fix(deps): update uds package kit support dependencies (#52)

* fix(deps): update uds package kit support dependencies

| datasource  | package                                                     | from     | to       |
| ----------- | ----------------------------------------------------------- | -------- | -------- |
| github-tags | actions/checkout                                            | v4.2.2   | v5.0.0   |
| github-tags | actions/setup-go                                            | v5.5.0   | v6.0.0   |
| github-tags | anchore/sbom-action                                         | v0.20.2  | v0.20.6  |
| docker      | curlimages/curl                                             | 8.14.1   | 8.16.0   |
| github-tags | defenseunicorns/uds-cli                                     | v0.27.8  | v0.27.13 |
| github-tags | defenseunicorns/uds-common                                  | v1.16.3  | v1.20.3  |
| go          | github.com/defenseunicorns/uds-cli                          | v0.27.8  | v0.27.13 |
| go          | github.com/google/go-github/v69                             | v69.2.0  | v74.0.0  |
| go          | github.com/mikefarah/yq/v4                                  | v4.45.4  | v4.47.2  |
| go          | github.com/olekukonko/tablewriter                           | v0.0.5   | v1.0.9   |
| go          | github.com/spf13/cobra                                      | v1.9.1   | v1.10.1  |
| go          | github.com/stretchr/testify                                 | v1.10.0  | v1.11.1  |
| go          | github.com/zarf-dev/zarf                                    | v0.57.0  | v0.61.2  |
| github-tags | github/codeql-action                                        | v3.29.2  | v3.30.3  |
| go          | gitlab.com/gitlab-org/api/client-go                         | v0.134.0 | v0.146.0 |
| github-tags | goreleaser/goreleaser-action                                | v6.3.0   | v6.4.0   |
| helm        | mattermost-enterprise-edition                               | 2.6.77   | 2.6.81   |
| docker      | mattermost/mattermost-enterprise-edition                    | 10.10.0  | 10.12.0  |
| docker      | registry1.dso.mil/ironbank/opensource/mattermost/mattermost | 10.9.1   | 10.12.0  |

* fix(deps): post-renovate fixes + attempt to fix go mod tidy in renovate

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Michał Szynkiewicz <michal.l.szynkiewicz@gmail.com>

Author: renovate[bot]

.github/actions/golang/action.yaml

@@ -7,6 +7,6 @@ description: "Setup Go binary and caching"
 runs:
   using: composite
   steps:
-    - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+    - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
       with:
         go-version-file: 'go.mod'

.github/actions/install-uds-cli/action.yaml

@@ -9,7 +9,7 @@ inputs:
   udsCliVersion:
     description: The uds-cli version to install
     # renovate: datasource=github-tags depName=defenseunicorns/uds-cli versioning=semver
-    default: 0.27.8
+    default: 0.27.13
 
 runs:
   using: composite

.github/workflows/go-checks.yaml

@@ -29,7 +29,7 @@ jobs:
     name: lint
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Setup golang
         uses: ./.github/actions/golang
       - name: golangci-lint
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Run govulncheck
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Setup golang
         uses: ./.github/actions/golang
       - id: govulncheck

.github/workflows/lint.yaml

@@ -21,15 +21,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
 
       - name: Install UDS CLI
         uses: defenseunicorns/setup-uds@ab842abcad1f7a3305c2538e3dd1950d0daacfa5 # v1.0.1
         with:
           # renovate: datasource=github-tags depName=defenseunicorns/uds-cli versioning=semver
-          version: v0.27.8
+          version: v0.27.13
 
       - name: Install lint deps
         run: |

.github/workflows/release.yaml

@@ -18,18 +18,18 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
 
       - name: Setup golang
         uses: ./.github/actions/golang
 
       - name: Install syft
-        uses: anchore/sbom-action/download-syft@cee1b8e05ae5b2593a75e197229729eabaa9f8ec # v0.20.2
+        uses: anchore/sbom-action/download-syft@f8bdd1d8ac5e901a77a92f111440fdb1b593736b # v0.20.6
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         with:
           distribution: goreleaser
           version: latest

.github/workflows/scan-codeql.yaml

@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup golang
         uses: ./.github/actions/golang
@@ -51,7 +51,7 @@ jobs:
         run: uds run build-cli-linux-amd
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+        uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
         env:
           CODEQL_EXTRACTOR_GO_BUILD_TRACING: on
         with:
@@ -60,6 +60,6 @@ jobs:
 
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+        uses: github/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/test.yaml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
 

README.md

@@ -173,26 +173,26 @@ Existing vulnerabilities: <count>
 <details>
 <summary>New vulnerabilities</summary>
 
-| ID | Severity | URL |
-|----|----------|-----|
+|  ID | Severity  |  URL |
+|:----|:----------|:-----|
 | ... | ... | ... |
 
 </details>
 
 <details>
 <summary>Fixed vulnerabilities</summary>
 
-| ID | Severity | URL |
-|----|----------|-----|
+|  ID |  Severity |  URL |
+|:----|:----------|:-----|
 | ... | ... | ... |
 
 </details>
 
 <details>
 <summary>Existing vulnerabilities</summary>
 
-| ID | Severity | URL |
-|----|----------|-----|
+|  ID |  Severity |  URL |
+|:----|:----------|:-----|
 | ... | ... | ... |
 
 </details>

go.mod

@@ -1,24 +1,29 @@
 module github.com/defenseunicorns/uds-pk
 
-go 1.24.2
+go 1.24.6
 
 require (
 	github.com/CycloneDX/cyclonedx-go v0.9.2
-	github.com/defenseunicorns/uds-cli v0.27.8
+	github.com/defenseunicorns/uds-cli v0.27.13
 	github.com/go-git/go-git/v5 v5.16.2
 	github.com/goccy/go-yaml v1.18.0
 	github.com/google/go-github/v69 v69.2.0
-	github.com/mikefarah/yq/v4 v4.45.4
-	github.com/olekukonko/tablewriter v0.0.5
-	github.com/spf13/cobra v1.9.1
-	github.com/stretchr/testify v1.10.0
-	github.com/zarf-dev/zarf v0.57.0
+	github.com/mikefarah/yq/v4 v4.47.2
+	github.com/olekukonko/tablewriter v1.0.9
+	github.com/spf13/cobra v1.10.1
+	github.com/stretchr/testify v1.11.1
+	github.com/zarf-dev/zarf v0.61.2
 	gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473
 )
 
 require (
+	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/mikelolasagasti/xz v1.0.1 // indirect
 	github.com/minio/minlz v1.0.0 // indirect
+	github.com/olekukonko/errors v1.1.0 // indirect
+	github.com/olekukonko/ll v0.0.9 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/exp v0.0.0-20250808145144-a408d31f581a // indirect
 )
 
 require (
@@ -70,17 +75,17 @@ require (
 	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/skeema/knownhosts v1.3.1 // indirect
 	github.com/sorairolake/lzip-go v0.3.5 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
-	github.com/ulikunitz/xz v0.5.12 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/ulikunitz/xz v0.5.14 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/yuin/gopher-lua v1.1.1 // indirect
-	gitlab.com/gitlab-org/api/client-go v0.134.0
+	gitlab.com/gitlab-org/api/client-go v0.146.0
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
-	golang.org/x/crypto v0.39.0 // indirect
-	golang.org/x/net v0.41.0 // indirect
+	golang.org/x/crypto v0.41.0 // indirect
+	golang.org/x/net v0.43.0 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/text v0.26.0 // indirect
+	golang.org/x/sys v0.35.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
 	golang.org/x/time v0.12.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect