Dependency Dashboard

[renovate-sh-app]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Repository Problems

Renovate tried to run on this repository, but found these problems.

• ⚠️ WARN: Package lookup failures

Deprecations / Replacements

Warning

The following dependencies are either deprecated or have replacements available.

Datasource	Package	Replacement PR?
bun	@types/eslint__js

Abandoned Dependencies

The following dependencies have not received updates for an extended period and may be unmaintained.

View abandoned dependencies (28)

[!NOTE]
Packages are marked as abandoned when they exceed the abandonmentThreshold since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity.

Datasource	Package	Last Updated
bun	@types/tmp	2023-11-07
github-actions	dsaltares/fetch-gh-release-asset	2024-04-26
github-actions	pre-commit/action	2024-02-07
gomod	github.com/davecgh/go-spew	2018-02-21
gomod	github.com/go-kit/log	2022-05-14
gomod	github.com/inconshreveable/mousetrap	2022-11-27
gomod	github.com/kelseyhightower/envconfig	2019-05-24
gomod	github.com/kr/pretty	2022-08-29
gomod	github.com/pmezard/go-difflib	2016-01-10
gomod	github.com/willabides/actionslog	2023-07-20
gomod	gopkg.in/check.v1	2020-11-30
gomod	gopkg.in/yaml.v3	2022-05-27

Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

• chore(deps): update grafana/shared-workflows/get-vault-secrets action to v2.0.1
• chore(deps): update mikefarah/yq docker tag to v4.53.4
• fix(deps): update module google.golang.org/protobuf to v1.36.12
• fix(deps): update octokit monorepo (@octokit/core, @octokit/graphql, @octokit/request-error)
• chore(deps): update actions/attest-build-provenance action to v4.2.2
• chore(deps): update actions/checkout action to v6.1.0
• chore(deps): update dependency globals to v17.11.0
• chore(deps): update dependency grafana/grafana-bench to v1.2.0
• chore(deps): update dependency renovate to 43.288
• chore(deps): update dependency typescript-eslint to v8.67.0
• chore(deps): update dependency zizmor to v1.29.0
• chore(deps): update docker/setup-buildx-action action to v4.3.0
• chore(deps): update go toolchain directive to v1.27.0
• chore(deps): update int128/comment-action action to v1.72.0
• chore(deps): update int128/hide-comment-action action to v1.69.0
• chore(deps): update module github.com/rogpeppe/go-internal to v1.16.0
• chore(deps): update module golang.org/x/text to v0.41.0
• chore(deps): update step-security/harden-runner action to v2.21.0
• fix(deps): update module github.com/stretchr/testify to v1.12.0
• fix(deps): update module github.com/urfave/cli/v3 to v3.11.0
• fix(deps): update module golang.org/x/tools to v0.49.0
• chore(deps): update actions/checkout action to v7
• chore(deps): update astral-sh/setup-uv action to v10
• chore(deps): update dependency renovate to v44
• chore(deps): update module go.yaml.in/yaml/v2 to v3
• chore(deps): update octokit monorepo (major) (@octokit/openapi-types, @octokit/types)
• chore(deps): update slackapi/slack-github-action action to v4
• fix(deps): update module github.com/cenkalti/backoff/v5 to v7
• fix(deps): update module github.com/neilotoole/slogt to v2
• 🔐 Create all rate-limited PRs at once 🔐

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

• chore(deps): update golang.org/x/exp digest to ca53665
• chore(deps): update dependency @types/bun to v1.4.0 (@types/bun, Bun)

---

Warning

Renovate failed to look up the following dependencies: Could not determine new digest for update (github-tags package grafana/shared-workflows).

