Dependency Dashboard

[agntcy-automation]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Repository Problems

Renovate tried to run on this repository, but found these problems.

• ⚠️ WARN: Package lookup failures

Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

• chore(deps): update golang:1.26.7-bookworm docker digest to e8c859f
• chore(deps): update python:3.13-slim docker digest to 7ce4b6d
• chore(deps): update github/codeql-action action to v4.37.8
• chore(deps): update go patches (github.com/grpc-ecosystem/go-grpc-middleware/v2, github.com/sigstore/protobuf-specs, github.com/stretchr/testify, google.golang.org/grpc)
• chore(deps): update helm release postgresql to v18.8.12
• chore(deps): update module github.com/mikefarah/yq/v4 to v4.53.6
• chore(deps): update module github.com/spiffe/spire to v1.15.3
• chore(deps): update module k8s.io/apimachinery to v0.36.4
• chore(deps): update dependency go to v1.27.0
• chore(deps): lock file maintenance
• 🔐 Create all awaiting schedule PRs at once 🔐

PR Edited (Blocked)

The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below.

• chore(deps): update module github.com/libp2p/go-libp2p-pubsub to v0.17.0

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

• chore(deps): update google.golang.org/genproto/googleapis/api digest to da73d73
• chore(deps): update ghcr.io/grpc-ecosystem/grpc-health-probe docker tag to v0.4.56
• chore(deps): update module github.com/agntcy/dir-mcp to v1.3.6
• chore(deps): update golang docker tag to v1.27.0

---

Warning

Renovate failed to look up the following dependencies: Failed to look up github-tags package aquasecurity/trivy-action.

Files affected: .github/workflows/container-security-scan.yml

---

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): update module golang.org/x/crypto to v0.55.0 [security]
• chore(deps): update busybox:1.38.0-musl docker digest to 32b5cda
• chore(deps): update docker/dockerfile:1 docker digest to ecfaec9
• chore(deps): update gcr.io/distroless/static:nonroot docker digest to 1c2c046
• chore(deps): update module github.com/agntcy/oasf-sdk/pkg to v1.2.0
• chore(deps): update module github.com/libp2p/go-libp2p-kad-dht to v0.42.2
• Click on this checkbox to rebase all open PRs at once

PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

• chore(deps): update python docker tag to v3.14

Vulnerabilities

Important

3/21 CVEs have Renovate fixes.

gomod

api/go.mod

golang.org/x/crypto

• GO-2026-5932
• GO-2026-6303 (fixed in >= 0.55.0)

cli/go.mod

golang.org/x/crypto

• GO-2026-5932

github.com/aquasecurity/trivy

• GO-2026-4919

github.com/aws/aws-sdk-go

• GO-2022-0635
• GO-2022-0646

github.com/sigstore/cosign/v2

• GO-2026-4529

github.com/libp2p/go-libp2p-kad-dht

• GO-2024-3218

client/go.mod

golang.org/x/crypto

• GO-2026-5932
• GO-2026-6303 (fixed in >= 0.55.0)

reconciler/go.mod

golang.org/x/crypto

• GO-2026-5932

samples/ard-over-ads/go.mod

github.com/aquasecurity/trivy

• GO-2026-4919

github.com/aws/aws-sdk-go

• GO-2022-0635
• GO-2022-0646

github.com/libp2p/go-libp2p-kad-dht

• GO-2024-3218

github.com/sigstore/cosign/v2

• GO-2026-4529

golang.org/x/crypto

• GO-2026-5932

server/go.mod

github.com/libp2p/go-libp2p-kad-dht

• GO-2024-3218

golang.org/x/crypto

• GO-2026-5932

utils/go.mod

golang.org/x/crypto

• GO-2026-5932
• GO-2026-6303 (fixed in >= 0.55.0)

Detected Dependencies

docker-compose (2)

install/docker/docker-compose.debug.yml

install/docker/docker-compose.yml (2)

• ghcr.io/project-zot/zot v2.1.20
• docker.io/bitnami/postgresql latest@sha256:40a261ed77f3b8dc65eeeec98bb79c4d3ef3410d7e2af7cfcf3785a6af00e4c5

dockerfile (3)

cli/Dockerfile (4)

