Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.

## Repository Problems

Renovate tried to run on this repository, but found these problems.

- ⚠️ WARN: Package lookup failures

## Abandoned Dependencies

The following dependencies have not received updates for an extended period and may be unmaintained.

View abandoned dependencies (5)

> [!NOTE]
Packages are marked as abandoned when they exceed the [`abandonmentThreshold`](https://docs.renovatebot.com/configuration-options/#abandonmentthreshold) since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity.
>
| Datasource | Package | Last Updated |
|------------|------|-------------|
| gomod | [github.com/cespare/xxhash/v2](https://redirect.github.com/cespare/xxhash) | `2024-04-04` |
| gomod | [github.com/go-logr/stdr](https://redirect.github.com/go-logr/stdr) | `2021-12-15` |
| gomod | [github.com/google/sqlcommenter/go/core](https://redirect.github.com/google/sqlcommenter) | `2022-12-22` |
| gomod | [github.com/google/sqlcommenter/go/database/sql](https://redirect.github.com/google/sqlcommenter) | `2023-01-03` |
| gomod | [github.com/google/uuid](https://redirect.github.com/google/uuid) | `2024-01-23` |

## Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

- [ ] chore(deps): lock file maintenance

## Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

- [ ] chore(deps): update docker/setup-buildx-action digest to f87e599
- [ ] chore(deps): update dependency ruby to v4.0.7
- [ ] chore(deps): update ruby non-major (`faraday`, `opentelemetry-sdk`)
- [ ] chore(deps): update dependency puma to v8

---

> [!WARNING]
> Renovate failed to look up the following dependencies: `Could not determine new digest for update (github-tags package ruby/setup-ruby)`.
>
> Files affected: `.github/workflows/ci.yml`

---

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [chore(deps): update go non-major to f61a6ca](../pull/126) (`google.golang.org/genproto/googleapis/api`, `google.golang.org/genproto/googleapis/rpc`)
- [ ] [chore(deps): update mysql:26.7 docker digest to 45abdd9](../pull/127)
- [ ] [chore(deps): update dependency protobuf to v7.36.1](../pull/123)
- [ ] [chore(deps): update terraform grafana to v4.46.0](../pull/124)
- [ ] [fix(deps): update dependency io.opentelemetry:opentelemetry-api to v1.66.0](../pull/125)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

- [ ] [fix(security/high/python/docker-compose/services/common): update dependency setuptools to v83 [security]](../pull/23)
- [ ] [chore(deps): update module github.com/cenkalti/backoff/v5 to v7](../pull/85)

## Vulnerabilities

> [!IMPORTANT]
> `4`/`4` CVEs have Renovate fixes.

pip_requirements

python/docker-compose/services/common/base-requirements.txt

setuptools

- [GHSA-5rjg-fvgr-3xxf](https://osv.dev/vulnerability/GHSA-5rjg-fvgr-3xxf) (fixed in >= 78.1.1)
- [GHSA-h35f-9h28-mq5c](https://osv.dev/vulnerability/GHSA-h35f-9h28-mq5c) (fixed in >= 83.0.0)
- [PYSEC-2025-49](https://osv.dev/vulnerability/PYSEC-2025-49) (fixed in >= 78.1.1)
- [PYSEC-2026-3447](https://osv.dev/vulnerability/PYSEC-2026-3447) (fixed in >= 83.0.0)

## Detected Dependencies

bundler (1)

ruby/docker-compose/services/Gemfile (17)

- `ruby >= 3.3`
- `sinatra "~> 4.1"`
- `rackup "~> 2.2"`
- `puma "~> 7.0"` → [Updates: `"~> 8.0"`]
- `sequel "~> 5.89"`
- `mysql2 "~> 0.5"`
- `pg "~> 1.5"`
- `faraday "~> 2.12"` → [Updates: `"~> 2.12"`]
- `opentelemetry-sdk "~> 1.6"` → [Updates: `"~> 1.6"`]
- `opentelemetry-exporter-otlp "~> 0.30"`
- `opentelemetry-instrumentation-sinatra "~> 0.24"`
- `opentelemetry-instrumentation-rack "~> 0.26"`
- `opentelemetry-instrumentation-faraday "~> 0.26"`
- `opentelemetry-instrumentation-mysql2 "~> 0.34"`
- `opentelemetry-instrumentation-pg "~> 0.36"`
- `pyroscope "~> 1.1"`
- `pyroscope-otel "~> 0.2"`

docker-compose (6)

go/docker-compose/docker-compose.yml (3)

