Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.

## Repository Problems

Renovate tried to run on this repository, but found these problems.

- ⚠️ WARN: Package lookup failures

## Abandoned Dependencies

The following dependencies have not received updates for an extended period and may be unmaintained.

View abandoned dependencies (13)

> [!NOTE]
Packages are marked as abandoned when they exceed the [`abandonmentThreshold`](https://docs.renovatebot.com/configuration-options/#abandonmentthreshold) since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity.
>
| Datasource | Package | Last Updated |
|------------|------|-------------|
| gomod | [github.com/beorn7/perks](https://redirect.github.com/beorn7/perks) | `2019-07-31` |
| gomod | [github.com/cespare/xxhash/v2](https://redirect.github.com/cespare/xxhash) | `2024-04-04` |
| gomod | [github.com/davecgh/go-spew](https://redirect.github.com/davecgh/go-spew) | `2018-02-21` |
| gomod | [github.com/go-logr/stdr](https://redirect.github.com/go-logr/stdr) | `2021-12-15` |
| gomod | [github.com/google/uuid](https://redirect.github.com/google/uuid) | `2024-01-23` |
| gomod | [github.com/json-iterator/go](https://redirect.github.com/json-iterator/go) | `2021-09-11` |
| gomod | [github.com/modern-go/concurrent](https://redirect.github.com/modern-go/concurrent) | `2018-03-06` |
| gomod | [github.com/modern-go/reflect2](https://redirect.github.com/modern-go/reflect2) | `2021-09-11` |
| gomod | [github.com/munnerz/goautoneg](https://redirect.github.com/munnerz/goautoneg) | `2019-10-10` |
| gomod | [github.com/opencontainers/go-digest](https://redirect.github.com/opencontainers/go-digest) | `2020-05-14` |
| gomod | [github.com/pmezard/go-difflib](https://redirect.github.com/pmezard/go-difflib) | `2016-01-10` |
| gomod | [github.com/x448/float16](https://redirect.github.com/x448/float16) | `2020-01-17` |
| gomod | [gopkg.in/inf.v0](https://redirect.github.com/go-inf/inf) | `2018-03-26` |

## Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

- [ ] chore(deps): pin dependencies (`gitleaks/gitleaks`, `golangci/golangci-lint`, `pre-commit/pre-commit-hooks`)
- [ ] chore(deps): update module github.com/klauspost/compress to v1.20.0
- [ ] chore(deps): update module github.com/prometheus/common to v0.71.0
- [ ] chore(deps): update module github.com/prometheus/procfs to v0.22.0
- [ ] chore(deps): update module golang.org/x/net to v0.59.0
- [ ] chore(deps): update module golang.org/x/oauth2 to v0.37.0
- [ ] chore(deps): update module golang.org/x/sync to v0.23.0
- [ ] chore(deps): update module golang.org/x/sys to v0.48.0
- [ ] chore(deps): update module golang.org/x/term to v0.46.0
- [ ] chore(deps): update module golang.org/x/text to v0.42.0
- [ ] chore(deps): update module golang.org/x/time to v0.16.0
- [ ] fix(deps): update module sigs.k8s.io/controller-runtime to v0.25.0
- [ ] chore(deps): update module sigs.k8s.io/structured-merge-diff/v6 to v7
- [ ] 🔐 **Create all rate-limited PRs at once** 🔐

## Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

- [ ] chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.4
- [ ] chore(deps): update docker/build-push-action action to v7.4.0
- [ ] chore(deps): update docker/setup-buildx-action action to v4.4.1
- [ ] chore(deps): update module github.com/fluxcd/pkg/apis/acl to v0.11.0
- [ ] chore(deps): update module github.com/fluxcd/pkg/apis/kustomize to v1.21.0
- [ ] chore(deps): update module github.com/fluxcd/pkg/apis/meta to v1.32.0

---

> [!WARNING]
> Renovate failed to look up the following dependencies: `Could not determine new digest for update (github-tags package grafana/shared-workflows)`, `Could not determine new digest for update (github-tags package actions/dependency-review-action)`.
>
> Files affected: `.github/workflows/build.yml`, `.github/workflows/dependency-review.yml`

---

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [chore(deps): update google.golang.org/genproto/googleapis/api digest to f61a6ca](../pull/491)
- [ ] [chore(deps): update google.golang.org/genproto/googleapis/rpc digest to f61a6ca](../pull/470)
- [ ] [chore(deps): update k8s.io/kube-openapi digest to 7970a1e](../pull/475)
- [ ] [chore(deps): update sigs.k8s.io/json digest to 11ed52e](../pull/492)
- [ ] [chore(deps): update module github.com/prometheus/client_model to v0.6.3](../pull/487)
- [ ] [fix(deps): update module github.com/fluxcd/kustomize-controller/api to v1.9.5](../pull/490)
- [ ] [fix(deps): update module github.com/fluxcd/source-controller/api to v1.9.5](../pull/493)
- [ ] [fix(deps): update opentelemetry-go-contrib monorepo](../pull/481) (`go.opentelemetry.io/contrib/bridges/otelslog`, `go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace`, `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`, `go.opentelemetry.io/contrib/instrumentation/runtime`)
- [ ] [chore(deps): update module github.com/docker/cli to v29.8.0+incompatible](../pull/495)
- [ ] [fix(deps): update opentelemetry-go monorepo](../pull/480) (`go.opentelemetry.io/otel`, `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`, `go.opentelemetry.io/otel/exporters/stdout/stdoutmetric`, `go.opentelemetry.io/otel/exporters/stdout/stdouttrace`, `go.opentelemetry.io/otel/log`, `go.opentelemetry.io/otel/metric`, `go.opentelemetry.io/otel/sdk`, `go.opentelemetry.io/otel/sdk/log`, `go.opentelemetry.io/otel/sdk/metric`, `go.opentelemetry.io/otel/trace`)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

- [ ] [chore(deps): update actions/dependency-review-action action to v5](../pull/306)
- [ ] [chore(deps): update module github.com/cenkalti/backoff/v5 to v7](../pull/382)
- [ ] [chore(deps): update module go.yaml.in/yaml/v2 to v3](../pull/383)
- [ ] [chore(deps): update module gomodules.xyz/jsonpatch/v2 to v3](../pull/394)
- [ ] [chore(deps): update module gopkg.in/evanphx/json-patch.v4 to v5](../pull/385)

## Vulnerabilities

Renovate has not found any CVEs on [osv.dev](https://osv.dev).

## Detected Dependencies

docker-compose (1)

docker-compose.yml

dockerfile (1)

Dockerfile (1)

- `golang 1.26.4-alpine3.22@sha256:727cfc3c40be55cd1bc9a4a059406b28a059857e3be752aa9d09531e12c20c56`

github-actions (5)

.github/workflows/build.yml (17)

- `step-security/harden-runner v2.21.1@e14015d583714f6e62063499dc959a02595150a1`
- `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f`
- `docker/setup-buildx-action v4.3.0@37fe631027851001ddb9b187196cc803df7f5f0e` → [Updates: `v4.4.1`]
- `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` → [Updates: `v7.4.0`]
- `anchore/sbom-action v0.24.2@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26`
- `actions/attest-sbom v4.1.0@c604332985a26aa8cf1bdc465b92731239ec6b9e`
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`
- `step-security/harden-runner v2.21.1@e14015d583714f6e62063499dc959a02595150a1`
- `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c`
- `docker/metadata-action v6.2.0@dc802804100637a589fabce1cb79ff13a1411302`
- `docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f`
- `actions/attest-build-provenance v4.2.2@4d101475d8b20a2381f78447822ac1eab6504dd8`
- `octokit/graphql-action v3.0.2@ddde8ebb2493e79f390e6449c725c21663a67505`
- `grafana/shared-workflows trigger-argo-workflows/v1.1.1@ecdca383418cd7662e5e96f6297c72c98d52916f`
- `ubuntu 24.04`

.github/workflows/codeql.yml (5)

- `step-security/harden-runner v2.21.1@e14015d583714f6e62063499dc959a02595150a1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `github/codeql-action v4.38.0@b96794f015dfd88f77b49b1c93e0fa7110f94c63`
- `github/codeql-action v4.38.0@b96794f015dfd88f77b49b1c93e0fa7110f94c63`
- `github/codeql-action v4.38.0@b96794f015dfd88f77b49b1c93e0fa7110f94c63`

.github/workflows/dependency-review.yml (3)

- `step-security/harden-runner v2.21.1@e14015d583714f6e62063499dc959a02595150a1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/dependency-review-action v4@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261` → [Updates: `v5.0.0`]

.github/workflows/scorecards.yml (5)

- `step-security/harden-runner v2.21.1@e14015d583714f6e62063499dc959a02595150a1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `ossf/scorecard-action v2.4.4@2d1146689b8cda280b9bc96326124645441f03bc`
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`
- `github/codeql-action v4.38.0@b96794f015dfd88f77b49b1c93e0fa7110f94c63`

