Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

• chore(deps): update docker/build-push-action action to v7.4.0
• chore(deps): update docker/setup-buildx-action action to v4.4.0
• fix(deps): update kubernetes monorepo to v0.37.0 (k8s.io/api, k8s.io/apimachinery, k8s.io/client-go)
• fix(deps): update module github.com/kcp-dev/multicluster-provider to v0.8.0
• fix(deps): update module github.com/kcp-dev/sdk to v0.33.0
• fix(deps): update module github.com/onsi/ginkgo/v2 to v2.32.2
• fix(deps): update module github.com/onsi/gomega to v1.43.0
• fix(deps): update module sigs.k8s.io/multicluster-runtime to v0.24.1
• chore(deps): update actions/checkout action to v7
• chore(deps): update actions/setup-go action to v7
• chore(deps): update dependency opendefensecloud/dev-kit to v2
• 🔐 Create all rate-limited PRs at once 🔐

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

• chore(deps): update gcr.io/distroless/static:nonroot docker digest to e2e927e

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): pin dependencies (ghcr.io/opendefensecloud/quota-controller, ghcr.io/opendefensecloud/quota-webhook)
• chore(deps): update actions/checkout action to v6.1.0
• chore(deps): update docker/setup-qemu-action action to v4.4.0
• chore(deps): update github/codeql-action action to v4.38.0
• chore(deps): update golang version sync to v1.27.1 (go, golang)
• chore(deps): update golangci-lint to v2.13.2 (golangci-lint, golangci/golangci-lint)
• chore(deps): update google/osv-scanner-action action to v2.6.0
• chore(deps): update module controller-gen to v0.22.0
• chore(deps): update module osv-scanner to v2.6.0
• fix(deps): update controller-runtime (setup-envtest, sigs.k8s.io/controller-runtime)
• Click on this checkbox to rebase all open PRs at once

Detected Dependencies

dockerfile (1)

Dockerfile (4)

• golang 1.26.5@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a → [Updates: 1.27.1, 1.26.5]
• gcr.io/distroless/static nonroot@sha256:963fa6c544fe5ce420f1f54fb88b6fb01479f054c8056d0f74cc2c6000df5240 → [Updates: nonroot]
• gcr.io/distroless/static nonroot@sha256:963fa6c544fe5ce420f1f54fb88b6fb01479f054c8056d0f74cc2c6000df5240 → [Updates: nonroot]
• gcr.io/distroless/static nonroot@sha256:963fa6c544fe5ce420f1f54fb88b6fb01479f054c8056d0f74cc2c6000df5240 → [Updates: nonroot]

github-actions (9)

.github/workflows/conventional-commits.yml (5)

• amannn/action-semantic-pull-request v6@48f256284bd46cdaab1048c3721360e808335d50
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• wagoid/commitlint-github-action v6@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed
• ubuntu 24.04
• ubuntu 24.04

.github/workflows/docker.yaml (10)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.1.0, v7.0.1]
• docker/metadata-action v6.2.0@dc802804100637a589fabce1cb79ff13a1411302
• docker/setup-qemu-action v4.1.0@06116385d9baf250c9f4dcb4858b16962ea869c3 → [Updates: v4.4.0]
• docker/setup-buildx-action v4.3.0@37fe631027851001ddb9b187196cc803df7f5f0e → [Updates: v4.4.0]
• docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f
• docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a → [Updates: v7.4.0]
• sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6
• anchore/sbom-action v0.24.2@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26
• actions/attest-sbom v4.1.0@c604332985a26aa8cf1bdc465b92731239ec6b9e
• actions/attest-build-provenance v4.2.2@4d101475d8b20a2381f78447822ac1eab6504dd8

.github/workflows/fuzz.yaml (3)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.1.0, v7.0.1]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

.github/workflows/golang.yaml (6)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.1.0, v7.0.1]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• golangci/golangci-lint-action v9.3.0@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a
• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.1.0, v7.0.1]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• golangci/golangci-lint v2.12.2 → [Updates: v2.13.2]

.github/workflows/helm-lint.yaml (1)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.1.0, v7.0.1]

.github/workflows/helm-publish.yaml (4)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.1.0, v7.0.1]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6
• docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f

.github/workflows/ossf-scorecard.yml (4)

• actions/checkout v6.0.2@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v6.1.0, v7.0.1]
• ossf/scorecard-action v2.4.4@2d1146689b8cda280b9bc96326124645441f03bc
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• github/codeql-action v4.36.0@7211b7c8077ea37d8641b6271f6a365a22a5fbfa → [Updates: v4.38.0]

.github/workflows/osv-scanner.yml (2)

• google/osv-scanner-action v2.3.8@9a498708959aeaef5ef730655706c5a1df1edbc2 → [Updates: v2.6.0]
• google/osv-scanner-action v2.3.8@9a498708959aeaef5ef730655706c5a1df1edbc2 → [Updates: v2.6.0]

.github/workflows/zizmor.yml (3)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• zizmorcore/zizmor-action v0.6.4@cc914d7f3750a2d13d75c7f184a1060aa0e9d482
• ubuntu 24.04

gomod (1)

go.mod (12)

• go 1.26.5 → [Updates: 1.27.1]
• github.com/go-logr/logr v1.4.4
• github.com/kcp-dev/logicalcluster/v3 v3.0.5
• github.com/kcp-dev/multicluster-provider v0.7.1 → [Updates: v0.8.0]
• github.com/kcp-dev/sdk v0.31.2 → [Updates: v0.33.0]
• github.com/onsi/ginkgo/v2 v2.27.4 → [Updates: v2.32.2]
• github.com/onsi/gomega v1.39.0 → [Updates: v1.43.0]
• k8s.io/api v0.35.4 → [Updates: v0.37.0]
• k8s.io/apimachinery v0.35.4 → [Updates: v0.37.0]
• k8s.io/client-go v0.35.4 → [Updates: v0.37.0]
• sigs.k8s.io/controller-runtime v0.23.3 → [Updates: v0.25.1]
• sigs.k8s.io/multicluster-runtime v0.23.3 → [Updates: v0.24.1]

helm-values (1)

charts/quota-controller/values.yaml (2)

• ghcr.io/opendefensecloud/quota-controller unknown version → [Updates: ``]
• ghcr.io/opendefensecloud/quota-webhook unknown version → [Updates: ``]

nix (1)

flake.nix (4)

• dev-kit lock file @ 41370fd52f6889401ef79388e54e7e38bfbf112e
• flake-utils lock file @ 11707dc2f618dd54ca8739b309ec4fc024de578b
• go-overlay lock file @ 423eed783363fa154fc7f0c049f7effa910d2440
• nixpkgs nixos-unstable

regex (5)

.github/workflows/golang.yaml (1)

• golangci/golangci-lint v2.12.2 → [Updates: v2.13.2]

flake.nix (1)

• go 1.26.5 → [Updates: 1.27.1]

Makefile (1)

• opendefensecloud/dev-kit v1.0.15 → [Updates: v2.2.0]

tools.lock (4)

• addlicense v1.2.0
• controller-gen v0.19.0 → [Updates: v0.22.0]
• golangci-lint v2.12.2 → [Updates: v2.13.2]
• osv-scanner v2.3.8 → [Updates: v2.6.0]

tools.lock (1)

• setup-envtest release-0.23 → [Updates: release-0.25]

---

• Check this box to trigger a request for Renovate to run again on this repository