Files affected: actions/run-capslock/action.yaml

---

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): update k8s.io/utils digest to cf1189d
• chore(deps): update dependency eslint to v10.8.1
• chore(deps): update dependency eslint-plugin-jest to v29.16.1
• chore(deps): update dependency jose to v6.2.9
• chore(deps): update github/codeql-action action to v4.37.7
• fix(deps): update commitlint monorepo (@commitlint/config-conventional, @commitlint/format, @commitlint/lint, @commitlint/load, @commitlint/types)
• fix(deps): update module github.com/lmittmann/tint to v1.2.0
• fix(deps): update module k8s.io/apimachinery to v0.36.3
• chore(deps): update dependency typescript to v7
• chore(deps): lock file maintenance
• Click on this checkbox to rebase all open PRs at once

PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

• chore(deps): update actions/dependency-review-action action to v5

Vulnerabilities

Renovate has not found any CVEs on osv.dev.

Detected Dependencies

bun (7)

actions/dependabot-auto-triage/package.json (12)

• @octokit/graphql 9.0.3 → [Updates: 9.0.4]
• @octokit/request-error 7.1.0 → [Updates: 7.1.1]
• @octokit/rest 22.0.1
• minimatch 10.2.6
• @eslint/js 10.0.1
• @types/bun 1.3.14 → [Updates: 1.4.0]
• eslint 10.8.0 → [Updates: 10.8.1]
• eslint-config-prettier 10.1.8
• eslint-plugin-jest 29.16.0 → [Updates: 29.16.1]
• eslint-plugin-prettier 5.5.6
• typescript 6.0.3 → [Updates: 7.0.2]
• typescript-eslint 8.65.0 → [Updates: 8.67.0]

actions/dependabot-auto-triage/package.json (12)

• @octokit/graphql 9.0.3 → [Updates: 9.0.4]
• @octokit/request-error 7.1.0 → [Updates: 7.1.1]
• @octokit/rest 22.0.1
• minimatch 10.2.6
• @eslint/js 10.0.1
• @types/bun 1.3.14 → [Updates: 1.4.0]
• eslint 10.8.0 → [Updates: 10.8.1]
• eslint-config-prettier 10.1.8
• eslint-plugin-jest 29.16.0 → [Updates: 29.16.1]
• eslint-plugin-prettier 5.5.6
• typescript 6.0.3 → [Updates: 7.0.2]
• typescript-eslint 8.65.0 → [Updates: 8.67.0]

actions/get-latest-workflow-artifact/package.json (6)

• @actions/artifact 6.2.1
• @actions/core 3.0.1
• @actions/github 9.1.1
• @js-temporal/polyfill 0.5.1
• @octokit/openapi-types 27.0.0 → [Updates: 28.0.0]
• @types/node 26.2.0

actions/get-latest-workflow-artifact/package.json (6)

• @actions/artifact 6.2.1
• @actions/core 3.0.1
• @actions/github 9.1.1
• @js-temporal/polyfill 0.5.1
• @octokit/openapi-types 27.0.0 → [Updates: 28.0.0]
• @types/node 26.2.0

actions/lint-pr-title/package.json (23)

• @actions/core 3.0.1
• @actions/github 9.1.1
• @commitlint/config-conventional 21.0.2 → [Updates: 21.2.2]
• @commitlint/format 21.0.1 → [Updates: 21.2.2]
• @commitlint/lint 21.0.2 → [Updates: 21.2.2]
• @commitlint/load 21.0.2 → [Updates: 21.2.2]
• @octokit/core 7.0.6 → [Updates: 7.0.7]
• @octokit/graphql 9.0.3 → [Updates: 9.0.4]
• tmp 0.2.7
• @commitlint/types 21.0.1 → [Updates: 21.2.0]
• @eslint/js 10.0.1
• @octokit/types 16.0.0 → [Updates: 17.0.0]
• @octokit/webhooks-types 7.6.1
• @types/bun 1.3.14 → [Updates: 1.4.0]
• @types/eslint__js 9.14.0
• @types/tmp 0.2.6
• eslint 10.8.0 → [Updates: 10.8.1]
• eslint-config-prettier 10.1.8
• eslint-plugin-jest 29.16.0 → [Updates: 29.16.1]
• eslint-plugin-prettier 5.5.6
• prettier 3.9.6
• typescript 6.0.3 → [Updates: 7.0.2]
• typescript-eslint 8.65.0 → [Updates: 8.67.0]

actions/signed-commits-info/package.json (5)