• docker/dockerfile 1@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769 → [Updates: 1]
• tonistiigi/xx 1.9.0@sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707
• golang 1.26.7-bookworm@sha256:6ef6e30f0ea5c384f6d111cf856e024e3086bbdcb1779da3f3b3fbba0aea53d2 → [Updates: 1.27.0-bookworm, 1.26.7-bookworm]
• alpine 3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b

reconciler/Dockerfile (6)

• docker/dockerfile 1@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769 → [Updates: 1]
• tonistiigi/xx 1.9.0@sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707
• golang 1.26.7-bookworm@sha256:6ef6e30f0ea5c384f6d111cf856e024e3086bbdcb1779da3f3b3fbba0aea53d2 → [Updates: 1.27.0-bookworm, 1.26.7-bookworm]
• busybox 1.38.0-musl@sha256:8635836765b0c4c43970660219739baa58b0883c2e429e4b8918f7dd1519455c → [Updates: 1.38.0-musl]
• busybox 1.38.0-musl@sha256:8635836765b0c4c43970660219739baa58b0883c2e429e4b8918f7dd1519455c → [Updates: 1.38.0-musl]
• python 3.13-slim@sha256:ffb752e139c0a19692a43af8d8523b274222dd68eebad5d583b45c2201c6e30a → [Updates: 3.14-slim, 3.13-slim]

server/Dockerfile (8)

• docker/dockerfile 1@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769 → [Updates: 1]
• tonistiigi/xx 1.9.0@sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707
• golang 1.26.7-bookworm@sha256:6ef6e30f0ea5c384f6d111cf856e024e3086bbdcb1779da3f3b3fbba0aea53d2 → [Updates: 1.27.0-bookworm, 1.26.7-bookworm]
• ghcr.io/grpc-ecosystem/grpc-health-probe v0.4.55@sha256:d261bc6df0fdd676c2f77230e1107636f43ef843cecd9ac05b89e4aabd017679 → [Updates: v0.4.56]
• gcr.io/distroless/static nonroot@sha256:963fa6c544fe5ce420f1f54fb88b6fb01479f054c8056d0f74cc2c6000df5240 → [Updates: nonroot]
• ghcr.io/grpc-ecosystem/grpc-health-probe v0.4.55@sha256:d261bc6df0fdd676c2f77230e1107636f43ef843cecd9ac05b89e4aabd017679 → [Updates: v0.4.56]
• busybox 1.38.0-musl@sha256:8635836765b0c4c43970660219739baa58b0883c2e429e4b8918f7dd1519455c → [Updates: 1.38.0-musl]
• ghcr.io/grpc-ecosystem/grpc-health-probe v0.4.55@sha256:d261bc6df0fdd676c2f77230e1107636f43ef843cecd9ac05b89e4aabd017679 → [Updates: v0.4.56]

github-actions (26)

.github/actions/build-dirctl/action.yaml (2)

• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• go-task/setup-task v2.2.0@a00fbb05ce67b35648be3c78cbc9fd85354c757e

.github/actions/fetch-oidc-token/action.yaml (1)

• actions/github-script v8.0.0@ed597411d8f924073f98dfc5c65a23a2325f34cd → [Updates: v9.0.0]

.github/actions/trigger-integrations/action.yaml (2)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• actions/github-script v8.0.0@ed597411d8f924073f98dfc5c65a23a2325f34cd → [Updates: v9.0.0]

.github/workflows/buf-ci.yaml (2)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• bufbuild/buf-action v1.5.0@8c6a16e16f12ba20b6470afa9c2ba9b5ba8c97c3

.github/workflows/build-feature.yaml (1)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]

.github/workflows/ci.yaml (19)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• dorny/paths-filter v4.0.3@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d
• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• go-task/setup-task v2.2.0@a00fbb05ce67b35648be3c78cbc9fd85354c757e
• actions/cache v5.1.0@caa296126883cff596d87d8935842f9db880ef25 → [Updates: v6.1.0]
• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• go-task/setup-task v2.2.0@a00fbb05ce67b35648be3c78cbc9fd85354c757e
• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• go-task/setup-task v2.2.0@a00fbb05ce67b35648be3c78cbc9fd85354c757e
• actions/setup-node v4.4.0@49933ea5288caeca8642d1e84afbd3f7d6820020 → [Updates: v7.0.0]
• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
• codecov/codecov-action v6.0.2@fb8b3582c8e4def4969c97caa2f19720cb33a72f → [Updates: v7.0.0]
• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• go 1.26.7 → [Updates: 1.27.0]
• go 1.26.7 → [Updates: 1.27.0]
• node 22 → [Updates: 24]

.github/workflows/codeql.yml (6)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• go-task/setup-task v2.2.0@a00fbb05ce67b35648be3c78cbc9fd85354c757e
• github/codeql-action v4.37.7@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd → [Updates: v4.37.8]
• github/codeql-action v4.37.7@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd → [Updates: v4.37.8]
• go 1.26.7 → [Updates: 1.27.0]

.github/workflows/container-security-scan.yml (7)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• go-task/setup-task v2.2.0@a00fbb05ce67b35648be3c78cbc9fd85354c757e
• aquasecurity/trivy-action v0.35.0@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
• github/codeql-action v4.37.7@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd → [Updates: v4.37.8]
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c

.github/workflows/demo-dir.yaml (1)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]

.github/workflows/dependencies.yaml (7)

• actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• go-task/setup-task v2.2.0@a00fbb05ce67b35648be3c78cbc9fd85354c757e
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• actions/setup-node v6.5.0@249970729cb0ef3589644e2896645e5dc5ba9c38 → [Updates: v7.0.0]
• go 1.26.7 → [Updates: 1.27.0]
• node 24.x

.github/workflows/docs-ci.yaml

.github/workflows/docs-deploy.yml

.github/workflows/import-records.yaml (11)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
• actions/cache v5.1.0@caa296126883cff596d87d8935842f9db880ef25 → [Updates: v6.1.0]
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]

.github/workflows/lint-pr-title.yaml (3)

• amannn/action-semantic-pull-request v6.1.1@48f256284bd46cdaab1048c3721360e808335d50
• marocchino/sticky-pull-request-comment v3.0.5@5770ad5eb8f42dd2c4f34da00c94c5381e49af88
• marocchino/sticky-pull-request-comment v3.0.5@5770ad5eb8f42dd2c4f34da00c94c5381e49af88

.github/workflows/oidc-test.yml (1)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]

.github/workflows/post-release.yml (3)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• actions/github-script v8.0.0@ed597411d8f924073f98dfc5c65a23a2325f34cd → [Updates: v9.0.0]

.github/workflows/pr.yaml (1)

• codelytv/pr-size-labeler v1.10.4@095a41fca88b8764fd9e008ad269bcdb82bb38b9

.github/workflows/project.yaml (3)

• actions/stale v10.4.0@1e223db275d687790206a7acac4d1a11bd6fe629 → [Updates: v11.0.0]
• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• EndBug/label-sync v2.3.3@52074158190acb45f3077f9099fea818aa43f97a

.github/workflows/reusable-brew-update.yaml (1)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]

.github/workflows/reusable-build.yaml (23)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• go-task/setup-task v2.2.0@a00fbb05ce67b35648be3c78cbc9fd85354c757e
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• docker/bake-action v7.3.0@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b
• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f
• docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8
• docker/setup-buildx-action v4.3.0@37fe631027851001ddb9b187196cc803df7f5f0e
• docker/metadata-action v6.2.0@dc802804100637a589fabce1cb79ff13a1411302
• docker/bake-action v7.3.0@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b
• docker/bake-action v7.3.0@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f
• docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8
• docker/setup-buildx-action v4.3.0@37fe631027851001ddb9b187196cc803df7f5f0e
• docker/metadata-action v6.2.0@dc802804100637a589fabce1cb79ff13a1411302
• docker/bake-action v7.3.0@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• go 1.26.7 → [Updates: 1.27.0]

.github/workflows/reusable-docs.yml (3)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• astral-sh/setup-uv v5.4.2@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 → [Updates: v10.0.1]
• go-task/setup-task v2.2.0@a00fbb05ce67b35648be3c78cbc9fd85354c757e

