Dependency Dashboard

[renovate-sh-app]

ℹ️ Note

This PR body was truncated due to platform limits.

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Repository Problems

Renovate tried to run on this repository, but found these problems.

• ⚠️ WARN: Package lookup failures

Abandoned Dependencies

Note

Packages are marked as abandoned when they exceed the abandonmentThreshold since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity.

These dependencies have not received updates for an extended period and may be unmaintained:

View abandoned dependencies (81)

Datasource	Package	Last Updated
dockerfile	rfratto/viceroy	2023-05-18
github-actions	rfratto/depcheck	2022-11-30
gomod	github.com/Azure/go-autorest/autorest	2025-01-28
gomod	github.com/DATA-DOG/go-sqlmock	2024-01-06
gomod	github.com/MasslessParticle/azure-storage-blob-go	2021-07-02
gomod	github.com/Masterminds/goutils	2021-02-04
gomod	github.com/Masterminds/sprig/v3	2024-08-29
gomod	github.com/PuerkitoBio/rehttp	2024-03-02
gomod	github.com/alecthomas/kingpin/v2	2023-09-30
gomod	github.com/alecthomas/units	2024-09-27
gomod	github.com/blang/semver/v4	2020-05-24
gomod	github.com/c2h5oh/datasize	2023-12-15
gomod	github.com/cespare/xxhash/v2	2024-04-04
gomod	github.com/channelmeter/iso8601duration	2015-02-04
gomod	github.com/dimchansky/utfbom	2020-11-06
gomod	github.com/drone/envsubst/v2	2021-07-30
gomod	github.com/elastic/go-freelru	2024-11-20
gomod	github.com/fortytw2/leaktest	2018-11-09
gomod	github.com/fsnotify/fsnotify	2025-04-04
gomod	github.com/github/smimesign	2021-10-04
gomod	github.com/githubexporter/github-exporter	2024-09-25
gomod	github.com/go-kit/log	2022-04-27
gomod	github.com/go-sourcemap/sourcemap	2024-03-13
gomod	github.com/gogo/protobuf	2021-01-10
gomod	github.com/golang/protobuf	2024-03-06
gomod	github.com/golang/snappy	2023-12-25
gomod	github.com/google/dnsmasq_exporter	2024-08-05
gomod	github.com/google/go-cmp	2025-01-14
gomod	github.com/google/uuid	2024-01-23
gomod	github.com/gorilla/mux	2023-10-18
gomod	github.com/grafana/alloy/syntax	2024-04-05
gomod	github.com/grafana/go-gelf/v2	2022-04-21
gomod	github.com/grafana/memberlist	2021-11-12
gomod	github.com/grafana/prometheus	2019-01-31
gomod	github.com/grafana/smimesign	2021-10-04
gomod	github.com/grafana/vmware_exporter	2024-03-14
gomod	github.com/hashicorp/go-multierror	2021-03-11
gomod	github.com/hashicorp/golang-lru	2023-09-21
gomod	github.com/hashicorp/golang-lru/v2	2023-09-21
gomod	github.com/influxdata/influxdb-client-go/v2	2024-08-12
gomod	github.com/influxdata/influxdb1-client	2022-03-02
gomod	github.com/jackc/pgproto3/v2	2024-03-04
gomod	github.com/jmespath-community/go-jmespath	2023-05-31
gomod	github.com/jonboulle/clockwork	2024-11-29
gomod	github.com/json-iterator/go	2021-09-11
gomod	github.com/mitchellh/mapstructure	2022-04-20
gomod	github.com/mwitkow/go-conntrack	2019-07-16
gomod	github.com/natefinch/atomic	2021-06-28
gomod	github.com/phayes/freeport	2022-02-01
gomod	github.com/pkg/errors	2020-01-14
gomod	github.com/pmezard/go-difflib	2016-01-10
gomod	github.com/prometheus-community/stackdriver_exporter	2025-01-17
gomod	github.com/prometheus/client_model	2025-04-11
gomod	github.com/prometheus/consul_exporter	2024-11-06
gomod	github.com/rfratto/go-yaml	2020-05-06
gomod	github.com/richardartoul/molecule	2021-12-17
gomod	github.com/rogpeppe/go-internal	2025-02-25
gomod	github.com/rs/cors	2024-08-29
gomod	github.com/spaolacci/murmur3	2018-01-18
gomod	github.com/tilinna/clock	2021-02-18
gomod	github.com/vincent-petithory/dataurl	2019-11-04
gomod	github.com/wk8/go-ordered-map	2023-06-27
gomod	go.uber.org/atomic	2023-05-03
gomod	go.uber.org/goleak	2023-10-24
gomod	go.uber.org/multierr	2023-03-29
gomod	gopkg.in/yaml.v2	2022-05-27
gomod	gopkg.in/yaml.v3	2022-05-27
gomod	gotest.tools	2018-11-11
npm	d3	2024-03-12
npm	d3-zoom	2021-06-10
npm	normalize.css	2018-11-09

Pending Approval

The following branches are pending approval. To create them, click on a checkbox below.

• fix(deps): Update gomod unstable dependency github.com/grafana/jfr-parser/pprof to v0.0.7
• fix(deps): Update gomod unstable dependency github.com/heroku/x to v0.5.3
• fix(deps): Update gomod unstable dependency github.com/mackerelio/go-osstat to v0.2.7
• fix(deps): Update gomod unstable dependency k8s.io/api to v0.35.3
• fix(deps): Update gomod unstable dependency k8s.io/apimachinery to v0.35.3
• fix(deps): Update gomod unstable dependency k8s.io/client-go to v0.35.3
• fix(deps): Update gomod unstable dependency k8s.io/component-base to v0.35.3
• chore(deps): Update gomod unstable dependency github.com/opencontainers/runc to v1.4.2
• chore(deps): Update gomod unstable dependency sigs.k8s.io/controller-runtime to v0.23.3
• fix(deps): Update go otel collector dependencies (github.com/open-telemetry/opentelemetry-collector-contrib/connector/countconnector, github.com/open-telemetry/opentelemetry-collector-contrib/connector/grafanacloudconnector, github.com/open-telemetry/opentelemetry-collector-contrib/connector/servicegraphconnector, github.com/open-telemetry/opentelemetry-collector-contrib/connector/spanmetricsconnector, github.com/open-telemetry/opentelemetry-collector-contrib/exporter/datadogexporter, github.com/open-telemetry/opentelemetry-collector-contrib/exporter/faroexporter, github.com/open-telemetry/opentelemetry-collector-contrib/exporter/fileexporter, github.com/open-telemetry/opentelemetry-collector-contrib/exporter/googlecloudexporter, github.com/open-telemetry/opentelemetry-collector-contrib/exporter/googlecloudpubsubexporter, github.com/open-telemetry/opentelemetry-collector-contrib/exporter/kafkaexporter, github.com/open-telemetry/opentelemetry-collector-contrib/exporter/loadbalancingexporter, github.com/open-telemetry/opentelemetry-collector-contrib/exporter/prometheusexporter, github.com/open-telemetry/opentelemetry-collector-contrib/exporter/prometheusremotewriteexporter, github.com/open-telemetry/opentelemetry-collector-contrib/exporter/splunkhecexporter, github.com/open-telemetry/opentelemetry-collector-contrib/exporter/syslogexporter, github.com/open-telemetry/opentelemetry-collector-contrib/exporter/zipkinexporter, github.com/open-telemetry/opentelemetry-collector-contrib/extension/basicauthextension, github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension, github.com/open-telemetry/opentelemetry-collector-contrib/extension/googleclientauthextension, github.com/open-telemetry/opentelemetry-collector-contrib/extension/headerssetterextension, github.com/open-telemetry/opentelemetry-collector-contrib/extension/healthcheckextension, github.com/open-telemetry/opentelemetry-collector-contrib/extension/jaegerremotesampling, github.com/open-telemetry/opentelemetry-collector-contrib/extension/oauth2clientauthextension, github.com/open-telemetry/opentelemetry-collector-contrib/extension/pprofextension, github.com/open-telemetry/opentelemetry-collector-contrib/extension/sigv4authextension, github.com/open-telemetry/opentelemetry-collector-contrib/extension/storage/filestorage, github.com/open-telemetry/opentelemetry-collector-contrib/pkg/datadog, github.com/open-telemetry/opentelemetry-collector-contrib/pkg/kafka/configkafka, github.com/open-telemetry/opentelemetry-collector-contrib/pkg/ottl, github.com/open-telemetry/opentelemetry-collector-contrib/pkg/pdatatest, github.com/open-telemetry/opentelemetry-collector-contrib/pkg/stanza, github.com/open-telemetry/opentelemetry-collector-contrib/pkg/translator/loki, github.com/open-telemetry/opentelemetry-collector-contrib/pkg/translator/prometheus, github.com/open-telemetry/opentelemetry-collector-contrib/pkg/translator/splunk, github.com/open-telemetry/opentelemetry-collector-contrib/processor/attributesprocessor, github.com/open-telemetry/opentelemetry-collector-contrib/processor/cumulativetodeltaprocessor, github.com/open-telemetry/opentelemetry-collector-contrib/processor/deltatocumulativeprocessor, github.com/open-telemetry/opentelemetry-collector-contrib/processor/filterprocessor, github.com/open-telemetry/opentelemetry-collector-contrib/processor/groupbyattrsprocessor, github.com/open-telemetry/opentelemetry-collector-contrib/processor/intervalprocessor, github.com/open-telemetry/opentelemetry-collector-contrib/processor/k8sattributesprocessor, github.com/open-telemetry/opentelemetry-collector-contrib/processor/metricstarttimeprocessor, github.com/open-telemetry/opentelemetry-collector-contrib/processor/probabilisticsamplerprocessor, github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor, github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourceprocessor, github.com/open-telemetry/opentelemetry-collector-contrib/processor/spanprocessor, github.com/open-telemetry/opentelemetry-collector-contrib/processor/tailsamplingprocessor, github.com/open-telemetry/opentelemetry-collector-contrib/processor/transformprocessor, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awscloudwatchreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsecscontainermetricsreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awss3receiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/cloudflarereceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/datadogreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/faroreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/filelogreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/filestatsreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/fluentforwardreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/googlecloudpubsubreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/hostmetricsreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/influxdbreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/jaegerreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/k8sobjectsreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/kafkareceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/kubeletstatsreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/prometheusreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/prometheusremotewritereceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/solacereceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/splunkhecreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/syslogreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/tcplogreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/vcenterreceiver, github.com/open-telemetry/opentelemetry-collector-contrib/receiver/zipkinreceiver, go.opentelemetry.io/collector/client, go.opentelemetry.io/collector/component, go.opentelemetry.io/collector/component/componentstatus, go.opentelemetry.io/collector/component/componenttest, go.opentelemetry.io/collector/config/configauth, go.opentelemetry.io/collector/config/configcompression, go.opentelemetry.io/collector/config/configgrpc, go.opentelemetry.io/collector/config/confighttp, go.opentelemetry.io/collector/config/confignet, go.opentelemetry.io/collector/config/configopaque, go.opentelemetry.io/collector/config/configoptional, go.opentelemetry.io/collector/config/configretry, go.opentelemetry.io/collector/config/configtelemetry, go.opentelemetry.io/collector/config/configtls, go.opentelemetry.io/collector/confmap, go.opentelemetry.io/collector/confmap/provider/envprovider, go.opentelemetry.io/collector/confmap/provider/fileprovider, go.opentelemetry.io/collector/confmap/provider/httpprovider, go.opentelemetry.io/collector/confmap/provider/httpsprovider, go.opentelemetry.io/collector/confmap/provider/yamlprovider, go.opentelemetry.io/collector/confmap/xconfmap, go.opentelemetry.io/collector/connector, go.opentelemetry.io/collector/connector/connectortest, go.opentelemetry.io/collector/connector/forwardconnector, go.opentelemetry.io/collector/consumer, go.opentelemetry.io/collector/consumer/consumertest, go.opentelemetry.io/collector/exporter, go.opentelemetry.io/collector/exporter/debugexporter, go.opentelemetry.io/collector/exporter/exporterhelper, go.opentelemetry.io/collector/exporter/nopexporter, go.opentelemetry.io/collector/exporter/otlpexporter, go.opentelemetry.io/collector/exporter/otlphttpexporter, go.opentelemetry.io/collector/extension, go.opentelemetry.io/collector/extension/extensionauth, go.opentelemetry.io/collector/extension/extensiontest, go.opentelemetry.io/collector/extension/xextension, go.opentelemetry.io/collector/extension/zpagesextension, go.opentelemetry.io/collector/featuregate, go.opentelemetry.io/collector/otelcol, go.opentelemetry.io/collector/pdata, go.opentelemetry.io/collector/pipeline, go.opentelemetry.io/collector/processor, go.opentelemetry.io/collector/processor/batchprocessor, go.opentelemetry.io/collector/processor/memorylimiterprocessor, go.opentelemetry.io/collector/receiver, go.opentelemetry.io/collector/receiver/otlpreceiver, go.opentelemetry.io/collector/receiver/receiverhelper, go.opentelemetry.io/collector/receiver/receivertest, go.opentelemetry.io/collector/scraper/scraperhelper, go.opentelemetry.io/collector/service, go.opentelemetry.io/otel/exporters/otlp/otlptrace, go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/sdk/metric, go.opentelemetry.io/otel/trace)
• fix(deps): Update gomod unstable dependency github.com/google/cadvisor to v0.56.2
• fix(deps): Update gomod unstable dependency github.com/hashicorp/vault/api/auth/approle to v0.12.0
• fix(deps): Update gomod unstable dependency github.com/hashicorp/vault/api/auth/aws to v0.12.0
• fix(deps): Update gomod unstable dependency github.com/hashicorp/vault/api/auth/azure to v0.11.0
• fix(deps): Update gomod unstable dependency github.com/hashicorp/vault/api/auth/gcp to v0.12.0
• fix(deps): Update gomod unstable dependency github.com/hashicorp/vault/api/auth/kubernetes to v0.12.0
• fix(deps): Update gomod unstable dependency github.com/hashicorp/vault/api/auth/ldap to v0.12.0
• fix(deps): Update gomod unstable dependency github.com/hashicorp/vault/api/auth/userpass to v0.12.0
• fix(deps): Update gomod unstable dependency github.com/percona/mongodb_exporter to v0.50.0
• fix(deps): Update gomod unstable dependency github.com/prometheus-community/elasticsearch_exporter to v1.10.0
• fix(deps): Update gomod unstable dependency github.com/prometheus-operator/prometheus-operator to v0.90.1
• fix(deps): Update gomod unstable dependency github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring to v0.90.1
• fix(deps): Update gomod unstable dependency github.com/prometheus-operator/prometheus-operator/pkg/client to v0.90.1
• fix(deps): Update gomod unstable dependency github.com/prometheus/alertmanager to v0.31.1
• fix(deps): Update gomod unstable dependency github.com/prometheus/consul_exporter to v0.13.0
• fix(deps): Update gomod unstable dependency github.com/prometheus/memcached_exporter to v0.15.5
• fix(deps): Update gomod unstable dependency github.com/prometheus/sigv4 to v0.4.1
• fix(deps): Update gomod unstable dependency github.com/testcontainers/testcontainers-go to v0.41.0
• fix(deps): Update gomod unstable dependency go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux to v0.67.0
• fix(deps): Update gomod unstable dependency go.opentelemetry.io/otel/exporters/prometheus to v0.65.0
• fix(deps): Update gomod unstable dependency google.golang.org/api to v0.274.0
• chore(deps): Update docker-compose dependency mysql to v9
• chore(deps): Update docker-compose dependency redis to v8
• chore(deps): Update dockerfile dependency debian to v13
• chore(deps): Update npm dependency @eslint/js to v10
• chore(deps): Update npm dependency @types/react to v19
• chore(deps): Update npm dependency @types/react-dom to v19
• chore(deps): Update npm dependency @vitejs/plugin-react to v6
• chore(deps): Update npm dependency eslint to v10
• chore(deps): Update npm dependency eslint-plugin-react-hooks to v7
• chore(deps): Update npm dependency eslint-plugin-simple-import-sort to v13
• chore(deps): Update npm dependency globals to v17
• chore(deps): Update npm dependency typescript to v6
• fix(deps): Update gomod dependency github.com/caarlos0/env/v9 to v11
• fix(deps): Update gomod dependency github.com/google/go-github/v57 to v84
• fix(deps): Update gomod dependency github.com/hashicorp/golang-lru to v2
• fix(deps): Update gomod dependency github.com/olekukonko/tablewriter to v1
• fix(deps): Update gomod dependency github.com/oschwald/geoip2-golang to v2
• fix(deps): Update gomod dependency github.com/oschwald/maxminddb-golang to v2
• fix(deps): Update gomod dependency github.com/shirou/gopsutil/v3 to v4
• fix(deps): Update gomod dependency github.com/wk8/go-ordered-map to v2
• fix(deps): Update gomod dependency go.yaml.in/yaml/v2 to v3
• fix(deps): Update gomod dependency gopkg.in/yaml.v2 to v3
• fix(deps): Update npm dependency @dagrejs/dagre to v3
• fix(deps): Update npm dependency @fortawesome/fontawesome-svg-core to v7
• fix(deps): Update npm dependency @fortawesome/free-solid-svg-icons to v7
• fix(deps): Update npm dependency @fortawesome/react-fontawesome to v3
• fix(deps): Update npm dependency @grafana/data to v12
• fix(deps): Update npm dependency @grafana/ui to v12
• fix(deps): Update npm dependency d3-dag to v1
• fix(deps): Update npm dependency react to v19
• fix(deps): Update npm dependency react-dom to v19
• 🔐 Create all pending approval PRs at once 🔐

Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

• chore(deps): Pin dependencies (github.com/grafana/grafonnet/gen/grafonnet-latest, github.com/grafana/jsonnet-libs/logs-lib/, github.com/grafana/jsonnet-libs/logs-lib/logs)
• chore(deps): Update github-actions dependencies (actions/cache, actions/checkout, anthropics/claude-code-action, golangci/golangci-lint, grafana/security-github-actions, grafana/writers-toolkit, softprops/action-gh-release)
• chore(deps): update grafana/shared-workflows/azure-trusted-signing action to v1.0.1
• chore(deps): update grafana/shared-workflows/get-vault-secrets action to v1.3.1
• fix(deps): Update npm dependencies (@grafana/data, @grafana/ui, @testing-library/jest-dom, @testing-library/react, @types/node, @xyflow/react, prettier, react-router, release-please, typescript-eslint, vitest)
• chore(deps): Update docker-compose dependencies (grafana/loki, grafana/mimir, postgres)
• chore(deps): Update Node.js to v24.14.1
• chore(deps): Lock file maintenance
• 🔐 Create all rate-limited PRs at once 🔐

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

• chore(deps): Update docker-compose dependency postgres to v18
• chore(deps): Update github-actions dependency actions/github-script to v9
• chore(deps): Update github-actions dependency softprops/action-gh-release to v3
• chore(deps): Update github-actions dependency windows to v2025

---

Warning

Renovate failed to look up the following dependencies: Could not determine new digest for update (github-tags package grafana/shared-workflows), Failed to look up github-tags package aquasecurity/trivy-action: no-result, Failed to look up go package github.com/open-telemetry/opentelemetry-collector-contrib/exporter/awss3exporter: no-result, Failed to look up go package github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/collector: no-result, Failed to look up go package example.com/fork: no-result.

