Dependency Dashboard

[forking-renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Awaiting Schedule

These updates are awaiting their schedule. Click on a checkbox to get an update now.

• chore(deps): update golang:1.23 docker digest to 7ea4c9d
• chore(deps): update dependency autolinker to v4.1.0
• chore(deps): update github-actions (actions/setup-go, actions/upload-artifact, github/codeql-action)
• fix(deps): update dependency org.apache.maven.plugin-tools:maven-plugin-annotations to v3.15.1
• fix(deps): update go (github.com/secure-systems-lab/go-securesystemslib, github.com/sigstore/cosign/v2, github.com/sigstore/fulcio, github.com/sigstore/rekor, github.com/sigstore/sigstore, github.com/slsa-framework/slsa-github-generator, golang.org/x/mod, google.golang.org/protobuf, sigs.k8s.io/release-utils)
• chore(deps): update npm dev (major) (@types/jasmine, @types/node, eslint, eslint-plugin-github, renovate, typescript-eslint)

Edited/Blocked

These updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox.

• chore(deps): update npm dev (@types/node, @vercel/ncc, eslint, eslint-plugin-prettier, jasmine, renovate, typescript, typescript-eslint)

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• chore(deps): update gcr.io/distroless/base:nonroot docker digest to 6d4a4f4
• fix(deps): update golang.org/x/exp digest to b2144cd

Detected dependencies

dockerfile

cli/experimental/service/Dockerfile

• golang 1.23@sha256:574185e5c6b9d09873f455a7c205ea0514bfd99738c5dc7750196403a44ed4b7
• gcr.io/distroless/base nonroot@sha256:e5260be292def77bc70d03003f788f3d32c0796972ea1412d72cc0c843ab139a

github-actions

.github/workflows/codeql-analysis.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-go v5.1.0@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed
• github/codeql-action v3.27.6@aa578102511db1f4524ed59b8cc2bae4f6e88195
• github/codeql-action v3.27.6@aa578102511db1f4524ed59b8cc2bae4f6e88195
• github/codeql-action v3.27.6@aa578102511db1f4524ed59b8cc2bae4f6e88195

.github/workflows/depsreview.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/dependency-review-action v4.5.0@3b139cfc5fae8b618d3eae3675e383bb1769c019

.github/workflows/e2e.schedule.cli.yml

• actions/download-artifact v4.1.8@fa0a91b85d4f404e444e00e005971372dc801d16
• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683

.github/workflows/e2e.schedule.installer.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683

.github/workflows/pr-title.yml

• thehanimo/pr-title-checker v1.4.3@7fbfe05602bdd86f926d3fb3bccb6f3aed43bc70

.github/workflows/pre-submit.actions.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-node v4.1.0@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
• actions/upload-artifact v4.4.3@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882

.github/workflows/pre-submit.cli.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-go v5.1.0@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed
• actions/upload-artifact v4.4.3@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882

.github/workflows/pre-submit.e2e.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-go v5.1.0@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed
• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683

.github/workflows/pre-submit.lfs.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actionsdesk/lfs-warning v3.3@4b98a8a5e6c429c23c34eee02d71553bca216425

.github/workflows/pre-submit.lint.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-go v5.1.0@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed
• golangci/golangci-lint-action v6.1.1@971e284b6050e8a5849b72094c50ab08da042db8
• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-node v4.1.0@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-node v4.1.0@39370e3970a6d050c480ffad4ff0ed4d3fdee5af

.github/workflows/pre-submit.references.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683

.github/workflows/release.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• slsa-framework/slsa-github-generator X.Y.Z
• slsa-framework/slsa-verifier v2.6.0@3714a2a4684014deb874a0e737dffa0ee02dd647
• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683

.github/workflows/scorecards.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• ossf/scorecard-action v2.4.0@62b2cac7ed8198b15735ed49ab1e5cf35480ba46
• actions/upload-artifact v4.4.3@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
• github/codeql-action v3.27.6@aa578102511db1f4524ed59b8cc2bae4f6e88195

.github/workflows/update-actions-dist-post-commit.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/upload-artifact v4.4.3@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/download-artifact v4.1.8@fa0a91b85d4f404e444e00e005971372dc801d16

gomod

go.mod

• go 1.23.1
• github.com/docker/go v1.5.1-1
• github.com/go-openapi/runtime v0.28.0
• github.com/google/go-cmp v0.6.0
• github.com/in-toto/in-toto-golang v0.9.0
• github.com/secure-systems-lab/go-securesystemslib v0.8.0
• github.com/sigstore/rekor v1.3.6
• github.com/sigstore/sigstore v1.8.9
• github.com/google/go-containerregistry v0.20.2
• github.com/gorilla/mux v1.8.1
• github.com/in-toto/attestation v1.1.0
• github.com/sigstore/cosign/v2 v2.2.4
• github.com/sigstore/sigstore-go v0.6.2
• github.com/slsa-framework/slsa-github-generator v1.9.0
• github.com/spf13/cobra v1.8.1
• golang.org/x/mod v0.21.0
• sigs.k8s.io/release-utils v0.8.4
• github.com/sigstore/fulcio v1.4.5
• github.com/sigstore/protobuf-specs v0.3.2
• golang.org/x/exp v0.0.0-20241004190924-225e2abe05e6@225e2abe05e6
• google.golang.org/protobuf v1.34.2

maven

experimental/maven-plugin/pom.xml

• org.apache.maven:maven-core 3.9.9
• org.apache.maven:maven-plugin-api 3.9.9
• org.apache.maven.plugin-tools:maven-plugin-annotations 3.11.0
• org.apache.maven:maven-project 2.2.1
• org.twdata.maven:mojo-executor 2.4.0

npm

actions/installer/package.json

• @actions/core ^1.9.1
• @actions/exec ^1.1.1
• @actions/github ^6.0.0
• @actions/io ^1.1.2
• @actions/tool-cache ^2.0.1
• nodejs ^0.0.0
• @types/jasmine 4.6.4
• @types/node 18.19.33
• @vercel/ncc 0.38.1
• eslint 8.57.0
• eslint-plugin-github 4.10.2
• eslint-plugin-prettier 5.1.3
• jasmine 5.1.0
• typescript 5.4.3
• typescript-eslint 7.5.0

package.json

• markdown-toc 1.2.0
• renovate 37.374.1
• autolinker ^4.0.0

pip_requirements

requirements-lint.txt

• pathspec ==0.12.1
• PyYAML ==6.0.2
• yamllint ==1.35.1

---

• Check this box to trigger a request for Renovate to run again on this repository