- `mysql 26.7@sha256:66aec17cd21a956029b83f083b813073859e8355dc1a00e55df6ba02f0e32345` → [Updates: `26.7`]
- `postgres latest@sha256:06cad38a5d9f5d24b4d83d86def30795d5e4b757fedbf5281172b576dedcd941` → [Updates: `latest`]
- `grafana/alloy v1.19.2@sha256:b8ec653c44235fbe910879145dac3597d66b0aaecf60bcbbe82580767771a839`

java/docker-compose/docker-compose.yml (3)

- `mysql 26.7@sha256:66aec17cd21a956029b83f083b813073859e8355dc1a00e55df6ba02f0e32345` → [Updates: `26.7`]
- `postgres latest@sha256:06cad38a5d9f5d24b4d83d86def30795d5e4b757fedbf5281172b576dedcd941` → [Updates: `latest`]
- `grafana/alloy v1.19.2@sha256:b8ec653c44235fbe910879145dac3597d66b0aaecf60bcbbe82580767771a839`

nodejs/docker-compose/docker-compose.yml (3)

- `mysql 26.7@sha256:66aec17cd21a956029b83f083b813073859e8355dc1a00e55df6ba02f0e32345` → [Updates: `26.7`]
- `postgres latest@sha256:06cad38a5d9f5d24b4d83d86def30795d5e4b757fedbf5281172b576dedcd941` → [Updates: `latest`]
- `grafana/alloy v1.19.2@sha256:b8ec653c44235fbe910879145dac3597d66b0aaecf60bcbbe82580767771a839`

python/docker-compose/docker-compose.arm64-cryptography-workaround.yml

python/docker-compose/docker-compose.yml (3)

- `mysql 26.7@sha256:66aec17cd21a956029b83f083b813073859e8355dc1a00e55df6ba02f0e32345` → [Updates: `26.7`]
- `postgres latest@sha256:06cad38a5d9f5d24b4d83d86def30795d5e4b757fedbf5281172b576dedcd941` → [Updates: `latest`]
- `grafana/alloy v1.19.2@sha256:b8ec653c44235fbe910879145dac3597d66b0aaecf60bcbbe82580767771a839`

ruby/docker-compose/docker-compose.yml (3)

- `mysql 26.7@sha256:66aec17cd21a956029b83f083b813073859e8355dc1a00e55df6ba02f0e32345` → [Updates: `26.7`]
- `postgres latest@sha256:06cad38a5d9f5d24b4d83d86def30795d5e4b757fedbf5281172b576dedcd941` → [Updates: `latest`]
- `grafana/alloy v1.19.2@sha256:b8ec653c44235fbe910879145dac3597d66b0aaecf60bcbbe82580767771a839`

dockerfile (20)

go/docker-compose/frontend/Dockerfile (2)

- `node 24-alpine@sha256:50c8e8ca1d27439048670df5883f32d57cf81cff6233222c893fd0d9884cbd81`
- `nginx alpine@sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2a470c1752` → [Updates: `alpine`]

go/docker-compose/services/checkout/Dockerfile (2)

- `golang 1.27@sha256:f44f6e88636cfb311f9ebace870ded69d943f227bb3cb27d32ffd84ea18c43ea`
- `gcr.io/distroless/static-debian12 sha256:6447365a6337c3732f412d1b74357b30a633831955b2bc45552b0086be907687` → [Updates: `undefined`]

go/docker-compose/services/products/Dockerfile (2)

- `golang 1.27@sha256:f44f6e88636cfb311f9ebace870ded69d943f227bb3cb27d32ffd84ea18c43ea`
- `gcr.io/distroless/static-debian12 sha256:6447365a6337c3732f412d1b74357b30a633831955b2bc45552b0086be907687` → [Updates: `undefined`]

go/docker-compose/services/shipping/Dockerfile (2)

- `golang 1.27@sha256:f44f6e88636cfb311f9ebace870ded69d943f227bb3cb27d32ffd84ea18c43ea`
- `gcr.io/distroless/static-debian12 sha256:6447365a6337c3732f412d1b74357b30a633831955b2bc45552b0086be907687` → [Updates: `undefined`]

java/docker-compose/frontend/Dockerfile (2)

- `node 24-alpine@sha256:50c8e8ca1d27439048670df5883f32d57cf81cff6233222c893fd0d9884cbd81`
- `nginx alpine@sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2a470c1752` → [Updates: `alpine`]

java/docker-compose/services/checkout/Dockerfile (2)

