates: `26.04`]

docs/docs.Dockerfile (1)

- `ruby 4@sha256:8dc3950712ad2078bdd275b890419ba2fd3aab5a0653b291a7325f0d8a24ca05`

gcp/indexer/Dockerfile (2)

- `golang 1.27.1-alpine@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125`
- `gcr.io/distroless/base-debian12 sha256:62730825d3cf03571e0a1b8f014748de94d0404500f063593b614c23da38841d` → [Updates: `undefined`]

gcp/workers/cron/Dockerfile

gcp/workers/oss_fuzz_importer/Dockerfile

gcp/workers/oss_fuzz_worker/Dockerfile

gcp/workers/vanir_signatures/Dockerfile

gcp/workers/worker/Dockerfile

go/cmd/osv-linter-worker/Dockerfile (1)

- `golang 1.27.1-alpine@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125`

go/Dockerfile (14)

- `golang 1.27.1-alpine@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125`
- `alpine 3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b`
- `gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd` → [Updates: `undefined`]
- `gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd` → [Updates: `undefined`]
- `gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd` → [Updates: `undefined`]
- `gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd` → [Updates: `undefined`]
- `gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd` → [Updates: `undefined`]
- `gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd` → [Updates: `undefined`]
- `alpine 3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b`
- `alpine 3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b`
- `gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd` → [Updates: `undefined`]
- `gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd` → [Updates: `undefined`]
- `gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd` → [Updates: `undefined`]
- `gcr.io/distroless/static-debian12 sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd` → [Updates: `undefined`]

vulnfeeds/cmd/combine-to-osv/Dockerfile (2)

- `golang 1.27.1-alpine@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125`
- `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb` → [Updates: `alpine`]

vulnfeeds/cmd/converters/alpine/Dockerfile (2)

- `golang 1.27.1-alpine@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125`
- `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb` → [Updates: `alpine`]

vulnfeeds/cmd/converters/cve/cve5/bulk-converter/Dockerfile (2)

- `golang 1.27.1-alpine@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125`
- `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb` → [Updates: `alpine`]

vulnfeeds/cmd/converters/cve/nvd-cve-osv/Dockerfile (2)

- `golang 1.27.1-alpine@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125`
- `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb` → [Updates: `alpine`]

vulnfeeds/cmd/converters/debian/Dockerfile (2)

- `golang 1.27.1-alpine@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125`
- `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb` → [Updates: `alpine`]

vulnfeeds/cmd/converters/dsa-dla-dtsa/Dockerfile (2)

- `golang 1.27.1-alpine@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125`
- `alpine 3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b`

vulnfeeds/cmd/mirrors/cpe-repo-gen/Dockerfile (2)

- `golang 1.27.1-alpine@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125`
- `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb` → [Updates: `alpine`]

vulnfeeds/cmd/mirrors/debian-copyright-mirror/Dockerfile (1)

- `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb` → [Updates: `alpine`]

vulnfeeds/cmd/mirrors/download-cves/Dockerfile (2)

- `golang 1.27.1-alpine@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125`
- `gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:be40864452bd6d7be21632a1dc18adf03d423de0bf2595f4a287c22400c484bb` → [Updates: `alpine`]

git-submodules (1)

.gitmodules (1)

- `osv/osv-schema f3f826310aeca8e324baabd195632f2229952abe` → [Updates: `undefined`]

github-actions (14)

.github/workflows/codeql-analysis.yml (4)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `github/codeql-action v4.37.9@cdf488f595d80d6e07e03d4674febd5ab45fa938` → [Updates: `v4.38.0`]
- `github/codeql-action v4.37.9@cdf488f595d80d6e07e03d4674febd5ab45fa938` → [Updates: `v4.38.0`]
- `github/codeql-action v4.37.9@cdf488f595d80d6e07e03d4674febd5ab45fa938` → [Updates: `v4.38.0`]

.github/workflows/docs-deploy.yml (5)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `ruby/setup-ruby v1.321.0@95ef2b042f9d7a56d8268cba8559e2842e2ad01b` → [Updates: `v1.323.0`]
- `actions/configure-pages v6.0.0@45bfe0192ca1faeb007ade9deae92b16b8254a0d`
- `actions/upload-pages-artifact v5@fc324d3547104276b827a68afc52ff2a11cc49c9`
- `actions/deploy-pages v5.0.1@368f82528645a54fb793d4d04e342629a3f51346`

