Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.

## Repository Problems

Renovate tried to run on this repository, but found these problems.

- ⚠️ WARN: Package lookup failures

## Abandoned Dependencies

The following dependencies have not received updates for an extended period and may be unmaintained.

View abandoned dependencies (11)

> [!NOTE]
Packages are marked as abandoned when they exceed the [`abandonmentThreshold`](https://docs.renovatebot.com/configuration-options/#abandonmentthreshold) since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity.
>
| Datasource | Package | Last Updated |
|------------|------|-------------|
| gomod | [github.com/cespare/xxhash/v2](https://redirect.github.com/cespare/xxhash) | `2024-04-04` |
| gomod | [github.com/davecgh/go-spew](https://redirect.github.com/davecgh/go-spew) | `2018-02-21` |
| gomod | [github.com/go-logr/stdr](https://redirect.github.com/go-logr/stdr) | `2021-12-15` |
| gomod | [github.com/kr/pretty](https://redirect.github.com/kr/pretty) | `2022-08-29` |
| gomod | [github.com/patrickmn/go-cache](https://redirect.github.com/patrickmn/go-cache) | `2017-10-24` |
| gomod | [github.com/pmezard/go-difflib](https://redirect.github.com/pmezard/go-difflib) | `2016-01-10` |
| gomod | [gopkg.in/check.v1](https://redirect.github.com/go-check/check) | `2020-11-30` |
| gomod | [gopkg.in/yaml.v3](https://redirect.github.com/go-yaml/yaml) | `2022-05-27` |

## Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

- [ ] chore(deps): pin dependency golangci/golangci-lint to c0d3ddc
- [ ] chore(deps): update actions/checkout digest to 3d3c42e
- [ ] fix(deps): update module google.golang.org/protobuf to v1.36.12
- [ ] chore(deps): update dependency golangci/golangci-lint to v2.13.2
- [ ] fix(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.30.0
- [ ] fix(deps): update module github.com/stretchr/testify to v1.12.1
- [ ] fix(deps): update opentelemetry-go monorepo to v1.46.0 (`go.opentelemetry.io/otel`, `go.opentelemetry.io/otel/metric`, `go.opentelemetry.io/otel/trace`)
- [ ] chore(deps): update actions/setup-go action to v7
- [ ] 🔐 **Create all rate-limited PRs at once** 🔐

## Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

- [ ] fix(deps): update github.com/grafana/authlib/types digest to 0d62418
- [ ] fix(deps): update github.com/grafana/dskit digest to 407dda1

---

> [!WARNING]
> Renovate failed to look up the following dependencies: `Could not determine new digest for update (github-tags package bufbuild/buf-setup-action)`.
>
> Files affected: `.github/workflows/go.yml`

---

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [fix(security/unknown/types): update go toolchain directive to v1.26.6 [security]](../pull/313)
- [ ] [fix(security/unknown/): update module golang.org/x/net to v0.56.0 [security]](../pull/318)
- [ ] [fix(security/unknown/): update module golang.org/x/text to v0.39.0 [security]](../pull/319)
- [ ] [fix(security/unknown/): update module google.golang.org/grpc to v1.83.1 [security]](../pull/320)
- [ ] [chore(deps): update actions/setup-go digest to 924ae3a](../pull/307)
- [ ] [chore(deps): update google.golang.org/genproto/googleapis/rpc digest to f61a6ca](../pull/308)
- [ ] [fix(deps): update google.golang.org/genproto/googleapis/api digest to f61a6ca](../pull/309)
- [ ] [chore(deps): update module github.com/go-logr/logr to v1.4.4](../pull/323)
- [ ] [chore(deps): update module github.com/stretchr/objx to v0.5.3](../pull/302)
- [ ] [fix(deps): update module github.com/go-jose/go-jose/v4 to v4.1.5](../pull/325)
- [ ] [chore(deps): update actions/setup-go action to v6.5.0](../pull/281)
- [ ] [chore(deps): update module github.com/rogpeppe/go-internal to v1.16.0](../pull/303)
- [ ] [chore(deps): update module golang.org/x/sys to v0.48.0](../pull/305)
- [ ] [fix(deps): update module golang.org/x/sync to v0.23.0](../pull/312)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## Vulnerabilities

> [!IMPORTANT]
> `20`/`20` CVEs have Renovate fixes.

gomod

go.mod

google.golang.org/grpc

- [GHSA-2v4p-qf9q-27wj](https://osv.dev/vulnerability/GHSA-2v4p-qf9q-27wj) (fixed in >= 1.82.2)
- [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) (fixed in >= 1.82.1)
- [GHSA-qc2q-p7wx-3px3](https://osv.dev/vulnerability/GHSA-qc2q-p7wx-3px3) (fixed in >= 1.83.1)
- [GHSA-vp52-pcj8-j9qc](https://osv.dev/vulnerability/GHSA-vp52-pcj8-j9qc) (fixed in >= 1.83.1)
- [GO-2026-6061](https://osv.dev/vulnerability/GO-2026-6061) (fixed in >= 1.82.1)
- [GO-2026-6348](https://osv.dev/vulnerability/GO-2026-6348) (fixed in >= 1.83.1)
- [GO-2026-6441](https://osv.dev/vulnerability/GO-2026-6441) (fixed in >= 1.83.1)
- [GO-2026-6443](https://osv.dev/vulnerability/GO-2026-6443) (fixed in >= 1.82.2)

golang.org/x/net

- [GO-2026-5942](https://osv.dev/vulnerability/GO-2026-5942) (fixed in >= 0.56.0)

golang.org/x/text

- [GO-2026-5970](https://osv.dev/vulnerability/GO-2026-5970) (fixed in >= 0.39.0)

types/go.mod

go

- [GO-2026-4970](https://osv.dev/vulnerability/GO-2026-4970) (fixed in >= 1.26.5)
- [GO-2026-5026](https://osv.dev/vulnerability/GO-2026-5026) (fixed in >= 1.26.6)
- [GO-2026-5856](https://osv.dev/vulnerability/GO-2026-5856) (fixed in >= 1.26.5)
- [GO-2026-5942](https://osv.dev/vulnerability/GO-2026-5942) (fixed in >= 1.26.6)
- [GO-2026-5972](https://osv.dev/vulnerability/GO-2026-5972) (fixed in >= 1.26.6)
- [GO-2026-6088](https://osv.dev/vulnerability/GO-2026-6088) (fixed in >= 1.26.6)
- [GO-2026-6089](https://osv.dev/vulnerability/GO-2026-6089) (fixed in >= 1.26.6)
- [GO-2026-6090](https://osv.dev/vulnerability/GO-2026-6090) (fixed in >= 1.26.6)
- [GO-2026-6091](https://osv.dev/vulnerability/GO-2026-6091) (fixed in >= 1.26.6)
- [GO-2026-6218](https://osv.dev/vulnerability/GO-2026-6218) (fixed in >= 1.26.6)

## Detected Dependencies

github-actions (1)

.github/workflows/go.yml (11)

- `actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0` → [Updates: `v7`]
- `actions/setup-go v6@4dc6199c7b1a012772edbd06daecab0f50c9053c` → [Updates: `v7`, `v6`]
- `actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0` → [Updates: `v7`]
- `actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c` → [Updates: `v6.5.0`, `v7.0.0`]
- `actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0` → [Updates: `v7`]
- `bufbuild/buf-setup-action v1@a47c93e0b1648d5651a065437926377d060baa99`
- `ubuntu 24.04-arm`
- `go 1.25.x`
- `ubuntu 24.04-arm`
- `golangci/golangci-lint v2.12.2` → [Updates: `v2.13.2`, `v2.12.2`]
- `ubuntu 24.04-arm`

gomod (2)

go.mod (27)

- `go 1.25.0`
- `github.com/go-jose/go-jose/v4 v4.1.4` → [Updates: `v4.1.5`]
- `github.com/google/go-querystring v1.2.0`
- `github.com/grafana/authlib/types v0.0.0-20260304161757-e152786a5bb4@e152786a5bb4` → [Updates: `v0.0.0-20260304161757-e152786a5bb4`]
- `github.com/grafana/dskit v0.0.0-20260108123158-1a1acfb6ef2e@1a1acfb6ef2e` → [Updates: `v0.0.0-20260108123158-1a1acfb6ef2e`]
- `github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0` → [Updates: `v2.30.0`]
- `github.com/patrickmn/go-cache v2.1.0+incompatible`
- `github.com/stretchr/testify v1.11.1` → [Updates: `v1.12.1`]
- `go.opentelemetry.io/otel v1.44.0` → [Updates: `v1.46.0`]
- `go.opentelemetry.io/otel/trace v1.44.0` → [Updates: `v1.46.0`]
- `golang.org/x/sync v0.21.0` → [Updates: `v0.23.0`]
- `google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478@afd174a4e478` → [Updates: `v0.0.0-20260911204522-f61a6ca850bd`]
- `google.golang.org/grpc v1.81.1` → [Updates: `v1.83.1`]
- `google.golang.org/protobuf v1.36.11` → [Updates: `v1.36.12`]
- `github.com/cespare/xxhash/v2 v2.3.0`
- `github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc@d8f796af33cc`
- `github.com/go-logr/logr v1.4.3` → [Updates: `v1.4.4`]
- `github.com/go-logr/stdr v1.2.2`
- `github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2@5d4384ee4fb2`
- `github.com/stretchr/objx v0.5.2` → [Updates: `v0.5.3`]
- `go.opentelemetry.io/auto/sdk v1.2.1`
- `go.opentelemetry.io/otel/metric v1.44.0` → [Updates: `v1.46.0`]
- `golang.org/x/net v0.55.0` → [Updates: `v0.56.0`]
- `golang.org/x/sys v0.45.0` → [Updates: `v0.48.0`]
- `golang.org/x/text v0.37.0` → [Updates: `v0.39.0`]
- `google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478@afd174a4e478` → [Updates: `v0.0.0-20260911204522-f61a6ca850bd`]
- `gopkg.in/yaml.v3 v3.0.1`

types/go.mod (9)

- `go 1.23.0`
- `go 1.26.4` → [Updates: `1.26.6`]
- `github.com/stretchr/testify v1.11.1` → [Updates: `v1.12.1`]
- `github.com/davecgh/go-spew v1.1.1`
- `github.com/kr/pretty v0.3.1`
- `github.com/pmezard/go-difflib v1.0.0`
- `github.com/rogpeppe/go-internal v1.12.0` → [Updates: `v1.16.0`]
- `gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c@10cb98267c6c`
- `gopkg.in/yaml.v3 v3.0.1`

renovate-config (1)

.github/renovate.json5

---
## Need help?
You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.