Dependency Dashboard

[forking-renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• fix(deps): update dependency jinja2 to v3.1.5 [security]
• chore(deps): update gcr.io/google.com/cloudsdktool/google-cloud-cli:alpine docker digest to 9efc6c3
• chore(deps): update dependency dulwich to v0.22.7
• chore(deps): update dependency urllib3 to v2.3.0
• chore(deps): update workflows
• fix(deps): update docs (github.com/grpc-ecosystem/grpc-gateway/v2, google.golang.org/protobuf, undefined)
• fix(deps): update indexer (cloud.google.com/go/storage, google.golang.org/api)
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance
• chore(deps): lock file maintenance api (undefined, pylint)
• chore(deps): lock file maintenance osv-lib (undefined, pylint)
• chore(deps): lock file maintenance website-backend (undefined, pylint)
• fix(deps): lock file maintenance tools (undefined, pylint, google.golang.org/api)
• fix(deps): lock file maintenance vulnfeeds (undefined, pylint, github.com/google/osv-scanner, golang.org/x/exp)
• fix(deps): lock file maintenance workers (undefined, google-api-python-client, pylint)
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

bundler

docs/Gemfile

• github-pages undefined
• jekyll-feed "~> 0.12"
• tzinfo ">= 1", "< 3"
• wdm "~> 0.2.0"
• http_parser.rb "~> 0.6.0"
• webrick "~> 1.7"

cloudbuild

cloudbuild.yaml

docker/terraform/cloudbuild.yaml

vulnfeeds/cloudbuild.yaml

vulnfeeds/pypi/cloudbuild.yaml

dockerfile

actions/analyze/Dockerfile

docker/ci/Dockerfile

docker/deployment/Dockerfile

• ubuntu 22.04@sha256:0e5e4a57c2499249aafc3b40fcd541e9a456aab7296681a3994d631587203f97

docker/terraform/Dockerfile

• golang 1.23.4-alpine@sha256:6c5c9590f169f77c8046e45c611d3b28fe477789acd8d3762d23d4744de69812
• gcr.io/google.com/cloudsdktool/google-cloud-cli alpine@sha256:72eafef391b644d4fcaf2fb6faee03b42868d11c10ed891db028ed7c5b58d47d

docker/worker-base/Dockerfile

• ubuntu 20.04@sha256:8e5c4f0285ecbb4ead070431d29b576a530d3166df73ec44affc1cd27555141b

gcp/api/Dockerfile

gcp/api/Dockerfile.esp

• gcr.io/endpoints-release/endpoints-runtime 2

gcp/indexer/Dockerfile

• golang 1.23.4-alpine@sha256:6c5c9590f169f77c8046e45c611d3b28fe477789acd8d3762d23d4744de69812
• gcr.io/distroless/base-debian12 sha256:e9d0321de8927f69ce20e39bfc061343cce395996dfc1f0db6540e5145bc63a5

gcp/website/Dockerfile

• node 20.18@sha256:f4755c9039bdeec5c736b2e0dd5b47700d6393b65688b9e9f807ec12f54a8690

gcp/workers/alias/Dockerfile

gcp/workers/cron/Dockerfile

gcp/workers/exporter/Dockerfile

gcp/workers/importer/Dockerfile

gcp/workers/staging_api_test/Dockerfile

gcp/workers/worker/Dockerfile

vulnfeeds/cmd/alpine/Dockerfile

• golang 1.23.4-alpine@sha256:6c5c9590f169f77c8046e45c611d3b28fe477789acd8d3762d23d4744de69812
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/combine-to-osv/Dockerfile

• golang 1.23.4-alpine@sha256:6c5c9590f169f77c8046e45c611d3b28fe477789acd8d3762d23d4744de69812
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/cpe-repo-gen/Dockerfile

• golang 1.23.4-alpine@sha256:6c5c9590f169f77c8046e45c611d3b28fe477789acd8d3762d23d4744de69812
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/debian-copyright-mirror/Dockerfile

• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/debian/Dockerfile

• golang 1.23.4-alpine@sha256:6c5c9590f169f77c8046e45c611d3b28fe477789acd8d3762d23d4744de69812
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/download-cves/Dockerfile

• golang 1.23.4-alpine@sha256:6c5c9590f169f77c8046e45c611d3b28fe477789acd8d3762d23d4744de69812
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/cmd/nvd-cve-osv/Dockerfile

• golang 1.23.4-alpine@sha256:6c5c9590f169f77c8046e45c611d3b28fe477789acd8d3762d23d4744de69812
• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

vulnfeeds/tools/debian/Dockerfile

• gcr.io/google.com/cloudsdktool/google-cloud-cli 485.0.0-alpine@sha256:d5da0344b23d03a6f2728657732c7a60300a91acaad9b8076c6fd30b1dfe1ff4

github-actions

.github/workflows/codeql-analysis.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• github/codeql-action v3.27.9@df409f7d9260372bd5f19e5b04e83cb3c43714ae
• github/codeql-action v3.27.9@df409f7d9260372bd5f19e5b04e83cb3c43714ae
• github/codeql-action v3.27.9@df409f7d9260372bd5f19e5b04e83cb3c43714ae

