chore(deps): update non-major dependencies by renovate[bot] · Pull Request #62 · enddzone/servestead

renovate · 2026-07-18T09:34:53Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@astrojs/starlight (source)	`^0.41.1` → `^0.42.0`	dependencies	minor
anchore/syft	`v1.48.0` → `v1.55.0`		minor
aquasecurity/trivy	`v0.72.0` → `v0.76.1`		minor
charm.land/bubbles/v2	`v2.1.1` → `v2.2.1`	require	minor
charm.land/bubbletea/v2	`v2.0.8` → `v2.1.1`	require	minor
charm.land/lipgloss/v2	`v2.0.5` → `v2.0.6`	require	patch
filippo.io/age	`v1.3.1` → `v1.3.2`	require	patch
github.com/charmbracelet/x/ansi	`v0.11.7` → `v0.11.9`	require	patch
github.com/digitalocean/godo	`v1.199.0` → `v1.233.0`	require	minor
github.com/getsops/sops/v3	`v3.13.2` → `v3.13.3`	require	patch
github.com/goreleaser/goreleaser/v2	`v2.17.0` → `v2.19.0`		minor
github.com/mattn/go-isatty	`v0.0.23` → `v0.0.24`	require	patch
golang.org/x/crypto	`v0.55.0` → `v0.58.0`	require	minor
golang.org/x/sys	`v0.47.0` → `v0.49.0`	require	minor
golang.org/x/vuln	`v1.6.0` → `v1.9.0`		minor

Release Notes

withastro/starlight (@astrojs/starlight)

`v0.42.8`

Compare Source

Patch Changes

#4309 3490c80 Thanks @athulsreekumar! - Fixes autogenerated sidebar groups omitting directories whose names match Object.prototype properties, such as constructor or toString
#4290 bf93823 Thanks @RaphaelFakhri! - Fixes missing last-updated dates in production builds for pages whose file path contains special characters
#4295 af9557e Thanks @delucis! - Fixes a formatting issue in some error messages impacting projects with Zod ≥4.5 installed
#4299 a103f38 Thanks @clean99! - Fixes empty sidebars when autogenerating entries from the docs root directory using directory: ''

`v0.42.7`

Compare Source

Patch Changes

#4264 94e0985 Thanks @chrispezza! - Fixes a layout shift where the table of contents could be painted at the start of the content area and then jump to the end when a page's HTML arrived in several chunks
#4285 6f22edd Thanks @tunetheweb! - Improves hero image loading by adding fetchpriority="high" hint for browsers

`v0.42.6`

Compare Source

Patch Changes

#4252 40a2584 Thanks @olafur-andri! - Adds Icelandic language support
#4229 e4a3d82 Thanks @HiDeoo! - Fixes a potential issue with icons being cut off in Firefox when pinch-zooming.
#4226 fb562dd Thanks @HiDeoo! - Fixes an issue where pages not importing components from @astrojs/starlight/components included styles of Starlight components used on other pages.
#4250 531af7d Thanks @HiDeoo! - Fixes Failed to resolve dependency warnings logged when running the development server in projects using the Cloudflare adapter.
#4229 e4a3d82 Thanks @HiDeoo! - Fixes the codePen and node icons slightly extending beyond their bounding box.

`v0.42.5`

Compare Source

Patch Changes

#4227 5ba7a70 Thanks @I90rche! - Adds Macedonian language support

`v0.42.4`

Compare Source

Patch Changes

#4149 fa10e87 Thanks @ematipico! - Optimizes rendering of large nested sidebars
#4215 f791de6 Thanks @HiDeoo! - Adds a new seti:coffee icon for CoffeeScript files in the <FileTree> component.
#4215 f791de6 Thanks @HiDeoo! - Fixes <FileTree> icons for .ejs and npm-debug.log files displaying the default file icon.

`v0.42.3`

Compare Source

Patch Changes

#4211 33e21ec Thanks @HiDeoo! - Fixes a potential page freeze due to table of contents highlighting when a <PageTitle> component override does not render a heading with the required id="_top".

`v0.42.2`

Compare Source

Patch Changes

#4201 fafd989 Thanks @linux-universe! - Add 1 new icon: fluxer

`v0.42.1`

Compare Source

Patch Changes

#4198 96a44d4 Thanks @mayank99! - Removes the popover attribute from the sidebar pane on desktop viewports. This ensures the desktop sidebar doesn't stay in a "hidden" popover visibility state.