.github/workflows/test-lint.yml (10)

- `step-security/harden-runner v2.21.1@e14015d583714f6e62063499dc959a02595150a1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `golangci/golangci-lint-action v9.3.0@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a`
- `step-security/harden-runner v2.21.1@e14015d583714f6e62063499dc959a02595150a1`
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `DavidAnson/markdownlint-cli2-action v24.2.0@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff`
- `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`
- `astral-sh/setup-uv v10.1.0@bec219d24cd3e171d82865faccec33120bb574f4`
- `github/codeql-action v4.38.0@b96794f015dfd88f77b49b1c93e0fa7110f94c63`

gomod (1)

go.mod (109)

- `go 1.26.0`
- `github.com/alecthomas/kong v1.16.1`
- `github.com/fluxcd/kustomize-controller/api v1.9.4` → [Updates: `v1.9.5`]
- `github.com/fluxcd/source-controller/api v1.9.4` → [Updates: `v1.9.5`]
- `github.com/go-logr/logr v1.4.4`
- `github.com/go-slog/otelslog v0.3.0`
- `github.com/google/go-containerregistry v0.22.1`
- `github.com/google/uuid v1.6.0`
- `github.com/lmittmann/tint v1.2.0`
- `github.com/mattn/go-isatty v0.0.24`
- `github.com/samber/slog-multi v1.8.0`
- `github.com/stretchr/testify v1.12.1`
- `go.opentelemetry.io/contrib/bridges/otelslog v0.20.0` → [Updates: `v0.20.1`]
- `go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.70.0` → [Updates: `v0.71.0`]
- `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0` → [Updates: `v0.71.0`]
- `go.opentelemetry.io/contrib/instrumentation/runtime v0.70.0` → [Updates: `v0.71.0`]
- `go.opentelemetry.io/otel v1.45.0` → [Updates: `v1.46.0`]
- `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0` → [Updates: `v0.22.0`]
- `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.45.0` → [Updates: `v1.46.0`]
- `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0` → [Updates: `v1.46.0`]
- `go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.45.0` → [Updates: `v1.46.0`]
- `go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.45.0` → [Updates: `v1.46.0`]
- `go.opentelemetry.io/otel/log v0.21.0` → [Updates: `v0.22.0`]
- `go.opentelemetry.io/otel/metric v1.45.0` → [Updates: `v1.46.0`]
- `go.opentelemetry.io/otel/sdk v1.45.0` → [Updates: `v1.46.0`]
- `go.opentelemetry.io/otel/sdk/log v0.21.0` → [Updates: `v0.22.0`]
- `go.opentelemetry.io/otel/sdk/metric v1.45.0` → [Updates: `v1.46.0`]
- `go.opentelemetry.io/otel/trace v1.45.0` → [Updates: `v1.46.0`]
- `k8s.io/apimachinery v0.37.0`
- `k8s.io/client-go v0.37.0`
- `sigs.k8s.io/controller-runtime v0.24.1` → [Updates: `v0.25.0`]
- `github.com/beorn7/perks v1.0.1`
- `github.com/cenkalti/backoff/v5 v5.0.3` → [Updates: `v7.0.0`]
- `github.com/cespare/xxhash/v2 v2.3.0`
- `github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc@d8f796af33cc`
- `github.com/docker/cli v29.7.2+incompatible` → [Updates: `v29.8.0+incompatible`]
- `github.com/docker/docker-credential-helpers v0.9.9`
- `github.com/emicklei/go-restful/v3 v3.13.0`
- `github.com/evanphx/json-patch v5.9.11+incompatible`
- `github.com/evanphx/json-patch/v5 v5.9.11`
- `github.com/felixge/httpsnoop v1.1.0`
- `github.com/fluxcd/pkg/apis/acl v0.10.0` → [Updates: `v0.11.0`]
- `github.com/fluxcd/pkg/apis/kustomize v1.20.0` → [Updates: `v1.21.0`]
- `github.com/fluxcd/pkg/apis/meta v1.31.0` → [Updates: `v1.32.0`]
- `github.com/fsnotify/fsnotify v1.10.1`
- `github.com/fxamacker/cbor/v2 v2.9.3` → [Updates: `v2.9.4`]
- `github.com/go-logr/stdr v1.2.2`
- `github.com/go-openapi/jsonpointer v1.0.1`
- `github.com/go-openapi/jsonreference v1.0.2`
