fix(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
antonbabenko/pre-commit-terraform	repository	minor	v1.97.4 -> v1.100.0
github.com/gruntwork-io/terratest	require	minor	v0.48.2 -> v0.50.0
go (source)	toolchain	minor	1.24.1 -> 1.25.0
golang.org/x/net	indirect	minor	v0.36.0 -> v0.38.0
pre-commit/pre-commit-hooks	repository	major	v5.0.0 -> v6.0.0
renovatebot/pre-commit-hooks	repository	major	39.200.2 -> 41.81.2
sirosen/texthooks	repository	minor	0.6.8 -> 0.7.1
tofuutils/pre-commit-opentofu	repository	minor	v2.1.0 -> v2.2.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

GitHub Vulnerability Alerts

CVE-2025-22872

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. , , etc contexts).

---

Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

CVE-2025-22872 / GHSA-vvgc-356p-c3xw / GO-2025-3595

More information

Details

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. , , etc contexts).

Severity

Unknown

References

• https://go.dev/cl/662715
• https://go.dev/issue/73070
• https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

golang.org/x/net vulnerable to Cross-site Scripting

CVE-2025-22872 / GHSA-vvgc-356p-c3xw / GO-2025-3595

More information

Details

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. , , etc contexts).

Severity

• CVSS Score: Unknown
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-22872
• https://go.dev/cl/662715
• https://go.dev/issue/73070
• https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
• https://pkg.go.dev/vuln/GO-2025-3595
• https://security.netapp.com/advisory/ntap-20250516-0007

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

antonbabenko/pre-commit-terraform (antonbabenko/pre-commit-terraform)

v1.100.0

Compare Source

Features

• terraform_fmt: Add support for .tftest.hcl and .tfmock.hcl formatting (#​911) (7433e13)

v1.99.5

Compare Source

Features

• terraform_fmt: Add support for .tftest.hcl and .tfmock.hcl formatting (#​911) (7433e13), closes /github.com/hashicorp/terraform/blob/0c63fb2b097edcd5cb1a91322765a414206fbea2/internal/command/fmt.go#L30-L35

1.99.5 (2025-07-08)

Bug Fixes

• Regression from (at least) v1.99.0 which incorrectly handle pre-commit run -a, that causes multiply hooks runs. terraform_trivy from its introduction could always be Passed for pre-commit run -a (#​909) (a5bd84e), closes #​908 /github.com/pre-commit-terraform/#​908

1.99.4 (2025-06-12)

Bug Fixes

• docker: Drop Mac arm64 build-time hack, needed for checkov<3.2.395 (#​907) (3c9ef3d)

1.99.3 (2025-06-06)

Bug Fixes

• terraform_docs, terraform_wrapper_module_for_each: Improve .tofu files support (#​904) (4f85212)

1.99.2 (2025-06-05)

Bug Fixes

• make infracost_breakdown.sh compatible with bash 3.2 (macOS) (#​903) (dcb4c36)

1.99.1 (2025-05-29)

Bug Fixes

• terragrunt_* hooks: Use new subcommands for terragrunt v0.78.0+ instead of deprecated ones (#​901) (54468bb)

v1.99.4

Compare Source

Features

• terraform_fmt: Add support for .tftest.hcl and .tfmock.hcl formatting (#​911) (7433e13), closes /github.com/hashicorp/terraform/blob/0c63fb2b097edcd5cb1a91322765a414206fbea2/internal/command/fmt.go#L30-L35

1.99.5 (2025-07-08)

Bug Fixes

• Regression from (at least) v1.99.0 which incorrectly handle pre-commit run -a, that causes multiply hooks runs. terraform_trivy from its introduction could always be Passed for pre-commit run -a (#​909) (a5bd84e), closes #​908 /github.com/pre-commit-terraform/#​908

1.99.4 (2025-06-12)

Bug Fixes

• docker: Drop Mac arm64 build-time hack, needed for checkov<3.2.395 (#​907) (3c9ef3d)

1.99.3 (2025-06-06)

Bug Fixes

• terraform_docs, terraform_wrapper_module_for_each: Improve .tofu files support (#​904) (4f85212)

1.99.2 (2025-06-05)

Bug Fixes

• make infracost_breakdown.sh compatible with bash 3.2 (macOS) (#​903) (dcb4c36)

1.99.1 (2025-05-29)