`v0.42.0`

Compare Source

Minor Changes

#3572 292fb17 Thanks @HiDeoo! - Distributes package as JavaScript files with dedicated type declaration files instead of TypeScript source files.
#4121 2623ae6 Thanks @delucis! - Simplifies markup for Starlight’s mobile menu toggle

⚠️ Potentially breaking change: If you use a theme plugin, custom styles, or component overrides targeting the MobileMenuToggle button or PageFrame components, you may need to adjust these for the new markup. The button is no longer wrapped in a <starlight-menu-button> custom element and no longer uses the aria-expanded attribute. Instead, you can use the .sl-menu-button class name to target the button and the :popover-open pseudo-class to style the menu open state specifically.

In the following example, custom styles for the menu button are updated for the new approach:
```
- starlight-menu-button button {
+ .sl-menu-button {
  color: var(--sl-color-text);
}

- starlight-menu-button[aria-expanded='true'] button {
+ .sl-menu-button:has(~ :popover-open) {
  color: var(--sl-color-text-accent-high);
}
```
See MobileMenuToggle.astro and PageFrame.astro on GitHub for the full source code of the updated components.
#3572 292fb17 Thanks @HiDeoo! - Removes the tagline configuration option, which was never used.

If your configuration included a tagline option, you can safely remove it without any replacement.
#4134 6135f01 Thanks @HiDeoo! - Updates internal @astrojs/mdx, @astrojs/markdown-satteri, and satteri dependencies.

⚠️ BREAKING CHANGE: The following minimum versions are now required:
- astro v7.2.10 or later
- @astrojs/markdown-satteri 0.4.0 or later (if you use it)
- @astrojs/markdown-remark 7.3.0 or later (if you use it)
Please update Starlight and Astro together:
```
npx @astrojs/upgrade
```
#4121 2623ae6 Thanks @delucis! - Refactors Starlight’s mobile menu toggle to work when JavaScript fails or is disabled

⚠️ BREAKING CHANGE: This release drops official support for Chromium-based browsers prior to version 116 (released August 2023), Safari-based browsers prior to version 17.0 (released September 2023), and Firefox prior to version 125 (released April 2024). You can find a list of currently supported browsers and their versions using this browserslist query.

This change also removes the data-mobile-menu-expanded attribute, which was previously added to <body> while the mobile menu is open. If you have custom code that was depending on this attribute, you will need to update it to use a new selector to check if the mobile menu is open.

In the following example, a custom background colour for the site header while the menu is open is updated for the new approach:
```
- [data-mobile-menu-expanded] header {
+ body:has(sl-sidebar-pane:popover-open) header {
  background-color: var(--sl-color-bg);
}
```

`v0.41.11`

Compare Source

Patch Changes

#4167 32a5e29 Thanks @HiDeoo! - Fixes a layout issue and anchor links appearing for hidden headings, e.g. footnote headings, when markdown.headingLinks is enabled or the <AnchorHeading> component is used.
#4148 cdfafd8 Thanks @ematipico! - Optimizes sidebar data generation logic to speed up sites with large sidebars

`v0.41.10`

Compare Source

Patch Changes

#4160 88442c3 Thanks @ArmandPhilippot! - Adds the missing translations for Expressive Code in the following locales: ar, hi, it, ja, ko, pt, zh-CN, and zh-TW.
#4156 57af92d Thanks @pyxelr! - Adds 1 new icon: hypothesis
#4159 a0e0ba2 Thanks @trueberryless! - Adds 1 new icon: npmx

`v0.41.9`

Compare Source

Patch Changes

#4145 1c90d69 Thanks @pyxelr! - Adds 1 new icon: goodreads

`v0.41.8`

Compare Source

Patch Changes

#4142 cacbc9f Thanks @alebelcor! - Adds 1 new icon: whatsApp
#4133 3944311 Thanks @delucis! - Internal refactor: numbered id attributes in the <Tabs> component are now page-specific instead of using a global counter
#4138 cd4b665 Thanks @delucis! - Fixes localisation of code block UI elements when using the Sätteri Markdown processor

`v0.41.7`

Compare Source

Patch Changes

#4114 3e486fb Thanks @delucis! - Fixes processing of code examples in RTL languages when using Astro’s Sätteri Markdown processor

`v0.41.6`

Compare Source

Patch Changes

#4102 f1dddc0 Thanks @delucis! - Adds 1 new icon: forgejo

`v0.41.5`

Compare Source

Patch Changes

#4095 bb06434 Thanks @HiDeoo! - Fixes a regression when using a union to extend Starlight’s docsSchema().