- `github.com/go-openapi/swag v0.29.2`
- `github.com/go-openapi/swag/cmdutils v0.29.2`
- `github.com/go-openapi/swag/conv v0.29.2`
- `github.com/go-openapi/swag/fileutils v0.29.2`
- `github.com/go-openapi/swag/jsonutils v0.29.2`
- `github.com/go-openapi/swag/loading v0.29.2`
- `github.com/go-openapi/swag/mangling v0.29.2`
- `github.com/go-openapi/swag/netutils v0.29.2`
- `github.com/go-openapi/swag/pools v0.29.2`
- `github.com/go-openapi/swag/stringutils v0.29.2`
- `github.com/go-openapi/swag/typeutils v0.29.2`
- `github.com/go-openapi/swag/yamlutils v0.29.2`
- `github.com/google/gnostic-models v0.7.1`
- `github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0`
- `github.com/json-iterator/go v1.1.12`
- `github.com/klauspost/compress v1.19.2` → [Updates: `v1.20.0`]
- `github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd@bacd9c7ef1dd`
- `github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee@35a7c28c31ee`
- `github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822@a7dc8b61c822`
- `github.com/opencontainers/go-digest v1.0.0`
- `github.com/opencontainers/image-spec v1.1.1`
- `github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2@5d4384ee4fb2`
- `github.com/prometheus/client_golang v1.24.1`
- `github.com/prometheus/client_model v0.6.2` → [Updates: `v0.6.3`]
- `github.com/prometheus/common v0.70.1` → [Updates: `v0.71.0`]
- `github.com/prometheus/procfs v0.21.1` → [Updates: `v0.22.0`]
- `github.com/samber/lo v1.53.0`
- `github.com/samber/slog-common v0.22.0`
- `github.com/sirupsen/logrus v1.10.2`
- `github.com/spf13/pflag v1.0.10`
- `github.com/x448/float16 v0.8.4`
- `go.opentelemetry.io/auto/sdk v1.2.1`
- `go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0` → [Updates: `v1.46.0`]
- `go.opentelemetry.io/proto/otlp v1.11.0`
- `go.yaml.in/yaml/v2 v2.4.4` → [Updates: `v3.0.5`]
- `go.yaml.in/yaml/v3 v3.0.5`
- `golang.org/x/net v0.58.0` → [Updates: `v0.59.0`]
- `golang.org/x/oauth2 v0.36.0` → [Updates: `v0.37.0`]
- `golang.org/x/sync v0.22.0` → [Updates: `v0.23.0`]
- `golang.org/x/sys v0.47.0` → [Updates: `v0.48.0`]
- `golang.org/x/term v0.45.0` → [Updates: `v0.46.0`]
- `golang.org/x/text v0.41.0` → [Updates: `v0.42.0`]
- `golang.org/x/time v0.15.0` → [Updates: `v0.16.0`]
- `gomodules.xyz/jsonpatch/v2 v2.5.0` → [Updates: `v3.0.1`]
- `google.golang.org/genproto/googleapis/api v0.0.0-20260904194346-d0f1323225a4@d0f1323225a4` → [Updates: `v0.0.0-20260911204522-f61a6ca850bd`]
- `google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5@da73d73af1c5` → [Updates: `v0.0.0-20260911204522-f61a6ca850bd`]
- `google.golang.org/grpc v1.83.2`
- `google.golang.org/protobuf v1.36.12`
- `gopkg.in/evanphx/json-patch.v4 v4.13.0` → [Updates: `v5.9.11`]
- `gopkg.in/inf.v0 v0.9.1`
- `gotest.tools/v3 v3.5.2`
- `k8s.io/api v0.37.0`
- `k8s.io/apiextensions-apiserver v0.37.0`
- `k8s.io/klog/v2 v2.140.0`
- `k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad@d427ff9ee9ad` → [Updates: `v0.0.0-20260911184034-7970a1e230da`]
- `k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3@cf1189d6abe3`
- `sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730@2d320260d730` → [Updates: `v0.0.0-20260909141634-11ed52e25bc5`]
- `sigs.k8s.io/randfill v1.0.0`
- `sigs.k8s.io/structured-merge-diff/v6 v6.4.2` → [Updates: `v7.0.0`]
- `sigs.k8s.io/yaml v1.6.0`

pre-commit (1)

.pre-commit-config.yaml (3)

- `gitleaks/gitleaks v8.30.1` → [Updates: `v8.30.1`]
- `golangci/golangci-lint v2.13.2` → [Updates: `v2.13.2`]
- `pre-commit/pre-commit-hooks v6.0.0` → [Updates: `v6.0.0`]

---
## Need help?
You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.