Files affected: .github/workflows/release-announce.yml, .github/workflows/trigger-argo-workflow-on-tag.yml, .github/workflows/trivy.yml, collector/go.mod, go.mod, tools/generate-module-dependencies/testdata/update-existing-mod/go.mod

---

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): Update npm dependency vite to v7.3.2 [SECURITY]
• chore(deps): Update module github.com/aws/aws-sdk-go-v2/service/lambda to v1.88.5 [SECURITY]
• chore(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY]
• fix(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY]
• fix(deps): Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY]
• fix(deps): Update module go.opentelemetry.io/otel/sdk to v1.43.0 [SECURITY]
• chore(deps): Pin grafana/alloy-dev Docker tag to cc8edd3
• chore(deps): Update dockerfile dependencies (debian, docker/dockerfile, golang, mcr.microsoft.com/windows/nanoserver, public.ecr.aws/ubuntu/ubuntu)
• fix(deps): Update go dependencies (cloud.google.com/go/pubsub/v2, github.com/DataDog/datadog-agent/pkg/util/system, github.com/DataDog/go-sqllexer, github.com/IBM/sarama, github.com/aws/aws-sdk-go-v2/config, github.com/aws/aws-sdk-go-v2/feature/ec2/imds, github.com/aws/aws-sdk-go-v2/service/s3, github.com/aws/aws-sdk-go-v2/service/servicediscovery, github.com/deneonet/benc, github.com/fatih/color, github.com/go-git/go-git/v5, github.com/grafana/beyla/v3, github.com/grafana/loki/v3, github.com/hashicorp/consul/api, github.com/hashicorp/go-discover, github.com/hashicorp/vault/api, github.com/influxdata/telegraf, github.com/lib/pq, github.com/ohler55/ojg, github.com/oliver006/redis_exporter, github.com/openai/openai-go/v3, github.com/prometheus-community/postgres_exporter, github.com/prometheus/mysqld_exporter, github.com/prometheus/node_exporter, github.com/prometheus/statsd_exporter, github.com/samber/lo, github.com/spf13/cobra, github.com/zricethezav/gitleaks/v8, go, go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp, go.opentelemetry.io/contrib/propagators/jaeger, go.opentelemetry.io/obi, go.opentelemetry.io/otel, golang.org/x/mod, golang.org/x/oauth2, golang.org/x/sys, golang.org/x/time, google.golang.org/grpc, k8s.io/klog/v2)
• chore(deps): Lock file maintenance
• chore(deps): Lock file maintenance
• Click on this checkbox to rebase all open PRs at once

Vulnerabilities

Important

28/55 CVEs have Renovate fixes.

gomod

collector/go.mod

github.com/grafana/alloy

• GHSA-chqx-36rm-rf8h (fixed in >= 1.3.4)
• GO-2024-3168 (fixed in >= 1.3.4)

github.com/aws/aws-sdk-go-v2/service/lambda

• GHSA-xmrv-pmrh-hhx2 (fixed in >= 1.88.5)

github.com/buger/jsonparser

• GO-2026-4514

github.com/docker/docker

• GHSA-6hwg-w5jg-9c6x
• GHSA-j249-ghv5-7mxv
• GHSA-pxq6-2prw-chj9
• GHSA-qrqr-3x5j-2xw9
• GHSA-x744-4wpc-v9h2
• GO-2026-4883
• GO-2026-4887

github.com/jackc/pgproto3/v2

• GHSA-jqcq-xjh3-6g23 (fixed in > 2.3.3)
• GO-2026-4518

go.etcd.io/bbolt

• GHSA-6jwv-w5xf-7j27 (fixed in > 1.4.3)

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp

• GHSA-w8rr-5gcm-pp58 (fixed in >= 0.19.0)

go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp

• GHSA-w8rr-5gcm-pp58 (fixed in >= 1.43.0)

go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp

• GHSA-w8rr-5gcm-pp58 (fixed in >= 1.43.0)

go.opentelemetry.io/otel/sdk

• GHSA-hfvc-g4fc-pqhx (fixed in >= 1.43.0)

extension/alloyengine/go.mod

github.com/grafana/alloy

• GHSA-chqx-36rm-rf8h (fixed in >= 1.3.4)
• GO-2024-3168 (fixed in >= 1.3.4)

github.com/aws/aws-sdk-go-v2/service/lambda

• GHSA-xmrv-pmrh-hhx2 (fixed in >= 1.88.5)

github.com/buger/jsonparser

• GO-2026-4514

github.com/docker/docker

• GHSA-6hwg-w5jg-9c6x
• GHSA-j249-ghv5-7mxv
• GHSA-pxq6-2prw-chj9
• GHSA-qrqr-3x5j-2xw9
• GHSA-x744-4wpc-v9h2
• GO-2026-4883
• GO-2026-4887

github.com/jackc/pgproto3/v2

• GHSA-jqcq-xjh3-6g23 (fixed in > 2.3.3)
• GO-2026-4518

go.etcd.io/bbolt

• GHSA-6jwv-w5xf-7j27 (fixed in > 1.4.3)

