Dependency Dashboard

[forking-renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

• fix(deps): update docs (go, google.golang.org/grpc/cmd/protoc-gen-go-grpc)
• fix(deps): update website (google-auth, google-cloud-ndb)
• fix(deps): update dependency gunicorn to v26
• chore(deps): lock file maintenance
• 🔐 Create all awaiting schedule PRs at once 🔐

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

• chore(deps): update osv-lib (hypothesis, requests)
• fix(deps): update dependency cryptography to v48

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• fix(deps): update module github.com/go-git/go-git/v5 to v5.19.0 [security]
• chore(deps): update gcr.io/google.com/cloudsdktool/google-cloud-cli:alpine docker digest to 36d5252
• chore(deps): update submodules (gcp/api/googleapis, github/codeql-action, osv-schema, osv/osv-schema)
• chore(deps): update terraform to ~> 7.31.0 (google, google-beta)
• fix(deps): update gcp-indexer-go (cloud.google.com/go/datastore, go, google.golang.org/api)
• fix(deps): update gcp-services-python (google-api-python-client, google-auth-httplib2, google-cloud-logging, google-cloud-ndb, google-cloud-pubsub, google-cloud-secret-manager, google-cloud-storage, mypy-protobuf, osv, packaging, pygit2, requests, vanir)
• fix(deps): update go-libraries (cloud.google.com/go/datastore, cloud.google.com/go/monitoring, github.com/klauspost/compress, github.com/package-url/packageurl-go, go, google.golang.org/api, google.golang.org/grpc, k8s.io/apimachinery)
• fix(deps): update tools (cloud.google.com/go/datastore, go, google-cloud-ndb, google.golang.org/api)
• fix(deps): update vulnfeeds-go (cloud.google.com/go/secretmanager, go, google.golang.org/api)
• chore(deps): update dependency ruby to v4
• fix(deps): update module cloud.google.com/go/pubsub to v2
• fix(deps): update module gopkg.in/yaml.v2 to v3
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• Click on this checkbox to rebase all open PRs at once

Detected Dependencies

bundler (1)

docs/Gemfile (7)

• ruby ~> 3 → [Updates: ~> 4]
• github-pages lock file @ 232
• jekyll-feed "~> 0.12"
• tzinfo ">= 1", "< 3"
• wdm "~> 0.2.0"
• http_parser.rb "~> 0.8.0"
• webrick "~> 1.7"

cloudbuild (10)

bindings/cloudbuild.yaml

cloudbuild.yaml

docker/terraform/cloudbuild.yaml

gcp/api/cloudbuild.yaml

gcp/website/cloudbuild.yaml

gcp/workers/cloudbuild.yaml

go/cloudbuild.yaml

osv/cloudbuild.yaml

vulnfeeds/cloudbuild.yaml

vulnfeeds/pypi/cloudbuild.yaml

dockerfile (37)

actions/analyze/Dockerfile

docker/ci/Dockerfile

docker/deployment/Dockerfile (1)

• ubuntu 26.04@sha256:f3d28607ddd78734bb7f71f117f3c6706c666b8b76cbff7c9ff6e5718d46ff64

docker/terraform/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:30b3a542786ee597ddc866aaf1d5201e794be1a4c328507a0531b97ad469ea64 → [Updates: alpine]

docker/worker-base/Dockerfile (1)

• ubuntu 26.04@sha256:f3d28607ddd78734bb7f71f117f3c6706c666b8b76cbff7c9ff6e5718d46ff64

docs/docs.Dockerfile (1)

• ruby 3 → [Updates: 4]

gcp/api/Dockerfile

gcp/api/Dockerfile.esp (1)

• gcr.io/endpoints-release/endpoints-runtime 2

gcp/indexer/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• gcr.io/distroless/base-debian12 sha256:9dce90e688a57e59ce473ff7bc4c80bc8fe52d2303b4d99b44f297310bbd2210

gcp/website/Dockerfile (1)

• node 24.14@sha256:80fc934952c8f1b2b4d39907af7211f8a9fff1a4c2cf673fb49099292c251cec → [Updates: 24.15]

gcp/workers/cron/Dockerfile

gcp/workers/importer/Dockerfile

gcp/workers/linter/Dockerfile (1)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]

gcp/workers/oss_fuzz_importer/Dockerfile

gcp/workers/oss_fuzz_worker/Dockerfile

gcp/workers/recoverer/Dockerfile

gcp/workers/staging_api_test/Dockerfile

gcp/workers/vanir_signatures/Dockerfile

gcp/workers/worker/Dockerfile

go/cmd/custommetrics/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• gcr.io/distroless/static-debian12 sha256:20bc6c0bc4d625a22a8fde3e55f6515709b32055ef8fb9cfbddaa06d1760f838

go/cmd/exporter/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• gcr.io/distroless/static-debian12 sha256:20bc6c0bc4d625a22a8fde3e55f6515709b32055ef8fb9cfbddaa06d1760f838

go/cmd/first_package_finder/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• alpine 3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11

go/cmd/generatesitemap/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• gcr.io/distroless/static-debian12 sha256:20bc6c0bc4d625a22a8fde3e55f6515709b32055ef8fb9cfbddaa06d1760f838

go/cmd/gitter/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• alpine 3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11

go/cmd/importer/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• alpine 3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11

go/cmd/recordchecker/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• gcr.io/distroless/static-debian12 sha256:20bc6c0bc4d625a22a8fde3e55f6515709b32055ef8fb9cfbddaa06d1760f838

go/cmd/relations/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• gcr.io/distroless/static-debian12 sha256:20bc6c0bc4d625a22a8fde3e55f6515709b32055ef8fb9cfbddaa06d1760f838

go/cmd/worker/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• gcr.io/distroless/static-debian12 sha256:20bc6c0bc4d625a22a8fde3e55f6515709b32055ef8fb9cfbddaa06d1760f838

vulnfeeds/cmd/combine-to-osv/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:30b3a542786ee597ddc866aaf1d5201e794be1a4c328507a0531b97ad469ea64 → [Updates: alpine]

vulnfeeds/cmd/converters/alpine/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:30b3a542786ee597ddc866aaf1d5201e794be1a4c328507a0531b97ad469ea64 → [Updates: alpine]

vulnfeeds/cmd/converters/cve/cve5/bulk-converter/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:30b3a542786ee597ddc866aaf1d5201e794be1a4c328507a0531b97ad469ea64 → [Updates: alpine]

vulnfeeds/cmd/converters/cve/nvd-cve-osv/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:30b3a542786ee597ddc866aaf1d5201e794be1a4c328507a0531b97ad469ea64 → [Updates: alpine]

vulnfeeds/cmd/converters/debian/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:30b3a542786ee597ddc866aaf1d5201e794be1a4c328507a0531b97ad469ea64 → [Updates: alpine]

vulnfeeds/cmd/converters/dsa-dla-dtsa/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• alpine 3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11

vulnfeeds/cmd/mirrors/cpe-repo-gen/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:30b3a542786ee597ddc866aaf1d5201e794be1a4c328507a0531b97ad469ea64 → [Updates: alpine]

vulnfeeds/cmd/mirrors/debian-copyright-mirror/Dockerfile (1)

• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:30b3a542786ee597ddc866aaf1d5201e794be1a4c328507a0531b97ad469ea64 → [Updates: alpine]

vulnfeeds/cmd/mirrors/download-cves/Dockerfile (2)

• golang 1.26.2-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 → [Updates: 1.26.3-alpine]
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:30b3a542786ee597ddc866aaf1d5201e794be1a4c328507a0531b97ad469ea64 → [Updates: alpine]

git-submodules (1)

.gitmodules (2)

• gcp/api/googleapis 08fe47aa6f694301a07f2099229ba7123dba5946 → [Updates: undefined]
• osv/osv-schema 83285ce2a8661d6b30cd45b909e53ad4833802ce → [Updates: undefined]

github-actions (12)

.github/workflows/codeql-analysis.yml (4)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• github/codeql-action v4.35.2@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 → [Updates: v4.35.3]
• github/codeql-action v4.35.2@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 → [Updates: v4.35.3]
• github/codeql-action v4.35.2@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 → [Updates: v4.35.3]

.github/workflows/generate-protos.yml (4)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-python v6.2.0@a309ff8b426b58ec0e2a45f0f869d46889d02405
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c
• peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1

.github/workflows/issue-signposting.yml

.github/workflows/links.yml (2)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• tcort/github-action-markdown-link-check v1.1.2@e7c7a18363c842693fadde5d41a3bd3573a7a225

.github/workflows/lint.yaml (5)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-python v6.2.0@a309ff8b426b58ec0e2a45f0f869d46889d02405
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c
• hashicorp/setup-terraform v4.0.0@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 → [Updates: v4.0.1]

.github/workflows/osv-scanner-unified.yml (2)

• google/osv-scanner-action nightly
• google/osv-scanner-action nightly

.github/workflows/renovate-validator.yml (2)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e

.github/workflows/scorecards.yml (4)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• ossf/scorecard-action v2.4.3@4eaacf0543bb3f2c246792bd56e8cdeffafb205a
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• github/codeql-action v4.35.2@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 → [Updates: v4.35.3]

.github/workflows/snapshots.yml (3)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c
• peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1

.github/workflows/staleness.yml (1)

• actions/stale v10.2.0@b5d41d4e1d5dceea10e7104786b73624c18a190f

.github/workflows/title.yml (1)

• amannn/action-semantic-pull-request v6.1.1@48f256284bd46cdaab1048c3721360e808335d50

.github/workflows/zizmor.yml (2)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• zizmorcore/zizmor-action v0.5.3@b1d7e1fb5de872772f31590499237e7cce841e8e

gomod (8)

bindings/go/go.mod (7)

• go 1.26.2 → [Updates: 1.26.3]
• github.com/google/go-cmp v0.7.0
• github.com/ossf/osv-schema/bindings/go v0.0.0-20260331231022-2a6a0b9b0ccd@2a6a0b9b0ccd → [Updates: v0.0.0-20260513062843-447c7315b34e]
• golang.org/x/sync v0.20.0
• google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9@9d38bb4040a9 → [Updates: v0.0.0-20260511170946-3700d4141b60]
• google.golang.org/grpc v1.80.0 → [Updates: v1.81.0]
• google.golang.org/protobuf v1.36.11

docs/go.mod (4)

• go 1.26.2 → [Updates: 1.26.3]
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0
• google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 → [Updates: v1.6.2]
• google.golang.org/protobuf v1.36.11

gcp/indexer/go.mod (10)

• go 1.26.2 → [Updates: 1.26.3]
• cloud.google.com/go/datastore v1.22.0 → [Updates: v1.23.0]
• cloud.google.com/go/pubsub v1.50.2 → [Updates: v2.6.0]
• cloud.google.com/go/storage v1.62.1
• github.com/go-git/go-git/v5 v5.18.0 → [Updates: v5.19.0]
• github.com/golang/glog v1.2.5
• github.com/google/go-cmp v0.7.0
• golang.org/x/sync v0.20.0
• google.golang.org/api v0.276.0 → [Updates: v0.278.0]
• gopkg.in/yaml.v3 v3.0.1

go/go.mod (29)

• go 1.26.2 → [Updates: 1.26.3]
• charm.land/lipgloss/v2 v2.0.3
• cloud.google.com/go/datastore v1.22.0 → [Updates: v1.23.0]
• cloud.google.com/go/monitoring v1.27.0 → [Updates: v1.28.0]
• cloud.google.com/go/pubsub/v2 v2.6.0
• cloud.google.com/go/storage v1.62.1
• github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.32.0
• github.com/dgraph-io/ristretto/v2 v2.4.0
• github.com/dustin/go-humanize v1.0.1
• github.com/go-git/go-git/v6 v6.0.0-alpha.3
• github.com/google/go-cmp v0.7.0
• github.com/google/osv-scalibr v0.4.5
• github.com/hashicorp/go-retryablehttp v0.7.8
• github.com/klauspost/compress v1.18.5 → [Updates: v1.18.6]
• github.com/ossf/osv-schema/bindings/go v0.0.0-20260424063704-83285ce2a866@83285ce2a866 → [Updates: v0.0.0-20260513062843-447c7315b34e]
• github.com/package-url/packageurl-go v0.1.5 → [Updates: v0.1.6]
• github.com/tidwall/gjson v1.18.0 → [Updates: v1.19.0]
• github.com/xeipuuv/gojsonschema v1.2.0
• go.opentelemetry.io/contrib/detectors/gcp v1.43.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0
• go.opentelemetry.io/otel v1.43.0
• go.opentelemetry.io/otel/sdk v1.43.0
• go.opentelemetry.io/otel/trace v1.43.0
• golang.org/x/sync v0.20.0
• google.golang.org/api v0.276.0 → [Updates: v0.278.0]
• google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9@9d38bb4040a9 → [Updates: v0.0.0-20260511170946-3700d4141b60]
• google.golang.org/protobuf v1.36.11
• gopkg.in/dnaeon/go-vcr.v4 v4.0.6
• k8s.io/apimachinery v0.35.4 → [Updates: v0.36.0]

tools/apitester/go.mod (7)

• go 1.26.2 → [Updates: 1.26.3]
• github.com/gkampitakis/go-snaps v0.5.21
• github.com/google/go-cmp v0.7.0
• github.com/tidwall/gjson v1.18.0 → [Updates: v1.19.0]
• github.com/tidwall/pretty v1.2.1
• github.com/tidwall/sjson v1.2.5
• gopkg.in/dnaeon/go-vcr.v4 v4.0.6

tools/datastore-remover/go.mod (3)

• go 1.26.2 → [Updates: 1.26.3]
• cloud.google.com/go/datastore v1.22.0 → [Updates: v1.23.0]
• google.golang.org/api v0.276.0 → [Updates: v0.278.0]

tools/indexer-api-caller/go.mod (1)

• go 1.26.2 → [Updates: 1.26.3]

vulnfeeds/go.mod (27)

• go 1.26.2 → [Updates: 1.26.3]
• charm.land/lipgloss/v2 v2.0.3
• cloud.google.com/go/secretmanager v1.19.0 → [Updates: v1.20.0]
• cloud.google.com/go/storage v1.62.1
• github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.32.0
• github.com/JohannesKaufmann/html-to-markdown/v2 v2.5.0 → [Updates: v2.5.1]
• github.com/aquasecurity/go-pep440-version v0.0.1
• github.com/atombender/go-jsonschema v0.23.0
• github.com/fsouza/fake-gcs-server v1.54.0
• github.com/gkampitakis/go-snaps v0.5.21
• github.com/go-git/go-git/v5 v5.18.0 → [Updates: v5.19.0]
• github.com/goccy/go-yaml v1.19.2
• github.com/google/go-cmp v0.7.0
• github.com/knqyf263/go-cpe v0.0.0-20230627041855-cb0794d06872@cb0794d06872
• github.com/ossf/osv-schema/bindings/go v0.0.0-20260513062843-447c7315b34e@447c7315b34e
• github.com/redis/go-redis/v9 v9.19.0
• github.com/sethvargo/go-retry v0.3.0
• go.opentelemetry.io/contrib/detectors/gcp v1.43.0
• go.opentelemetry.io/otel v1.43.0
• go.opentelemetry.io/otel/sdk v1.43.0
• go.opentelemetry.io/otel/trace v1.43.0
• golang.org/x/sync v0.20.0
• golang.org/x/text v0.36.0 → [Updates: v0.37.0]
• google.golang.org/api v0.276.0 → [Updates: v0.278.0]
• google.golang.org/protobuf v1.36.11
• gopkg.in/dnaeon/go-vcr.v4 v4.0.6
• gopkg.in/yaml.v2 v2.4.0 → [Updates: v3.0.1]

npm (2)

gcp/website/frontend3/package.json (20)

• @github/clipboard-copy-element 1.3.0
• @hotwired/turbo 8.0.23
• @material/data-table 14.0.0
• @material/layout-grid 14.0.0
• @material/theme 14.0.0
• @material/web ^2.0.0
• lit 3.3.2 → [Updates: 3.3.3]
• copy-webpack-plugin ^14.0.0
• css-loader ^7.1.3
• html-webpack-plugin ^5.6.6
• mini-css-extract-plugin ^2.10.0
• raw-loader ^4.0.2
• sass ^1.97.3
• sass-loader ^16.0.0 → [Updates: ^16.0.0]
• style-loader ^4.0.0
• webpack ^5.105.4
• webpack-bundle-analyzer ^5.0.0
• webpack-cli ^7.0.0
• webpack-dev-server ^5.2.3 → [Updates: ^5.2.3]
• pnpm 11.0.8 → [Updates: 11.1.1]

gcp/website/frontend3/pnpm-workspace.yaml

poetry (7)

gcp/api/pyproject.toml (8)

• poetry-core >=2.0.0
• mypy-protobuf ^5.0.0 → [Updates: ^5.0.0]
• yapf *
• pylint *
• google-cloud-ndb ==2.4.0 → [Updates: ==2.5.0]
• google-cloud-logging ==3.13.0 → [Updates: ==3.15.0]
• packaging ==26.0 → [Updates: ==26.2]
• requests ==2.33.0 → [Updates: ==2.33.1]

gcp/functions/pypi/pyproject.toml (5)

• poetry-core >=2.0.0
• cryptography ==46.0.7 → [Updates: ==48.0.0]
• google-cloud-secret-manager ==2.26.0 → [Updates: ==2.28.0]
• osv ==0.1.2 → [Updates: ==0.1.3]
• requests ==2.33.0 → [Updates: ==2.33.1]

gcp/website/pyproject.toml (20)

• poetry-core >=2.0.0
• yapf *
• pylint *
• Flask ==3.1.3
• Flask-Caching ==2.4.0
• Flask-Compress ==1.24
• werkzeug ==3.1.8
• google-auth ==2.50.0 → [Updates: ==2.51.0]
• google-cloud-ndb ==2.4.2 → [Updates: ==2.5.0]
• google-cloud-logging ==3.15.0
• google-cloud-storage ==3.10.1
• jinja2 ==3.1.6
• markdown2 ==2.5.5
• markupsafe ==3.0.3
• packageurl-python ==0.17.6
• redis ==6.4.0
• requests ==2.33.1 → [Updates: ==2.34.1]
• gunicorn ==25.3.0 → [Updates: ==26.0.0]
• whitenoise ==6.12.0
• cvss ==3.6

gcp/workers/oss_fuzz_worker/pyproject.toml (15)