.github/workflows/issue-signposting.yml

.github/workflows/link-checker-on-push.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• gaurav-nelson/github-action-markdown-link-check 7d83e59a57f3c201c76eed3d33dff64ec4452d27

.github/workflows/link-checker.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• gaurav-nelson/github-action-markdown-link-check 7d83e59a57f3c201c76eed3d33dff64ec4452d27

.github/workflows/lint.yaml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-python v5.3.0@0b93645e9fea7318ecaed2b359559ac225c90a2b
• actions/setup-go v5.2.0@3041bf56c941b39c61721a86cd11f3bb1338122a
• hashicorp/setup-terraform v3.1.2@b9cd54a3c349d3f38e8881555d616ced269862dd

.github/workflows/osv-scanner-unified.yml

.github/workflows/pr-check.yml

• amannn/action-semantic-pull-request v5.5.3@0723387faaf9b38adef4775cd42cfd5155ed6017

.github/workflows/publish-to-pypi.yaml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-python v5.3.0@0b93645e9fea7318ecaed2b359559ac225c90a2b
• pypa/gh-action-pypi-publish v1.12.3@67339c736fd9354cd4f8cb0b744f2b82a74b5c70

.github/workflows/renovate-validator.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• actions/setup-node v4.1.0@39370e3970a6d050c480ffad4ff0ed4d3fdee5af

.github/workflows/scorecards.yml

• actions/checkout v4.2.2@11bd71901bbe5b1630ceea73d27597364c9af683
• ossf/scorecard-action v2.4.0@62b2cac7ed8198b15735ed49ab1e5cf35480ba46
• actions/upload-artifact v4.5.0@6f51ac03b9356f520e9adb1b1b7802705f340c2b
• github/codeql-action v2.27.9@277b89701e930e6af7a758f50afa5185bfc53c81

.github/workflows/staleness.yml

• actions/stale v9.0.0@28ca1036281a5e5922ead5184a1bbf96e5fc984e

gomod

docs/go.mod

• go 1.23.1
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0
• google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
• google.golang.org/protobuf v1.36.0

gcp/indexer/go.mod

• go 1.23.1
• cloud.google.com/go/datastore v1.20.0
• cloud.google.com/go/pubsub v1.45.3
• cloud.google.com/go/storage v1.48.0
• github.com/go-git/go-git/v5 v5.12.0
• github.com/golang/glog v1.2.3
• github.com/google/go-cmp v0.6.0
• golang.org/x/sync v0.10.0
• google.golang.org/api v0.213.0
• gopkg.in/yaml.v3 v3.0.1

tools/datastore-remover/go.mod

• go 1.23.1
• cloud.google.com/go/datastore v1.20.0
• google.golang.org/api v0.213.0

tools/indexer-api-caller/go.mod

• go 1.23.1

vulnfeeds/go.mod

• go 1.23.1
• cloud.google.com/go/logging v1.12.0
• cloud.google.com/go/secretmanager v1.14.2
• github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46@22b2f8951d46
• github.com/atombender/go-jsonschema v0.17.0
• github.com/go-git/go-git/v5 v5.12.0
• github.com/google/go-cmp v0.6.0
• github.com/google/osv-scanner v1.9.1
• github.com/knqyf263/go-cpe v0.0.0-20230627041855-cb0794d06872@cb0794d06872
• github.com/sethvargo/go-retry v0.3.0
• golang.org/x/exp v0.0.0-20241210194714-1829a127f884@1829a127f884
• gopkg.in/yaml.v2 v2.4.0

npm

gcp/website/frontend3/package.json

• @github/clipboard-copy-element 1.3.0
• @hotwired/turbo 7.3.0
• @material/data-table 13.0.0
• @material/layout-grid 13.0.0
• @material/theme 13.0.0
• @material/web ^1.5.0
• lit 2.8.0
• spicy-sections c3aae99dbf1e627cdf03a35c913d7f6e970de22b
• copy-webpack-plugin 10.2.4
• css-loader 6.11.0
• html-webpack-plugin 5.6.3
• mini-css-extract-plugin 2.9.2
• raw-loader 4.0.2
• sass 1.83.0
• sass-loader 12.6.0
• style-loader 3.3.4
• webpack 5.97.1
• webpack-bundle-analyzer 4.10.2
• webpack-cli 4.10.0
• webpack-dev-server 4.15.2

pep621

gcp/api/pyproject.toml

gcp/functions/pypi/pyproject.toml

gcp/website/pyproject.toml

gcp/workers/worker/pyproject.toml

pyproject.toml

tools/datafix/pyproject.toml

vulnfeeds/tools/debian/debian_converter/pyproject.toml

pip_requirements

docker/poetry/requirements.txt

• build ==1.2.2.post1
• cachecontrol ==0.14.1
• certifi ==2024.12.14
• cffi ==1.17.1
• charset-normalizer ==3.4.0
• cleo ==2.1.0
• crashtest ==0.4.1
• cryptography ==44.0.0
• distlib ==0.3.9
• dulwich ==0.21.7
• fastjsonschema ==2.21.1
• filelock ==3.16.1
• idna ==3.10
• importlib-metadata ==8.5.0
• installer ==0.7.0
• jaraco-classes ==3.4.0
• jeepney ==0.8.0
• keyring ==24.3.1
• more-itertools ==10.5.0
• msgpack ==1.1.0
• packaging ==24.2
• pexpect ==4.9.0
• pkginfo ==1.12.0
• platformdirs ==4.3.6
• poetry ==1.8.5
• poetry-core ==1.9.1
• poetry-plugin-export ==1.8.0
• ptyprocess ==0.7.0
• pycparser ==2.22
• pyproject-hooks ==1.2.0
• rapidfuzz ==3.11.0
• requests ==2.32.3
• requests-toolbelt ==1.0.0
• secretstorage ==3.3.3
• shellingham ==1.5.4
• tomlkit ==0.13.2
• trove-classifiers ==2024.10.21.16
• urllib3 ==2.2.3
• virtualenv ==20.28.0
• zipp ==3.21.0

poetry

gcp/api/pyproject.toml

• python ^3.11
• google-cloud-ndb ==2.3.2
• google-cloud-logging ==3.11.3
• packaging ==20.9
• requests ==2.32.3
• google-cloud-profiler ==4.1.0
• mypy-protobuf ^3.6.0
• yapf *
• pylint *

gcp/functions/pypi/pyproject.toml

• python ^3.11
• cryptography ==43.0.3
• google-cloud-secret-manager ==2.22.0
• osv ==0.0.22
• requests ==2.32.3

gcp/website/pyproject.toml

• python ^3.11
• Flask ==2.3.3
• Flask-Caching ==2.3.0
• Flask-Compress ==1.17
• werkzeug ==3.1.3
• google-auth ==2.37.0
• google-cloud-ndb ==2.3.2
• google-cloud-logging ==3.11.3
• jinja2 ==3.1.4
• markdown2 ==2.5.2
• markupsafe ==2.1.5
• packageurl-python ==0.16.0
• redis ==4.6.0
• requests ==2.32.3
• gunicorn ==22.0.0
• whitenoise ==6.8.2
• cvss ==3.3
• yapf *
• pylint *

gcp/workers/worker/pyproject.toml

• python ^3.11
• google-auth-httplib2 ^0.2.0
• google-api-python-client ^2.147
• google-cloud-pubsub ==2.27.1
• google-cloud-ndb ==2.3.2
• google-cloud-storage ==2.19.0
• PyYAML ==6.0.2
• redis ==5.2.1
• packageurl-python ==0.16.0
• pygit2 ==1.16.0
• requests ==2.32.3
• jsonschema ==4.23.0
• yapf *
• pylint *

pyproject.toml

• python ^3.11
• google-cloud-ndb ^2.3
• google-cloud-logging ^3.10
• google-cloud-storage ^2.17
• semver ^3.0
• packageurl-python ==0.16.0
• pyyaml ^6.0
• pygit2 ^1.14.0
• attrs ^23.2
• jsonschema ^4.0
• grpcio ^1.0
• packaging <22.0
• requests ^2.32
• yapf *
• pylint *
• grpcio-tools *
• mypy-protobuf ^3.6.0

tools/datafix/pyproject.toml

• python ^3.11
• google-cloud-ndb ==2.3.2
• google-cloud-storage ==2.19.0
• PyYAML ==6.0.2
• google-cloud-pubsub ^2.25.2
• yapf *
• pylint *

vulnfeeds/tools/debian/debian_converter/pyproject.toml

• python ^3.11
• markdownify ==0.14.1
• pandas ==2.2.3
• python-dateutil ==2.9.0.post0
• yapf *
• pylint *

terraform

deployment/terraform/environments/oss-vdb-test/main.tf

• external ~> 2.3.3
• google ~> 5.45.0
• google-beta ~> 5.45.0
• null ~> 3.2.2

deployment/terraform/environments/oss-vdb/main.tf

• external ~> 2.3.3
• google ~> 5.45.0
• google-beta ~> 5.45.0
• null ~> 3.2.2

deployment/terraform/modules/osv/website.tf

• terraform-google-modules/lb-http/google ~> 10.0

---

• Check this box to trigger a request for Renovate to run again on this repository