Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Repository Problems

These problems occurred while renovating this repository. View logs.

• ⚠️ WARN: Package lookup failures

Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

• chore(deps): update docker/setup-qemu-action digest to 1f40c72
• fix(deps): update dependencies (minor) (aquasec/trivy, github.com/onsi/gomega, go.opendefense.cloud/kit, golangci-lint, idna)
• fix(deps): update kubernetes dependencies (k8s.io/api, k8s.io/apimachinery, k8s.io/apiserver, k8s.io/client-go, k8s.io/code-generator, kindest/node)
• 🔐 Create all awaiting schedule PRs at once 🔐

---

Warning

Renovate failed to look up the following dependencies: Failed to look up docker package alpine: no-result, Failed to look up go package github.com/robfig/cron/v3: no-result.

Files affected: examples/ocm/Dockerfile, go.mod

---

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): update dependency go to v1.27.0
• chore(deps): update dependency opendefensecloud/dev-kit to v2
• Click on this checkbox to rebase all open PRs at once

Detected Dependencies

dockerfile (2)

Dockerfile (4)

• golang 1.26@sha256:0d1d3a794be25f809dd2cb3160d8c73276c4056a9f8242a138e908ddeee7b6b6 → [Updates: 1.27, 1.26]
• gcr.io/distroless/static nonroot@sha256:1c2c046bc09ed40fad370b599a0b1ae7987f55b01e247cf27a7c27cd97e5bbc7
• gcr.io/distroless/static nonroot@sha256:1c2c046bc09ed40fad370b599a0b1ae7987f55b01e247cf27a7c27cd97e5bbc7
• squidfunk/mkdocs-material sha256:51b87149d227691486b5f08993d28c65ca7e4990010664b697265b8e6fcd5287

examples/ocm/Dockerfile (1)

• alpine 3@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b

github-actions (16)

.github/workflows/codegen.yaml (6)

• actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1
• opendefensecloud/dev-kit v1.0.15@f16fb83a8669ba840346929d9c45b9efe95c4da0 → [Updates: v2.0.0]
• actions/setup-go v7@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• opendefensecloud/dev-kit v1.0.15@f16fb83a8669ba840346929d9c45b9efe95c4da0 → [Updates: v2.0.0]
• ubuntu 24.04
• go ${{ steps.go-version.outputs.version }}

.github/workflows/conventional-commits.yml (3)

• amannn/action-semantic-pull-request v6@48f256284bd46cdaab1048c3721360e808335d50
• actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1
• wagoid/commitlint-github-action v6@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed

.github/workflows/docker.yaml (12)

• actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1
• docker/metadata-action v6@dc802804100637a589fabce1cb79ff13a1411302
• docker/setup-qemu-action v4@96fe6ef7f33517b61c61be40b68a1882f3264fb8 → [Updates: v4]
• docker/setup-buildx-action v4@37fe631027851001ddb9b187196cc803df7f5f0e
• docker/login-action v4@dbcb813823bdd20940b903addbd779551569679f
• docker/build-push-action v7@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
• sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6
• anchore/sbom-action v0@e22c389904149dbc22b58101806040fa8d37a610
• actions/attest v4@1e69f48acb82d1966a394da916b4c1698aa569d6
• actions/attest v4@1e69f48acb82d1966a394da916b4c1698aa569d6
• ubuntu 24.04
• buildx latest

.github/workflows/docs-develop.yaml (4)

• actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-python v7@5fda3b95a4ea91299a34e894583c3862153e4b97
• ubuntu 24.04
• python 3.14.5

.github/workflows/docs-release.yaml (4)

• actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-python v7@5fda3b95a4ea91299a34e894583c3862153e4b97
• ubuntu 24.04
• python 3.14.5

.github/workflows/golang.yaml (12)

• actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1
• opendefensecloud/dev-kit v1.0.15@f16fb83a8669ba840346929d9c45b9efe95c4da0 → [Updates: v2.0.0]
• actions/setup-go v7@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• golangci/golangci-lint-action v9@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a
• actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-go v7@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• jandelgado/gcov2lcov-action v1.2.0@e4612787670fc5b5f49026b8c29c5569921de1db
• coverallsapp/github-action v2.3.8@8d6379e14d29928660c4ba802d8e85393440b329
• ubuntu 24.04
• go ${{ steps.go-version.outputs.version }}
• ubuntu 24.04
• go ${{ needs.lint.outputs.go-version }}

.github/workflows/helm-lint.yaml (4)

• actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1
• azure/setup-helm v5@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310
• ubuntu 24.04
• helm v4.2.4

.github/workflows/helm-publish.yaml (6)

• actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1
• azure/setup-helm v5@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310
• sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6
• docker/login-action v4@dbcb813823bdd20940b903addbd779551569679f
• ubuntu 24.04
• helm v4.2.4

.github/workflows/issues-add-labels.yaml

.github/workflows/issues-add-to-project.yml (1)

• actions/add-to-project v2.0.0@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd

.github/workflows/osv-scanner.yml (2)

• google/osv-scanner-action v2.5.1@6e4298ebc4db23e847df9b2e2de2939d6f066c67
• google/osv-scanner-action v2.5.1@6e4298ebc4db23e847df9b2e2de2939d6f066c67

.github/workflows/release-drafter.yaml (1)

• release-drafter/release-drafter v7@34d80673e067bdc0c24568d3af899c216adcfaa9

.github/workflows/release.yaml (7)

• actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-go v7@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• actions/attest v4@1e69f48acb82d1966a394da916b4c1698aa569d6
• sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6
• softprops/action-gh-release v3@efb35369e0ad2afab669f228072c1b0d510eae64
• ubuntu 24.04
• go ${{ steps.get-go-version.outputs.version }}