`v0.41.4`

Compare Source

Patch Changes

#3936 712eedd Thanks @miichom! - Fixes support for modifying Zod enums when passing an extend option to Starlight’s docsSchema()
#4092 0896b91 Thanks @delucis! - Fixes support for links containing a protocol like mailto: in the sidebar
#4088 4486ba4 Thanks @delucis! - Simplifies Starlight’s client-side sidebar state persistence script slightly

anchore/syft

`v1.55.0`

Compare Source

Added Features

Add support for scanning IPK packages using the deb-archive-cataloger [PR #5111 @skyhisi]

Bug Fixes

Pin Gguff lib to prevent dropping packages [PR #5447 @spiffcs]
Licensing: copyright holder missing, needed for Debian packaging [Issue #5394] [PR #5414 @wagoodman]
Syft cli.Command() panics when invoked multiple times [Issue #2285] [PR #5386 @JasonMetal]

Additional Changes

bump go-make module and action together [PR #5415 @wagoodman]

Dependencies

49 dependency changes (46 updated, 1 added, 2 removed). 5 vulnerabilities remediated.

🟢 Remediated (5)

GO-2026-6603 (High) — golang.org/x/net
GO-2026-6610 (High) — golang.org/x/net
GO-2026-6611 (High) — golang.org/x/net
GO-2026-6612 (Critical) — golang.org/x/net
GO-2026-6617 (High) — golang.org/x/net

Updated (46 packages)

cloud.google.com/go/auth v0.23.2 → v0.23.3
cloud.google.com/go/compute/metadata v0.9.0 → v0.9.1
cloud.google.com/go/storage v1.65.1 → v1.68.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 → v1.34.0
github.com/aws/aws-sdk-go-v2 v1.44.0 → v1.47.1
github.com/aws/aws-sdk-go-v2/config v1.32.40 → v1.33.6
github.com/aws/aws-sdk-go-v2/credentials v1.19.39 → v1.20.6
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.40 → v1.20.1
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40 → v1.5.4
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40 → v2.8.4
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.41 → v1.5.4
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.10.0 → v1.11.5
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40 → v1.14.4
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.41 → v1.20.4
github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0 → v1.114.0
github.com/aws/aws-sdk-go-v2/service/signin v1.6.0 → v1.10.1
github.com/aws/aws-sdk-go-v2/service/sso v1.34.0 → v1.38.1
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.39.0 → v1.43.1
github.com/aws/aws-sdk-go-v2/service/sts v1.46.0 → v1.51.1
github.com/github/go-spdx/v2 v2.7.0 → v2.7.1
github.com/go-git/go-billy/v5 v5.9.1 → v5.9.2
github.com/go-git/go-git/v5 v5.19.2 → v5.19.3
github.com/google/s2a-go v0.1.9 → v0.1.10
github.com/googleapis/enterprise-certificate-proxy v0.3.20 → v0.3.22
github.com/googleapis/gax-go/v2 v2.24.0 → v2.24.1
github.com/gookit/color v1.6.1 → v1.6.2
github.com/gpustack/gguf-parser-go v0.26.3 → v0.26.4
github.com/hashicorp/go-getter v1.8.9 → v1.8.10
github.com/pb33f/ordered-map/v2 v2.3.1 → v2.3.2
github.com/pjbgf/sha1cd v0.6.0 → v0.7.0
github.com/spiffe/go-spiffe/v2 v2.7.0 → v2.8.1
golang.org/x/crypto v0.57.0 → v0.58.0
golang.org/x/net v0.59.0 → v0.61.0 (🟢 remediated GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617)
golang.org/x/oauth2 v0.36.0 → v0.37.0
golang.org/x/sync v0.23.0 → v0.24.0
golang.org/x/sys v0.48.0 → v0.49.0
golang.org/x/term v0.46.0 → v0.47.0
golang.org/x/text v0.42.0 → v0.43.0
golang.org/x/tools v0.50.0 → v0.51.0
google.golang.org/api v0.294.0 → v0.299.0
google.golang.org/genproto/googleapis/rpc v0.0.0-da73d73 → v0.0.0-b142276
google.golang.org/grpc v1.83.2 → v1.84.0
modernc.org/cc/v4 v4.29.2 → v4.29.7
modernc.org/ccgo/v4 v4.35.0 → v4.36.1
modernc.org/libc v1.75.7 → v1.77.1
modernc.org/sqlite v1.59.0 → v1.60.1

Added (1 package)

github.com/pb33f/go-yaml v0.1.0

Removed (2 packages)

github.com/klauspost/cpuid/v2 v2.3.0
go.yaml.in/yaml/v4 v4.0.0-rc.2

(Full Changelog)

`v1.54.1`

Compare Source

Bug Fixes

resolve packages.lock dependencies deterministically [PR #5210 @spiffcs]
Cannot produce attestation file from local podman image [Issue #1664] [PR #5368 @Bru456]

Dependencies

9 dependency changes (9 updated).

Updated (9 packages)

github.com/anchore/go-rpmdb v0.2.0 → v0.2.2
github.com/anchore/stereoscope v0.3.3 → v0.3.4
github.com/docker/cli v29.8.1+incompatible → v29.8.2+incompatible
github.com/glebarez/go-sqlite v1.20.3 → v1.23.0
github.com/klauspost/compress v1.20.0 → v1.20.1
github.com/secure-systems-lab/go-securesystemslib v0.11.0 → v0.11.1
github.com/sigstore/protobuf-specs v0.5.1 → v0.5.2
github.com/sigstore/sigstore v1.10.8 → v1.10.11
github.com/sylabs/sif/v2 v2.24.1 → v2.24.2

(Full Changelog)

`v1.54.0`

Compare Source

Added Features

report the perl interpreter as a cpan package [PR #5132 @wagoodman]
Add package cataloger for perl ecosystem [Issue #1906] [PR #5131 @wagoodman]
Analyze with Non-Daemon podman [Issue #1173]

Bug Fixes

write a name for the root package when the source has none [PR #5349 @DrVelvetFog]
match opensource.org license URLs across SPDX URL forms [PR #5361 @willmurphyscode]
Account for malformed GGUF and safetensors parameter counts [PR #5343 @wagoodman]
don't panic on a root file without a supplier or null entries [PR #5326 @DrVelvetFog]
do not panic on a stack.yaml rev pin [PR #5310 @arpitjain099]
report scanner errors and raise the line cap in metadata parsers [PR #5353 @wagoodman]
Harden cataloger parsers against truncated input (do not panic) [PR #5355 @wagoodman]
bound CPE candidate generation for pathological package metadata [PR #5356 @wagoodman]
account for UPX's loader padding when unpacking Go binaries [PR #5347 @huuyafwww]
handle malformed GGUF headers without panicking [PR #5345 @wagoodman]
bound model companion file reads and validate their contents [PR #5344 @wagoodman]
don't fail the whole SBOM when a cataloger panics on one file [PR #5342 @wagoodman]
release package collection lock in Ubuntu ESM detection [PR #5336 @sverrirsig]
render TUI log lines on their own rows, with colors and a small header [PR #5324 @wagoodman]
uv.lock: dependents are linked to every locked version of a dependency [Issue #5340] [PR #5351 @devtechedge]
java-archive-cataloger maps Apache Groovy 4+ (org.apache.groovy) to obsolete org.codehaus.groovy [Issue #5311] [PR #5313 @texasich]
Support traefik binary various versions [Issue #4980] [PR #5281 @mayanksekhar]
File Digests Remain at Zero, No Hashes Available Despite .syft.yaml Settings Should Support [Issue #5325] [PR #5341 @wagoodman]
not showing expat CVEs from syft generated sbom [Issue #4771] [PR #5259 @KR-Ravindra]
PHP extensions are cataloged as upstream products using the PHP version [Issue #5014] [PR #5102 @pujitha24]
Panic during scanning with gguf-cataloger/safetensors-cataloger [Issue #5327] [PR #5328 @tk1475]
github-actions cataloger emits an invalid PURL for docker:// use statements [Issue #5299] [PR #5302 @yunaremaia]
Crash when running syft on a directory that is the root file system of a Yocto build [Issue #5320] [PR #5321 @somaz94]
Invalid PURLs when cataloging instrumentation classes/jars [Issue #2596]

Dependencies

79 dependency changes (48 updated, 28 added, 3 removed). 2 vulnerabilities remediated.

🟢 Remediated (2)

GHSA-8wmf-6v46-5gfg (Low) — go.opentelemetry.io/otel/sdk
GHSA-pg57-6jwg-q645 (Medium) — github.com/containerd/containerd/v2

Toolchains (1)

Go minimum version: 1.26.3 → 1.26.8

Updated (48 packages)

