Skip to content

fix(deps): update dependencies (minor) - #79

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-updates
Open

fix(deps): update dependencies (minor)#79
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-updates

Conversation

@renovate

@renovate renovate Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
golangci-lint v2.12.2v2.13.0 age confidence minor v2.13.1
google/osv-scanner-action v2.3.8v2.5.1 age confidence action minor
ocm v0.44.0v0.48.0 age confidence minor
ocm.software/ocm v0.44.0v0.48.0 age confidence require minor
osv-scanner v2.4.0v2.5.1 age confidence minor

Release Notes

golangci/golangci-lint (golangci-lint)

v2.13.0

Compare Source

Released on 2026-08-19

  1. Enhancements
    • 🎉 go1.27 support
  2. Bug fixes
    • fix: cache package facts
  3. Linters new features or changes
    • dupword: from 0.1.7 to 0.1.8 (new option skip-raw-strings)
    • errcheck: from 1.10.0 to 1.20.0
    • exhaustruct_v5: from 4.0.0 to 5.0.2 (new configuration)
    • exhaustruct: deprecated and replaced by exhaustruct_v5
    • fatcontext: from 0.9.0 to 0.10.0 (new options: check-loops, check-function-literals)
    • goconst: from 1.10.0 to 1.11.0 (new options: ignore-map-keys, exclude-types)
    • gofumpt: from 0.9.2 to 0.11.0 (new options: extra.group-params, extra.clothe-returns, extra.balance-calls)
    • gomoddirectives: from 0.8.0 to 0.9.0 (new option: replace-allow-all)
    • gosec: from 2.26.1 to 2.27.1
    • govet-modernize: from 0.44.0 to 0.49.0 (fmtappendf is removed. New analyzers atomictypes, embedlit, errorsastype, importcomment, reflecttypeassert, slicesclip, and slicesbackward. waitgroup is renamed waitgroupgo)
    • iface: from 1.4.3 to 1.5.0 (new analyzer: unusedmethod)
    • noinlineerr: from 1.0.5 to 1.0.6
    • nonamedreturns: from 1.0.6 to 1.0.8 (new option: allow-unused-named-returns)
    • recvcheck: from 0.2.0 to 0.3.0 (new default exclusions)
    • unparam: from 5beb8c8 to 3f964bc
  4. Linters bug fixes
    • clickhouse-go-linter: from 1.2.0 to 1.2.1
    • errname: from 1.1.1 to 1.1.2
    • exhaustruct: from 5.0.2 to 5.0.3
    • funcorder: add missing Function field
    • ginkgolinter: from 0.23.0 to 0.23.1
    • gocheckcompilerdirectives: from 1.3.0 to 1.4.0
    • gocritic: from 0.14.3 to 0.14.4
    • gomoddirectives: add missing IgnoreForbidden field
    • iface: from 1.4.2 to 1.4.3
    • mirror: from 1.3.0 to 1.3.3
    • nilnil: from 1.1.1 to 1.1.2
    • protogetter: from 0.3.20 to 0.3.21
google/osv-scanner-action (google/osv-scanner-action)

v2.5.1

Compare Source

This updates OSV-Scanner to v2.3.8.

What's Changed
Fixes:
  • Preserve package namespaces when querying osv.dev API (fixes #​2978).
  • Re-add support for the OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY environment variable (fixes #​2983).
  • Fix local vulnerability matching (--offline-vulnerabilities) not working when network capability is NetworkOnline.

Full Changelog: google/osv-scanner-action@v2.5.0...v2.5.1

v2.5.0

Compare Source

This updates OSV-Scanner to v2.5.0 as well as:

What's Changed

New Contributors

Full Changelog: google/osv-scanner-action@v2.3.8...v2.5.0

open-component-model/ocm (ocm)

v0.48.0

Compare Source

What's Changed
⬆️ Dependencies
🧰 Maintenance

Full Changelog: open-component-model/ocm@v0.47...v0.48.0

v0.47.0

Compare Source

What's Changed
🐛 Bug Fixes
⬆️ Dependencies
🧰 Maintenance

Full Changelog: open-component-model/ocm@v0.46...v0.47.0

v0.46.0

Compare Source

What's Changed
🚀 Features
🐛 Bug Fixes
⬆️ Dependencies
🧰 Maintenance

Full Changelog: open-component-model/ocm@v0.45...v0.46.0

v0.45.0

Compare Source

What's Changed
🐛 Bug Fixes
⬆️ Dependencies
🧰 Maintenance
New Contributors

Full Changelog: open-component-model/ocm@v0.44...v0.45.0

google/osv-scanner (osv-scanner)

v2.5.1

Compare Source

Fixes:
  • Preserve package namespaces when querying osv.dev API (fixes #​2978).
  • Re-add support for the OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY environment variable (fixes #​2983).
  • Fix local vulnerability matching (--offline-vulnerabilities) not working when network capability is NetworkOnline.

v2.5.0

Compare Source

Features & Refactors:
  • Full OSV-Scalibr pipeline: Migrated scanning, filtering, and matching in osv-scanner to use osv-scalibr end-to-end, so most plugins that's supported in osv-scalibr should be supported via the --experimental-plugins flag (#​2935).

