Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

• chore(deps): update gcr.io/distroless/static:nonroot docker digest to f7f8f72
• chore(deps): update golang:1.26.5 docker digest to 3aff665
• chore(deps): update github/codeql-action action to v4.37.3
• chore(deps): update actions/checkout action to v6.1.0
• chore(deps): update docker/login-action action to v4.5.0
• fix(deps): update module github.com/onsi/gomega to v1.42.1
• fix(deps): update module sigs.k8s.io/controller-runtime to v0.24.1
• chore(deps): update actions/checkout action to v7
• chore(deps): update actions/setup-go action to v7
• 🔐 Create all rate-limited PRs at once 🔐

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

• chore(deps): update ossf/scorecard-action action to v2.4.4

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): pin ghcr.io/opendefensecloud/dependency-controller docker tag to 31b1423
• chore(deps): update module apigen to v0.32.3
• chore(deps): update module ginkgo to v2.32.0
• chore(deps): update module osv-scanner to v2.4.0
• fix(deps): update kubernetes monorepo to v0.36.3 (k8s.io/api, k8s.io/apiextensions-apiserver, k8s.io/apimachinery, k8s.io/client-go)
• fix(deps): update module github.com/kcp-dev/multicluster-provider to v0.8.0
• fix(deps): update module github.com/kcp-dev/multicluster-provider/client to v0.8.0
• fix(deps): update module github.com/kcp-dev/sdk to v0.32.3
• fix(deps): update module github.com/onsi/ginkgo/v2 to v2.32.0
• fix(deps): update module sigs.k8s.io/multicluster-runtime to v0.24.1
• Click on this checkbox to rebase all open PRs at once

Detected Dependencies

dockerfile (1)

Dockerfile (4)

• golang 1.26.5@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a → [Updates: 1.26.5]
• gcr.io/distroless/static nonroot@sha256:d29e660cc75a5b6b1334e03c5c81ccf9bc0884a002c6000dbf0fb96034814478 → [Updates: nonroot]
• gcr.io/distroless/static nonroot@sha256:d29e660cc75a5b6b1334e03c5c81ccf9bc0884a002c6000dbf0fb96034814478 → [Updates: nonroot]
• gcr.io/distroless/static nonroot@sha256:d29e660cc75a5b6b1334e03c5c81ccf9bc0884a002c6000dbf0fb96034814478 → [Updates: nonroot]

github-actions (7)

.github/workflows/docker.yaml (10)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v6.1.0, v7.0.1]
• docker/metadata-action v6.2.0@dc802804100637a589fabce1cb79ff13a1411302
• docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8
• docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c
• docker/login-action v4.4.0@af1e73f918a031802d376d3c8bbc3fe56130a9b0 → [Updates: v4.5.0]
• docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
• sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6
• anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610
• actions/attest-sbom v4.1.0@c604332985a26aa8cf1bdc465b92731239ec6b9e
• actions/attest-build-provenance v4.1.1@0f67c3f4856b2e3261c31976d6725780e5e4c373

.github/workflows/fuzz.yaml (3)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v6.1.0, v7.0.1]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

.github/workflows/golang.yaml (5)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v6.1.0, v7.0.1]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• golangci/golangci-lint-action v9.3.0@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a
• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v6.1.0, v7.0.1]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]

.github/workflows/helm-lint.yaml (1)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v6.1.0, v7.0.1]

.github/workflows/helm-publish.yaml (4)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v6.1.0, v7.0.1]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6
• docker/login-action v4.4.0@af1e73f918a031802d376d3c8bbc3fe56130a9b0 → [Updates: v4.5.0]

.github/workflows/ossf-scorecard.yml (4)

• actions/checkout v6.0.3@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v6.1.0, v7.0.1]
• ossf/scorecard-action v2.4.3@4eaacf0543bb3f2c246792bd56e8cdeffafb205a → [Updates: v2.4.4]
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• github/codeql-action v4.37.0@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 → [Updates: v4.37.3]

.github/workflows/osv-scanner.yml (2)

• google/osv-scanner-action v2.3.8@9a498708959aeaef5ef730655706c5a1df1edbc2
• google/osv-scanner-action v2.3.8@9a498708959aeaef5ef730655706c5a1df1edbc2

gomod (1)

go.mod (15)

• go 1.26.5
• github.com/kcp-dev/logicalcluster/v3 v3.0.5
• github.com/kcp-dev/multicluster-provider v0.7.1 → [Updates: v0.8.0]
• github.com/kcp-dev/multicluster-provider/client v0.7.1 → [Updates: v0.8.0]
• github.com/kcp-dev/sdk v0.31.2 → [Updates: v0.32.3]
• github.com/onsi/ginkgo/v2 v2.30.0 → [Updates: v2.32.0]
• github.com/onsi/gomega v1.41.0 → [Updates: v1.42.1]
• github.com/stretchr/testify v1.11.1
• k8s.io/api v0.35.4 → [Updates: v0.36.3]
• k8s.io/apiextensions-apiserver v0.35.1 → [Updates: v0.36.3]
• k8s.io/apimachinery v0.35.4 → [Updates: v0.36.3]
• k8s.io/client-go v0.35.4 → [Updates: v0.36.3]
• sigs.k8s.io/controller-runtime v0.23.3 → [Updates: v0.24.1]
• sigs.k8s.io/multicluster-runtime v0.23.3 → [Updates: v0.24.1]
• sigs.k8s.io/yaml v1.6.0

helm-values (1)

charts/dependency-controller/values.yaml (1)

• ghcr.io/opendefensecloud/dependency-controller unknown version → [Updates: ``]

nix (1)

flake.nix (4)

• dev-kit lock file @ c53d2a15cd1b83f238c91f174bce003dfb12a71a
• flake-utils lock file @ 11707dc2f618dd54ca8739b309ec4fc024de578b
• go-overlay lock file @ 1a7dd3c1e396d5d969da6f7a39bc6affd0847f1c
• nixpkgs nixos-unstable

regex (3)

flake.nix (1)

• go 1.26.5

Makefile (1)

• opendefensecloud/dev-kit v1.0.11

tools.lock (6)

• addlicense v1.2.0
• apigen v0.31.2 → [Updates: v0.32.3]
• controller-gen v0.21.0
• ginkgo v2.30.0 → [Updates: v2.32.0]
• golangci-lint v2.12.2
• osv-scanner v2.3.8 → [Updates: v2.4.0]

---

• Check this box to trigger a request for Renovate to run again on this repository