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp

• GHSA-w8rr-5gcm-pp58 (fixed in >= 0.19.0)

go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp

• GHSA-w8rr-5gcm-pp58 (fixed in >= 1.43.0)

go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp

• GHSA-w8rr-5gcm-pp58 (fixed in >= 1.43.0)

go.opentelemetry.io/otel/sdk

• GHSA-hfvc-g4fc-pqhx (fixed in >= 1.43.0)

go.mod

github.com/buger/jsonparser

• GO-2026-4514

github.com/docker/docker

• GHSA-6hwg-w5jg-9c6x
• GHSA-j249-ghv5-7mxv
• GHSA-pxq6-2prw-chj9
• GHSA-qrqr-3x5j-2xw9
• GHSA-x744-4wpc-v9h2
• GO-2026-4883
• GO-2026-4887

go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp

• GHSA-w8rr-5gcm-pp58 (fixed in >= 1.43.0)

go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp

• GHSA-w8rr-5gcm-pp58 (fixed in >= 1.43.0)

go.opentelemetry.io/otel/sdk

• GHSA-hfvc-g4fc-pqhx (fixed in >= 1.43.0)

github.com/jackc/pgproto3/v2

• GHSA-jqcq-xjh3-6g23 (fixed in > 2.3.3)
• GO-2026-4518

go.etcd.io/bbolt

• GHSA-6jwv-w5xf-7j27 (fixed in > 1.4.3)

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp

• GHSA-w8rr-5gcm-pp58 (fixed in >= 0.19.0)

github.com/aws/aws-sdk-go-v2/service/lambda

• GHSA-xmrv-pmrh-hhx2 (fixed in >= 1.88.5)

npm

internal/web/ui/package.json

vite

• GHSA-4w7w-66w2-5vf9 (fixed in >= 7.3.2)
• GHSA-p9ff-h696-f583 (fixed in >= 7.3.2)
• GHSA-v2wj-q39q-566r (fixed in >= 7.3.2)

Detected Dependencies

Note

Detected dependencies section has been truncated

docker-compose (3)

docs/developer/updating-otel/k6-trace-gen/docker-compose.yaml (1)

• ghcr.io/grafana/xk6-client-tracing v0.0.5 → [Updates: v0.0.9, v0.0.5]

example/docker-compose/compose.yaml (1)

• grafana/alloy latest@sha256:579582bce40049f2e27bd1e445000689c907a41f0495cb0d0c7f65609316ba7c

integration-tests/docker/docker-compose.yaml (9)

• grafana/mimir 3.0.4@sha256:686138d9f941508c99c931cc9e69bf9f6100dd4d2d623bf57b38d5c25ee645c1 → [Updates: 3.0.5]
• apache/kafka latest@sha256:9516fb7634bad307d17c33b589fde9023003b0cb761374f500002b980a3149b9
• grafana/loki 3.6.7@sha256:3c8fd3570dd9219951a60d3f919c7f31923d10baee578b77bc26c4a0b32d092d → [Updates: 3.7.1]
• redis 6.2.21-alpine@sha256:46884be93652d02a96a176ccf173d1040bef365c5706aa7b6a1931caec8bfeef → [Updates: 8.6.2-alpine]
• redis 6.2.21-alpine@sha256:46884be93652d02a96a176ccf173d1040bef365c5706aa7b6a1931caec8bfeef → [Updates: 8.6.2-alpine]
• tandrup/snmpsim v0.4@sha256:a080b493042d91c4cec9282a83403e334660ed1c2c71e7e3afa920c3f1c42d7e
• mysql 8.4@sha256:da906917ca4ace3ba55538b7c2ee97a9bc865ef14a4b6920b021f0249d603f3d → [Updates: 9.6]
• postgres 16@sha256:2586e2a95d1c9b31cb2967feb562948f7d364854453d703039b6efa45fe48417 → [Updates: 18, 16]
• postgres 16@sha256:2586e2a95d1c9b31cb2967feb562948f7d364854453d703039b6efa45fe48417 → [Updates: 18, 16]

dockerfile (11)

Dockerfile (4)

• docker/dockerfile 1.21@sha256:27f9262d43452075f3c410287a2c43f5ef1bf7ec2bb06e8c9eeb1b8d453087bc → [Updates: 1.23]
• grafana/alloy-build-image v0.1.30@sha256:5ec4c2b765b604d71a6a78b55ed59740d143a79fd84cb7a2bc34fd76a9a3c6e6
• grafana/alloy-build-image v0.1.30@sha256:5ec4c2b765b604d71a6a78b55ed59740d143a79fd84cb7a2bc34fd76a9a3c6e6
• public.ecr.aws/ubuntu/ubuntu noble@sha256:b1940c8ecf8ff591053cc5db0303fb882f9fafec50f26892a870bcbe1b30d25a → [Updates: noble]

Dockerfile.windows (2)