github.com/Microsoft/hcsshim v0.15.0-rc.1 → v0.15.0-rc.4
github.com/anchore/bubbly v0.2.1 → v0.2.2
github.com/anchore/go-logger v0.1.1 → v0.2.0
github.com/anchore/stereoscope v0.3.2 → v0.3.3
github.com/bmatcuk/doublestar/v4 v4.10.0 → v4.10.2
github.com/containerd/containerd/api v1.11.1 → v1.12.0
github.com/containerd/containerd/v2 v2.3.5 → v2.4.1 (🟢 remediated GHSA-pg57-6jwg-q645)
github.com/containerd/log v0.1.0 → v0.2.0
github.com/containerd/ttrpc v1.2.8 → v1.2.9
github.com/containerd/typeurl/v2 v2.2.3 → v2.3.0
github.com/cyphar/filepath-securejoin v0.6.1 → v0.7.0
github.com/docker/cli v29.8.0+incompatible → v29.8.1+incompatible
github.com/docker/docker-credential-helpers v0.9.5 → v0.9.8
github.com/dustin/go-humanize v1.0.1 → v1.1.0
github.com/erofs/go-erofs v0.3.0 → v0.3.1
github.com/felixge/httpsnoop v1.0.4 → v1.1.0
github.com/fsnotify/fsnotify v1.9.0 → v1.10.1
github.com/go-jose/go-jose/v4 v4.1.4 → v4.1.5
github.com/go-logr/logr v1.4.3 → v1.4.4
github.com/hashicorp/hcl/v2 v2.24.0 → v2.25.0
github.com/magiconair/properties v1.18.11 → v1.18.12
github.com/mattn/go-runewidth v0.0.21 → v0.0.27
github.com/moby/sys/user v0.4.0 → v0.4.1
github.com/moby/sys/userns v0.1.0 → v0.2.1
github.com/nwaples/rardecode/v2 v2.2.0 → v2.4.1
github.com/olekukonko/tablewriter v1.1.4 → v1.1.5
github.com/sirupsen/logrus v1.9.4 → v1.10.2
github.com/ulikunitz/xz v0.5.16 → v0.5.17
github.com/zclconf/go-cty v1.16.3 → v1.19.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 → v0.71.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 → v0.71.0
go.opentelemetry.io/otel v1.44.0 → v1.46.0
go.opentelemetry.io/otel/metric v1.44.0 → v1.46.0
go.opentelemetry.io/otel/metric/x v0.66.0 → v0.68.0
go.opentelemetry.io/otel/sdk v1.44.0 → v1.46.0 (🟢 remediated GHSA-8wmf-6v46-5gfg)
go.opentelemetry.io/otel/sdk/metric v1.44.0 → v1.46.0
go.opentelemetry.io/otel/trace v1.44.0 → v1.46.0
golang.org/x/crypto v0.56.0 → v0.57.0
golang.org/x/net v0.58.0 → v0.59.0
golang.org/x/sync v0.22.0 → v0.23.0
golang.org/x/sys v0.47.0 → v0.48.0
golang.org/x/term v0.45.0 → v0.46.0
golang.org/x/text v0.41.0 → v0.42.0
golang.org/x/tools v0.49.0 → v0.50.0
google.golang.org/genproto/googleapis/api v0.0.0-e75dac1 → v0.0.0-da73d73
google.golang.org/genproto/googleapis/rpc v0.0.0-08b0e42 → v0.0.0-da73d73
modernc.org/libc v1.75.6 → v1.75.7
modernc.org/sqlite v1.58.0 → v1.59.0

Added (28 packages)

cyphar.com/go-pathrs v0.2.5
github.com/VividCortex/ewma v1.2.0
github.com/apparentlymart/go-textseg/v17 v17.0.1
github.com/containerd/log/otel v0.1.0
github.com/containerd/stargz-snapshotter/estargz v0.18.2
github.com/containers/libtrust v0.0.0-c1716e8
github.com/containers/ocicrypt v1.3.2
github.com/cyberphone/json-canonicalization v0.0.0-19d51d7
github.com/google/go-intervals v0.0.2
github.com/mattn/go-sqlite3 v1.14.48
github.com/miekg/pkcs11 v1.1.2
github.com/mistifyio/go-zfs/v4 v4.0.0
github.com/moby/sys/capability v0.4.0
github.com/opencontainers/selinux v1.15.1
github.com/proglottis/gpgme v0.1.6
github.com/secure-systems-lab/go-securesystemslib v0.11.0
github.com/sigstore/fulcio v1.8.7
github.com/sigstore/protobuf-specs v0.5.1
github.com/sigstore/sigstore v1.10.8
github.com/smallstep/pkcs7 v0.2.1
github.com/stefanberger/go-pkcs11uri v0.0.0-7828495
github.com/tchap/go-patricia/v2 v2.3.3
github.com/vbatts/tar-split v0.12.3
github.com/vbauerster/cupwriter v0.0.4
github.com/vbauerster/mpb/v8 v8.14.0
github.com/youmark/pkcs8 v0.0.0-a2c0da2
go.podman.io/image/v5 v5.41.2
go.podman.io/storage v1.64.1

Removed (3 packages)

github.com/gogo/protobuf v1.3.2
github.com/moby/sys/sequential v0.6.0
go.opencensus.io v0.24.0

(Full Changelog)

`v1.52.0`

Compare Source

Added Features

passthrough-exact-format copies matching syft-json input unchanged [PR #5279 @juanjsebgarcia]

Bug Fixes

bound what a compressed kernel module expands to [PR #5294 @wagoodman]
bound the decompressed members of a .deb archive [PR #5293 @wagoodman]
alpm mtree gzip unbounded processing [PR #5292 @wagoodman]
graalvm unbounded allocation [PR #5291 @wagoodman]
harden .NET PE/ELF parsing against malformed binaries [PR #5267 @wagoodman]
bound allocations from UPX-packed binary headers [PR #5195 @wagoodman]
Syft rpm-db-cataloger reports stale libssh version from a single-layer Rocky Linux 10 image [Issue #5247]
java-archive-cataloger returns unknown ver for uber-jars [Issue #5163] [PR #5164 @rezmoss]

Dependencies

52 dependency changes (52 updated). 6 vulnerabilities remediated.

