Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Config Migration Needed

See Config Migration PR: #30.

Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

• chore(deps): update actions/setup-go action to v7
• chore(deps): lock file maintenance
• 🔐 Create all awaiting schedule PRs at once 🔐

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security]
• chore(deps): update actions/checkout digest to 34e1148
• chore(deps): update actions/setup-go digest to 40f1582
• chore(deps): update wangyoucao577/go-release-action digest to 2794951
• chore(deps): update terraform aws to v5.100.0
• chore(deps): update actions/checkout action to v7
• chore(deps): update terraform aws to v6
• Click on this checkbox to rebase all open PRs at once

Vulnerabilities

Important

75/76 CVEs have Renovate fixes.

gomod

go.mod

github.com/go-git/go-git/v5

• GHSA-37cx-329c-33x3 (fixed in >= 5.16.5)
• GHSA-389r-gv7p-r3rp (fixed in >= 5.19.0)
• GHSA-3xc5-wrhm-f963 (fixed in >= 5.18.0)
• GHSA-crhj-59gh-8x96 (fixed in >= 5.19.1)
• GHSA-gm2x-2g9h-ccm8 (fixed in >= 5.17.1)
• GHSA-jhf3-xxhw-2wpp (fixed in >= 5.17.1)
• GHSA-m7cr-m3pv-hgrp (fixed in >= 5.19.1)
• GHSA-r9px-m959-cxf4 (fixed in >= 5.13.0)
• GHSA-v725-9546-7q7m (fixed in >= 5.13.0)
• GHSA-w5pp-99ch-qj29 (fixed in >= 5.19.1)
• GO-2025-3367 (fixed in >= 5.13.0)
• GO-2025-3368 (fixed in >= 5.13.0)
• GO-2026-4473 (fixed in >= 5.16.5)
• GO-2026-4909 (fixed in >= 5.17.1)
• GO-2026-4910 (fixed in >= 5.17.1)
• GO-2026-5496 (fixed in >= 5.19.1)

github.com/cloudflare/circl

• GHSA-2x5j-vhc8-9cwm (fixed in >= 1.6.1)
• GHSA-q9hv-hpm4-hj6x (fixed in >= 1.6.3)
• GO-2025-3754 (fixed in >= 1.6.1)
• GO-2026-4550 (fixed in >= 1.6.3)

github.com/go-git/go-billy/v5

• GHSA-m3xc-h892-ggx6 (fixed in >= 5.9.0)
• GHSA-qw64-3x98-g7q2 (fixed in >= 5.9.0)

golang.org/x/crypto

• GHSA-45gg-vh54-h5m9 (fixed in >= 0.52.0)
• GHSA-5cgq-3rg8-m6cv (fixed in >= 0.52.0)
• GHSA-78mq-xcr3-xm33 (fixed in >= 0.52.0)
• GHSA-89gr-r52h-f8rx (fixed in >= 0.52.0)
• GHSA-9m57-25v3-79x9 (fixed in >= 0.52.0)
• GHSA-f5wc-c3c7-36mc (fixed in >= 0.52.0)
• GHSA-f6x5-jh6r-wrfv (fixed in >= 0.45.0)
• GHSA-hcg3-q754-cr77 (fixed in >= 0.35.0)
• GHSA-j5w8-q4qc-rx2x (fixed in >= 0.45.0)
• GHSA-jppx-rxg9-jmrx (fixed in >= 0.52.0)
• GHSA-q4h4-gmj2-qvw2 (fixed in >= 0.52.0)
• GHSA-qpw4-5x99-6vjp (fixed in >= 0.52.0)
• GHSA-rm3j-f69w-wqmq (fixed in >= 0.52.0)
• GHSA-v778-237x-gjrc (fixed in >= 0.31.0)
• GHSA-vgwf-h737-ff37 (fixed in >= 0.52.0)
• GHSA-w879-237q-wc7r (fixed in >= 0.52.0)
• GHSA-x527-x647-q7gg (fixed in >= 0.52.0)
• GO-2024-3321 (fixed in >= 0.31.0)
• GO-2025-3487 (fixed in >= 0.35.0)
• GO-2025-4116 (fixed in >= 0.43.0)
• GO-2025-4134 (fixed in >= 0.45.0)
• GO-2025-4135 (fixed in >= 0.45.0)
• GO-2026-5005 (fixed in >= 0.52.0)
• GO-2026-5006 (fixed in >= 0.52.0)
• GO-2026-5013 (fixed in >= 0.52.0)
• GO-2026-5014 (fixed in >= 0.52.0)
• GO-2026-5015 (fixed in >= 0.52.0)
• GO-2026-5016 (fixed in >= 0.52.0)
• GO-2026-5017 (fixed in >= 0.52.0)
• GO-2026-5018 (fixed in >= 0.52.0)
• GO-2026-5019 (fixed in >= 0.52.0)
• GO-2026-5020 (fixed in >= 0.52.0)
• GO-2026-5021 (fixed in >= 0.52.0)
• GO-2026-5023 (fixed in >= 0.52.0)
• GO-2026-5033 (fixed in >= 0.52.0)
• GO-2026-5932

golang.org/x/net

• GHSA-4v7x-pqxf-cx7m (fixed in >= 0.23.0)
• GHSA-5cv4-jp36-h3mw (fixed in >= 0.55.0)
• GHSA-qxp5-gwg8-xv66 (fixed in >= 0.36.0)
• GHSA-vvgc-356p-c3xw (fixed in >= 0.38.0)
• GO-2024-2687 (fixed in >= 0.23.0)
• GO-2024-3333 (fixed in >= 0.33.0)
• GO-2025-3503 (fixed in >= 0.36.0)
• GO-2025-3595 (fixed in >= 0.38.0)
• GO-2026-4440 (fixed in >= 0.45.0)
• GO-2026-4441 (fixed in >= 0.45.0)
• GO-2026-4918 (fixed in >= 0.53.0)
• GO-2026-5025 (fixed in >= 0.55.0)
• GO-2026-5026 (fixed in >= 0.55.0)
• GO-2026-5027 (fixed in >= 0.55.0)
• GO-2026-5028 (fixed in >= 0.55.0)
• GO-2026-5029 (fixed in >= 0.55.0)
• GO-2026-5030 (fixed in >= 0.55.0)

golang.org/x/sys

• GO-2026-5024 (fixed in >= 0.44.0)

Detected Dependencies

github-actions (2)

.github/workflows/build.yaml (2)

• actions/checkout v4@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 → [Updates: v7, v4]
• actions/setup-go v5@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 → [Updates: v7, v5]

.github/workflows/release.yaml (2)

• actions/checkout v4@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 → [Updates: v7, v4]
• wangyoucao577/go-release-action v1@6ac7dba1f9e61850053324549cb6bc88e4b473d2 → [Updates: v1]

gomod (1)

go.mod (2)

• go 1.21.4
• github.com/go-git/go-git/v5 v5.12.0 → [Updates: v5.19.1]

terraform (1)

infra/terraform/main.tf (1)

• aws 5.71.0 → [Updates: 5.100.0, 6.55.0]

---

• Check this box to trigger a request for Renovate to run again on this repository