.github/workflows/generate-protos.yml (4)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-python v7.0.0@5fda3b95a4ea91299a34e894583c3862153e4b97`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1`

.github/workflows/go-generate.yml (3)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1`

.github/workflows/issue-signposting.yml

.github/workflows/links.yml (2)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `tcort/github-action-markdown-link-check v1.1.3@e047c5b37f24ab722bbef1a27b6fab7f96bc4068`

.github/workflows/lint.yaml (5)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-python v7.0.0@5fda3b95a4ea91299a34e894583c3862153e4b97`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `hashicorp/setup-terraform v4.0.1@dfe3c3f87815947d99a8997f908cb6525fc44e9e`

.github/workflows/osv-scanner-unified.yml (2)

- `google/osv-scanner-action nightly`
- `google/osv-scanner-action nightly`

.github/workflows/renovate-validator.yml (2)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020`

.github/workflows/scorecards.yml (4)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `ossf/scorecard-action v2.4.4@2d1146689b8cda280b9bc96326124645441f03bc`
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`
- `github/codeql-action v4.37.9@cdf488f595d80d6e07e03d4674febd5ab45fa938` → [Updates: `v4.38.0`]

.github/workflows/snapshots.yml (3)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1`

.github/workflows/staleness.yml (1)

- `actions/stale v11.0.0@4391f3da665fdf50b6810c1a66712fb9ba21aa93`

.github/workflows/title.yml (1)

- `amannn/action-semantic-pull-request v6.1.1@48f256284bd46cdaab1048c3721360e808335d50`

.github/workflows/zizmor.yml (2)

- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `zizmorcore/zizmor-action v0.6.3@70fb788f84895a7701f5643d103d587e460b5c99` → [Updates: `v0.6.4`]

gomod (11)

bindings/go/go.mod (7)

- `go 1.27.0` → [Updates: `1.27.1`]
- `github.com/google/go-cmp v0.7.0`
- `github.com/ossf/osv-schema/bindings/go v0.0.0-20260806060209-f3f826310aec@f3f826310aec` → [Updates: `v0.0.0-20260915070347-423306dd97fb`]
- `golang.org/x/sync v0.22.0` → [Updates: `v0.23.0`]
- `google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa@3dc84a4a5aaa` → [Updates: `v0.0.0-20260911204522-f61a6ca850bd`]
- `google.golang.org/grpc v1.83.2`
- `google.golang.org/protobuf v1.36.12`

docs/go.mod (4)

- `go 1.27.1`
- `github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0`
- `google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2`
- `google.golang.org/protobuf v1.36.12`

external/go.mod (6)

- `go 1.27.1`
- `github.com/aquasecurity/go-pep440-version v0.0.1`
- `github.com/goccy/go-yaml v1.19.2`
- `github.com/google/osv.dev/vulnfeeds v0.0.0-20260812014536-918f43604b8d@918f43604b8d` → [Updates: `v0.0.0-20260916060645-3af979d03add`]
- `github.com/ossf/osv-schema/bindings/go v0.0.0-20260806060209-f3f826310aec@f3f826310aec` → [Updates: `v0.0.0-20260915070347-423306dd97fb`]
- `google.golang.org/protobuf v1.36.12`

gcp/indexer/go.mod (10)

- `go 1.27.1`
- `cloud.google.com/go/datastore v1.26.0`
- `cloud.google.com/go/pubsub/v2 v2.7.0`
- `cloud.google.com/go/storage v1.67.1`
- `github.com/go-git/go-git/v5 v5.19.2`
- `github.com/golang/glog v1.2.5`
- `github.com/google/go-cmp v0.7.0`
- `golang.org/x/sync v0.23.0`
- `google.golang.org/api v0.297.0` → [Updates: `v0.298.0`]
- `gopkg.in/yaml.v3 v3.0.1`

go/cmd/tools/reimport-tui/go.mod (6)

