Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.

## Abandoned Dependencies

The following dependencies have not received updates for an extended period and may be unmaintained.

View abandoned dependencies (16)

> [!NOTE]
Packages are marked as abandoned when they exceed the [`abandonmentThreshold`](https://docs.renovatebot.com/configuration-options/#abandonmentthreshold) since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity.
>
| Datasource | Package | Last Updated |
|------------|------|-------------|
| gomod | [github.com/apex/log](https://redirect.github.com/apex/log) | `2020-08-18` |
| gomod | [github.com/davecgh/go-spew](https://redirect.github.com/davecgh/go-spew) | `2018-02-21` |
| gomod | [github.com/go-test/deep](https://redirect.github.com/go-test/deep) | `2024-06-23` |
| gomod | [github.com/google/uuid](https://redirect.github.com/google/uuid) | `2024-01-23` |
| gomod | [github.com/josharian/intern](https://redirect.github.com/josharian/intern) | `2019-12-14` |
| gomod | [github.com/json-iterator/go](https://redirect.github.com/json-iterator/go) | `2021-09-11` |
| gomod | [github.com/modern-go/concurrent](https://redirect.github.com/modern-go/concurrent) | `2018-03-06` |
| gomod | [github.com/modern-go/reflect2](https://redirect.github.com/modern-go/reflect2) | `2021-09-11` |
| gomod | [github.com/munnerz/goautoneg](https://redirect.github.com/munnerz/goautoneg) | `2019-10-10` |
| gomod | [github.com/pkg/errors](https://redirect.github.com/pkg/errors) | `2020-01-14` |
| gomod | [github.com/pmezard/go-difflib](https://redirect.github.com/pmezard/go-difflib) | `2016-01-10` |
| gomod | [github.com/ryanuber/go-glob](https://redirect.github.com/ryanuber/go-glob) | `2019-01-24` |
| gomod | [github.com/x448/float16](https://redirect.github.com/x448/float16) | `2020-01-17` |
| gomod | [gopkg.in/inf.v0](https://redirect.github.com/go-inf/inf) | `2018-03-26` |
| gomod | [gopkg.in/yaml.v2](https://redirect.github.com/go-yaml/yaml) | `2022-05-27` |
| gomod | [gopkg.in/yaml.v3](https://redirect.github.com/go-yaml/yaml) | `2022-05-27` |

## Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

- [ ] chore(deps): update k8s.io/kube-openapi digest to 7970a1e
- [ ] chore(deps): update sigs.k8s.io/json digest to 11ed52e
- [ ] chore(deps): update module go.yaml.in/yaml/v2 to v2.4.4
- [ ] chore(deps): update module go.yaml.in/yaml/v3 to v3.0.5
- [ ] chore(deps): update module google.golang.org/protobuf to v1.36.12
- [ ] chore(deps): update go-openapi packages (`github.com/go-openapi/jsonpointer`, `github.com/go-openapi/jsonreference`, `github.com/go-openapi/swag`)
- [ ] chore(deps): update module github.com/emicklei/go-restful/v3 to v3.13.0
- [ ] chore(deps): update module github.com/mailru/easyjson to v0.9.2
- [ ] chore(deps): update module golang.org/x/oauth2 to v0.37.0
- [ ] chore(deps): update module golang.org/x/term to v0.46.0
- [ ] chore(deps): update module golang.org/x/time to v0.16.0
- [ ] chore(deps): update module k8s.io/klog/v2 to v2.140.0
- [ ] chore(deps): update module sigs.k8s.io/structured-merge-diff/v6 to v6.4.2
- [ ] chore(deps): update actions/setup-go action to v7
- [ ] chore(deps): update go-openapi packages to v1 (`github.com/go-openapi/jsonpointer`, `github.com/go-openapi/jsonreference`)
- [ ] chore(deps): update module go.yaml.in/yaml/v2 to v3
- [ ] chore(deps): update module gopkg.in/evanphx/json-patch.v4 to v5
- [ ] chore(deps): update module sigs.k8s.io/structured-merge-diff/v6 to v7
- [ ] 🔐 **Create all rate-limited PRs at once** 🔐

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [fix(security/unknown/): update module golang.org/x/net to v0.56.0 [security]](../pull/121)
- [ ] [fix(security/unknown/): update module golang.org/x/sys to v0.44.0 [security]](../pull/122)
- [ ] [fix(security/unknown/): update module golang.org/x/text to v0.39.0 [security]](../pull/130)
- [ ] [chore(deps): pin dependencies](../pull/113) (`actions/checkout`, `actions/setup-go`, `alpine`, `golang`, `plugins/docker`)
- [ ] [chore(deps): update k8s.io/utils digest to cf1189d](../pull/126)
- [ ] [chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.3](../pull/127)
- [ ] [chore(deps): update module github.com/go-logr/logr to v1.4.4](../pull/131)
- [ ] [chore(deps): update module github.com/google/gnostic-models to v0.7.1](../pull/128)
- [ ] [chore(deps): update module github.com/spf13/pflag to v1.0.10](../pull/129)
- [ ] [chore(deps): update golang docker tag to v1.27.1](../pull/114)
- [ ] [fix(deps): update kubernetes monorepo to v0.37.0](../pull/115) (`k8s.io/api`, `k8s.io/apimachinery`, `k8s.io/client-go`)
- [ ] [chore(deps): update actions/checkout action to v7](../pull/125)
- [ ] [fix(deps): update module gopkg.in/yaml.v2 to v3](../pull/119)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

- [ ] [fix(deps): update module github.com/go-test/deep to v1.1.1](../pull/61)

## Vulnerabilities

> [!IMPORTANT]
> `11`/`11` CVEs have Renovate fixes.

gomod

go.mod

golang.org/x/net

- [GHSA-5cv4-jp36-h3mw](https://osv.dev/vulnerability/GHSA-5cv4-jp36-h3mw) (fixed in >= 0.55.0)
- [GO-2026-4918](https://osv.dev/vulnerability/GO-2026-4918) (fixed in >= 0.53.0)
- [GO-2026-5025](https://osv.dev/vulnerability/GO-2026-5025) (fixed in >= 0.55.0)
- [GO-2026-5026](https://osv.dev/vulnerability/GO-2026-5026) (fixed in >= 0.55.0)
- [GO-2026-5027](https://osv.dev/vulnerability/GO-2026-5027) (fixed in >= 0.55.0)
- [GO-2026-5028](https://osv.dev/vulnerability/GO-2026-5028) (fixed in >= 0.55.0)
- [GO-2026-5029](https://osv.dev/vulnerability/GO-2026-5029) (fixed in >= 0.55.0)
- [GO-2026-5030](https://osv.dev/vulnerability/GO-2026-5030) (fixed in >= 0.55.0)
- [GO-2026-5942](https://osv.dev/vulnerability/GO-2026-5942) (fixed in >= 0.56.0)

golang.org/x/sys

- [GO-2026-5024](https://osv.dev/vulnerability/GO-2026-5024) (fixed in >= 0.44.0)

golang.org/x/text

- [GO-2026-5970](https://osv.dev/vulnerability/GO-2026-5970) (fixed in >= 0.39.0)

## Detected Dependencies

dockerfile (1)

Dockerfile (2)

- `golang 1.25.6` → [Updates: `1.27.1`, `1.25.6`]
- `alpine latest` → [Updates: `latest`]

droneci (1)

.drone.yml (1)

- `plugins/docker unknown version` → [Updates: `undefined`]

github-actions (1)

.github/workflows/ci.yml (3)

- `actions/checkout v2` → [Updates: `v7`, `v2`]
- `actions/setup-go v2` → [Updates: `v7`, `v2`]
- `go 1.24.2`

gomod (1)

go.mod (47)