• @actions/core ^3.0.0
• @actions/github ^9.0.0
• @eslint/js 10.0.1
• eslint 10.8.0 → [Updates: 10.8.1]
• typescript 6.0.3 → [Updates: 7.0.2]

package.json (10)

• @eslint/js 10.0.1
• @types/bun 1.3.14 → [Updates: 1.4.0]
• eslint 10.8.0 → [Updates: 10.8.1]
• eslint-config-prettier 10.1.8
• eslint-plugin-jest 29.16.0 → [Updates: 29.16.1]
• eslint-plugin-prettier 5.5.6
• globals 17.9.0 → [Updates: 17.11.0]
• prettier 3.9.6
• typescript-eslint 8.65.0 → [Updates: 8.67.0]
• typescript ^5 || ^6.0.0 → [Updates: ^5 || ^6.0.0 || ^7.0.0]

bun-version (1)

.bun-version (1)

• Bun 1.3.14 → [Updates: 1.4.0]

github-actions (63)

.github/workflows/build-trigger-argo-workflow.yaml (5)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• golangci/golangci-lint-action v9.3.0@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a
• golangci/golangci-lint latest

.github/workflows/check-catalog-info.yaml (3)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e

.github/workflows/check-drone-signature.yaml (5)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3
• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1

.github/workflows/check-for-non-releasable-actions.yaml (3)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/github-script v9@3a2844b7e9c422d3c10d287c895573f7108da1b3

.github/workflows/codeql.yml (4)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• github/codeql-action v4.37.3@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 → [Updates: v4.37.7]
• github/codeql-action v4.37.3@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 → [Updates: v4.37.7]

.github/workflows/dependency-review.yml (3)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/dependency-review-action v4.9.0@2031cfc080254a8a887f58cffee85186f0e49e48 → [Updates: v5.0.0]

.github/workflows/docker-build-push-multiarch.yml (4)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• grafana/shared-workflows docker-build-push-image/v0.3.4@c66d74df41cf4ed28a90da1d91c263f9d1609a21
• grafana/shared-workflows docker-export-digest/v0.1.4@015e80562a04751edab840263e21561807c88c76
• grafana/shared-workflows docker-import-digests-push-manifest/v0.2.2@e1fd5ba412232d9b76c72fcbe77acb6323ba884e

.github/workflows/global-signed-commits-info.yml (1)

• grafana/shared-workflows signed-commits-info/v0.1.0@f7e20b4de846c5951fba99c43c0340e8d2147468

.github/workflows/lint-pr-title.yml (2)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1

.github/workflows/lint-shared-workflows.yaml (5)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• mikefarah/yq 4.53.3@sha256:11a1f0b604b13dbbdc662260d8db6f644b22d8553122a25c1b5b2e8713ca6977 → [Updates: 4.53.4]

.github/workflows/pre-commit.yaml (4)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• oven-sh/setup-bun v2.2.0@0c5077e51419868618aeaa5fe8019c62421857d6
• pre-commit/action v3.0.1@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd

.github/workflows/publish-techdocs.yaml (6)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-python v7.0.0@5fda3b95a4ea91299a34e894583c3862153e4b97
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• python 3.11

.github/workflows/release.yml (3)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• googleapis/release-please-action v5@45996ed1f6d02564a971a2fa1b5860e934307cf7
• actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3

