Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.

## Deprecations / Replacements
> [!WARNING]
The following dependencies are either deprecated or have replacements available.

| Datasource | Package | Replacement PR? |
|------------|------|--------------|
| nuget | [OpenTracing](https://redirect.github.com/opentracing/opentracing-csharp) |  |

## Abandoned Dependencies

The following dependencies have not received updates for an extended period and may be unmaintained.

View abandoned dependencies (1)

> [!NOTE]
Packages are marked as abandoned when they exceed the [`abandonmentThreshold`](https://docs.renovatebot.com/configuration-options/#abandonmentthreshold) since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity.
>
| Datasource | Package | Last Updated |
|------------|------|-------------|
| nuget | [StyleCop.Analyzers](https://redirect.github.com/DotNetAnalyzers/StyleCopAnalyzers) | `2023-12-20` |

## Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

- [ ] chore(deps): lock file maintenance

## Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

- [ ] chore(deps): update grafana/shared-workflows/get-vault-secrets action to v2.1
- [ ] chore(deps): update grafana/shared-workflows/create-github-app-token action to v1.0

## Vulnerabilities

Renovate has not found any CVEs on [osv.dev](https://osv.dev).

## Detected Dependencies

dockerfile (4)

integration-test-with-otel.Dockerfile

integration-test.Dockerfile

Pyroscope.Dockerfile (3)

- `quay.io/pypa/manylinux_2_28_x86_64 2026.09.05-1@sha256:53390351aeb4688114b02c36a23b3e6ce1166ee9b7afc5df1a4f776354fc764c` → [Updates: `2026.09.14-1`]
- `quay.io/pypa/manylinux_2_28_aarch64 2026.09.05-1@sha256:ad74e53b713f3b07d8c889c526dc0c6500da9827b45e38739570875fef52e28f` → [Updates: `2026.09.14-1`]
- `busybox 1.38.0-glibc@sha256:3ba030337caebbfc2232b22b1e435eb213b28e5844a34942c74555bf904a265a`

Pyroscope.musl.Dockerfile (3)

- `quay.io/pypa/musllinux_1_2_x86_64 2026.09.05-1@sha256:621f8004ed526a5a6bf6a866fb415ad8da54d59a991e50b3b69167c3a768a616` → [Updates: `2026.09.14-1`]
- `quay.io/pypa/musllinux_1_2_aarch64 2026.09.05-1@sha256:4dffcd49f0b6fc6928a49915f3cd939f973bbecbdfe96e1e7926b6049bc0bad5` → [Updates: `2026.09.14-1`]
- `busybox 1.38.0-musl@sha256:8635836765b0c4c43970660219739baa58b0883c2e429e4b8918f7dd1519455c` → [Updates: `1.38.0-musl`]

git-submodules (1)

.gitmodules (4)

- `profiler/third_party/protobuf dab4d24d44eea0f21d6a21a548ee2b8c22b37f4f` → [Updates: `undefined`]
- `profiler/third_party/cpp-httplib 7c33fd47bf3ab74fe968e31c5e585598373e2d8c` → [Updates: `undefined`]
- `profiler/third_party/cppcodec 8019b8b580f8573c33c50372baec7039dfe5a8ce`
- `profiler/third_party/spdlog 79524ddd08a4ec981b7fea76afd08ee05f83755d` → [Updates: `undefined`]

github-actions (6)

.github/workflows/build_linux_profiler.yml (3)

- `actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd` → [Updates: `v7`, `v6`]
- `actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd` → [Updates: `v7`, `v6`]
- `actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd` → [Updates: `v7`, `v6`]

.github/workflows/build_tracing_packages.yml (2)

- `actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd` → [Updates: `v7`, `v6`]
- `actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd` → [Updates: `v7`, `v6`]

.github/workflows/integration_test.yml (9)

- `actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd` → [Updates: `v6.1.0`, `v7.0.1`]
- `actions/setup-go v6@4a3601121dd01d1626a1e23e37211e3254c1c06c` → [Updates: `v7`, `v6`]
- `actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd` → [Updates: `v6.1.0`, `v7.0.1`]
- `actions/setup-go v6@4a3601121dd01d1626a1e23e37211e3254c1c06c` → [Updates: `v7`, `v6`]
- `actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd` → [Updates: `v6.1.0`, `v7.0.1`]
- `actions/setup-go v6@4a3601121dd01d1626a1e23e37211e3254c1c06c` → [Updates: `v7`, `v6`]
- `go stable`
- `go stable`
- `go stable`

.github/workflows/release-please.yml (17)