- `go 1.25.0`
- `github.com/apex/log v1.9.0`
- `github.com/go-test/deep v1.0.7` → [Updates: `v1.1.1`]
- `github.com/pkg/errors v0.9.1`
- `github.com/ryanuber/go-glob v1.0.0`
- `gopkg.in/yaml.v2 v2.4.0` → [Updates: `v3.0.1`]
- `k8s.io/api v0.35.0` → [Updates: `v0.37.0`]
- `k8s.io/apimachinery v0.35.0` → [Updates: `v0.37.0`]
- `k8s.io/client-go v0.35.0` → [Updates: `v0.37.0`]
- `github.com/davecgh/go-spew v1.1.1`
- `github.com/emicklei/go-restful/v3 v3.12.2` → [Updates: `v3.13.0`]
- `github.com/fxamacker/cbor/v2 v2.9.0` → [Updates: `v2.9.3`]
- `github.com/go-logr/logr v1.4.3` → [Updates: `v1.4.4`]
- `github.com/go-openapi/jsonpointer v0.21.0` → [Updates: `v0.24.0`, `v1.0.1`]
- `github.com/go-openapi/jsonreference v0.20.2` → [Updates: `v0.21.6`, `v1.0.2`]
- `github.com/go-openapi/swag v0.23.0` → [Updates: `v0.29.2`]
- `github.com/google/gnostic-models v0.7.0` → [Updates: `v0.7.1`]
- `github.com/google/go-cmp v0.7.0`
- `github.com/google/uuid v1.6.0`
- `github.com/josharian/intern v1.0.0`
- `github.com/json-iterator/go v1.1.12`
- `github.com/mailru/easyjson v0.7.7` → [Updates: `v0.9.2`]
- `github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd@bacd9c7ef1dd`
- `github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee@35a7c28c31ee`
- `github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822@a7dc8b61c822`
- `github.com/pmezard/go-difflib v1.0.0`
- `github.com/spf13/pflag v1.0.9` → [Updates: `v1.0.10`]
- `github.com/x448/float16 v0.8.4`
- `go.yaml.in/yaml/v2 v2.4.3` → [Updates: `v2.4.4`, `v3.0.5`]
- `go.yaml.in/yaml/v3 v3.0.4` → [Updates: `v3.0.5`]
- `golang.org/x/net v0.47.0` → [Updates: `v0.56.0`]
- `golang.org/x/oauth2 v0.30.0` → [Updates: `v0.37.0`]
- `golang.org/x/sys v0.38.0` → [Updates: `v0.44.0`]
- `golang.org/x/term v0.37.0` → [Updates: `v0.46.0`]
- `golang.org/x/text v0.31.0` → [Updates: `v0.39.0`]
- `golang.org/x/time v0.9.0` → [Updates: `v0.16.0`]
- `google.golang.org/protobuf v1.36.8` → [Updates: `v1.36.12`]
- `gopkg.in/evanphx/json-patch.v4 v4.13.0` → [Updates: `v5.9.11`]
- `gopkg.in/inf.v0 v0.9.1`
- `gopkg.in/yaml.v3 v3.0.1`
- `k8s.io/klog/v2 v2.130.1` → [Updates: `v2.140.0`]
- `k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912@589584f1c912` → [Updates: `v0.0.0-20260911184034-7970a1e230da`]
- `k8s.io/utils v0.0.0-20251002143259-bc988d571ff4@bc988d571ff4` → [Updates: `v0.0.0-20260707023825-cf1189d6abe3`]
- `sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730@2d320260d730` → [Updates: `v0.0.0-20260909141634-11ed52e25bc5`]
- `sigs.k8s.io/randfill v1.0.0`
- `sigs.k8s.io/structured-merge-diff/v6 v6.3.0` → [Updates: `v6.4.2`, `v7.0.0`]
- `sigs.k8s.io/yaml v1.6.0`

---
## Need help?
You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.