Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Repository Problems

These problems occurred while renovating this repository. View logs.

• ⚠️ WARN: Package lookup failures

Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

• fix(deps): update module github.com/circleci/ex to v1.0.19544-752f938
• fix(deps): update module golang.org/x/sys to v0.39.0
• 🔐 Create all rate-limited PRs at once 🔐

---

Warning

Renovate failed to look up the following dependencies: Failed to look up docker package circleci/command-convenience.

Files affected: .circleci/config.yml

---

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): update module github.com/quic-go/quic-go to v0.57.0 [security]
• chore(deps): update module github.com/sigstore/timestamp-authority to v2 [security]
• chore(deps): update go version to v1.25.5 (cimg/go, go)
• chore(deps): update dependency slack to v5.2.3
• chore(deps): update module github.com/golangci/golangci-lint/v2 to v2.7.2
• chore(deps): update module github.com/goreleaser/goreleaser/v2 to v2.13.2
• chore(deps): update module github.com/sigstore/cosign/v2 to v2.6.1
• chore(deps): update module gotest.tools/gotestsum to v1.13.0
• chore(deps): update dependency slack to v6
• chore(deps): update module github.com/sigstore/cosign/v2 to v3
• Click on this checkbox to rebase all open PRs at once

Vulnerabilities

3/9 CVEs have Renovate fixes.

gomod

go.mod

github.com/aws/aws-sdk-go

• GO-2022-0646
• GO-2022-0635

github.com/docker/docker

• GHSA-qrqr-3x5j-2xw9
• GHSA-6hwg-w5jg-9c6x
• GHSA-j249-ghv5-7mxv

github.com/quic-go/quic-go

• GHSA-g754-hx8w-x2g6 (fixed in >= 0.57.0)
• GO-2025-4233 (fixed in >= 0.57.0)

github.com/sigstore/timestamp-authority

• GO-2025-4192
• GHSA-4qg8-fj49-pxjh (fixed in >= 2.0.3)

Detected Dependencies

circleci (1)

.circleci/config.yml (5)

• slack 5.1.1 → [Updates: 5.2.3, 6.1.2]
• vuln-scanner 0.11.4
• cimg/go 1.25.3 → [Updates: 1.25.5]
• cimg/go 1.25.3 → [Updates: 1.25.5]
• circleci/command-convenience 0.1

dockerfile (2)

docker/Dockerfile

docker/windows.Dockerfile

gomod (1)

go.mod (18)

• go 1.25.0
• go 1.25.4 → [Updates: 1.25.5]
• github.com/alecthomas/kong v1.13.0
• github.com/fsnotify/fsnotify v1.9.0
• github.com/gin-gonic/gin v1.11.0
• github.com/goccy/go-json v0.10.5
• github.com/google/go-cmp v0.7.0
• github.com/hashicorp/go-reap v0.0.0-20230117204525-bf69c61a7b71@bf69c61a7b71
• gotest.tools/v3 v3.5.2
• github.com/golangci/golangci-lint/v2 v2.4.0 → [Updates: v2.7.2]
• github.com/google/go-licenses/v2 v2.0.1
• github.com/goreleaser/goreleaser/v2 v2.10.2 → [Updates: v2.13.2]
• github.com/quic-go/quic-go v0.54.1 → [Updates: v0.57.0]
• github.com/sigstore/cosign/v2 v2.5.2 → [Updates: v2.6.1, v3.0.3]
• github.com/sigstore/timestamp-authority v1.2.8 → [Updates: v2.0.3]
• gotest.tools/gotestsum v1.12.3 → [Updates: v1.13.0]
• github.com/circleci/ex v1.0.18572-c9dd937 → [Updates: v1.0.19544-752f938]
• golang.org/x/sys v0.38.0 → [Updates: v0.39.0]

---

• Check this box to trigger a request for Renovate to run again on this repository