Bug Fixes

• terragrunt_* hooks: Use new subcommands for terragrunt v0.78.0+ instead of deprecated ones (#​901) (54468bb)

v1.99.3

Compare Source

Features

• terraform_fmt: Add support for .tftest.hcl and .tfmock.hcl formatting (#​911) (7433e13), closes /github.com/hashicorp/terraform/blob/0c63fb2b097edcd5cb1a91322765a414206fbea2/internal/command/fmt.go#L30-L35

1.99.5 (2025-07-08)

Bug Fixes

• Regression from (at least) v1.99.0 which incorrectly handle pre-commit run -a, that causes multiply hooks runs. terraform_trivy from its introduction could always be Passed for pre-commit run -a (#​909) (a5bd84e), closes #​908 /github.com/pre-commit-terraform/#​908

1.99.4 (2025-06-12)

Bug Fixes

• docker: Drop Mac arm64 build-time hack, needed for checkov<3.2.395 (#​907) (3c9ef3d)

1.99.3 (2025-06-06)

Bug Fixes

• terraform_docs, terraform_wrapper_module_for_each: Improve .tofu files support (#​904) (4f85212)

1.99.2 (2025-06-05)

Bug Fixes

• make infracost_breakdown.sh compatible with bash 3.2 (macOS) (#​903) (dcb4c36)

1.99.1 (2025-05-29)

Bug Fixes

• terragrunt_* hooks: Use new subcommands for terragrunt v0.78.0+ instead of deprecated ones (#​901) (54468bb)

v1.99.2

Compare Source

Features

• terraform_fmt: Add support for .tftest.hcl and .tfmock.hcl formatting (#​911) (7433e13), closes /github.com/hashicorp/terraform/blob/0c63fb2b097edcd5cb1a91322765a414206fbea2/internal/command/fmt.go#L30-L35

1.99.5 (2025-07-08)

Bug Fixes

• Regression from (at least) v1.99.0 which incorrectly handle pre-commit run -a, that causes multiply hooks runs. terraform_trivy from its introduction could always be Passed for pre-commit run -a (#​909) (a5bd84e), closes #​908 /github.com/pre-commit-terraform/#​908

1.99.4 (2025-06-12)

Bug Fixes

• docker: Drop Mac arm64 build-time hack, needed for checkov<3.2.395 (#​907) (3c9ef3d)

1.99.3 (2025-06-06)

Bug Fixes

• terraform_docs, terraform_wrapper_module_for_each: Improve .tofu files support (#​904) (4f85212)

1.99.2 (2025-06-05)

Bug Fixes

• make infracost_breakdown.sh compatible with bash 3.2 (macOS) (#​903) (dcb4c36)

1.99.1 (2025-05-29)

Bug Fixes

• terragrunt_* hooks: Use new subcommands for terragrunt v0.78.0+ instead of deprecated ones (#​901) (54468bb)

v1.99.1

Compare Source

Features

• terraform_fmt: Add support for .tftest.hcl and .tfmock.hcl formatting (#​911) (7433e13), closes /github.com/hashicorp/terraform/blob/0c63fb2b097edcd5cb1a91322765a414206fbea2/internal/command/fmt.go#L30-L35

1.99.5 (2025-07-08)

Bug Fixes

• Regression from (at least) v1.99.0 which incorrectly handle pre-commit run -a, that causes multiply hooks runs. terraform_trivy from its introduction could always be Passed for pre-commit run -a (#​909) (a5bd84e), closes #​908 /github.com/pre-commit-terraform/#​908

1.99.4 (2025-06-12)

Bug Fixes

• docker: Drop Mac arm64 build-time hack, needed for checkov<3.2.395 (#​907) (3c9ef3d)

1.99.3 (2025-06-06)

Bug Fixes

• terraform_docs, terraform_wrapper_module_for_each: Improve .tofu files support (#​904) (4f85212)

1.99.2 (2025-06-05)

Bug Fixes

• make infracost_breakdown.sh compatible with bash 3.2 (macOS) (#​903) (dcb4c36)

1.99.1 (2025-05-29)

Bug Fixes

• terragrunt_* hooks: Use new subcommands for terragrunt v0.78.0+ instead of deprecated ones (#​901) (54468bb)

v1.99.0

Compare Source

Features

• terraform_fmt: Add support for .tftest.hcl and .tfmock.hcl formatting (#​911) (7433e13), closes /github.com/hashicorp/terraform/blob/0c63fb2b097edcd5cb1a91322765a414206fbea2/internal/command/fmt.go#L30-L35

1.99.5 (2025-07-08)