.github/workflows/reusable-release-helm.yaml (3)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f
• azure/setup-helm v5.0.1@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310

.github/workflows/reusable-release.yaml (9)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• go-task/setup-task v2.2.0@a00fbb05ce67b35648be3c78cbc9fd85354c757e
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• softprops/action-gh-release v2.6.2@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 → [Updates: v3.0.2]
• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
• softprops/action-gh-release v2.6.2@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 → [Updates: v3.0.2]
• go 1.26.7 → [Updates: 1.27.0]

.github/workflows/reusable-test-e2e-cross-platform.yaml (5)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• go-task/setup-task v2.2.0@a00fbb05ce67b35648be3c78cbc9fd85354c757e
• sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• go 1.26.7 → [Updates: 1.27.0]

.github/workflows/reusable-test-e2e.yaml (9)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f
• go-task/setup-task v2.2.0@a00fbb05ce67b35648be3c78cbc9fd85354c757e
• sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
• actions/cache v5.1.0@caa296126883cff596d87d8935842f9db880ef25 → [Updates: v6.1.0]
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• go 1.26.7 → [Updates: 1.27.0]

.github/workflows/reusable-test.yaml (5)

• actions/checkout v6.1.0@d23441a48e516b6c34aea4fa41551a30e30af803 → [Updates: v7.0.1]
• go-task/setup-task v2.2.0@a00fbb05ce67b35648be3c78cbc9fd85354c757e
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• go 1.26.7 → [Updates: 1.27.0]

gomod (7)

api/go.mod (15)

• go 1.26.7
• buf.build/gen/go/agntcy/oasf-sdk/protocolbuffers/go v1.36.12-20260811133823-5281d0c487b5.1@5281d0c487b5
• buf.build/gen/go/agntcy/oasf/protocolbuffers/go v1.36.12-20260721113505-cf7db8888586.1@cf7db8888586 → [Updates: v1.36.12-20260828094143-e699d1c609e4.1]
• buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.1@511051f7f437
• github.com/agntcy/oasf-sdk/pkg v1.1.0 → [Updates: v1.2.0]
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0
• github.com/multiformats/go-multihash v0.2.3
• github.com/opencontainers/go-digest v1.0.0
• github.com/stretchr/testify v1.12.0 → [Updates: v1.12.1]
• google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d@6ac0973c030d → [Updates: v0.0.0-20260825221802-da73d73af1c5]
• google.golang.org/grpc v1.83.0 → [Updates: v1.83.1]
• google.golang.org/protobuf v1.36.12
• k8s.io/apimachinery v0.36.3 → [Updates: v0.36.4]
• github.com/ipfs/go-cid v0.6.2
• golang.org/x/crypto v0.54.0 → [Updates: v0.55.0]

cli/go.mod (37)

• go 1.26.7
• github.com/eclipse-keypont/crypto11 v1.6.8
• github.com/libp2p/go-libp2p v0.49.0
• buf.build/gen/go/agntcy/oasf/protocolbuffers/go v1.36.12-20260721113505-cf7db8888586.1@cf7db8888586 → [Updates: v1.36.12-20260828094143-e699d1c609e4.1]
• github.com/agntcy/dir-importer v1.5.5-0.20260819134321-525b42c65a49@525b42c65a49
• github.com/agntcy/dir-mcp v1.3.5 → [Updates: v1.3.6]
• github.com/agntcy/dir-runtime/discovery v1.3.5
• github.com/agntcy/dir-runtime/server v1.3.5
• github.com/agntcy/dir-runtime/store v1.3.5
• github.com/agntcy/oasf-sdk/pkg v1.1.0 → [Updates: v1.2.0]
• github.com/briandowns/spinner v1.23.2
• github.com/ipfs/go-cid v0.6.2
• github.com/libp2p/go-libp2p v0.49.0
• github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c@8508981c8b6c
• github.com/rs/zerolog v1.35.1
• github.com/sigstore/cosign/v3 v3.1.3
• github.com/sigstore/sigstore v1.10.9
• github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.9
• github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.9
• github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.9
• github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.9
• github.com/spf13/cobra v1.10.2
• github.com/spf13/pflag v1.0.10
• github.com/spf13/viper v1.21.0
• github.com/stretchr/testify v1.12.0 → [Updates: v1.12.1]
• golang.org/x/crypto v0.55.0
• golang.org/x/mod v0.40.0
• google.golang.org/protobuf v1.36.12
• oras.land/oras-go/v2 v2.6.2
• github.com/libp2p/go-libp2p-kad-dht v0.41.0 → [Updates: v0.42.2]
• github.com/multiformats/go-multiaddr v0.16.1
• github.com/pelletier/go-toml/v2 v2.4.3
• go.yaml.in/yaml/v3 v3.0.5
• golang.org/x/term v0.45.0
• google.golang.org/grpc v1.83.0 → [Updates: v1.83.1]
• gopkg.in/yaml.v3 v3.0.1
• zotregistry.dev/zot/v2 v2.1.20