- `go 1.27.0` → [Updates: `1.27.1`]
- `charm.land/bubbles/v2 v2.2.1`
- `charm.land/bubbletea/v2 v2.0.9`
- `charm.land/lipgloss/v2 v2.0.6`
- `cloud.google.com/go/datastore v1.26.0`
- `github.com/google/osv.dev/go v0.0.0-20260715030208-adbd23231c20@adbd23231c20` → [Updates: `v0.0.0-20260916060645-3af979d03add`]

go/go.mod (43)

- `go 1.27.0` → [Updates: `1.27.1`]
- `charm.land/lipgloss/v2 v2.0.6`
- `cloud.google.com/go/compute/metadata v0.9.0`
- `cloud.google.com/go/datastore v1.26.0`
- `cloud.google.com/go/monitoring v1.30.0`
- `cloud.google.com/go/pubsub/v2 v2.7.0`
- `cloud.google.com/go/storage v1.66.0` → [Updates: `v1.67.1`]
- `github.com/alicebob/miniredis/v2 v2.38.0` → [Updates: `v2.39.0`]
- `github.com/dgraph-io/ristretto/v2 v2.4.2`
- `github.com/dustin/go-humanize v1.0.1`
- `github.com/go-git/go-git/v6 v6.0.0-alpha.5`
- `github.com/google/go-cmp v0.7.0`
- `github.com/google/osv-scalibr v0.5.2`
- `github.com/hashicorp/go-retryablehttp v0.7.8`
- `github.com/klauspost/compress v1.19.2` → [Updates: `v1.20.0`]
- `github.com/microcosm-cc/bluemonday v1.0.27`
- `github.com/nikolalohinski/gonja/v2 v2.9.0`
- `github.com/ossf/osv-schema/bindings/go v0.0.0-20260806060209-f3f826310aec@f3f826310aec` → [Updates: `v0.0.0-20260915070347-423306dd97fb`]
- `github.com/package-url/packageurl-go v0.1.7`
- `github.com/pandatix/go-cvss v0.6.4`
- `github.com/redis/go-redis/v9 v9.22.0`
- `github.com/tidwall/gjson v1.19.0`
- `github.com/xeipuuv/gojsonschema v1.2.0`
- `github.com/yuin/goldmark v1.8.5` → [Updates: `v1.8.6`, `v2.0.1`]
- `go.opentelemetry.io/contrib/detectors/gcp v1.46.0`
- `go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0`
- `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0`
- `go.opentelemetry.io/otel v1.46.0`
- `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0`
- `go.opentelemetry.io/otel/sdk v1.46.0`
- `go.opentelemetry.io/otel/trace v1.46.0`
- `golang.org/x/oauth2 v0.36.0` → [Updates: `v0.37.0`]
- `golang.org/x/sync v0.22.0` → [Updates: `v0.23.0`]
- `golang.org/x/text v0.41.0` → [Updates: `v0.42.0`]
- `google.golang.org/api v0.294.0` → [Updates: `v0.297.0`]
- `google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688@08b0e4226688` → [Updates: `v0.0.0-20260911204522-f61a6ca850bd`]
- `google.golang.org/grpc v1.83.2`
- `google.golang.org/protobuf v1.36.12`
- `gopkg.in/dnaeon/go-vcr.v4 v4.0.7`
- `k8s.io/apimachinery v0.37.0`
- `mvdan.cc/sh/v3 v3.13.1` → [Updates: `v3.14.1`]
- `osv.dev/bindings/go v0.0.0-20260527044221-c1c72c1b0158@c1c72c1b0158` → [Updates: `v0.0.0-20260916060645-3af979d03add`]
- `sigs.k8s.io/yaml v1.6.0`

tools/apitester/go.mod (7)

- `go 1.27.1`
- `github.com/gkampitakis/go-snaps v0.5.23`
- `github.com/google/go-cmp v0.7.0`
- `github.com/tidwall/gjson v1.19.0`
- `github.com/tidwall/pretty v1.2.1`
- `github.com/tidwall/sjson v1.2.5`
- `gopkg.in/dnaeon/go-vcr.v4 v4.0.7`

tools/datastore-remover/go.mod (3)

- `go 1.27.1`
- `cloud.google.com/go/datastore v1.26.0`
- `google.golang.org/api v0.297.0` → [Updates: `v0.298.0`]

tools/indexer-api-caller/go.mod (1)

- `go 1.27.1`

tools/repo-allowlist-sync/go.mod (4)