🟢 Remediated (6)

GHSA-2v4p-qf9q-27wj (High) — google.golang.org/grpc
GHSA-7jxh-36q5-gcqv (Medium) — github.com/containerd/containerd/v2
GHSA-qc2q-p7wx-3px3 (Medium) — google.golang.org/grpc
GHSA-vp52-pcj8-j9qc (High) — google.golang.org/grpc
GO-2026-6354 (High) — golang.org/x/crypto
GO-2026-6355 (High) — golang.org/x/crypto

Updated (52 packages)

cloud.google.com/go/auth v0.22.0 → v0.23.2
cloud.google.com/go/iam v1.11.0 → v1.12.0
cloud.google.com/go/logging v1.18.0 → v1.19.0
cloud.google.com/go/monitoring v1.29.0 → v1.30.0
cloud.google.com/go/storage v1.64.0 → v1.65.1
github.com/CycloneDX/cyclonedx-go v0.11.0 → v0.12.0
github.com/anchore/go-sync v0.1.1 → v0.1.2
github.com/anchore/stereoscope v0.3.1 → v0.3.2
github.com/aws/aws-sdk-go-v2 v1.43.4 → v1.44.0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16 → v1.7.20
github.com/aws/aws-sdk-go-v2/config v1.32.35 → v1.32.40
github.com/aws/aws-sdk-go-v2/credentials v1.19.34 → v1.19.39
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 → v1.18.40
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 → v1.4.40
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 → v2.7.40
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 → v1.4.41
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 → v1.13.19
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28 → v1.10.0
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35 → v1.13.40
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36 → v1.19.41
github.com/aws/aws-sdk-go-v2/service/s3 v1.106.5 → v1.108.0
github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 → v1.6.0
github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 → v1.34.0
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 → v1.39.0
github.com/aws/aws-sdk-go-v2/service/sts v1.45.4 → v1.46.0
github.com/aws/smithy-go v1.27.6 → v1.28.1
github.com/containerd/containerd/v2 v2.3.4 → v2.3.5 (🟢 remediated GHSA-7jxh-36q5-gcqv)
github.com/docker/cli v29.7.2+incompatible → v29.8.0+incompatible
github.com/google/go-containerregistry v0.21.9 → v0.22.1
github.com/googleapis/enterprise-certificate-proxy v0.3.19 → v0.3.20
github.com/googleapis/gax-go/v2 v2.23.0 → v2.24.0
github.com/gpustack/gguf-parser-go v0.25.0 → v0.26.3
github.com/hashicorp/go-getter v1.8.8 → v1.8.9
github.com/klauspost/compress v1.19.2 → v1.20.0
github.com/moby/moby/api v1.55.0 → v1.56.0
github.com/moby/moby/client v0.5.1 → v0.6.0
github.com/terminalstatic/go-xsd-validate v0.1.6 → v0.1.8
golang.org/x/crypto v0.55.0 → v0.56.0 (🟢 remediated GO-2026-6354, GO-2026-6355)
golang.org/x/mod v0.40.0 → v0.41.0
golang.org/x/time v0.15.0 → v0.16.0
google.golang.org/api v0.292.0 → v0.294.0
google.golang.org/genproto v0.0.0-aa98bba → v0.0.0-e75dac1
google.golang.org/genproto/googleapis/api v0.0.0-925bb5d → v0.0.0-e75dac1
google.golang.org/genproto/googleapis/rpc v0.0.0-6ac0973 → v0.0.0-08b0e42
google.golang.org/grpc v1.83.0 → v1.83.2 (🟢 remediated GHSA-2v4p-qf9q-27wj, GHSA-qc2q-p7wx-3px3, GHSA-vp52-pcj8-j9qc)
google.golang.org/protobuf v1.36.12-0.f2248ac → v1.36.12
modernc.org/cc/v4 v4.29.1 → v4.29.2
modernc.org/ccgo/v4 v4.34.6 → v4.35.0
modernc.org/gc/v3 v3.1.4 → v3.1.5
modernc.org/libc v1.74.4 → v1.75.6
modernc.org/memory v1.11.0 → v1.12.1
modernc.org/sqlite v1.56.0 → v1.58.0

(Full Changelog)