.github/workflows/reusable-zizmor.yml (19)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020
• actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3
• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• grafana/shared-workflows zizmor-collection-paths/v0.2.0@0488ac5c8514affaad8206148e57f8c44a4e9a27
• actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3
• astral-sh/setup-uv v9.0.0@c771a70e6277c0a99b617c7a806ffedaca235ff9 → [Updates: v10.0.1]
• grafana/shared-workflows validate-zizmor-config/v0.2.1@e181109698e53b4c68bd51fe27ba47c6adf27da7
• actions/cache v6@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• github/codeql-action v4.37.3@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 → [Updates: v4.37.7]
• int128/hide-comment-action v1.67.0@95dd081d51b1cae55a0d089db892cea5835e4e15 → [Updates: v1.69.0]
• int128/comment-action v1.69.0@2263c1a82c13c37672f725bcd07145530cd42579 → [Updates: v1.72.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/download-artifact v8@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
• grafana/shared-workflows send-slack-message/v3.0.2@551bc8d50017d3e95d5da3f8a4826e733a208dc0
• node 22.x

.github/workflows/scorecards.yml (5)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• ossf/scorecard-action v2.4.4@2d1146689b8cda280b9bc96326124645441f03bc
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• github/codeql-action v4.37.3@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 → [Updates: v4.37.7]

.github/workflows/sign-and-attest.yml (4)

• grafana/shared-workflows login-to-gar/v1.0.3@1f541877ceb22c7be7667d8a8df04984aeac9f9d
• sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6
• actions/attest-build-provenance v4.1.1@0f67c3f4856b2e3261c31976d6725780e5e4c373 → [Updates: v4.2.2]
• sigstore/cosign ${{ inputs.cosign-version || env.COSIGN_VERSION }}

.github/workflows/test-annotate-coverage.yaml (8)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• golangci/golangci-lint-action v9.3.0@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a
• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• golangci/golangci-lint latest

.github/workflows/test-component-change-detection.yml (2)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1

.github/workflows/test-create-github-app-token.yaml (1)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1

.github/workflows/test-download-branch-workflow-artifact.yaml (4)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1

.github/workflows/test-find-pr-for-commit.yml (2)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1

.github/workflows/test-get-vault-secrets.yaml (8)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• oven-sh/setup-bun v2.2.0@0c5077e51419868618aeaa5fe8019c62421857d6
• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• mig4/setup-bats v1.2.0@af9a00deb21b5d795cabfeaa8d9060410377686d

.github/workflows/test-lint-pr-title.yml (3)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• oven-sh/setup-bun v2.2.0@0c5077e51419868618aeaa5fe8019c62421857d6

.github/workflows/test-login-to-gar.yaml (2)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1

.github/workflows/test-remove-checkout-credentials.yaml (2)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1

.github/workflows/test-setup-argo.yml (2)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1

.github/workflows/test-setup-jrsonnet.yml (2)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1

.github/workflows/test-signed-commits-info.yml (3)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• oven-sh/setup-bun v2.2.0@0c5077e51419868618aeaa5fe8019c62421857d6

.github/workflows/test-techdocs-rewrite-relative-links.yaml (6)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• golangci/golangci-lint-action v9.3.0@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a
• go 1.25.2
• golangci/golangci-lint latest

.github/workflows/test-validate-zizmor-config.yml (3)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• astral-sh/setup-uv v9.0.0@c771a70e6277c0a99b617c7a806ffedaca235ff9 → [Updates: v10.0.1]

.github/workflows/test-wait-for-docker-publish.yml (6)

• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• step-security/harden-runner v2.20.0@bf7454d06d71f1098171f2acdf0cd4708d7b5920 → [Updates: v2.21.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1

.github/workflows/test-zizmor-collection-paths.yml (2)

• step-security/harden-runner v2.19.0@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 → [Updates: v2.21.0]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.1.0, v7.0.1]

actions/annotate-coverage/action.yaml (2)

• actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• go ${{ inputs.go-version }}

actions/argo-lint/action.yaml (1)

• grafana/shared-workflows setup-argo/v1.2.1@21cbef8182ef0fc1c3ae8e68b9590af49ed10a5b

actions/aws-auth/action.yaml (1)

• catnekaise/cognito-idpool-auth v1.0.2@41fcec30f55c069bc59f5773077c37477c743bf6

actions/azure-trusted-signing/action.yaml (4)

• actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
• actions/setup-dotnet v6.0.0@a98b56852c35b8e3190ac28c8c2271da59106c68
• azure/login v3.0.1@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

actions/component-change-detection/action.yml (3)

• actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3
• actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
• actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e

actions/create-github-app-token/action.yaml (2)

• actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3
• actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3

actions/dependabot-auto-triage/action.yml (1)

• oven-sh/setup-bun v2.2.0@0c5077e51419868618aeaa5fe8019c62421857d6

actions/docker-build-push-image/action.yaml (7)

• grafana/shared-workflows login-to-gar/v1.0.3@1f541877ceb22c7be7667d8a8df04984aeac9f9d
• grafana/shared-workflows dockerhub-login/v2.0.0@3ffeda28e54d6c8e02c3998594fafaf0a359328d
• docker/metadata-action v6.2.0@dc802804100637a589fabce1cb79ff13a1411302
• docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8
• docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c → [Updates: v4.3.0]
• docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
• buildx latest

actions/docker-export-digest/action.yaml (1)

• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

actions/docker-import-digests-push-manifest/action.yaml (8)

• actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
• docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c → [Updates: v4.3.0]
• grafana/shared-workflows login-to-gar/v1.0.3@1f541877ceb22c7be7667d8a8df04984aeac9f9d
• grafana/shared-workflows dockerhub-login/v2.0.0@3ffeda28e54d6c8e02c3998594fafaf0a359328d
• docker/metadata-action v6.2.0@dc802804100637a589fabce1cb79ff13a1411302
• actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• buildx latest
• go 1.25

actions/dockerhub-login/action.yaml (2)

• grafana/shared-workflows get-vault-secrets/v2.0.0@e46fe1e9a2bf9e618bcf8d8d32f3a7381b45c06d → [Updates: get-vault-secrets/v2.0.1]
• docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f

actions/download-branch-workflow-artifact/action.yml (2)

• actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3
• actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c

actions/find-pr-for-commit/action.yaml (1)

• octokit/graphql-action v3.0.2@ddde8ebb2493e79f390e6449c725c21663a67505

actions/generate-openapi-clients/action.yaml (3)

• actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• stefanzweifel/git-auto-commit-action v7.2.0@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d

actions/get-latest-workflow-artifact/action.yml (1)

• oven-sh/setup-bun v2.2.0@0c5077e51419868618aeaa5fe8019c62421857d6

actions/get-vault-secrets/action.yaml (2)

• actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3
• hashicorp/vault-action v4.0.0@892a26828f195e65540a40b4768ae4571f51ebfc

actions/go-flaky-tests/action.yaml (2)

• actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• go 1.25

actions/issues-update-project-status/action.yaml (1)

• grafana/shared-workflows create-github-app-token/v0.3.1@46f48da11e78ebdba7a8747ae456b11062fac83e

actions/lint-pr-title/action.yml (1)

• oven-sh/setup-bun v2.2.0@0c5077e51419868618aeaa5fe8019c62421857d6

actions/login-to-gar/action.yaml (2)

• google-github-actions/auth v3.0.0@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
• google-github-actions/setup-gcloud v3.0.1@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db

actions/login-to-gcs/action.yaml (1)

• google-github-actions/auth v3.0.0@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093

actions/push-to-gcs/action.yaml (2)

• grafana/shared-workflows login-to-gcs/v0.3.1@1f02013f3a8a0c29e3cb7dc6793158defe914569
• google-github-actions/upload-cloud-storage v3.0.0@6397bd7208e18d13ba2619ee21b9873edc94427a

actions/run-capslock/action.yaml (6)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• grafana/shared-workflows v0.1.0@2c55567fed8874f47886e035f4e91f79f6039149
• marocchino/sticky-pull-request-comment v3.0.5@5770ad5eb8f42dd2c4f34da00c94c5381e49af88
• go ${{ inputs.go-version }}

actions/send-slack-message/action.yaml (2)