- `go 1.27.1`
- `cloud.google.com/go/datastore v1.26.0`
- `github.com/google/osv.dev/go v0.0.0`
- `go.yaml.in/yaml/v4 v4.0.0-rc.6`

vulnfeeds/go.mod (28)

- `go 1.27.0` → [Updates: `1.27.1`]
- `charm.land/lipgloss/v2 v2.0.6`
- `cloud.google.com/go/secretmanager v1.21.0`
- `cloud.google.com/go/storage v1.66.0` → [Updates: `v1.67.1`]
- `github.com/JohannesKaufmann/html-to-markdown/v2 v2.5.2`
- `github.com/aquasecurity/go-pep440-version v0.0.1`
- `github.com/atombender/go-jsonschema v0.24.1`
- `github.com/fsouza/fake-gcs-server v1.56.1`
- `github.com/gkampitakis/go-snaps v0.5.23`
- `github.com/go-git/go-git/v5 v5.19.2`
- `github.com/goccy/go-yaml v1.19.2`
- `github.com/google/go-cmp v0.7.0`
- `github.com/knqyf263/go-cpe v0.0.0-20230627041855-cb0794d06872@cb0794d06872`
- `github.com/ossf/osv-schema/bindings/go v0.0.0-20260806060209-f3f826310aec@f3f826310aec` → [Updates: `v0.0.0-20260915070347-423306dd97fb`]
- `github.com/redis/go-redis/v9 v9.22.0`
- `github.com/sethvargo/go-retry v0.4.0`
- `go.opentelemetry.io/contrib/detectors/gcp v1.46.0`
- `go.opentelemetry.io/otel v1.46.0`
- `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0`
- `go.opentelemetry.io/otel/sdk v1.46.0`
- `go.opentelemetry.io/otel/trace v1.46.0`
- `golang.org/x/sync v0.22.0` → [Updates: `v0.23.0`]
- `golang.org/x/text v0.41.0` → [Updates: `v0.42.0`]
- `google.golang.org/api v0.294.0` → [Updates: `v0.297.0`]
- `google.golang.org/grpc v1.83.2`
- `google.golang.org/protobuf v1.36.12`
- `gopkg.in/dnaeon/go-vcr.v4 v4.0.7`
- `gopkg.in/yaml.v2 v2.4.0` → [Updates: `v3.0.1`]

npm (2)

website/frontend3/package.json (21)

- `@github/clipboard-copy-element 1.3.2`
- `@hotwired/turbo 8.0.23`
- `@material/data-table 14.0.0`
- `@material/layout-grid 14.0.0`
- `@material/theme 14.0.0`
- `@material/web ^2.0.0`
- `json-formatter-js ^2.5.23`
- `lit 3.3.3`
- `copy-webpack-plugin ^14.0.0`
- `css-loader ^7.1.3`
- `html-webpack-plugin ^5.6.6`
- `mini-css-extract-plugin ^2.10.0`
- `raw-loader ^4.0.2`
- `sass ^1.97.3`
- `sass-loader ^17.0.0`
- `style-loader ^4.0.0`
- `webpack ^5.105.4`
- `webpack-bundle-analyzer ^5.0.0`
- `webpack-cli ^7.0.0`
- `webpack-dev-server ^6.0.0`
- `pnpm 12.4.0` → [Updates: `12.4.2`]

website/frontend3/pnpm-workspace.yaml

poetry (5)

gcp/functions/pypi/pyproject.toml (5)

- `poetry-core >=2.0.0`
- `cryptography ==50.0.0` → [Updates: `==50.0.1`]
- `google-cloud-secret-manager ==2.26.0` → [Updates: `==2.30.0`]
- `osv ==0.1.2` → [Updates: `==0.1.3`]
- `requests ==2.33.0` → [Updates: `==2.34.2`]

gcp/workers/oss_fuzz_worker/pyproject.toml (15)