  • New extractors and ecosystem support via osv-scalibr:

    • Add javascript/vsix extractor to support scanning VS Code extension (.vsix) packages.
    • Extend ecosystem mapping for:
      • SUSE
      • Azure Linux / Mariner
      • Alpaquita
      • Mageia
      • openSUSE Leap
      • Debian and Ubuntu PURL
  • PURL Type Resolution: Updated osvscannerjson extractor to map ecosystem names to valid PURL types (golang, gem, cargo, npm, etc.).

Fixes:
  • Bug #​2915 Fix issue where osv-scanner reported already-fixed advisories as unfixed for RHEL-family RPM packages (Red Hat, AlmaLinux, Rocky Linux) with epochs by sending epoch-qualified versions.
  • Fix Python requirements.txt extractor in osv-scalibr, specifically regular expressions used to extract package names and per-requirement options (Fixes #​2940, #​2931)
  • Fix NPM and Composer PURL generation in osv-scalibr, separating package namespace (scope) from package name

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 5am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the ok-to-image PR is allowed to run container build label Jul 6, 2026
@renovate
renovate Bot enabled auto-merge July 6, 2026 02:47
@renovate renovate Bot added the ok-to-image PR is allowed to run container build label Jul 6, 2026
@renovate

renovate Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 102 additional dependencies were updated

Details:

Package Change
cloud.google.com/go/auth v0.19.0 -> v0.20.0
github.com/aws/aws-sdk-go-v2 v1.41.12 -> v1.43.0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.13 -> v1.7.14
github.com/aws/aws-sdk-go-v2/config v1.32.23 -> v1.32.31
github.com/aws/aws-sdk-go-v2/credentials v1.19.22 -> v1.19.30
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.28 -> v1.18.31
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.2.8 -> v0.3.5
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.28 -> v1.4.31
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.28 -> v2.7.31
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.29 -> v1.4.32
github.com/aws/aws-sdk-go-v2/service/ecr v1.58.3 -> v1.60.0
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12 -> v1.13.13
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.21 -> v1.9.24
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.28 -> v1.13.31
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.28 -> v1.19.32
github.com/aws/aws-sdk-go-v2/service/s3 v1.103.2 -> v1.106.0
github.com/aws/aws-sdk-go-v2/service/signin v1.1.4 -> v1.5.0
github.com/aws/aws-sdk-go-v2/service/sso v1.31.2 -> v1.33.0
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.5 -> v1.38.0
github.com/aws/aws-sdk-go-v2/service/sts v1.43.2 -> v1.45.0
github.com/aws/smithy-go v1.27.1 -> v1.27.4
github.com/buildkite/agent/v3 v3.118.0 -> v3.130.0
github.com/buildkite/go-pipeline v0.16.0 -> v0.17.1
github.com/containerd/containerd/v2 v2.3.1 -> v2.3.3
github.com/coreos/go-oidc/v3 v3.17.0 -> v3.18.0
github.com/docker/cli v29.5.3+incompatible -> v29.6.2+incompatible
github.com/docker/go-connections v0.7.0 -> v0.8.0
github.com/fsnotify/fsnotify v1.9.0 -> v1.10.1
github.com/go-chi/chi/v5 v5.2.5 -> v5.3.0
github.com/go-git/go-billy/v5 v5.9.0 -> v5.9.1
github.com/go-logr/logr v1.4.3 -> v1.4.4
github.com/go-openapi/analysis v0.25.0 -> v0.25.2
github.com/go-openapi/errors v0.22.7 -> v0.22.8
github.com/go-openapi/jsonpointer v0.22.5 -> v0.23.1
github.com/go-openapi/jsonreference v0.21.5 -> v0.21.6
github.com/go-openapi/loads v0.23.3 -> v0.24.0
github.com/go-openapi/runtime v0.29.4 -> v0.32.4
github.com/go-openapi/spec v0.22.4 -> v0.22.6
github.com/go-openapi/strfmt v0.26.3 -> v0.27.0
github.com/go-openapi/swag v0.26.0 -> v0.26.1
github.com/go-openapi/swag/cmdutils v0.26.0 -> v0.26.1
github.com/go-openapi/swag/conv v0.26.0 -> v0.27.3
github.com/go-openapi/swag/fileutils v0.26.0 -> v0.26.1
github.com/go-openapi/swag/jsonname v0.26.0 -> v0.26.1
github.com/go-openapi/swag/jsonutils v0.26.0 -> v0.26.1
github.com/go-openapi/swag/loading v0.26.0 -> v0.26.1
github.com/go-openapi/swag/mangling v0.26.0 -> v0.26.1
github.com/go-openapi/swag/netutils v0.26.0 -> v0.26.1
github.com/go-openapi/swag/stringutils v0.26.0 -> v0.26.1
github.com/go-openapi/swag/typeutils v0.26.0 -> v0.27.3
github.com/go-openapi/swag/yamlutils v0.26.0 -> v0.26.1
github.com/go-openapi/validate v0.25.2 -> v0.26.0
github.com/goccy/go-json v0.10.5 -> v0.10.6
github.com/google/go-containerregistry v0.21.3 -> v0.21.7
github.com/googleapis/enterprise-certificate-proxy v0.3.14 -> v0.3.16
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 -> v2.29.0
github.com/in-toto/attestation v1.1.2 -> v1.2.0
github.com/klauspost/compress v1.18.6 -> v1.19.1
github.com/moby/moby/api v1.54.2 -> v1.55.0
github.com/moby/moby/client v0.4.1 -> v0.5.0
github.com/redis/go-redis/v9 v9.20.0 -> v9.21.0
github.com/sigstore/cosign/v3 v3.0.6 -> v3.1.1
github.com/sigstore/fulcio v1.8.5 -> v1.8.7
github.com/sigstore/rekor v1.5.2 -> v1.5.3
github.com/sigstore/rekor-tiles/v2 v2.2.1 -> v2.3.0
github.com/sigstore/sigstore-go v1.1.4 -> v1.2.1
github.com/sigstore/timestamp-authority/v2 v2.0.6 -> v2.1.2
github.com/spiffe/go-spiffe/v2 v2.6.0 -> v2.7.0
github.com/tetratelabs/wazero v1.11.0 -> v1.12.0
github.com/theupdateframework/go-tuf/v2 v2.4.1 -> v2.4.2
github.com/transparency-dev/formats v0.0.0-20260202103038-9975703229b3 -> v0.1.1
github.com/ulikunitz/xz v0.5.15 -> v0.5.16
go.opentelemetry.io/otel v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/metric v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/sdk v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/sdk/metric v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/trace v1.43.0 -> v1.44.0
go.yaml.in/yaml/v2 v2.4.3 -> v2.4.4
golang.org/x/crypto v0.52.0 -> v0.54.0
golang.org/x/mod v0.35.0 -> v0.37.0
golang.org/x/net v0.55.0 -> v0.57.0
golang.org/x/sync v0.20.0 -> v0.22.0
golang.org/x/sys v0.45.0 -> v0.47.0
golang.org/x/term v0.43.0 -> v0.45.0
golang.org/x/text v0.37.0 -> v0.40.0
golang.org/x/tools v0.44.0 -> v0.47.0
google.golang.org/api v0.274.0 -> v0.284.0
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 -> v0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d -> v0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/grpc v1.80.0 -> v1.82.1
gopkg.in/ini.v1 v1.67.2 -> v1.67.3
helm.sh/helm/v4 v4.2.0 -> v4.2.3
k8s.io/api v0.36.1 -> v0.36.3
k8s.io/apiextensions-apiserver v0.36.1 -> v0.36.3
k8s.io/apimachinery v0.36.1 -> v0.36.3
k8s.io/cli-runtime v0.36.1 -> v0.36.3
k8s.io/client-go v0.36.1 -> v0.36.3
k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 -> v0.0.0-20260507154919-ff6756f316d2
oras.land/oras-go/v2 v2.6.0 -> v2.6.2
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 -> v6.3.3

@coveralls

coveralls commented Jul 6, 2026

Copy link
Copy Markdown

Coverage Report for CI Build 32611128222

Warning

No base build found for commit 909b766 on main.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 42.21%

Details

  • Patch coverage: No coverable lines changed in this PR.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

Requires a base build to compare against. How to fix this →


Coverage Stats

Coverage Status
Relevant Lines: 353
Covered Lines: 149
Line Coverage: 42.21%
Coverage Strength: 0.49 hits per line

💛 - Coveralls

@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch 2 times, most recently from 486be39 to 90171b2 Compare July 17, 2026 09:39
@renovate renovate Bot changed the title fix(deps): update dependencies (minor) to v0.45.0 fix(deps): update dependencies (minor) to v0.46.0 Jul 17, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch 2 times, most recently from b47beca to eed5d1b Compare July 20, 2026 16:02
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch from eed5d1b to c77133e Compare July 31, 2026 07:44
@renovate renovate Bot changed the title fix(deps): update dependencies (minor) to v0.46.0 fix(deps): update dependencies (minor) to v0.47.0 Jul 31, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch from c77133e to 2aa89b8 Compare August 10, 2026 06:04
@renovate renovate Bot changed the title fix(deps): update dependencies (minor) to v0.47.0 fix(deps): update dependencies (minor) Aug 10, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch 2 times, most recently from 2c30232 to e035157 Compare August 20, 2026 05:11
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch from e035157 to 8243e9c Compare August 23, 2026 01:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ok-to-image PR is allowed to run container build

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants