Dependency Dashboard

[renovate-sh-app]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Abandoned Dependencies

Note

Packages are marked as abandoned when they exceed the abandonmentThreshold since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity.

These dependencies have not received updates for an extended period and may be unmaintained:

View abandoned dependencies (1)

Datasource	Package	Last Updated
gomod	github.com/google/uuid	2024-01-23

Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

• chore(deps): update dependency @langchain/core to v1.1.39
• chore(deps): update dependency @langchain/langgraph to v1.2.8
• chore(deps): update dependency @openai/agents to v0.8.3
• chore(deps): update dependency @opencode-ai/plugin to ^1.3.13
• chore(deps): update dependency @opencode-ai/sdk to ^1.3.13
• chore(deps): update dependency @types/node to ^24.12.0
• chore(deps): update dependency vitest to ^4.1.2
• chore(deps): update dependency @google/genai to v1.48.0
• chore(deps): update dependency anthropic to 12.11.0
• chore(deps): update dependency esbuild to ^0.28.0
• chore(deps): update dependency grpc.tools to 2.80.0
• chore(deps): update dependency microsoft.net.test.sdk to 18.4.0
• chore(deps): update dependency openai to 2.10.0
• chore(deps): update pypa/gh-action-pypi-publish action to v1.14.0
• fix(deps): update dependency com.anthropic:anthropic-java to v2.19.0
• fix(deps): update module github.com/anthropics/anthropic-sdk-go to v1.30.0
• fix(deps): update module github.com/grafana/sigil-sdk/go to v0.2.0
• chore(deps): update actions/setup-go action to v6
• chore(deps): update actions/setup-java action to v5
• chore(deps): update actions/setup-node action to v6
• chore(deps): update astral-sh/setup-uv action to v8
• chore(deps): update golangci/golangci-lint-action action to v9
• chore(deps): update pnpm/action-setup action to v5
• chore(deps): lock file maintenance
• 🔐 Create all rate-limited PRs at once 🔐

PR Edited (Blocked)

The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below.

• chore(deps): pin dependencies (@opencode-ai/plugin, @opencode-ai/sdk, @opentelemetry/context-async-hooks, @types/node, esbuild, ghcr.io/berriai/litellm, typescript, vitest)
• chore(deps): update opentelemetry-dotnet monorepo to 1.15.1 (OpenTelemetry, OpenTelemetry.Exporter.OpenTelemetryProtocol)
• chore(deps): update dependency google.genai to 1.6.1
• chore(deps): update pnpm/action-setup action to v4.4.0
• fix(deps): update dependency @google/adk to ^0.6.0
• fix(deps): update dependency com.google.genai:google-genai to v1.46.0
• fix(deps): update dependency com.openai:openai-java to v4.30.0
• fix(deps): update module github.com/openai/openai-go/v3 to v3.30.0
• fix(deps): update module google.golang.org/genai to v1.52.1
• fix(deps): update opentelemetry-js monorepo to ^0.214.0 (@opentelemetry/exporter-metrics-otlp-grpc, @opentelemetry/exporter-metrics-otlp-http, @opentelemetry/exporter-trace-otlp-grpc, @opentelemetry/exporter-trace-otlp-http)
• chore(deps): update actions/setup-dotnet action to v5

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

• chore(deps): update dependency openai to v6.34.0

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): update pnpm to v10.28.2 [security]
• fix(deps): update dependency @anthropic-ai/sdk to ^0.81.0 [security]
• chore(deps): update actions/setup-go action to v5.6.0
• chore(deps): update actions/setup-java action to v4.8.0
• chore(deps): update astral-sh/setup-uv action to v6.8.0
• Click on this checkbox to rebase all open PRs at once

Vulnerabilities

Important

9/9 CVEs have Renovate fixes.