`v1.51.1`

Compare Source

Bug Fixes

detect multi-arch ingress-nginx [PR #5179 @CAOShurong]
keep the epoch when parsing RPM manifest packages [PR #5201 @sueun-dev]
correct Apache Derby group ID in purl generation [PR #5090 @Ankush-Pathak]
move image hardlink handling upstream during image indexing [PR #5196 @wagoodman]
keep epoch-pinned requirements in the SBOM [PR #5161 @sueun-dev]
Prevent unnecessary allocations when parsing compressed ELF sections [PR #5187 @wagoodman]
honor the io.ReaderAt contract in readerAtAdapter [PR #5186 @wagoodman]
Support grafana binary various version [Issue #5059] [PR #5213 @pujitha24]
Excluded paths are still scanned and cause syft to crash [Issue #3258]
Dotnet: Incorrect relationship graph in case of using package locks [Issue #5125] [PR #5143 @pujitha24]
Survive indexing not accessible files [Issue #3286] [PR #5170 @addielaruee]
CPE target_sw not being set consistency for Rust crates [Issue #3956] [PR #5167 @Xenira]
panic: nil pointer dereference in squashfs.(*File).Read when scanning snap (regression from 1.44.0) [Issue #4989] [PR #5119 @kzantow]
golang remote license search attempts to resolve stdlib modules [Issue #3149] [PR #5192 @luantaraschi]

Additional Changes

gzip binary classifier reports false-positive GNU gzip from BusyBox multicall binary via applet symlink [Issue #5171] [PR #5202 @spiffcs]
pnpm v5 lockfile: underscore peer-dep suffixes are not stripped from package versions [Issue #5174] [PR #5175 @codeAnqiang-ma]
pnpm cataloger reads only the first YAML document: SBOM contains pnpm's own binaries and no project dependencies [Issue #5168] [PR #5188 @hamodywe]

Dependencies

72 dependency changes (70 updated, 1 added, 1 removed). 3 vulnerabilities remediated.

🟢 Remediated (3)

GO-2026-5158 (Medium) — go.opentelemetry.io/otel
GO-2026-6179 (High) — golang.org/x/mod
GO-2026-6180 (High) — golang.org/x/mod

Updated (70 packages)

cel.dev/expr v0.25.1 → v0.25.2
cloud.google.com/go/auth v0.18.2 → v0.22.0
cloud.google.com/go/iam v1.5.3 → v1.11.0
cloud.google.com/go/logging v1.13.1 → v1.18.0
cloud.google.com/go/longrunning v0.8.0 → v1.2.0
cloud.google.com/go/monitoring v1.24.3 → v1.29.0
cloud.google.com/go/storage v1.61.3 → v1.64.0
cloud.google.com/go/trace v1.11.7 → v1.16.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 → v1.33.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 → v0.57.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 → v0.57.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 → v0.57.0
github.com/anchore/stereoscope v0.3.0 → v0.3.1
github.com/aws/aws-sdk-go-v2 v1.41.5 → v1.43.4
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 → v1.7.16
github.com/aws/aws-sdk-go-v2/config v1.32.12 → v1.32.35
github.com/aws/aws-sdk-go-v2/credentials v1.19.12 → v1.19.34
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 → v1.18.35
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 → v1.4.35
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 → v2.7.35
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 → v1.4.36
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 → v1.13.15
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 → v1.9.28
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 → v1.13.35
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 → v1.19.36
github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 → v1.106.5
github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 → v1.5.4
github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 → v1.33.4
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 → v1.38.4
github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 → v1.45.4
github.com/aws/smithy-go v1.24.2 → v1.27.6
github.com/containerd/containerd/v2 v2.3.3 → v2.3.4
github.com

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/Chicago)

Branch creation
- "before 6am"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-07-23T06:39:11Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

44 additional dependencies were updated

Details:

Package	Change
`cloud.google.com/go/auth`	`v0.20.0` -> `v0.22.0`
`cloud.google.com/go/iam`	`v1.11.0` -> `v1.12.0`
`cloud.google.com/go/kms`	`v1.31.0` -> `v1.32.0`
`cloud.google.com/go/longrunning`	`v1.1.0` -> `v1.2.0`
`cloud.google.com/go/monitoring`	`v1.29.0` -> `v1.30.0`
`cloud.google.com/go/storage`	`v1.63.0` -> `v1.63.1`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.33.0` -> `v1.34.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric`	`v0.57.0` -> `v0.58.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping`	`v0.57.0` -> `v0.58.0`
`github.com/aws/aws-sdk-go-v2`	`v1.42.0` -> `v1.42.1`
`github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream`	`v1.7.13` -> `v1.7.14`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.25` -> `v1.32.30`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.19.24` -> `v1.19.29`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.29` -> `v1.18.30`
`github.com/aws/aws-sdk-go-v2/feature/s3/manager`	`v1.22.28` -> `v1.22.34`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.4.29` -> `v1.4.30`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.29` -> `v2.7.30`
`github.com/aws/aws-sdk-go-v2/internal/v4a`	`v1.4.30` -> `v1.4.31`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.13.12` -> `v1.13.13`
`github.com/aws/aws-sdk-go-v2/service/internal/checksum`	`v1.9.22` -> `v1.9.23`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.13.29` -> `v1.13.30`
`github.com/aws/aws-sdk-go-v2/service/internal/s3shared`	`v1.19.29` -> `v1.19.31`
`github.com/aws/aws-sdk-go-v2/service/kms`	`v1.53.4` -> `v1.54.1`
`github.com/aws/aws-sdk-go-v2/service/s3`	`v1.104.0` -> `v1.105.2`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.2.0` -> `v1.4.1`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.31.3` -> `v1.32.1`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.36.6` -> `v1.37.1`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.43.3` -> `v1.44.1`
`github.com/aws/smithy-go`	`v1.27.3` -> `v1.27.4`
`github.com/charmbracelet/ultraviolet`	`v0.0.0-20260703014108-f5a850f9c2b7` -> `v0.0.0-20261008173134-6b8d4baf91b4`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.17` -> `v0.3.18`
`github.com/googleapis/gax-go/v2`	`v2.22.0` -> `v2.23.0`
`github.com/huaweicloud/huaweicloud-sdk-go-v3`	`v0.1.202` -> `v0.1.207`
`github.com/lucasb-eyer/go-colorful`	`v1.4.0` -> `v1.4.1`
`github.com/mattn/go-runewidth`	`v0.0.24` -> `v0.0.30`
`github.com/xo/terminfo`	`v0.0.0-20220910002029-abceb7e1c41e` -> `v1.0.0`
`golang.org/x/net`	`v0.57.0` -> `v0.60.0`
`golang.org/x/sync`	`v0.22.0` -> `v0.24.0`
`golang.org/x/term`	`v0.45.0` -> `v0.47.0`
`golang.org/x/text`	`v0.41.0` -> `v0.43.0`
`google.golang.org/api`	`v0.286.0` -> `v0.289.0`
`google.golang.org/genproto`	`v0.0.0-20260622175928-b703f567277d` -> `v0.0.0-20260720171339-e059f2f05d78`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260622175928-b703f567277d` -> `v0.0.0-20260720171339-e059f2f05d78`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260622175928-b703f567277d` -> `v0.0.0-20260720171339-e059f2f05d78`

renovate Bot added the dependencies Pull requests that update a dependency file label Jul 18, 2026

renovate Bot changed the title ~~chore(deps): update dependency astro to v7.1.1~~ chore(deps): update dependency astro to v7.1.3 Jul 20, 2026

renovate Bot force-pushed the renovate/non-major-dependencies branch 2 times, most recently from 7bd73d6 to 3468db8 Compare July 21, 2026 20:54

renovate Bot changed the title ~~chore(deps): update dependency astro to v7.1.3~~ chore(deps): update non-major dependencies Jul 21, 2026

renovate Bot force-pushed the renovate/non-major-dependencies branch 2 times, most recently from 6873283 to f38f3d6 Compare July 23, 2026 06:39

renovate Bot force-pushed the renovate/non-major-dependencies branch 8 times, most recently from 9d378dc to 4d1515c Compare July 30, 2026 14:05

renovate Bot force-pushed the renovate/non-major-dependencies branch 7 times, most recently from ae6735e to c85dd6d Compare August 7, 2026 20:53

renovate Bot force-pushed the renovate/non-major-dependencies branch 7 times, most recently from 6f59f9d to 2d7f303 Compare August 14, 2026 20:30

renovate Bot force-pushed the renovate/non-major-dependencies branch 27 times, most recently from ea95fd7 to 0fe2719 Compare September 3, 2026 02:45

renovate Bot force-pushed the renovate/non-major-dependencies branch 2 times, most recently from f496382 to 2644211 Compare September 3, 2026 20:04

chore(deps): update non-major dependencies

1e94157

Navigation Menu

Repository navigation

chore(deps): update non-major dependencies - #62

chore(deps): update non-major dependencies#62
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major-dependencies

renovate Bot commented Jul 18, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Added Features

Bug Fixes

Additional Changes

Dependencies

Bug Fixes

Dependencies

Added Features

Bug Fixes

Dependencies

Added Features

Bug Fixes

Dependencies

Bug Fixes

Additional Changes

Dependencies

Configuration

Uh oh!

renovate Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 18, 2026 •

edited

Loading

renovate Bot commented Jul 23, 2026 •

edited

Loading