- `grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e` → [Updates: `create-github-app-token/v1.0`]
- `googleapis/release-please-action v5@45996ed1f6d02564a971a2fa1b5860e934307cf7`
- `actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd` → [Updates: `v7`, `v6`]
- `actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd` → [Updates: `v7`, `v6`]
- `NuGet/login v1.2.0@8d196754b4036150537f80ac539e15c2f1028841`
- `actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd` → [Updates: `v7`, `v6`]
- `actions/cache v5.0.5@27d5ce7f107fe9357f9df03efb73ab90386fccae` → [Updates: `v5.1.0`, `v6.1.0`]
- `microsoft/setup-msbuild v3@30375c66a4eea26614e0d39710365f22f8b0af57`
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`
- `grafana/shared-workflows get-vault-secrets/v2.0.2@3b321a9af994a0b7d8caa3130f3cd9b5cc08fd7a` → [Updates: `get-vault-secrets/v2.1`]
- `grafana/shared-workflows azure-trusted-signing/v1.0.3@6a042eda14a697e71944976ab618d27104d9fed4`
- `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c`
- `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c`
- `actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd` → [Updates: `v7`, `v6`]
- `NuGet/login v1.2.0@8d196754b4036150537f80ac539e15c2f1028841`
- `windows 2025`
- `windows 2025`

.github/workflows/test_cpp_profiler.yml (1)

- `actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd` → [Updates: `v7`, `v6`]

.github/workflows/windows.yml (13)

- `actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v6.1.0`, `v7.0.1`]
- `actions/cache v5.0.5@27d5ce7f107fe9357f9df03efb73ab90386fccae` → [Updates: `v5.1.0`, `v6.1.0`]
- `microsoft/setup-msbuild v3@30375c66a4eea26614e0d39710365f22f8b0af57`
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`
- `actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v6.1.0`, `v7.0.1`]
- `actions/setup-go v6@4a3601121dd01d1626a1e23e37211e3254c1c06c` → [Updates: `v7`, `v6`]
- `actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10` → [Updates: `v6.1.0`, `v7.0.1`]
- `actions/setup-go v6@4a3601121dd01d1626a1e23e37211e3254c1c06c` → [Updates: `v7`, `v6`]
- `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c`
- `windows 2025`
- `go stable`
- `windows 2025`
- `go stable`

gomod (1)

integration-test/go.mod (2)

- `go 1.25.0`
- `go 1.26.6` → [Updates: `1.27.1`]

nuget (7)

global.json (1)

- `dotnet-sdk 10.0.203` → [Updates: `10.0.401`]

profiler/Directory.Build.props (1)

- `StyleCop.Analyzers 1.2.0-beta.556`

Pyroscope/Pyroscope.OpenTelemetry.Tests/Pyroscope.OpenTelemetry.Tests.csproj (3)

- `NUnit3TestAdapter 4.6.0` → [Updates: `6.3.0`]
- `NUnit 4.2.2` → [Updates: `4.6.1`]
- `Microsoft.NET.Test.Sdk 18.6.0` → [Updates: `18.10.0`]

Pyroscope/Pyroscope.OpenTelemetry/Pyroscope.OpenTelemetry.csproj (1)

- `OpenTelemetry 1.16.0` → [Updates: `1.18.0`]

Pyroscope/Pyroscope.OpenTracing.Tests/Pyroscope.OpenTracing.Tests.csproj (3)

- `NUnit3TestAdapter 4.6.0` → [Updates: `6.3.0`]
- `NUnit 4.2.2` → [Updates: `4.6.1`]
- `Microsoft.NET.Test.Sdk 18.6.0` → [Updates: `18.10.0`]

Pyroscope/Pyroscope.OpenTracing/Pyroscope.OpenTracing.csproj (1)

- `OpenTracing 0.12.1`

shared/CodeAnalysis.props (1)

- `Microsoft.CodeAnalysis.CSharp.CodeStyle 5.3.0` → [Updates: `5.9.0`]

regex (2)

Pyroscope.Dockerfile (1)

- `openssl/openssl 3.5.8` → [Updates: `3.6.4`, `4.0.2`]

Pyroscope.musl.Dockerfile (1)

- `openssl/openssl 3.5.8` → [Updates: `3.6.4`, `4.0.2`]

renovate-config (1)

renovate.json

---
## Need help?
You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

Start with the Renovate Dependency Dashboard and its linked documentation, then review the listed files such as .github/workflows/*.yml, integration-test/go.mod, the Dockerfiles, and the referenced project files. The dashboard does not define one requested change or a completion criterion, so the intended scope and what counts as done must be clarified before work begins.

Written by the indexing model from the issue text.