• poetry-core >=2.0.0
• yapf *
• pylint *
• google-auth-httplib2 ==0.3.0 → [Updates: ==0.4.0]
• google-api-python-client ==2.192.0 → [Updates: ==2.196.0]
• google-cloud-pubsub ==2.35.0 → [Updates: ==2.38.0]
• google-cloud-ndb ==2.4.0 → [Updates: ==2.5.0]
• google-cloud-storage ==3.9.0 → [Updates: ==3.10.1]
• pyyaml ==6.0.3
• redis ==6.4.0
• packageurl-python ==0.17.6
• pygit2 ==1.19.1 → [Updates: ==1.19.2]
• requests ==2.33.0 → [Updates: ==2.33.1]
• jsonschema ==4.26.0
• vanir ==1.0.2 → [Updates: ==1.1.0]

gcp/workers/worker/pyproject.toml (15)

• poetry-core >=2.0.0
• yapf *
• pylint *
• google-auth-httplib2 ==0.3.0 → [Updates: ==0.4.0]
• google-api-python-client ==2.192.0 → [Updates: ==2.196.0]
• google-cloud-pubsub ==2.35.0 → [Updates: ==2.38.0]
• google-cloud-ndb ==2.4.0 → [Updates: ==2.5.0]
• google-cloud-storage ==3.9.0 → [Updates: ==3.10.1]
• pyyaml ==6.0.3
• redis ==6.4.0
• packageurl-python ==0.17.6
• pygit2 ==1.19.1 → [Updates: ==1.19.2]
• requests ==2.33.1 → [Updates: ==2.34.1]
• jsonschema ==4.26.0
• vanir ==1.1.0

pyproject.toml (20)

• poetry-core >=2.0.0
• yapf *
• pylint *
• grpcio-tools *
• mypy-protobuf ^5.0.0
• vcrpy *
• hypothesis * → [Updates: *]
• google-cloud-ndb >=2.3
• google-cloud-logging >=3.10
• google-cloud-pubsub >=2.31.1
• google-cloud-storage >=2.17
• semver >=3.0
• packageurl-python >=0.17.0
• pyyaml >=6.0
• pygit2 >=1.14.0
• attrs >=23.2
• jsonschema >=4.0
• grpcio >=1.0
• packaging-legacy >=23.0.post0
• requests >=2.33 → [Updates: >=2.33]

tools/datafix/pyproject.toml (7)

• poetry-core >=2.0.0
• yapf *
• pylint *
• google-cloud-ndb ==2.4.2 → [Updates: ==2.5.0]
• google-cloud-storage ==3.10.1
• pyyaml ==6.0.3
• google-cloud-pubsub >=2.25.2

regex (4)

deployment/terraform/environments/oss-vdb-test/main.tf (1)

• gcr.io/endpoints-release/endpoints-runtime-serverless 2.55.1 → [Updates: 2.55.2]

deployment/terraform/environments/oss-vdb/main.tf (1)

• gcr.io/endpoints-release/endpoints-runtime-serverless 2.55.1 → [Updates: 2.55.2]

gcp/workers/linter/Dockerfile (1)

• osv-schema main@83285ce2a8661d6b30cd45b909e53ad4833802ce → [Updates: main]

osv/models.py (1)

• ossf/osv-schema 1.7.5

terraform (3)

deployment/terraform/environments/oss-vdb-test/main.tf (4)

• external ~> 2.3.3 → [Updates: ~> 2.4.0]
• google ~> 7.28.0 → [Updates: ~> 7.31.0]
• google-beta ~> 7.28.0 → [Updates: ~> 7.31.0]
• null ~> 3.2.2 → [Updates: ~> 3.3.0]

deployment/terraform/environments/oss-vdb/main.tf (4)

• external ~> 2.3.3 → [Updates: ~> 2.4.0]
• google ~> 7.28.0 → [Updates: ~> 7.31.0]
• google-beta ~> 7.28.0 → [Updates: ~> 7.31.0]
• null ~> 3.2.2 → [Updates: ~> 3.3.0]

deployment/terraform/modules/osv/website.tf (1)

• terraform-google-modules/lb-http/google ~> 14.0

---

• Check this box to trigger a request for Renovate to run again on this repository