client/go.mod (18)

• go 1.26.7
• github.com/eclipse-keypont/crypto11 v1.6.8
• github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c@8508981c8b6c
• github.com/sigstore/cosign/v3 v3.1.3
• github.com/sigstore/protobuf-specs v0.5.1 → [Updates: v0.5.2]
• github.com/sigstore/sigstore v1.10.9
• github.com/sigstore/sigstore-go v1.3.0
• github.com/spf13/viper v1.21.0
• github.com/spiffe/go-spiffe/v2 v2.8.1
• github.com/stretchr/testify v1.12.0 → [Updates: v1.12.1]
• google.golang.org/grpc v1.83.0 → [Updates: v1.83.1]
• google.golang.org/protobuf v1.36.12
• github.com/zitadel/oidc/v3 v3.49.2 → [Updates: v3.49.4]
• github.com/agntcy/oasf-sdk/pkg v1.1.0 → [Updates: v1.2.0]
• github.com/google/uuid v1.6.0
• github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c@5ac0b6a4141c
• go.yaml.in/yaml/v3 v3.0.5
• golang.org/x/crypto v0.54.0 → [Updates: v0.55.0]

reconciler/go.mod (12)

• go 1.26.7
• github.com/eclipse-keypont/crypto11 v1.6.8
• github.com/agntcy/oasf-sdk/pkg v1.1.0 → [Updates: v1.2.0]
• github.com/csirmazbendeguz/regclient v0.0.0-20260429082137-82ab6d426079@82ab6d426079
• github.com/opencontainers/go-digest v1.0.0
• github.com/opencontainers/image-spec v1.1.1
• github.com/sigstore/sigstore v1.10.9
• github.com/spf13/viper v1.21.0
• github.com/stretchr/testify v1.12.0 → [Updates: v1.12.1]
• google.golang.org/grpc v1.83.0 → [Updates: v1.83.1]
• gopkg.in/yaml.v3 v3.0.1
• oras.land/oras-go/v2 v2.6.2

samples/ard-over-ads/go.mod (6)

• go 1.26.5
• github.com/eclipse-keypont/crypto11 v1.6.8
• buf.build/gen/go/agntcy/oasf/protocolbuffers/go v1.36.12-20260721113505-cf7db8888586.1@cf7db8888586 → [Updates: v1.36.12-20260828094143-e699d1c609e4.1]
• github.com/opencontainers/go-digest v1.0.0
• github.com/sigstore/cosign/v3 v3.1.3
• google.golang.org/protobuf v1.36.12

server/go.mod (38)