- `poetry-core >=2.0.0`
- `yapf *`
- `pylint *`
- `google-auth-httplib2 ==0.3.0` → [Updates: `==0.4.2`]
- `google-api-python-client ==2.192.0` → [Updates: `==2.200.0`]
- `google-cloud-pubsub ==2.35.0` → [Updates: `==2.40.0`]
- `google-cloud-ndb ==2.4.0` → [Updates: `==2.6.0`]
- `google-cloud-storage ==3.9.0` → [Updates: `==3.14.1`]
- `pyyaml ==6.0.3`
- `redis ==6.4.0`
- `packageurl-python ==0.17.6`
- `pygit2 ==1.19.1` → [Updates: `==1.20.0`]
- `requests ==2.33.0` → [Updates: `==2.34.2`]
- `jsonschema ==4.26.0`
- `vanir ==1.0.2` → [Updates: `==1.1.0`]

gcp/workers/worker/pyproject.toml (15)

- `poetry-core >=2.0.0`
- `yapf *`
- `pylint *`
- `google-auth-httplib2 ==0.3.0` → [Updates: `==0.4.2`]
- `google-api-python-client ==2.192.0` → [Updates: `==2.200.0`]
- `google-cloud-pubsub ==2.35.0` → [Updates: `==2.40.0`]
- `google-cloud-ndb ==2.4.0` → [Updates: `==2.6.0`]
- `google-cloud-storage ==3.9.0` → [Updates: `==3.14.1`]
- `pyyaml ==6.0.3`
- `redis ==6.4.0`
- `packageurl-python ==0.17.6`
- `pygit2 ==1.19.1` → [Updates: `==1.20.0`]
- `requests ==2.33.1` → [Updates: `==2.34.2`]
- `jsonschema ==4.26.0`
- `vanir ==1.1.0`

pyproject.toml (21)

- `poetry-core >=2.0.0`
- `yapf *`
- `pylint *`
- `protobuf >=6.33.6,<7.0.0` → [Updates: `>=7.36.1,<7.37.0`]
- `grpcio-tools *` → [Updates: `*`]
- `mypy-protobuf ^5.0.0`
- `vcrpy *`
- `hypothesis *`
- `google-cloud-ndb >=2.3`
- `google-cloud-logging >=3.10`
- `google-cloud-pubsub >=2.31.1`
- `google-cloud-storage >=2.17`
- `semver >=3.0`
- `packageurl-python >=0.17.0`
- `pyyaml >=6.0`
- `pygit2 >=1.14.0`
- `attrs >=23.2`
- `jsonschema >=4.0`
- `grpcio >=1.0`
- `packaging-legacy >=23.0.post0`
- `requests >=2.33`

tools/datafix/pyproject.toml (7)

- `poetry-core >=2.0.0`
- `yapf *`
- `pylint *`
- `google-cloud-ndb ==2.6.0`
- `google-cloud-storage ==3.14.1`
- `pyyaml ==6.0.3`
- `google-cloud-pubsub >=2.25.2`

regex (3)

deployment/terraform/environments/oss-vdb-test/main.tf (1)

- `gcr.io/endpoints-release/endpoints-runtime-serverless 2.55.3` → [Updates: `2.56.0`]

deployment/terraform/environments/oss-vdb/main.tf (1)

- `gcr.io/endpoints-release/endpoints-runtime-serverless 2.55.3` → [Updates: `2.56.0`]

osv/models.py (1)

- `ossf/osv-schema 1.9.0`

terraform (4)

deployment/terraform/environments/oss-vdb-test/main.tf (4)

- `external ~> 2.4.0` → [Updates: `~> 2.4.0`]
- `google ~> 7.46.0` → [Updates: `~> 8.2.0`]
- `google-beta ~> 7.46.0` → [Updates: `~> 8.2.0`]
- `null ~> 3.3.0` → [Updates: `~> 3.3.0`]

deployment/terraform/environments/oss-vdb/main.tf (4)

- `external ~> 2.4.0` → [Updates: `~> 2.4.0`]
- `google ~> 7.46.0` → [Updates: `~> 8.2.0`]
- `google-beta ~> 7.46.0` → [Updates: `~> 8.2.0`]
- `null ~> 3.3.0` → [Updates: `~> 3.3.0`]

deployment/terraform/environments/private-osv/main.tf (2)

- `google ~> 7.46.0` → [Updates: `~> 8.2.0`]
- `google-beta ~> 7.46.0` → [Updates: `~> 8.2.0`]

deployment/terraform/modules/osv/website.tf (1)

- `terraform-google-modules/lb-http/google ~> 14.0`

---

- [ ] Check this box to trigger a request for Renovate to run again on this repository