• golang 1.26-windowsservercore-ltsc2022@sha256:8231fbb9b76c4acf94daf580a35ef5a64480e545aded8062fb29deaf456c145f → [Updates: 1.26-windowsservercore-ltsc2022]
• mcr.microsoft.com/windows/nanoserver ltsc2022@sha256:60612a30303eb5a15ce7f53fa2eecf70bca41d72657de0482fbde601ae5f3403 → [Updates: ltsc2022]

example/docker-compose/images/grizzly/Dockerfile (1)

• golang 1.25.9-alpine@sha256:7a00384194cf2cb68924bbb918d675f1517357433c8541bac0ab2f929b9d5447 → [Updates: 1.26.1-alpine]

example/docker-compose/images/jb/Dockerfile (1)

• golang 1.25.9-alpine@sha256:7a00384194cf2cb68924bbb918d675f1517357433c8541bac0ab2f929b9d5447 → [Updates: 1.26.1-alpine]

integration-tests/docker/configs/kafka/Dockerfile (2)

• golang 1.25.9@sha256:5ab234a9519e05043f4a97a505a59f21dc40eee172d6b17d411863d6bba599bb → [Updates: 1.26.0, 1.25.9]
• alpine 3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659

integration-tests/docker/configs/otel-gen/Dockerfile (2)

• golang 1.25.9@sha256:5ab234a9519e05043f4a97a505a59f21dc40eee172d6b17d411863d6bba599bb → [Updates: 1.26.0, 1.25.9]
• alpine 3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659

integration-tests/docker/configs/prom-gen/Dockerfile (2)

• golang 1.25.9@sha256:5ab234a9519e05043f4a97a505a59f21dc40eee172d6b17d411863d6bba599bb → [Updates: 1.26.0, 1.25.9]
• alpine 3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659

internal/tools/packaging_test/testdata/centos-systemd.Dockerfile (1)

• centos 8@sha256:a27fd8080b517143cbbbab9dfb7c8571c40d67d534bbdee55bd6c473f432b177

internal/tools/packaging_test/testdata/debian-systemd.Dockerfile (1)

• debian 10@sha256:58ce6f1271ae1c8a2006ff7d3e54e9874d839f573d8009c20154ad0f2fb0a225 → [Updates: buster-20240612, trixie-20260316]

tools/build-image/Dockerfile (6)

• docker/dockerfile 1.21@sha256:27f9262d43452075f3c410287a2c43f5ef1bf7ec2bb06e8c9eeb1b8d453087bc → [Updates: 1.23]
• alpine 3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
• alpine 3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
• alpine 3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
• mustoverride unknown version
• rfratto/viceroy v0.4.0@sha256:7e3f328889b5b0c5c0303dda5e74a89189e6e437d33f609dde98f9a84337e0a2

tools/build-image/windows/Dockerfile (1)

• golang 1.25.9-windowsservercore-ltsc2022@sha256:8231fbb9b76c4acf94daf580a35ef5a64480e545aded8062fb29deaf456c145f → [Updates: 1.26.1-windowsservercore-ltsc2022, 1.25.9-windowsservercore-ltsc2022]

github-actions (25)

.github/workflows/agent_bump_beyla.yml (13)

• grafana/shared-workflows get-vault-secrets/v1.3.0@a37de51f3d713a30a9e4b21bcdfbd38170020593 → [Updates: get-vault-secrets/v1.3.1]
• actions/create-github-app-token v3.0.0@f8d387b68d61c58ab83c6c016672934102569859 → [Updates: v3.1.1]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c
• anthropics/claude-code-action v1.0.72@cd77b50d2b0808657f8e6774085c8bf54484351c → [Updates: v1.0.89]
• actions/upload-artifact v7.0.0@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f → [Updates: v7.0.1]
• grafana/shared-workflows get-vault-secrets/v1.3.0@a37de51f3d713a30a9e4b21bcdfbd38170020593 → [Updates: get-vault-secrets/v1.3.1]
• actions/create-github-app-token v3.0.0@f8d387b68d61c58ab83c6c016672934102569859 → [Updates: v3.1.1]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c
• anthropics/claude-code-action v1.0.72@cd77b50d2b0808657f8e6774085c8bf54484351c → [Updates: v1.0.89]
• actions/upload-artifact v7.0.0@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f → [Updates: v7.0.1]

.github/workflows/ai-dependency-review.yml (3)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c
• grafana/shared-workflows get-vault-secrets/v1.3.0@a37de51f3d713a30a9e4b21bcdfbd38170020593 → [Updates: get-vault-secrets/v1.3.1]

.github/workflows/auto-apply-component-labels.yml (1)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd

.github/workflows/autolock.yml (1)

• dessant/lock-threads v6.0.0@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7