• go 1.26.7
• github.com/eclipse-keypont/crypto11 v1.6.8
• buf.build/gen/go/agntcy/oasf/protocolbuffers/go v1.36.12-20260721113505-cf7db8888586.1@cf7db8888586 → [Updates: v1.36.12-20260828094143-e699d1c609e4.1]
• buf.build/go/protovalidate v1.3.0
• github.com/agntcy/oasf-sdk/pkg v1.1.0 → [Updates: v1.2.0]
• github.com/casbin/casbin/v2 v2.135.0 → [Updates: v3.10.0]
• github.com/glebarez/sqlite v1.11.0
• github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 → [Updates: v2.3.4]
• github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0
• github.com/ipfs/go-datastore v0.9.2
• github.com/lestrrat-go/jwx/v2 v2.1.7 → [Updates: v4.4.0]
• github.com/libp2p/go-libp2p v0.49.0
• github.com/libp2p/go-libp2p-gorpc v0.6.0
• github.com/libp2p/go-libp2p-kad-dht v0.41.0 → [Updates: v0.42.2]
• github.com/libp2p/go-libp2p-pubsub v0.16.0 → [Updates: v0.17.0]
• github.com/libp2p/go-libp2p-record v0.3.1
• github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c@8508981c8b6c
• github.com/opencontainers/image-spec v1.1.1
• github.com/spf13/cobra v1.10.2
• github.com/spf13/viper v1.21.0
• github.com/spiffe/go-spiffe/v2 v2.8.1
• github.com/stretchr/testify v1.12.0 → [Updates: v1.12.1]
• google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d@6ac0973c030d → [Updates: v0.0.0-20260825221802-da73d73af1c5]
• google.golang.org/grpc v1.83.0 → [Updates: v1.83.1]
• google.golang.org/protobuf v1.36.12
• gorm.io/driver/postgres v1.6.2
• gorm.io/gorm v1.31.2
• oras.land/oras-go/v2 v2.6.2
• github.com/google/uuid v1.6.0
• github.com/ipfs/go-cid v0.6.2
• github.com/ipfs/go-ds-badger v0.3.4
• github.com/multiformats/go-multiaddr v0.16.1
• github.com/multiformats/go-multihash v0.2.3
• github.com/opencontainers/go-digest v1.0.0
• github.com/prometheus/client_golang v1.24.1
• golang.org/x/crypto v0.55.0
• golang.org/x/time v0.15.0

utils/go.mod (13)

• go 1.26.7
• buf.build/gen/go/agntcy/oasf-sdk/grpc/go v1.6.2-20260811133823-5281d0c487b5.1@5281d0c487b5
• buf.build/gen/go/agntcy/oasf-sdk/protocolbuffers/go v1.36.12-20260811133823-5281d0c487b5.1@5281d0c487b5
• buf.build/gen/go/agntcy/oasf/protocolbuffers/go v1.36.12-20260721113505-cf7db8888586.1@cf7db8888586 → [Updates: v1.36.12-20260828094143-e699d1c609e4.1]
• github.com/agntcy/oasf-sdk/pkg v1.1.0 → [Updates: v1.2.0]
• github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c@8508981c8b6c
• github.com/rs/zerolog v1.35.1
• github.com/spf13/viper v1.21.0
• github.com/spiffe/go-spiffe/v2 v2.8.1
• github.com/stretchr/testify v1.12.0 → [Updates: v1.12.1]
• google.golang.org/grpc v1.83.0 → [Updates: v1.83.1]
• google.golang.org/protobuf v1.36.12
• golang.org/x/crypto v0.54.0 → [Updates: v0.55.0]

helm-values (3)

install/charts/dir/apiserver/values.yaml

install/charts/dir/values.yaml

install/charts/dirctl/values.yaml

helmv3 (2)

install/charts/dir/apiserver/Chart.yaml (3)

• zot 0.1.122
• oasf v0.5.1
• postgresql 18.8.11 → [Updates: 18.8.12]

install/charts/dir/Chart.yaml

regex (4)

install/charts/dir/apiserver/values.yaml (1)

• docker.io/bitnami/postgresql latest@sha256:40a261ed77f3b8dc65eeeec98bb79c4d3ef3410d7e2af7cfcf3785a6af00e4c5

install/charts/dir/values.yaml (1)

• docker.io/bitnami/postgresql latest@sha256:40a261ed77f3b8dc65eeeec98bb79c4d3ef3410d7e2af7cfcf3785a6af00e4c5

Taskfile.vars.yml (4)

• github.com/project-zot/zot 2.1.20
• github.com/spiffe/spire 1.15.2 → [Updates: 1.15.3]
• github.com/mikefarah/yq/v4 4.53.3 → [Updates: 4.53.6]
• github.com/google/go-licenses/v2 2.0.1

Taskfile.vars.yml (1)

• docker.io/bitnami/postgresql latest@sha256:40a261ed77f3b8dc65eeeec98bb79c4d3ef3410d7e2af7cfcf3785a6af00e4c5