npm

js/package.json

@anthropic-ai/sdk

• GHSA-5474-4w2j-mq4c (fixed in >= 0.81.0)

package.json

pnpm

• GHSA-2phv-j68v-wwqx (fixed in >= 10.27.0)
• GHSA-379q-355j-w6rj (fixed in >= 10.26.0)
• GHSA-6pfh-p556-v868 (fixed in >= 10.28.1)
• GHSA-6x96-7vc8-cm3p (fixed in >= 10.28.1)
• GHSA-7vhp-vf5g-r2fw (fixed in >= 10.26.0)
• GHSA-m733-5w8f-5ggw (fixed in >= 10.28.2)
• GHSA-v253-rj99-jwpq (fixed in >= 10.28.2)
• GHSA-xpqm-wm3m-f34h (fixed in >= 10.28.1)

Detected Dependencies

docker-compose (1)

python-frameworks/litellm/example/docker-compose.yaml

dockerfile (1)

python-frameworks/litellm/example/Dockerfile (1)

• ghcr.io/berriai/litellm v1.82.3-stable.patch.2 → [Updates: v1.82.3-stable.patch.2]

github-actions (6)

.github/workflows/ci.yml (15)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v5.4.0@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b → [Updates: v5.6.0, v6.4.0]
• golangci/golangci-lint-action v8.0.0@4afd733a84b1f43292c63897423277bb7f4313a9 → [Updates: v9.2.0]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• pnpm/action-setup v4.1.0@a7487c7e89a18df4991f7f222e4898a00d66ddda → [Updates: v4.4.0, v5.0.0]
• actions/setup-node v4.4.0@49933ea5288caeca8642d1e84afbd3f7d6820020 → [Updates: v6.3.0]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-python v6.2.0@a309ff8b426b58ec0e2a45f0f869d46889d02405
• astral-sh/setup-uv v6.0.1@6b9c6063abd6010835644d4c2e1bef4cf5cd0fca → [Updates: v6.8.0, v8.0.0]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-dotnet v4.3.1@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 → [Updates: v5.2.0]
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-java v4.7.1@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 → [Updates: v4.8.0, v5.2.0]
• node 24
• python 3.11

.github/workflows/dotnet-publish.yml (3)

• grafana/shared-workflows get-vault-secrets/v1.3.1@f1614b210386ac420af6807a997ac7f6d96e477a
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-dotnet v4.3.1@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 → [Updates: v5.2.0]

.github/workflows/go-sdk-tag.yml (3)

• grafana/shared-workflows get-vault-secrets/v1.3.1@f1614b210386ac420af6807a997ac7f6d96e477a
• actions/create-github-app-token v3.0.0@f8d387b68d61c58ab83c6c016672934102569859
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd

.github/workflows/java-publish.yml (3)

• grafana/shared-workflows get-vault-secrets/v1.3.1@f1614b210386ac420af6807a997ac7f6d96e477a
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-java v4.7.1@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 → [Updates: v4.8.0, v5.2.0]

.github/workflows/js-sdk-publish.yml (5)

• grafana/shared-workflows get-vault-secrets/v1.3.1@f1614b210386ac420af6807a997ac7f6d96e477a
• actions/create-github-app-token v3.0.0@f8d387b68d61c58ab83c6c016672934102569859
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• pnpm/action-setup v4.1.0@a7487c7e89a18df4991f7f222e4898a00d66ddda → [Updates: v4.4.0, v5.0.0]
• actions/setup-node v4.4.0@49933ea5288caeca8642d1e84afbd3f7d6820020 → [Updates: v6.3.0]

.github/workflows/python-sdks-publish.yml (10)

• grafana/shared-workflows get-vault-secrets/v1.3.1@f1614b210386ac420af6807a997ac7f6d96e477a
• actions/create-github-app-token v3.0.0@f8d387b68d61c58ab83c6c016672934102569859
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-python v6.2.0@a309ff8b426b58ec0e2a45f0f869d46889d02405
• actions/upload-artifact v7.0.0@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
• actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
• pypa/gh-action-pypi-publish v1.13.0@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e → [Updates: v1.14.0]
• actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
• pypa/gh-action-pypi-publish v1.13.0@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e → [Updates: v1.14.0]
• python 3.11

gomod (6)

go-frameworks/google-adk/go.mod (6)

