Dependency Dashboard

[forking-renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

• chore(deps): update gcr.io/google.com/cloudsdktool/google-cloud-cli:alpine docker digest to cdac858
• fix(deps): update module cloud.google.com/go/storage to v1.57.0
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• fix(deps): update module cloud.google.com/go/pubsub to v1.50.1
• chore(deps): lock file maintenance workers (undefined, google-api-python-client, requests)
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

bundler

docs/Gemfile

• github-pages lock file @ 232
• jekyll-feed "~> 0.12"
• tzinfo ">= 1", "< 3"
• wdm "~> 0.2.0"
• http_parser.rb "~> 0.6.0"
• webrick "~> 1.7"

cloudbuild

bindings/cloudbuild.yaml

cloudbuild.yaml

docker/terraform/cloudbuild.yaml

gcp/api/cloudbuild.yaml

gcp/website/cloudbuild.yaml

gcp/workers/cloudbuild.yaml

osv/cloudbuild.yaml

vulnfeeds/cloudbuild.yaml

vulnfeeds/pypi/cloudbuild.yaml

dockerfile

actions/analyze/Dockerfile

docker/ci/Dockerfile

docker/deployment/Dockerfile

• ubuntu 22.04@sha256:4e0171b9275e12d375863f2b3ae9ce00a4c53ddda176bd55868df97ac6f21a6e

docker/terraform/Dockerfile

• golang 1.25.1-alpine@sha256:b6ed3fd0452c0e9bcdef5597f29cc1418f61672e9d3a2f55bf02e7222c014abd
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:cf7a564b01721aeff7fa6128569ff1fa1cd7b47538fb034228fbdb99b9b07835

docker/worker-base/Dockerfile

• ubuntu 24.04@sha256:353675e2a41babd526e2b837d7ec780c2a05bca0164f7ea5dbbd433d21d166fc

gcp/api/Dockerfile

gcp/api/Dockerfile.esp

• gcr.io/endpoints-release/endpoints-runtime 2

gcp/indexer/Dockerfile

• golang 1.25.1-alpine@sha256:b6ed3fd0452c0e9bcdef5597f29cc1418f61672e9d3a2f55bf02e7222c014abd
• gcr.io/distroless/base-debian12 sha256:fa15492938650e1a5b87e34d47dc7d99a2b4e8aefd81b931b3f3eb6bb4c1d2f6

gcp/website/Dockerfile

• node 20.19@sha256:abcf9c98af22ea2c5d33435143d9d8a5f6f191e1e1938a7650fc8b78c382b5a9

gcp/workers/alias/Dockerfile

gcp/workers/cron/Dockerfile

gcp/workers/exporter/Dockerfile

gcp/workers/importer/Dockerfile

gcp/workers/linter/Dockerfile

• golang 1.25.1-alpine

gcp/workers/recoverer/Dockerfile

gcp/workers/staging_api_test/Dockerfile

gcp/workers/worker/Dockerfile

go/cmd/recordchecker/Dockerfile

• golang 1.25.1-alpine@sha256:b6ed3fd0452c0e9bcdef5597f29cc1418f61672e9d3a2f55bf02e7222c014abd
• gcr.io/distroless/static-debian12 sha256:87bce11be0af225e4ca761c40babb06d6d559f5767fbf7dc3c47f0f1a466b92c

vulnfeeds/cmd/alpine/Dockerfile

• golang 1.25.1-alpine@sha256:b6ed3fd0452c0e9bcdef5597f29cc1418f61672e9d3a2f55bf02e7222c014abd
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:cdac858d976cb0e6bfdc3288fee5a0a7bf6348a009089be130b2009e28463c52

vulnfeeds/cmd/combine-to-osv/Dockerfile

• golang 1.25.1-alpine@sha256:b6ed3fd0452c0e9bcdef5597f29cc1418f61672e9d3a2f55bf02e7222c014abd
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:cdac858d976cb0e6bfdc3288fee5a0a7bf6348a009089be130b2009e28463c52

vulnfeeds/cmd/cpe-repo-gen/Dockerfile

• golang 1.25.1-alpine@sha256:b6ed3fd0452c0e9bcdef5597f29cc1418f61672e9d3a2f55bf02e7222c014abd
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:cdac858d976cb0e6bfdc3288fee5a0a7bf6348a009089be130b2009e28463c52

vulnfeeds/cmd/cve-bulk-converter/Dockerfile

• golang 1.25.1-alpine@sha256:b6ed3fd0452c0e9bcdef5597f29cc1418f61672e9d3a2f55bf02e7222c014abd
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:cdac858d976cb0e6bfdc3288fee5a0a7bf6348a009089be130b2009e28463c52

vulnfeeds/cmd/debian-copyright-mirror/Dockerfile

• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:cdac858d976cb0e6bfdc3288fee5a0a7bf6348a009089be130b2009e28463c52

vulnfeeds/cmd/debian/Dockerfile

• golang 1.25.1-alpine@sha256:b6ed3fd0452c0e9bcdef5597f29cc1418f61672e9d3a2f55bf02e7222c014abd
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:cdac858d976cb0e6bfdc3288fee5a0a7bf6348a009089be130b2009e28463c52

vulnfeeds/cmd/download-cves/Dockerfile

• golang 1.25.1-alpine@sha256:b6ed3fd0452c0e9bcdef5597f29cc1418f61672e9d3a2f55bf02e7222c014abd
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:cdac858d976cb0e6bfdc3288fee5a0a7bf6348a009089be130b2009e28463c52

vulnfeeds/cmd/nvd-cve-osv/Dockerfile

• golang 1.25.1-alpine@sha256:b6ed3fd0452c0e9bcdef5597f29cc1418f61672e9d3a2f55bf02e7222c014abd
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:cdac858d976cb0e6bfdc3288fee5a0a7bf6348a009089be130b2009e28463c52

vulnfeeds/tools/debian/Dockerfile

• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:cdac858d976cb0e6bfdc3288fee5a0a7bf6348a009089be130b2009e28463c52

git-submodules

.gitmodules

• gcp/api/googleapis master@d4a9eb5869a1698d8887a68dd17e5bda9ec802d3
• osv/osv-schema main@c3926b680ad58ad1c8c2ea5349c0db674a058248

github-actions

.github/workflows/codeql-analysis.yml

• actions/checkout v4.3.0@08eba0b27e820071cde6df949e0beb9ba4906955
• github/codeql-action v3.30.3@192325c86100d080feab897ff886c34abd4c83a3
• github/codeql-action v3.30.3@192325c86100d080feab897ff886c34abd4c83a3
• github/codeql-action v3.30.3@192325c86100d080feab897ff886c34abd4c83a3

.github/workflows/issue-signposting.yml

.github/workflows/link-checker-on-push.yml

• actions/checkout v4.3.0@08eba0b27e820071cde6df949e0beb9ba4906955
• gaurav-nelson/github-action-markdown-link-check 0524e79d8d7d1606112722dd7a3b5f5ce367de3e

.github/workflows/lint.yaml

• actions/checkout v4.3.0@08eba0b27e820071cde6df949e0beb9ba4906955
• actions/setup-python v5.6.0@a26af69be951a213d495a4c3e4e4022e16d87065
• actions/setup-go v5.5.0@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
• hashicorp/setup-terraform v3.1.2@b9cd54a3c349d3f38e8881555d616ced269862dd
• python 3.13
• go >=1.23.6

.github/workflows/osv-scanner-unified.yml

.github/workflows/pr-check.yml

• amannn/action-semantic-pull-request v5.5.3@0723387faaf9b38adef4775cd42cfd5155ed6017

.github/workflows/publish-to-pypi.yaml

• actions/checkout v4.3.0@08eba0b27e820071cde6df949e0beb9ba4906955
• actions/setup-python v5.6.0@a26af69be951a213d495a4c3e4e4022e16d87065
• pypa/gh-action-pypi-publish v1.13.0@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e
• python 3.13

.github/workflows/renovate-validator.yml

• actions/checkout v4.3.0@08eba0b27e820071cde6df949e0beb9ba4906955
• actions/setup-node v4.4.0@49933ea5288caeca8642d1e84afbd3f7d6820020

.github/workflows/scorecards.yml

• actions/checkout v4.3.0@08eba0b27e820071cde6df949e0beb9ba4906955
• ossf/scorecard-action v2.4.2@05b42c624433fc40578a4040d5cf5e36ddca8cde
• actions/upload-artifact v4.6.2@ea165f8d65b6e75b540449e92b4886f43607fa02
• github/codeql-action v3.30.3@192325c86100d080feab897ff886c34abd4c83a3

.github/workflows/staleness.yml

• actions/stale v9.1.0@5bef64f19d7facfb25b37b414482c7164d639639

gomod

bindings/go/go.mod

• go 1.24.6
• github.com/google/go-cmp v0.7.0
• github.com/ossf/osv-schema/bindings/go v0.0.0-20250923052108-c3926b680ad5@c3926b680ad5
• golang.org/x/sync v0.17.0

docs/go.mod

• go 1.24.6
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2
• google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
• google.golang.org/protobuf v1.36.9

gcp/indexer/go.mod

• go 1.24.6
• cloud.google.com/go/datastore v1.20.0
• cloud.google.com/go/pubsub v1.50.1
• cloud.google.com/go/storage v1.56.2
• github.com/go-git/go-git/v5 v5.16.2
• github.com/golang/glog v1.2.5
• github.com/google/go-cmp v0.7.0
• golang.org/x/sync v0.17.0
• google.golang.org/api v0.249.0
• gopkg.in/yaml.v3 v3.0.1

go/go.mod

• go 1.24.6
• cloud.google.com/go/datastore v1.20.0
• cloud.google.com/go/pubsub v1.49.0
• cloud.google.com/go/storage v1.57.0
• github.com/charmbracelet/lipgloss v1.1.0
• google.golang.org/api v0.249.0

tools/datastore-remover/go.mod

• go 1.24.6
• cloud.google.com/go/datastore v1.20.0
• google.golang.org/api v0.249.0

tools/indexer-api-caller/go.mod

• go 1.24.6

vulnfeeds/go.mod

• go 1.24.6
• cloud.google.com/go/secretmanager v1.15.0
• cloud.google.com/go/storage v1.57.0
• github.com/aquasecurity/go-pep440-version v0.0.1
• github.com/atombender/go-jsonschema v0.20.0
• github.com/charmbracelet/lipgloss v1.1.0
• github.com/go-git/go-git/v5 v5.16.2
• github.com/google/go-cmp v0.7.0
• github.com/google/osv-scanner v1.9.2
• github.com/knqyf263/go-cpe v0.0.0-20230627041855-cb0794d06872@cb0794d06872
• github.com/ossf/osv-schema/bindings/go v0.0.0-20250923052108-c3926b680ad5@c3926b680ad5
• github.com/sethvargo/go-retry v0.3.0
• gopkg.in/dnaeon/go-vcr.v4 v4.0.5
• gopkg.in/yaml.v2 v2.4.0

npm

gcp/website/frontend3/package.json

• @github/clipboard-copy-element 1.3.0
• @hotwired/turbo 7.3.0
• @material/data-table 13.0.0
• @material/layout-grid 13.0.0
• @material/theme 13.0.0
• @material/web ^1.5.0
• lit 2.8.0
• spicy-sections c3aae99dbf1e627cdf03a35c913d7f6e970de22b
• copy-webpack-plugin 10.2.4
• css-loader 6.11.0
• html-webpack-plugin 5.6.4
• mini-css-extract-plugin 2.9.4
• raw-loader 4.0.2
• sass 1.93.2
• sass-loader 12.6.0
• style-loader 3.3.4
• webpack 5.101.3
• webpack-bundle-analyzer 4.10.2
• webpack-cli 4.10.0
• webpack-dev-server 5.2.2

poetry

gcp/api/pyproject.toml

• google-cloud-ndb ==2.3.4
• google-cloud-logging ==3.12.1
• packaging ==24.2
• requests ==2.32.5
• mypy-protobuf ^3.6.0
• yapf *
• pylint *

gcp/functions/pypi/pyproject.toml

• cryptography ==44.0.3
• google-cloud-secret-manager ==2.24.0
• osv ==0.1.1
• requests ==2.32.5

gcp/website/pyproject.toml

• Flask ==2.3.3
• Flask-Caching ==2.3.1
• Flask-Compress ==1.18
• werkzeug ==3.1.3
• google-auth ==2.40.3
• google-cloud-ndb ==2.3.4
• google-cloud-logging ==3.12.1
• jinja2 ==3.1.6
• markdown2 ==2.5.4
• markupsafe ==2.1.5
• packageurl-python ==0.17.5
• redis ==4.6.0
• requests ==2.32.5
• gunicorn ==23.0.0
• whitenoise ==6.11.0
• cvss ==3.6
• yapf *
• pylint *

gcp/workers/worker/pyproject.toml

• google-auth-httplib2 ==0.2.0
• google-api-python-client ==2.181.0
• google-cloud-pubsub ==2.31.1
• google-cloud-ndb ==2.3.4
• google-cloud-storage ==2.19.0
• pyyaml ==6.0.2
• redis ==5.3.1
• packageurl-python ==0.17.5
• pygit2 ==1.18.2
• requests ==2.32.4
• jsonschema ==4.25.1
• vanir ==1.0.1
• yapf *
• pylint *

pyproject.toml

• google-cloud-ndb >=2.3
• google-cloud-logging >=3.10
• google-cloud-pubsub >=2.31.1
• google-cloud-storage >=2.17
• semver >=3.0
• packageurl-python >=0.17.0
• pyyaml >=6.0
• pygit2 >=1.14.0
• attrs >=23.2
• jsonschema >=4.0
• grpcio >=1.0
• packaging-legacy >=23.0.post0
• requests >=2.32
• yapf *
• pylint *
• grpcio-tools *
• mypy-protobuf ^3.6.0
• vcrpy *

tools/datafix/pyproject.toml

• google-cloud-ndb ==2.3.4
• google-cloud-storage ==2.19.0
• pyyaml ==6.0.2
• google-cloud-pubsub >=2.25.2
• yapf *
• pylint *

vulnfeeds/tools/debian/debian_converter/pyproject.toml

• markdownify ==0.14.1
• pandas ==2.3.2
• python-dateutil ==2.9.0.post0
• yapf *
• pylint *

terraform

deployment/terraform/environments/oss-vdb-test/main.tf

• external ~> 2.3.3
• google ~> 5.45.0
• google-beta ~> 5.45.0
• null ~> 3.2.2

deployment/terraform/environments/oss-vdb/main.tf

• external ~> 2.3.3
• google ~> 5.45.0
• google-beta ~> 5.45.0
• null ~> 3.2.2

deployment/terraform/modules/osv/website.tf

• terraform-google-modules/lb-http/google ~> 10.0

---

• Check this box to trigger a request for Renovate to run again on this repository