- `maven 3.9-eclipse-temurin-21@sha256:a972570be789ee5c9fa23446a8914ac7327560b5c022f662cfa9452aef829f18` → [Updates: `3.9-eclipse-temurin-21`]
- `eclipse-temurin 25-jre@sha256:15090d159279e5c158473eccb48cd87f57b3e3a47511a797eb5a7a7ea6f86b0f` → [Updates: `25-jre`]

java/docker-compose/services/products/Dockerfile (2)

- `maven 3.9-eclipse-temurin-21@sha256:a972570be789ee5c9fa23446a8914ac7327560b5c022f662cfa9452aef829f18` → [Updates: `3.9-eclipse-temurin-21`]
- `eclipse-temurin 25-jre@sha256:15090d159279e5c158473eccb48cd87f57b3e3a47511a797eb5a7a7ea6f86b0f` → [Updates: `25-jre`]

java/docker-compose/services/shipping/Dockerfile (2)

- `maven 3.9-eclipse-temurin-21@sha256:a972570be789ee5c9fa23446a8914ac7327560b5c022f662cfa9452aef829f18` → [Updates: `3.9-eclipse-temurin-21`]
- `eclipse-temurin 25-jre@sha256:15090d159279e5c158473eccb48cd87f57b3e3a47511a797eb5a7a7ea6f86b0f` → [Updates: `25-jre`]

nodejs/docker-compose/frontend/Dockerfile (2)

- `node 24-alpine@sha256:50c8e8ca1d27439048670df5883f32d57cf81cff6233222c893fd0d9884cbd81`
- `nginx alpine@sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2a470c1752` → [Updates: `alpine`]

nodejs/docker-compose/services/checkout/Dockerfile (1)

- `node 24-slim@sha256:2fe369e969550cde8e867afc3fe370b260140cab4a23d467074295b42163d553`

nodejs/docker-compose/services/products/Dockerfile (1)

- `node 24-slim@sha256:2fe369e969550cde8e867afc3fe370b260140cab4a23d467074295b42163d553`

nodejs/docker-compose/services/shipping/Dockerfile (1)

- `node 24-slim@sha256:2fe369e969550cde8e867afc3fe370b260140cab4a23d467074295b42163d553`

python/docker-compose/frontend/Dockerfile (2)

- `node 24-alpine@sha256:50c8e8ca1d27439048670df5883f32d57cf81cff6233222c893fd0d9884cbd81`
- `nginx alpine@sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2a470c1752` → [Updates: `alpine`]

python/docker-compose/services/checkout/Dockerfile (1)

- `python 3.14-slim@sha256:cad9a2c871761c413caa6fdd6441c783451e740a48aaeba60ae62a8b53525ef6`

python/docker-compose/services/products/Dockerfile (1)

- `python 3.14-slim@sha256:cad9a2c871761c413caa6fdd6441c783451e740a48aaeba60ae62a8b53525ef6`

python/docker-compose/services/shipping/Dockerfile (1)

- `python 3.14-slim@sha256:cad9a2c871761c413caa6fdd6441c783451e740a48aaeba60ae62a8b53525ef6`

ruby/docker-compose/frontend/Dockerfile (2)

- `node 24-alpine@sha256:50c8e8ca1d27439048670df5883f32d57cf81cff6233222c893fd0d9884cbd81`
- `nginx alpine@sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2a470c1752` → [Updates: `alpine`]

ruby/docker-compose/services/checkout/Dockerfile (1)

- `ruby 4.0-slim@sha256:58479f164d5947f852da27a4436c89bb986a811f959c40552bc7f6ccaabcc9c9`

ruby/docker-compose/services/products/Dockerfile (1)

- `ruby 4.0-slim@sha256:58479f164d5947f852da27a4436c89bb986a811f959c40552bc7f6ccaabcc9c9`

ruby/docker-compose/services/shipping/Dockerfile (1)

- `ruby 4.0-slim@sha256:58479f164d5947f852da27a4436c89bb986a811f959c40552bc7f6ccaabcc9c9`

github-actions (1)

.github/workflows/ci.yml (15)

- `actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-go v7@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e`
- `actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-python v7@5fda3b95a4ea91299a34e894583c3862153e4b97`
- `actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-java v6@de7274f081f381c8f8158605e0321c36c376e2e6`
- `actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `ruby/setup-ruby v1@95ef2b042f9d7a56d8268cba8559e2842e2ad01b`
- `actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `actions/setup-node v7@820762786026740c76f36085b0efc47a31fe5020`
- `actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1`
- `docker/setup-buildx-action v4@37fe631027851001ddb9b187196cc803df7f5f0e` → [Updates: `v4`]
- `python 3.12`
- `ruby 4.0.6` → [Updates: `4.0.7`]
- `node 22`

gomod (1)

go/docker-compose/services/go.mod (36)