• go 1.25.6
• github.com/grafana/sigil-sdk/go v0.1.2 → [Updates: v0.2.0]
• go.opentelemetry.io/otel v1.43.0
• go.opentelemetry.io/otel/sdk v1.43.0
• go.opentelemetry.io/otel/sdk/metric v1.43.0
• go.opentelemetry.io/otel/trace v1.43.0

go-providers/anthropic/go.mod (3)

• go 1.25.6
• github.com/anthropics/anthropic-sdk-go v1.27.1 → [Updates: v1.30.0]
• github.com/grafana/sigil-sdk/go v0.1.2 → [Updates: v0.2.0]

go-providers/gemini/go.mod (3)

• go 1.25.6
• github.com/grafana/sigil-sdk/go v0.1.2 → [Updates: v0.2.0]
• google.golang.org/genai v1.51.0 → [Updates: v1.52.1]

go-providers/openai/go.mod (3)

• go 1.25.6
• github.com/grafana/sigil-sdk/go v0.1.2 → [Updates: v0.2.0]
• github.com/openai/openai-go/v3 v3.29.0 → [Updates: v3.30.0]

go/go.mod (8)

• go 1.25.6
• go.opentelemetry.io/otel v1.43.0
• go.opentelemetry.io/otel/metric v1.43.0
• go.opentelemetry.io/otel/sdk v1.43.0
• go.opentelemetry.io/otel/sdk/metric v1.43.0
• go.opentelemetry.io/otel/trace v1.43.0
• google.golang.org/grpc v1.80.0
• google.golang.org/protobuf v1.36.11

plugins/claude-code/go.mod (10)

• go 1.25.6
• github.com/google/uuid v1.6.0
• github.com/grafana/sigil-sdk/go v0.2.0
• go.opentelemetry.io/otel v1.43.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0
• go.opentelemetry.io/otel/metric v1.43.0
• go.opentelemetry.io/otel/sdk v1.43.0
• go.opentelemetry.io/otel/sdk/metric v1.43.0
• go.opentelemetry.io/otel/trace v1.43.0

gradle (10)

java/benchmarks/build.gradle.kts

java/build.gradle.kts

java/core/build.gradle.kts (1)

• io.opentelemetry.proto:opentelemetry-proto 1.9.0-alpha

java/devex-emitter/build.gradle.kts

java/frameworks/google-adk/build.gradle.kts

java/gradle/libs.versions.toml (28)

• org.assertj:assertj-core 3.27.7
• com.fasterxml.jackson.core:jackson-annotations 2.21
• com.fasterxml.jackson.core:jackson-core 2.21.2
• com.fasterxml.jackson.core:jackson-databind 2.21.2
• com.fasterxml.jackson.datatype:jackson-datatype-jsr310 2.21.2
• io.grpc:grpc-netty-shaded 1.80.0
• io.grpc:grpc-protobuf 1.80.0
• io.grpc:grpc-stub 1.80.0
• io.grpc:grpc-services 1.80.0
• io.grpc:grpc-testing 1.80.0
• com.google.protobuf:protobuf-java 4.34.1
• com.google.protobuf:protobuf-java-util 4.34.1
• com.google.protobuf:protoc 4.34.1
• io.grpc:protoc-gen-grpc-java 1.80.0
• io.opentelemetry:opentelemetry-api 1.60.1
• io.opentelemetry:opentelemetry-context 1.60.1
• io.opentelemetry:opentelemetry-sdk-trace 1.60.1
• io.opentelemetry:opentelemetry-sdk-metrics 1.60.1
• io.opentelemetry:opentelemetry-exporter-otlp 1.60.1
• io.opentelemetry:opentelemetry-sdk-testing 1.60.1
• org.junit:junit-bom 6.0.3
• com.squareup.okhttp3:mockwebserver 5.3.2
• javax.annotation:javax.annotation-api 1.3.2
• com.openai:openai-java 4.29.1 → [Updates: 4.30.0]
• com.anthropic:anthropic-java 2.18.0 → [Updates: 2.19.0]
• com.google.genai:google-genai 1.44.0 → [Updates: 1.46.0]
• com.google.protobuf 0.9.6
• me.champeau.jmh 0.7.3