• grafana/shared-workflows get-vault-secrets/v2.0.0@e46fe1e9a2bf9e618bcf8d8d32f3a7381b45c06d → [Updates: get-vault-secrets/v2.0.1]
• slackapi/slack-github-action v3.0.5@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc → [Updates: v4.0.0]

actions/setup-argo/action.yaml (2)

• actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• dsaltares/fetch-gh-release-asset 1.1.2@aa2ab1243d6e0d5b405b973c89fa4d06a2d0fff7

actions/setup-conftest/action.yaml (2)

• actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• dsaltares/fetch-gh-release-asset 1.1.2@aa2ab1243d6e0d5b405b973c89fa4d06a2d0fff7

actions/setup-jrsonnet/action.yaml (2)

• actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• dsaltares/fetch-gh-release-asset 1.1.2@aa2ab1243d6e0d5b405b973c89fa4d06a2d0fff7

actions/socket-export-sbom/action.yml (3)

• actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020
• actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3
• node 22

actions/techdocs-rewrite-relative-links/action.yaml (2)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e

actions/trigger-argo-workflow/action.yaml (3)

• grafana/shared-workflows setup-argo/v1.2.1@21cbef8182ef0fc1c3ae8e68b9590af49ed10a5b
• actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
• grafana/shared-workflows get-vault-secrets/v2.0.0@e46fe1e9a2bf9e618bcf8d8d32f3a7381b45c06d → [Updates: get-vault-secrets/v2.0.1]

actions/validate-renovate-config/action.yml (2)

• actions/setup-node v7.0.0@820762786026740c76f36085b0efc47a31fe5020
• node 24

gomod (8)

actions/annotate-coverage/go.mod (12)

• go 1.25.4
• github.com/spf13/cobra v1.10.2
• github.com/stretchr/testify v1.11.1 → [Updates: v1.12.0]
• golang.org/x/tools v0.48.0 → [Updates: v0.49.0]
• github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc@d8f796af33cc
• github.com/inconshreveable/mousetrap v1.1.0
• github.com/kr/pretty v0.3.1
• github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2@5d4384ee4fb2
• github.com/rogpeppe/go-internal v1.15.0 → [Updates: v1.16.0]
• github.com/spf13/pflag v1.0.10
• gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c@10cb98267c6c
• gopkg.in/yaml.v3 v3.0.1

actions/component-change-detection/go.mod (5)

• go 1.25
• github.com/bmatcuk/doublestar/v4 v4.10.0
• github.com/go-kit/log v0.2.1
• gopkg.in/yaml.v3 v3.0.1
• github.com/go-logfmt/logfmt v0.6.1

actions/docker-import-digests-push-manifest/go.mod (1)

• go 1.25

actions/go-flaky-tests/go.mod (8)

• go 1.25
• github.com/stretchr/testify v1.11.1 → [Updates: v1.12.0]
• github.com/davecgh/go-spew v1.1.1
• github.com/kr/pretty v0.3.1
• github.com/pmezard/go-difflib v1.0.0
• github.com/rogpeppe/go-internal v1.15.0 → [Updates: v1.16.0]
• gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c@10cb98267c6c
• gopkg.in/yaml.v3 v3.0.1

actions/run-capslock/go.mod (3)

• go 1.25.0
• github.com/google/capslock v0.3.2
• google.golang.org/protobuf v1.36.11 → [Updates: v1.36.12]

actions/techdocs-rewrite-relative-links/go.mod (21)

