Dependency Dashboard

[forking-renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Config Migration Needed

• Select this checkbox to let Renovate create an automated Config Migration PR.

Awaiting Schedule

These updates are awaiting their schedule. Click on a checkbox to get an update now.

• chore(deps): update golang:1.23.3-alpine docker digest to c694a4d
• chore(deps): update node.js to a7a3b7e
• chore(deps): update workflows
• fix(deps): update docs to v1.35.2 (google.golang.org/protobuf, undefined)
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance api (undefined, yapf)
• chore(deps): lock file maintenance appengine-backend (undefined, yapf)
• chore(deps): lock file maintenance functions (undefined, google-cloud-secret-manager)
• chore(deps): lock file maintenance osv-lib (undefined, yapf)
• chore(deps): lock file maintenance tools (undefined, yapf, aiohttp)
• chore(deps): lock file maintenance vulnfeeds (undefined, yapf, golang)
• chore(deps): lock file maintenance workers (undefined, google-api-python-client, yapf)

Detected dependencies

bundler

docs/Gemfile

• github-pages undefined
• jekyll-feed "~> 0.12"
• tzinfo ">= 1", "< 3"
• wdm "~> 0.2.0"
• http_parser.rb "~> 0.6.0"
• webrick "~> 1.7"

cloudbuild

cloudbuild.yaml

docker/terraform/cloudbuild.yaml

vulnfeeds/cloudbuild.yaml

vulnfeeds/pypi/cloudbuild.yaml

dockerfile

actions/analyze/Dockerfile

docker/alias/Dockerfile

docker/ci/Dockerfile

docker/cron/Dockerfile

docker/deployment/Dockerfile

• ubuntu 22.04@sha256:0e5e4a57c2499249aafc3b40fcd541e9a456aab7296681a3994d631587203f97

docker/exporter/Dockerfile

docker/importer/Dockerfile

docker/indexer/Dockerfile

• golang 1.23.3-alpine@sha256:25db3a0508ff009054bf467f25e1ab395fced0f93b69459dd736ae523e61c781
• gcr.io/distroless/base-debian12 sha256:7a4bffcb07307d97aa731b50cb6ab22a68a8314426f4e4428335939b5b1943a5

docker/staging_api_test/Dockerfile

docker/terraform/Dockerfile

• golang 1.23.3-alpine@sha256:25db3a0508ff009054bf467f25e1ab395fced0f93b69459dd736ae523e61c781
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:5fb06d62786edacb958f6d5a8a993eac3b747d84a7ca3c6433ae1f9a6df098e1

docker/worker-base/Dockerfile

• ubuntu 20.04@sha256:8e5c4f0285ecbb4ead070431d29b576a530d3166df73ec44affc1cd27555141b

docker/worker/Dockerfile

gcp/api/Dockerfile

gcp/api/Dockerfile.esp

• gcr.io/endpoints-release/endpoints-runtime 2

gcp/appengine/Dockerfile

• node 20.18@sha256:7eaecf12ba40043be19af57e2c7fba35d61f9b906128e3e4d11eda81b1ecb857

vulnfeeds/cmd/alpine/Dockerfile

• golang 1.23.3-alpine@sha256:25db3a0508ff009054bf467f25e1ab395fced0f93b69459dd736ae523e61c781
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/combine-to-osv/Dockerfile

• golang 1.23.3-alpine@sha256:25db3a0508ff009054bf467f25e1ab395fced0f93b69459dd736ae523e61c781
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/cpe-repo-gen/Dockerfile

• golang 1.23.3-alpine@sha256:25db3a0508ff009054bf467f25e1ab395fced0f93b69459dd736ae523e61c781
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/debian-copyright-mirror/Dockerfile

• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/debian/Dockerfile

• golang 1.23.3-alpine@sha256:25db3a0508ff009054bf467f25e1ab395fced0f93b69459dd736ae523e61c781
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/download-cves/Dockerfile

• golang 1.23.3-alpine@sha256:25db3a0508ff009054bf467f25e1ab395fced0f93b69459dd736ae523e61c781
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/nvd-cve-osv/Dockerfile

• golang 1.23.3-alpine@sha256:25db3a0508ff009054bf467f25e1ab395fced0f93b69459dd736ae523e61c781
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/tools/debian/Dockerfile

• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

github-actions

.github/workflows/codeql-analysis.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• github/codeql-action v3.27.3@396bb3e45325a47dd9ef434068033c6d5bb0d11a
• github/codeql-action v3.27.3@396bb3e45325a47dd9ef434068033c6d5bb0d11a
• github/codeql-action v3.27.3@396bb3e45325a47dd9ef434068033c6d5bb0d11a

.github/workflows/issue-signposting.yml

.github/workflows/link-checker-on-push.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• gaurav-nelson/github-action-markdown-link-check 7d83e59a57f3c201c76eed3d33dff64ec4452d27

.github/workflows/link-checker.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• gaurav-nelson/github-action-markdown-link-check 7d83e59a57f3c201c76eed3d33dff64ec4452d27

.github/workflows/lint.yaml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-python v5.3.0@0b93645e9fea7318ecaed2b359559ac225c90a2b
• actions/setup-go v5.1.0@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed
• hashicorp/setup-terraform v3.1.2@b9cd54a3c349d3f38e8881555d616ced269862dd

.github/workflows/osv-scanner-unified.yml

.github/workflows/pr-check.yml

• amannn/action-semantic-pull-request v5.5.3@0723387faaf9b38adef4775cd42cfd5155ed6017

.github/workflows/publish-to-pypi.yaml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-python v5.3.0@0b93645e9fea7318ecaed2b359559ac225c90a2b
• pypa/gh-action-pypi-publish v1.12.2@15c56dba361d8335944d31a2ecd17d700fc7bcbc

.github/workflows/scorecards.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• ossf/scorecard-action v2.4.0@62b2cac7ed8198b15735ed49ab1e5cf35480ba46
• actions/upload-artifact v4.4.3@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
• github/codeql-action v2.27.3@cb6549f9103a3855e5c5084c8f44b706e1b0a83f

.github/workflows/staleness.yml

• actions/stale v9.0.0@28ca1036281a5e5922ead5184a1bbf96e5fc984e

gomod

docker/indexer/go.mod

• go 1.23.1
• cloud.google.com/go/datastore v1.20.0
• cloud.google.com/go/pubsub v1.45.1
• cloud.google.com/go/storage v1.46.0
• github.com/go-git/go-git/v5 v5.12.0
• github.com/golang/glog v1.2.3
• github.com/google/go-cmp v0.6.0
• golang.org/x/sync v0.9.0
• google.golang.org/api v0.205.0
• gopkg.in/yaml.v3 v3.0.1

docs/go.mod

• go 1.23.1
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.23.0
• google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
• google.golang.org/protobuf v1.35.1

tools/datastore-remover/go.mod

• go 1.23.1
• cloud.google.com/go/datastore v1.20.0
• google.golang.org/api v0.205.0

tools/indexer-api-caller/go.mod

• go 1.23.1

vulnfeeds/go.mod

• go 1.23.1
• cloud.google.com/go/logging v1.12.0
• cloud.google.com/go/secretmanager v1.14.2
• github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46@22b2f8951d46
• github.com/atombender/go-jsonschema v0.17.0
• github.com/go-git/go-git/v5 v5.12.0
• github.com/google/go-cmp v0.6.0
• github.com/google/osv-scanner v1.9.1
• github.com/knqyf263/go-cpe v0.0.0-20230627041855-cb0794d06872@cb0794d06872
• github.com/sethvargo/go-retry v0.3.0
• golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f@2d47ceb2692f
• gopkg.in/yaml.v2 v2.4.0