.github/workflows/build.yml (17)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c
• grafana/alloy-build-image v0.1.30@sha256:5ec4c2b765b604d71a6a78b55ed59740d143a79fd84cb7a2bc34fd76a9a3c6e6
• grafana/alloy-build-image v0.1.30-boringcrypto@sha256:0cec8ae144d98fdbc834ae28ddf0f2636deb07c53c985648d09897b5a61b3222
• macos 15-large
• macos 15-xlarge
• grafana/alloy-build-image v0.1.30@sha256:5ec4c2b765b604d71a6a78b55ed59740d143a79fd84cb7a2bc34fd76a9a3c6e6

.github/workflows/bump-formula-pr.yml (4)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• grafana/shared-workflows get-vault-secrets/v1.3.0@a37de51f3d713a30a9e4b21bcdfbd38170020593 → [Updates: get-vault-secrets/v1.3.1]
• actions/create-github-app-token v3.0.0@f8d387b68d61c58ab83c6c016672934102569859 → [Updates: v3.1.1]
• rez0n/actions-github-release main@794c12f5e8d629e6ca329cf2e2daeb0f0ce6a3ce

.github/workflows/check_docs.yml (1)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd

.github/workflows/check-alloy-mixin-rendered.yml (2)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4a3601121dd01d1626a1e23e37211e3254c1c06c

.github/workflows/check-component-labels.yml (1)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd

.github/workflows/check-generate-otel-collector-distro.yml (2)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4a3601121dd01d1626a1e23e37211e3254c1c06c

.github/workflows/check-linux-build-image.yml (4)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• docker/setup-qemu-action v4.0.0@ce360397dd3f832beb865e1373c09c0e9f86d70a
• docker/setup-buildx-action v4.0.0@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
• docker/build-push-action v7.0.0@d08e5c354a6adb9ed34480a06d141179aa583294 → [Updates: v7.1.0]

.github/workflows/check-sync-module-dependencies.yml (2)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4a3601121dd01d1626a1e23e37211e3254c1c06c

.github/workflows/check-windows-build-image.yml (3)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• mr-smithers-excellent/docker-build-push v6.8@19d2beefef6bcdc202195fdcb9deb79a4fab5c1f → [Updates: v6.10]
• windows 2022 → [Updates: 2025]

.github/workflows/create_build_image.yml (5)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• grafana/shared-workflows dockerhub-login/v1.0.3@081a366728379fd0426b9cfef190e9a21c2d5418
• docker/setup-qemu-action v4.0.0@ce360397dd3f832beb865e1373c09c0e9f86d70a
• docker/setup-buildx-action v4.0.0@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
• docker/build-push-action v7.0.0@d08e5c354a6adb9ed34480a06d141179aa583294 → [Updates: v7.1.0]

.github/workflows/depcheck.yml (2)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• rfratto/depcheck main@95f3e3d75101f21e73363c928d500a222cf03572

.github/workflows/deploy-pr-preview.yml (1)

• grafana/writers-toolkit main → [Updates: main]

.github/workflows/docker-images.yml (3)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• windows 2022 → [Updates: 2025]

.github/workflows/fuzz-go.yml (6)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c
• actions/cache v5.0.3@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 → [Updates: v5.0.4]
• actions/upload-artifact v7.0.0@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f → [Updates: v7.0.1]
• actions/github-script v8.0.0@ed597411d8f924073f98dfc5c65a23a2325f34cd → [Updates: v9.0.0]

.github/workflows/generate-component-labels.yml (1)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd

.github/workflows/helm-release.yml (8)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• helm/chart-testing-action v2.8.0@6ec842c01de15ebb84c8627d2744a0c2f2755c9f
• grafana/shared-workflows get-vault-secrets/v1.3.0@a37de51f3d713a30a9e4b21bcdfbd38170020593 → [Updates: get-vault-secrets/v1.3.1]
• actions/create-github-app-token v3.0.0@f8d387b68d61c58ab83c6c016672934102569859 → [Updates: v3.1.1]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• azure/setup-helm v5.0.0@dda3372f752e03dde6b3237bc9431cdc2f7a02a2
• softprops/action-gh-release v2.5.0@a06a81a03ee405af7f2048a818ed3f03bbf83c7b → [Updates: v2.6.1, v3.0.0]

.github/workflows/helm-test.yml (9)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• azure/setup-helm v5.0.0@dda3372f752e03dde6b3237bc9431cdc2f7a02a2
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• azure/setup-helm v5.0.0@dda3372f752e03dde6b3237bc9431cdc2f7a02a2
• actions/setup-python v6.2.0@a309ff8b426b58ec0e2a45f0f869d46889d02405
• helm/chart-testing-action v2.8.0@6ec842c01de15ebb84c8627d2744a0c2f2755c9f
• helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc
• python 3.13.3

.github/workflows/integration-test-windows-service.yml (2)

• actions/checkout v6.0.1@8e8c483db84b4bee98b60c0593521ed34d9990e8 → [Updates: v6.0.2]
• actions/setup-go v6.4.0@4a3601121dd01d1626a1e23e37211e3254c1c06c

.github/workflows/integration-tests-k8s.yml (2)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4a3601121dd01d1626a1e23e37211e3254c1c06c