• go 1.25.0
• go 1.26.6 → [Updates: 1.27.0]
• github.com/aymanbagabas/go-udiff v0.4.1
• github.com/lmittmann/tint v1.1.3 → [Updates: v1.2.0]
• github.com/neilotoole/slogt v1.1.0 → [Updates: v2.0.0]
• github.com/spf13/afero v1.15.0
• github.com/stretchr/testify v1.11.1 → [Updates: v1.12.0]
• github.com/teekennedy/goldmark-markdown v0.5.1
• github.com/urfave/cli/v3 v3.10.1 → [Updates: v3.11.0]
• github.com/willabides/actionslog v0.5.1
• github.com/yuin/goldmark v1.7.17
• go.yaml.in/yaml/v3 v3.0.5
• golang.org/x/term v0.45.0
• github.com/davecgh/go-spew v1.1.1
• github.com/goccy/go-yaml v1.19.2
• github.com/pmezard/go-difflib v1.0.0
• golang.org/x/exp v0.0.0-20260813180055-c1d0aacb2297@c1d0aacb2297 → [Updates: v0.0.0-20260820142414-ca536658362e]
• golang.org/x/sys v0.47.0
• golang.org/x/text v0.40.0 → [Updates: v0.41.0]
• gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c@10cb98267c6c
• gopkg.in/yaml.v3 v3.0.1

actions/trigger-argo-workflow/go.mod (14)

• go 1.26
• github.com/cenkalti/backoff/v5 v5.0.3 → [Updates: v7.0.0]
• github.com/kelseyhightower/envconfig v1.4.0
• github.com/lmittmann/tint v1.1.3 → [Updates: v1.2.0]
• github.com/stretchr/testify v1.11.1 → [Updates: v1.12.0]
• github.com/urfave/cli/v3 v3.10.1 → [Updates: v3.11.0]
• github.com/willabides/actionslog v0.5.1
• golang.org/x/term v0.45.0
• github.com/davecgh/go-spew v1.1.1
• github.com/goccy/go-yaml v1.19.2
• github.com/pmezard/go-difflib v1.0.0
• golang.org/x/exp v0.0.0-20260813180055-c1d0aacb2297@c1d0aacb2297 → [Updates: v0.0.0-20260820142414-ca536658362e]
• golang.org/x/sys v0.47.0
• gopkg.in/yaml.v3 v3.0.1

scripts/generate-catalog-info/go.mod (8)

• go 1.24.2
• github.com/hairyhenderson/go-codeowners v0.7.1
• k8s.io/apimachinery v0.34.1 → [Updates: v0.36.3]
• sigs.k8s.io/yaml v1.6.0
• github.com/go-logr/logr v1.4.4
• go.yaml.in/yaml/v2 v2.4.4 → [Updates: v3.0.5]
• k8s.io/klog/v2 v2.140.0
• k8s.io/utils v0.0.0-20250604170112-4c0f3b243397@4c0f3b243397 → [Updates: v0.0.0-20260707023825-cf1189d6abe3]

regex (13)

.github/workflows/reusable-zizmor.yml (2)

• jose 6.2.4 → [Updates: 6.2.9]
• zizmor 1.28.0 → [Updates: 1.29.0]

.github/workflows/reusable-zizmor.yml (3)

• jose 6.2.4 → [Updates: 6.2.9]
• zizmor 1.28.0 → [Updates: 1.29.0]
• grafana/grafana-bench v1.0.12 → [Updates: v1.2.0]

.github/workflows/sign-and-attest.yml (1)

• cosign v3.1.3

.github/workflows/sign-and-attest.yml (1)

• cosign v3.1.3

.github/workflows/test-validate-zizmor-config.yml (1)

• pyyaml 6.0.3

.github/workflows/test-validate-zizmor-config.yml (1)

• pyyaml 6.0.3

actions/azure-trusted-signing/action.yaml (1)

• sign 0.9.1-beta.26301.2

actions/azure-trusted-signing/action.yaml (2)

• dotnet-sdk 8.0.424 → [Updates: 10.0.400]
• sign 0.9.1-beta.26301.2

actions/socket-export-sbom/action.yml (1)

• @socketsecurity/cli 1.1.158

actions/socket-export-sbom/action.yml (1)

• @socketsecurity/cli 1.1.158

actions/validate-renovate-config/action.yml (1)

• renovate 43.232 → [Updates: 43.288, 44.34]

actions/validate-zizmor-config/action.yml (1)

• pyyaml 6.0.3

actions/validate-zizmor-config/action.yml (1)

• pyyaml 6.0.3

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.