java/providers/anthropic/build.gradle.kts

java/providers/gemini/build.gradle.kts

java/providers/openai/build.gradle.kts

java/settings.gradle.kts

gradle-wrapper (1)

java/gradle/wrapper/gradle-wrapper.properties (1)

• gradle 9.4.1

npm (4)

js/package.json (20)

• @anthropic-ai/sdk ^0.80.0 → [Updates: ^0.81.0]
• @google/adk ^0.5.0 → [Updates: ^0.6.0]
• @google/genai ^1.41.0 → [Updates: ^1.41.0]
• @grpc/grpc-js ^1.14.1
• @grpc/proto-loader ^0.8.0
• @langchain/core ^1.0.0 → [Updates: ^1.0.0]
• @langchain/langgraph ^1.2.0 → [Updates: ^1.2.0]
• @openai/agents ^0.8.0 → [Updates: ^0.8.0]
• @opentelemetry/api ^1.9.0
• @opentelemetry/exporter-metrics-otlp-grpc ^0.213.0 → [Updates: ^0.214.0]
• @opentelemetry/exporter-metrics-otlp-http ^0.213.0 → [Updates: ^0.214.0]
• @opentelemetry/exporter-trace-otlp-grpc ^0.213.0 → [Updates: ^0.214.0]
• @opentelemetry/exporter-trace-otlp-http ^0.213.0 → [Updates: ^0.214.0]
• @opentelemetry/sdk-metrics ^2.1.0
• @opentelemetry/sdk-trace-base ^2.5.0
• llamaindex ^0.12.1
• openai ^6.27.0 → [Updates: ^6.27.0]
• @opentelemetry/context-async-hooks ^2.6.0 → [Updates: 2.6.1]
• @types/node ^24.11.0 → [Updates: 24.12.0, ^24.12.0]
• typescript ^6.0.0 → [Updates: 6.0.2]

package.json (1)

• pnpm 10.12.1 → [Updates: 10.28.2]

plugins/opencode/package.json (7)

• @opencode-ai/plugin ^1.3.0 → [Updates: 1.3.13, ^1.3.13]
• @opencode-ai/sdk ^1.3.2 → [Updates: 1.3.13, ^1.3.13]
• @types/node ^24.0.0 → [Updates: 24.12.0, ^24.12.0]
• esbuild ^0.27.3 → [Updates: 0.27.4, ^0.28.0]
• typescript ^6.0.0 → [Updates: 6.0.2]
• vitest ^4.1.0 → [Updates: 4.1.2, ^4.1.2]
• @opencode-ai/plugin ^1.2.16

pnpm-workspace.yaml

nuget (8)

dotnet/src/Grafana.Sigil.Anthropic/Grafana.Sigil.Anthropic.csproj (1)

• Anthropic 12.9.0 → [Updates: 12.11.0]

dotnet/src/Grafana.Sigil.Gemini/Grafana.Sigil.Gemini.csproj (1)

• Google.GenAI 1.5.0 → [Updates: 1.6.1]

dotnet/src/Grafana.Sigil.OpenAI/Grafana.Sigil.OpenAI.csproj (1)

• OpenAI 2.9.1 → [Updates: 2.10.0]

dotnet/src/Grafana.Sigil/Grafana.Sigil.csproj (7)