- `go 1.26.0`
- `github.com/go-sql-driver/mysql v1.10.1`
- `github.com/lib/pq v1.12.3`
- `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0`
- `go.opentelemetry.io/otel v1.46.0`
- `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0`
- `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0`
- `go.opentelemetry.io/otel/sdk v1.46.0`
- `go.opentelemetry.io/otel/sdk/metric v1.46.0`
- `github.com/XSAM/otelsql v0.44.0`
- `github.com/google/sqlcommenter/go/core v0.1.2`
- `github.com/google/sqlcommenter/go/database/sql v0.1.1`
- `github.com/grafana/otel-profiling-go v0.6.0`
- `github.com/grafana/pyroscope-go v1.4.2`
- `go.opentelemetry.io/otel/trace v1.46.0`
- `filippo.io/edwards25519 v1.2.0`
- `github.com/cenkalti/backoff/v5 v5.0.3` → [Updates: `v7.0.0`]
- `github.com/cespare/xxhash/v2 v2.3.0`
- `github.com/felixge/httpsnoop v1.1.0`
- `github.com/go-logr/logr v1.4.4`
- `github.com/go-logr/stdr v1.2.2`
- `github.com/google/uuid v1.6.0`
- `github.com/grafana/pyroscope-go/godeltaprof v0.1.12`
- `github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0`
- `github.com/klauspost/compress v1.20.0`
- `go.opentelemetry.io/auto/sdk v1.2.1`
- `go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0`
- `go.opentelemetry.io/otel/metric v1.46.0`
- `go.opentelemetry.io/proto/otlp v1.11.0`
- `golang.org/x/net v0.59.0`
- `golang.org/x/sys v0.48.0`
- `golang.org/x/text v0.42.0`
- `google.golang.org/genproto/googleapis/api v0.0.0-20260908043556-f8649ddbbfe6@f8649ddbbfe6` → [Updates: `v0.0.0-20260911204522-f61a6ca850bd`]
- `google.golang.org/genproto/googleapis/rpc v0.0.0-20260908043556-f8649ddbbfe6@f8649ddbbfe6` → [Updates: `v0.0.0-20260911204522-f61a6ca850bd`]
- `google.golang.org/grpc v1.83.2`
- `google.golang.org/protobuf v1.36.12`

maven (3)

java/docker-compose/services/checkout/pom.xml (3)

- `org.springframework.boot:spring-boot-starter-parent 4.1.1`
- `com.mysql:mysql-connector-j 26.7.0`
- `io.opentelemetry:opentelemetry-api 1.65.0` → [Updates: `1.66.0`]

java/docker-compose/services/products/pom.xml (3)

- `org.springframework.boot:spring-boot-starter-parent 4.1.1`
- `com.mysql:mysql-connector-j 26.7.0`
- `io.opentelemetry:opentelemetry-api 1.65.0` → [Updates: `1.66.0`]

java/docker-compose/services/shipping/pom.xml (2)

- `org.springframework.boot:spring-boot-starter-parent 4.1.1`
- `io.opentelemetry:opentelemetry-api 1.65.0` → [Updates: `1.66.0`]

npm (6)

go/docker-compose/frontend/package.json (8)

- `@grafana/faro-instrumentation-replay ^2.11.0`
- `@grafana/faro-react ^2.11.0`
- `@grafana/faro-web-tracing ^2.11.0`
- `react ^19.0.0`
- `react-dom ^19.0.0`
- `react-router-dom ^7.18.2`
- `@vitejs/plugin-react 6.1.1`
- `vite 8.3.0`

java/docker-compose/frontend/package.json (8)

- `@grafana/faro-instrumentation-replay ^2.11.0`
- `@grafana/faro-react ^2.11.0`
- `@grafana/faro-web-tracing ^2.11.0`
- `react ^19.0.0`
- `react-dom ^19.0.0`
- `react-router-dom ^7.18.2`
- `@vitejs/plugin-react 6.1.1`
- `vite 8.3.0`

nodejs/docker-compose/frontend/package.json (8)