Bug Fixes

• Regression from (at least) v1.99.0 which incorrectly handle pre-commit run -a, that causes multiply hooks runs. terraform_trivy from its introduction could always be Passed for pre-commit run -a (#​909) (a5bd84e), closes #​908 /github.com/pre-commit-terraform/#​908

1.99.4 (2025-06-12)

Bug Fixes

• docker: Drop Mac arm64 build-time hack, needed for checkov<3.2.395 (#​907) (3c9ef3d)

1.99.3 (2025-06-06)

Bug Fixes

• terraform_docs, terraform_wrapper_module_for_each: Improve .tofu files support (#​904) (4f85212)

1.99.2 (2025-06-05)

Bug Fixes

• make infracost_breakdown.sh compatible with bash 3.2 (macOS) (#​903) (dcb4c36)

1.99.1 (2025-05-29)

Bug Fixes

• terragrunt_* hooks: Use new subcommands for terragrunt v0.78.0+ instead of deprecated ones (#​901) (54468bb)

v1.98.1

Compare Source

Features

• Add support for running hooks on .tofu files by default (#​875) (fe1f62f)

1.98.1 (2025-04-06)

Bug Fixes

• WSL: Fix parallelism support for WSL systems with enabled systemd (#​872) (da2e9a8)

v1.98.0

Compare Source

Features

• Add support for running hooks on .tofu files by default (#​875) (fe1f62f)

1.98.1 (2025-04-06)

Bug Fixes

• WSL: Fix parallelism support for WSL systems with enabled systemd (#​872) (da2e9a8)

gruntwork-io/terratest (github.com/gruntwork-io/terratest)

v0.50.0

Compare Source

What's Changed

• add cronjob by @​james03160927 in https://github.com/gruntwork-io/terratest/pull/1553
• fix ResourceGroupExists by @​james03160927 in https://github.com/gruntwork-io/terratest/pull/1552
• allow GOOGLE_OAUTH_ACCESS_TOKEN by @​james03160927 in https://github.com/gruntwork-io/terratest/pull/1555
• Adjust warning patterns by @​james03160927 in https://github.com/gruntwork-io/terratest/pull/1550
• chore: Offboarding Levko by @​yhakbar in https://github.com/gruntwork-io/terratest/pull/1558
• fix: Respect port selection by name by services in ForwardPortE by @​s-diez in https://github.com/gruntwork-io/terratest/pull/1557
• fix: Helm example deployment test by @​james03160927 in https://github.com/gruntwork-io/terratest/pull/1559
• Updated the subnet struct and corresponding function to fetch the subnet CIDR range by @​Atchuthmullapudi in https://github.com/gruntwork-io/terratest/pull/1561
• Implement support for terragrunt stack init by @​james03160927 in https://github.com/gruntwork-io/terratest/pull/1560

New Contributors

• @​Atchuthmullapudi made their first contribution in https://github.com/gruntwork-io/terratest/pull/1561

Full Changelog: gruntwork-io/terratest@v0.49.0...v0.50.0

v0.49.0

Compare Source

Modules affected

• terraform
• helm
• azure
• aws
• k8s
• logger
• packer

What's Changed

• feat: Creating a test for TF_LOG by @​james03160927 in #​1512
• feat: handle multiple yaml doc by @​james03160927 in #​1514
• feat: use the new sdk for azure resource group by @​james03160927 in #​1511
• feat: Stop DynamoDB methods with E Failing Immediately by @​robmorgan in #​1507
• feat: Get and Put for ECR repo policies by @​felixfriedrich in #​1519
• feat: include --version in helm upgrade by @​jijiechen in #​1532
• feat: add mixed vars support by @​james03160927 in #​1517
• feat: Add helper function for parsing packer-manifest.json by @​james03160927 in #​1546
• feat: Support a s3:putobject by @​james03160927 in #​1525
• feat: capture terraform stdout stderr and exitcode separately by @​james03160927 in #​1530
• feat: add UnmarshalK8SYamlsE by @​james03160927 in #​1533
• feat: add support for extra arguments by @​james03160927 in #​1523
• feat: allow --backend-config to use file path by setting the value to nil by @​james03160927 in #​1539
• feat: Support for ListNamespaces function by @​james03160927 in #​1543
• feat: K8S fix forward to service port by @​james03160927 in #​1547
• fix: add test for duplicate key by @​james03160927 in #​1518
• fix: support custom TG logger settings by @​bt-macole in #​1509
• docs: Improve README for terraform database example module by @​james03160927 in #​1515
• chore: adjust fixture to fix broken tests by @​james03160927 in #​1548
• chore: add RenderTemplateAndGetStdOutErrE & RunHelmCommandAndGetStdOutErrE by @​james03160927 in #​1526
• chore: Update parseListOfMaps to handle non-map data structures by @​james03160927 in #​1529
• chore: add test for literal block by @​james03160927 in #​1535
• chore: Update CODEOWNERS by @​james03160927 in #​1554
• chore: Adding Terragrunt team to CODEOWNERS by @​yhakbar in #​1513
• chore(deps): Bump nokogiri from 1.16.5 to 1.18.3 in /docs by @​dependabot in #​1516
• chore(deps): Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 by @​dependabot in #​1527
• chore(deps): Bump golang.org/x/crypto from 0.32.0 to 0.35.0 by @​dependabot in #​1541
• chore(deps): Bump golang.org/x/net from 0.34.0 to 0.38.0 by @​dependabot in #​1542
• chore(deps): Bump nokogiri from 1.18.3 to 1.18.8 in /docs by @​dependabot in #​1545