• System.Threading.Channels 10.0.5
• System.Text.Json 10.0.5
• OpenTelemetry.Exporter.OpenTelemetryProtocol 1.15.0 → [Updates: 1.15.1]
• OpenTelemetry 1.15.0 → [Updates: 1.15.1]
• Grpc.Tools 2.78.0 → [Updates: 2.80.0]
• Grpc.Net.Client 2.76.0
• Google.Protobuf 3.34.1

dotnet/tests/Grafana.Sigil.Anthropic.Tests/Grafana.Sigil.Anthropic.Tests.csproj (4)

• coverlet.collector 8.0.1
• xunit.runner.visualstudio 3.1.5
• xunit 2.9.2
• Microsoft.NET.Test.Sdk 18.3.0 → [Updates: 18.4.0]

dotnet/tests/Grafana.Sigil.Gemini.Tests/Grafana.Sigil.Gemini.Tests.csproj (4)

• coverlet.collector 8.0.1
• xunit.runner.visualstudio 3.1.5
• xunit 2.9.2
• Microsoft.NET.Test.Sdk 18.3.0 → [Updates: 18.4.0]

dotnet/tests/Grafana.Sigil.OpenAI.Tests/Grafana.Sigil.OpenAI.Tests.csproj (4)

• coverlet.collector 8.0.1
• xunit.runner.visualstudio 3.1.5
• xunit 2.9.2
• Microsoft.NET.Test.Sdk 18.3.0 → [Updates: 18.4.0]

dotnet/tests/Grafana.Sigil.Tests/Grafana.Sigil.Tests.csproj (6)

• Grpc.Tools 2.78.0 → [Updates: 2.80.0]
• Grpc.AspNetCore 2.76.0
• coverlet.collector 8.0.1
• xunit.runner.visualstudio 3.1.5
• xunit 2.9.2
• Microsoft.NET.Test.Sdk 18.3.0 → [Updates: 18.4.0]

pep621 (2)

python-frameworks/litellm/pyproject.toml (6)

• python >=3.10
• sigil-sdk >=0.1.2
• litellm >=1.82.3,!=1.82.7,!=1.82.8
• pytest >=8.2.0
• pytest-asyncio >=0.24.0
• setuptools >=68

python/pyproject.toml (11)

• python >=3.10
• grpcio >=1.78.0
• protobuf >=6.31.1
• opentelemetry-api >=1.27.0
• opentelemetry-sdk >=1.27.0
• opentelemetry-exporter-otlp-proto-grpc >=1.27.0
• opentelemetry-exporter-otlp-proto-http >=1.27.0
• opentelemetry-proto >=1.27.0
• grpcio-tools >=1.78.0
• pytest >=8.2.0
• setuptools >=68

poetry (8)

python-frameworks/google-adk/pyproject.toml (3)

• sigil-sdk >=0.1.2
• google-adk >=1.0.0
• pytest >=8.2.0

python-frameworks/langchain/pyproject.toml (3)

• sigil-sdk >=0.1.2
• langchain-core >=0.3.0
• pytest >=8.2.0

python-frameworks/langgraph/pyproject.toml (4)

• sigil-sdk >=0.1.2
• langchain-core >=0.3.0
• langgraph >=0.2.0
• pytest >=8.2.0

python-frameworks/llamaindex/pyproject.toml (3)

• sigil-sdk >=0.1.2
• llama-index >=0.14.0
• pytest >=8.2.0

python-frameworks/openai-agents/pyproject.toml (3)

• sigil-sdk >=0.1.2
• openai-agents >=0.9.0
• pytest >=8.2.0

python-providers/anthropic/pyproject.toml (3)

• sigil-sdk >=0.1.2
• anthropic >=0.79.0,<1
• pytest >=8.2.0

python-providers/gemini/pyproject.toml (3)

• sigil-sdk >=0.1.2
• google-genai >=1.63.0,<2
• pytest >=8.2.0

python-providers/openai/pyproject.toml (3)

• sigil-sdk >=0.1.2
• openai >=2.20.0,<3
• pytest >=8.2.0

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.