.github/workflows/scorecard.yaml (5)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• ossf/scorecard-action v2.4.4@2d1146689b8cda280b9bc96326124645441f03bc
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• github/codeql-action v4.37.9@cdf488f595d80d6e07e03d4674febd5ab45fa938
• ubuntu 24.04

.github/workflows/test-e2e.yaml (5)

• actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1
• opendefensecloud/dev-kit v1.0.15@f16fb83a8669ba840346929d9c45b9efe95c4da0 → [Updates: v2.0.0]
• actions/setup-go v7@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• ubuntu 24.04
• go ${{ steps.go-version.outputs.version }}

.github/workflows/update-action-pins.yml (1)

• actions/checkout v7@3d3c42e5aac5ba805825da76410c181273ba90b1

gomod (1)

go.mod (18)

• go 1.26.6 → [Updates: 1.27.0]
• github.com/argoproj/argo-workflows/v4 v4.1.2
• github.com/go-logr/logr v1.4.4
• github.com/jastBytes/sprint v0.0.3
• github.com/onsi/ginkgo/v2 v2.32.1
• github.com/onsi/gomega v1.42.1 → [Updates: v1.43.0]
• github.com/robfig/cron/v3 v3.0.1
• github.com/spf13/pflag v1.0.10
• go.opendefense.cloud/kit v0.3.4 → [Updates: v0.4.0]
• k8s.io/api v0.36.4 → [Updates: v0.37.0]
• k8s.io/apimachinery v0.36.4 → [Updates: v0.37.0]
• k8s.io/apiserver v0.36.4 → [Updates: v0.37.0]
• k8s.io/client-go v0.36.4 → [Updates: v0.37.0]
• k8s.io/code-generator v0.36.4 → [Updates: v0.37.0]
• k8s.io/kube-openapi v0.0.0-20260821135717-be32def86098@be32def86098
• sigs.k8s.io/controller-runtime v0.24.1
• sigs.k8s.io/randfill v1.0.0
• sigs.k8s.io/structured-merge-diff/v6 v6.4.2

helm-values (1)

charts/arc/values.yaml (1)

• quay.io/coreos/etcd v3.6.11 → [Updates: v3.7.1]

pip_requirements (1)

docs/requirements.txt (10)

• mkdocs-material ==9.7.7
• pymdown-extensions ==11.0.2
• mkdocs-glightbox == 0.5.2
• mkdocs-include-markdown-plugin == 7.3.0
• mkdocs-panzoom-plugin == 0.5.2
• mkdocs-awesome-nav == 3.3.0
• pillow ==12.3.0
• cairosvg == 2.9.0
• mike == 2.2.0
• idna == 3.18 → [Updates: ==3.19]

regex (11)

.github/workflows/docker.yaml (1)

• open-component-model/ocm 0.48.0

examples/blob/cluster-workflow-template.yaml (7)

• amazon/aws-cli 2.36.34 → [Updates: 2.36.38]
• amazon/aws-cli 2.36.34 → [Updates: 2.36.38]
• quay.io/curl/curl 8.20.0 → [Updates: 8.22.0]
• amazon/aws-cli 2.36.34 → [Updates: 2.36.38]
• quay.io/curl/curl 8.20.0 → [Updates: 8.22.0]
• clamav/clamav-debian 1.5.4
• amazon/aws-cli 2.36.34 → [Updates: 2.36.38]

examples/helm/cluster-workflow-template.yaml (5)

• alpine/helm 4.2.4
• alpine/helm 4.2.4
• alpine/helm 4.2.4
• aquasec/trivy 0.73.0 → [Updates: 0.74.0]
• alpine/helm 4.2.4

examples/oci/cluster-workflow-template.yaml (9)

• quay.io/skopeo/stable v1.22.2
• quay.io/skopeo/stable v1.22.2
• quay.io/skopeo/stable v1.22.2
• ghcr.io/trevex/semver v0.1.1
• hairyhenderson/gomplate v5.2.0-alpine
• quay.io/skopeo/stable v1.22.2
• quay.io/skopeo/stable v1.22.2
• aquasec/trivy 0.73.0 → [Updates: 0.74.0]
• quay.io/skopeo/stable v1.22.2

examples/ocm/cluster-workflow-template.yaml (4)

• registry 3
• ghcr.io/opendefensecloud/ocm-tools 0.45.0 → [Updates: 0.48.0]
• aquasec/trivy 0.73.0 → [Updates: 0.74.0]
• ghcr.io/opendefensecloud/ocm-tools 0.45.0 → [Updates: 0.48.0]

flake.nix (1)

• go 1.26.6 → [Updates: 1.27.0]

Makefile (1)

• opendefensecloud/dev-kit v1.0.15 → [Updates: v2.0.0]

Makefile (1)

• kindest/node 1.36.1 → [Updates: 1.37.0]

Makefile (1)

• cert-manager/cert-manager v1.21.1

Makefile (1)

• cert-manager/trust-manager v0.24.0

tools.lock (8)

• controller-gen v0.21.0 → [Updates: v0.22.0]
• addlicense v1.2.0
• osv-scanner v2.5.1
• helm-docs v1.14.2
• crd-ref-docs v0.3.0
• openapi-gen v0.0.0-20260414162039-ec9c827d403f
• ginkgo v2.32.1
• golangci-lint v2.12.2 → [Updates: v2.13.2]

renovate-config (1)

renovate.json

---

• Check this box to trigger a request for Renovate to run again on this repository