New Contributors

• @​felixfriedrich made their first contribution in #​1519
• @​jijiechen made their first contribution in #​1532

Full Changelog: gruntwork-io/terratest@v0.48.2...v0.49.0

golang/go (go)

v1.25.0

v1.24.6

v1.24.5

v1.24.4

v1.24.3

v1.24.2

pre-commit/pre-commit-hooks (pre-commit/pre-commit-hooks)

v6.0.0: pre-commit-hooks v6.0.0

Compare Source

Fixes

• check-shebang-scripts-are-executable: improve error message.
  • #​1115 PR by @​homebysix.

Migrating

• now requires python >= 3.9.
  • #​1098 PR by @​asottile.
• file-contents-sorter: disallow --unique and --ignore-case at the same
  time.
  • #​1095 PR by @​nemacysts.
  • #​794 issue by @​teksturi.
• Removed check-byte-order-marker and fix-encoding-pragma.
  • check-byte-order-marker: migrate to fix-byte-order-marker.
  • fix-encoding-pragma: migrate to pyupgrade.
  • #​1034 PR by @​mxr.
  • #​1032 issue by @​mxr.
  • #​522 PR by @​jgowdy.

renovatebot/pre-commit-hooks (renovatebot/pre-commit-hooks)

v41.81.2

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.81.2 for more changes

v41.81.1

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.81.1 for more changes

v41.81.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.81.0 for more changes

v41.80.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.80.0 for more changes

v41.79.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.79.0 for more changes

v41.78.1

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.78.1 for more changes

v41.77.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.77.0 for more changes

v41.76.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.76.0 for more changes

v41.75.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.75.0 for more changes

v41.74.3

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.74.3 for more changes

v41.74.2

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.74.2 for more changes

v41.74.1

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.74.1 for more changes

v41.74.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.74.0 for more changes

v41.73.4

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.73.4 for more changes

v41.73.3

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.73.3 for more changes

v41.73.2

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.73.2 for more changes

v41.73.1

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.73.1 for more changes

v41.72.1

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.72.1 for more changes

v41.72.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.72.0 for more changes

v41.71.1

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.71.1 for more changes

v41.71.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.71.0 for more changes

v41.70.3

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.70.3 for more changes

v41.70.2

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.70.2 for more changes

v41.70.1

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.70.1 for more changes

v41.70.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.70.0 for more changes

v41.69.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.69.0 for more changes

v41.67.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.67.0 for more changes

v41.66.3

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.66.3 for more changes

v41.66.2

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.66.2 for more changes

v41.66.1

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.66.1 for more changes

v41.66.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.66.0 for more changes

v41.65.1

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.65.1 for more changes

v41.65.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.65.0 for more changes

v41.64.4

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.64.4 for more changes

v41.64.3

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.64.3 for more changes

v41.64.2

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.64.2 for more changes

v41.63.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.63.0 for more changes

v41.62.4

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.62.4 for more changes

v41.62.3

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.62.3 for more changes

v41.62.2

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.62.2 for more changes

v41.62.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.62.0 for more changes

v41.61.1

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.61.1 for more changes

v41.61.0

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.61.0 for more changes

v41.60.4

Compare Source

See https://github.com/renovatebot/renovate/releases/tag/41.60.4 for more changes

v41.60.3

[Compare Sou

---

Configuration

📅 Schedule: Branch creation - "after 12am and before 12pm on Monday and Friday" in timezone America/New_York, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.