- `@grafana/faro-instrumentation-replay ^2.11.0`
- `@grafana/faro-react ^2.11.0`
- `@grafana/faro-web-tracing ^2.11.0`
- `react ^19.0.0`
- `react-dom ^19.0.0`
- `react-router-dom ^7.18.2`
- `@vitejs/plugin-react 6.1.1`
- `vite 8.3.0`

nodejs/docker-compose/services/package.json (13)

- `@opentelemetry/api ^1.9.0`
- `@opentelemetry/exporter-trace-otlp-grpc ^0.222.0`
- `@opentelemetry/instrumentation-express ^0.70.0`
- `@opentelemetry/instrumentation-http ^0.222.0`
- `@opentelemetry/instrumentation-mysql2 ^0.68.0`
- `@opentelemetry/instrumentation-pg ^0.74.0`
- `@opentelemetry/resources ^2.0.0`
- `@opentelemetry/sdk-node ^0.222.0`
- `@opentelemetry/semantic-conventions ^1.28.0`
- `@pyroscope/nodejs ^0.6.1`
- `express ^5.0.0`
- `mysql2 ^3.11.5`
- `pg ^8.13.1`

python/docker-compose/frontend/package.json (8)

- `@grafana/faro-instrumentation-replay ^2.11.0`
- `@grafana/faro-react ^2.11.0`
- `@grafana/faro-web-tracing ^2.11.0`
- `react ^19.0.0`
- `react-dom ^19.0.0`
- `react-router-dom ^7.18.2`
- `@vitejs/plugin-react 6.1.1`
- `vite 8.3.0`

ruby/docker-compose/frontend/package.json (8)

- `@grafana/faro-instrumentation-replay ^2.11.0`
- `@grafana/faro-react ^2.11.0`
- `@grafana/faro-web-tracing ^2.11.0`
- `react ^19.0.0`
- `react-dom ^19.0.0`
- `react-router-dom ^7.18.2`
- `@vitejs/plugin-react 6.1.1`
- `vite 8.3.0`

pip_requirements (4)

python/docker-compose/services/checkout/requirements.txt (2)

- `PyMySQL ==1.2.0`
- `cryptography ==50.0.1`

python/docker-compose/services/common/base-requirements.txt (14)

- `setuptools ==75.1.0` → [Updates: `==83.0.0`]
- `requests ==2.34.2`
- `Flask ==3.1.3`
- `flask-cors ==6.0.5`
- `gunicorn ==26.2.0`
- `SQLAlchemy ==2.0.52` → [Updates: `==2.0.54`]
- `protobuf ==7.35.1` → [Updates: `==7.36.1`]
- `opentelemetry-sdk ==1.44.0`
- `opentelemetry-exporter-otlp-proto-grpc ==1.44.0`
- `opentelemetry-instrumentation-flask ==0.65b0`
- `opentelemetry-instrumentation-requests ==0.65b0`
- `opentelemetry-instrumentation-sqlalchemy ==0.65b0`
- `pyroscope-io ==1.2.3`
- `pyroscope-otel ==1.1.0`

python/docker-compose/services/products/requirements.txt (2)

- `PyMySQL ==1.2.0`
- `cryptography ==50.0.1`

python/docker-compose/services/shipping/requirements.txt (1)

- `psycopg2-binary ==2.9.13`

terraform (5)

go/terraform/frontend-observability/main.tf (2)

- `grafana ~> 4.0` → [Updates: `~> 4.0`]
- `hashicorp/terraform >= 1.9`

java/terraform/frontend-observability/main.tf (2)

- `grafana ~> 4.0` → [Updates: `~> 4.0`]
- `hashicorp/terraform >= 1.9`

nodejs/terraform/frontend-observability/main.tf (2)

- `grafana ~> 4.0` → [Updates: `~> 4.0`]
- `hashicorp/terraform >= 1.9`

python/terraform/frontend-observability/main.tf (2)

- `grafana ~> 4.0` → [Updates: `~> 4.0`]
- `hashicorp/terraform >= 1.9`

ruby/terraform/frontend-observability/main.tf (2)

- `grafana ~> 4.0` → [Updates: `~> 4.0`]
- `hashicorp/terraform >= 1.9`

---
## Need help?
You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

Start with the Renovate Dependency Dashboard and the affected files listed in the issue, especially .github/workflows/ci.yml and the Dockerfiles, Gemfile, and Compose files across the language directories. Review the existing linked dependency PRs and Renovate's package lookup warning; done would require the relevant updates or failures to be resolved and the dashboard to report no remaining actionable problems.

Written by the indexing model from the issue text.