npm

gcp/appengine/frontend3/package.json

• @github/clipboard-copy-element 1.3.0
• @hotwired/turbo 7.3.0
• @material/data-table 13.0.0
• @material/layout-grid 13.0.0
• @material/theme 13.0.0
• @material/web ^1.5.0
• lit 2.8.0
• spicy-sections c3aae99dbf1e627cdf03a35c913d7f6e970de22b
• copy-webpack-plugin 10.2.4
• css-loader 6.11.0
• html-webpack-plugin 5.6.3
• mini-css-extract-plugin 2.9.2
• raw-loader 4.0.2
• sass 1.80.7
• sass-loader 12.6.0
• style-loader 3.3.4
• webpack 5.96.1
• webpack-bundle-analyzer 4.10.2
• webpack-cli 4.10.0
• webpack-dev-server 4.15.2

pep621

docker/worker/pyproject.toml

gcp/api/pyproject.toml

gcp/appengine/pyproject.toml

gcp/functions/pypi/pyproject.toml

pyproject.toml

tools/api-performance-test/pyproject.toml

tools/datafix/pyproject.toml

vulnfeeds/tools/debian/debian_converter/pyproject.toml

pip_setup

setup.py

• pygit2 >=1.14.0
• semver >=3.0.0
• packaging <22.0

poetry

docker/worker/pyproject.toml

• python ^3.11
• google-auth-httplib2 ^0.2.0
• google-api-python-client ^2.147
• google-cloud-pubsub ==2.27.1
• google-cloud-ndb ==2.3.2
• google-cloud-storage ==2.18.2
• PyYAML ==6.0.2
• redis ==5.2.0
• pygit2 ==1.16.0
• requests ==2.32.3
• jsonschema ==4.23.0
• yapf *
• pylint *

gcp/api/pyproject.toml

• python ^3.11
• google-cloud-ndb ==2.3.2
• google-cloud-logging ==3.11.3
• packageurl-python ==0.16.0
• packaging ==20.9
• requests ==2.32.3
• mypy-protobuf ^3.6.0
• yapf *
• pylint *

gcp/appengine/pyproject.toml

• python ^3.11
• Flask ==2.3.3
• Flask-Caching ==2.3.0
• Flask-Compress ==1.17
• werkzeug ==3.1.3
• google-cloud-ndb ==2.3.2
• google-cloud-logging ==3.11.3
• jinja2 ==3.1.4
• markdown2 ==2.5.1
• markupsafe ==2.1.5
• redis ==4.6.0
• requests ==2.32.3
• gunicorn ==22.0.0
• whitenoise ==6.8.2
• cvss ==3.3
• yapf *
• pylint *

gcp/functions/pypi/pyproject.toml

• python ^3.11
• cryptography ==43.0.3
• google-cloud-secret-manager ==2.21.0
• osv ==0.0.22
• requests ==2.32.3

pyproject.toml

• python ^3.11
• google-cloud-ndb ^2.3
• google-cloud-logging ^3.10
• google-cloud-storage ^2.17
• semver ^3.0
• pyyaml ^6.0
• pygit2 ^1.14.0
• attrs ^23.2
• jsonschema ^4.0
• grpcio ^1.0
• packaging <22.0
• requests ^2.32
• yapf *
• pylint *
• grpcio-tools *
• mypy-protobuf ^3.6.0

tools/api-performance-test/pyproject.toml

• python ^3.11
• aiohttp ^3.10.5
• yapf *
• pylint *

tools/datafix/pyproject.toml

• python ^3.11
• google-cloud-ndb ==2.3.2
• google-cloud-storage ==2.18.2
• PyYAML ==6.0.2
• google-cloud-pubsub ^2.25.2
• yapf *
• pylint *

vulnfeeds/tools/debian/debian_converter/pyproject.toml

• python ^3.11
• markdownify ==0.13.1
• pandas ==2.2.3
• python-dateutil ==2.9.0.post0
• yapf *
• pylint *

terraform

deployment/terraform/environments/oss-vdb-test/main.tf

• external ~> 2.3.3
• google ~> 5.45.0
• google-beta ~> 5.45.0
• null ~> 3.2.2

deployment/terraform/environments/oss-vdb/main.tf

• external ~> 2.3.3
• google ~> 5.45.0
• google-beta ~> 5.45.0
• null ~> 3.2.2

deployment/terraform/modules/osv/website.tf

• terraform-google-modules/lb-http/google ~> 10.0

---

• Check this box to trigger a request for Renovate to run again on this repository