Dependency Dashboard

[alaudaa-renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• chore(deps): update module golang.org/x/sys to v0.44.0 [security]
• fix(deps): update module github.com/jackc/pgx/v4 to v5 [security]
• chore(deps): update all patch dependencies (patch) (go, golang, harbor-scanner-trivy, hub-mirrors.alauda.cn/library/golang)
• Click on this checkbox to rebase all open PRs at once

Vulnerabilities

22/25 CVEs have Renovate fixes.

gomod

subtree/harbor/src/go.mod

github.com/aws/aws-sdk-go

• GO-2022-0635
• GO-2022-0646

github.com/jackc/pgx/v4

• GHSA-j88v-2chj-qfwx (fixed in > 4.18.3)

golang.org/x/crypto

• GO-2026-5015 (fixed in >= 0.52.0)
• GO-2026-5013 (fixed in >= 0.52.0)
• GO-2026-5005 (fixed in >= 0.52.0)
• GO-2026-5033 (fixed in >= 0.52.0)
• GO-2026-5021 (fixed in >= 0.52.0)
• GO-2026-5023 (fixed in >= 0.52.0)
• GO-2026-5019 (fixed in >= 0.52.0)
• GO-2026-5016 (fixed in >= 0.52.0)
• GO-2026-5020 (fixed in >= 0.52.0)
• GO-2026-5014 (fixed in >= 0.52.0)
• GO-2026-5006 (fixed in >= 0.52.0)
• GO-2026-5018 (fixed in >= 0.52.0)
• GO-2026-5017 (fixed in >= 0.52.0)

golang.org/x/net

• GO-2026-4918 (fixed in >= 0.53.0)
• GO-2026-5028 (fixed in >= 0.55.0)
• GO-2026-5029 (fixed in >= 0.55.0)
• GO-2026-5026 (fixed in >= 0.55.0)
• GO-2026-5030 (fixed in >= 0.55.0)
• GO-2026-5025 (fixed in >= 0.55.0)
• GO-2026-5027 (fixed in >= 0.55.0)

github.com/jackc/pgproto3/v2

• GO-2026-4518

golang.org/x/sys

• GO-2026-5024 (fixed in >= 0.44.0)

Detected dependencies

dockerfile

Containerfile

• hub-mirrors.alauda.cn/library/golang 1.26.1-bookworm

gomod

subtree/harbor/src/go.mod

• go 1.25.3
• filippo.io/csrf v0.2.1
• github.com/CloudNativeAI/model-spec v0.0.5
• github.com/FZambia/sentinel v1.1.0
• github.com/Masterminds/semver v1.5.0
• github.com/aliyun/alibaba-cloud-sdk-go v1.63.107
• github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2@a9d515a09cc2
• github.com/aws/aws-sdk-go v1.55.6
• github.com/beego/beego/v2 v2.3.8
• github.com/beego/i18n v0.0.0-20140604031826-e87155e8f0c0@e87155e8f0c0
• github.com/bmatcuk/doublestar v1.3.4
• github.com/casbin/casbin v1.9.1
• github.com/cenkalti/backoff/v4 v4.3.0
• github.com/cloudevents/sdk-go/v2 v2.16.1
• github.com/coreos/go-oidc/v3 v3.12.0
• github.com/dghubble/sling v1.4.2
• github.com/docker/distribution v2.8.3+incompatible
• github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7@aabc10ec26b7
• github.com/go-asn1-ber/asn1-ber v1.5.7
• github.com/go-ldap/ldap/v3 v3.4.10
• github.com/go-openapi/errors v0.22.0
• github.com/go-openapi/loads v0.22.0
• github.com/go-openapi/runtime v0.28.0
• github.com/go-openapi/spec v0.21.0
• github.com/go-openapi/strfmt v0.23.0
• github.com/go-openapi/swag v0.23.1
• github.com/go-openapi/validate v0.24.0
• github.com/go-redis/redis/v8 v8.11.4
• github.com/gocarina/gocsv v0.0.0-20210516172204-ca9e8a8ddea8@ca9e8a8ddea8
• github.com/gocraft/work v0.5.1
• github.com/golang-jwt/jwt/v5 v5.3.0
• github.com/golang-migrate/migrate/v4 v4.18.1
• github.com/gomodule/redigo v2.0.0+incompatible
• github.com/google/go-containerregistry v0.20.2
• github.com/google/uuid v1.6.0
• github.com/gorilla/handlers v1.5.2
• github.com/gorilla/mux v1.8.1
• github.com/graph-gophers/dataloader v5.0.0+incompatible
• github.com/jackc/pgconn v1.14.3
• github.com/jackc/pgx/v4 v4.18.3
• github.com/jpillora/backoff v1.0.0
• github.com/ncw/swift v1.0.49
• github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646@83c6a9932646
• github.com/olekukonko/tablewriter v0.0.5
• github.com/opencontainers/go-digest v1.0.0
• github.com/opencontainers/image-spec v1.1.1
• github.com/pkg/errors v0.9.1
• github.com/prometheus/client_golang v1.23.2
• github.com/prometheus/client_model v0.6.2
• github.com/robfig/cron/v3 v3.0.1
• github.com/spf13/viper v1.19.0
• github.com/stretchr/testify v1.11.1
• github.com/tencentcloud/tencentcloud-sdk-go v3.0.233+incompatible
• github.com/vmihailenco/msgpack/v5 v5.4.1
• github.com/volcengine/volcengine-go-sdk v1.1.29
• go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux v0.59.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0
• go.opentelemetry.io/otel v1.43.0
• go.opentelemetry.io/otel/exporters/jaeger v1.17.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0
• go.opentelemetry.io/otel/sdk v1.43.0
• go.opentelemetry.io/otel/trace v1.43.0
• go.pinniped.dev v0.37.0
• go.uber.org/ratelimit v0.3.1
• golang.org/x/crypto v0.49.0
• golang.org/x/net v0.52.0
• golang.org/x/oauth2 v0.35.0
• golang.org/x/sync v0.20.0
• golang.org/x/text v0.35.0
• golang.org/x/time v0.12.0
• gopkg.in/h2non/gock.v1 v1.1.2
• gopkg.in/yaml.v2 v2.4.0
• helm.sh/helm/v3 v3.20.2
• k8s.io/api v0.35.1
• k8s.io/apimachinery v0.35.1
• k8s.io/client-go v0.35.1
• sigs.k8s.io/yaml v1.6.0
• cloud.google.com/go/compute/metadata v0.9.0
• github.com/Azure/azure-sdk-for-go v37.2.0+incompatible
• github.com/Azure/go-autorest v14.2.0+incompatible
• github.com/Azure/go-autorest/autorest v0.11.27
• github.com/Azure/go-autorest/autorest/adal v0.9.20
• github.com/Azure/go-autorest/autorest/date v0.3.0
• github.com/Azure/go-autorest/autorest/to v0.3.0
• github.com/Azure/go-autorest/logger v0.2.1
• github.com/Azure/go-autorest/tracing v0.6.0
• github.com/Azure/go-ntlmssp v0.1.1
• github.com/Knetic/govaluate v3.0.1-0.20171022003610-9aa49832a739+incompatible@9aa49832a739
• github.com/Masterminds/semver/v3 v3.4.0
• github.com/Unknwon/goconfig v0.0.0-20160216183935-5f601ca6ef4d@5f601ca6ef4d
• github.com/benbjohnson/clock v1.3.0
• github.com/beorn7/perks v1.0.1
• github.com/cenkalti/backoff/v5 v5.0.3
• github.com/cespare/xxhash/v2 v2.3.0
• github.com/containerd/stargz-snapshotter/estargz v0.14.3
• github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc@d8f796af33cc
• github.com/denverdino/aliyungo v0.0.0-20191227032621-df38c6fa730c@df38c6fa730c
• github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f@9f7001d12a5f
• github.com/distribution/reference v0.6.0
• github.com/dnaeon/go-vcr v1.2.0
• github.com/docker/cli v29.2.0+incompatible
• github.com/docker/docker-credential-helpers v0.8.2
• github.com/docker/go-metrics v0.0.1
• github.com/felixge/httpsnoop v1.0.4
• github.com/fsnotify/fsnotify v1.8.0
• github.com/fxamacker/cbor/v2 v2.9.0
• github.com/go-jose/go-jose/v4 v4.1.4
• github.com/go-logr/logr v1.4.3
• github.com/go-logr/stdr v1.2.2
• github.com/go-openapi/analysis v0.23.0
• github.com/go-openapi/jsonpointer v0.21.0
• github.com/go-openapi/jsonreference v0.21.0
• github.com/golang-jwt/jwt/v4 v4.5.2
• github.com/google/go-querystring v1.1.0
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0
• github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542@b4df798d6542
• github.com/hashicorp/errwrap v1.1.0
• github.com/hashicorp/go-multierror v1.1.1
• github.com/hashicorp/golang-lru v0.5.4
• github.com/hashicorp/hcl v1.0.0
• github.com/jackc/chunkreader/v2 v2.0.1
• github.com/jackc/pgerrcode v0.0.0-20220416144525-469b46aa5efa@469b46aa5efa
• github.com/jackc/pgio v1.0.0
• github.com/jackc/pgpassfile v1.0.0
• github.com/jackc/pgproto3/v2 v2.3.4-0.20250125160525-bc041643406d@bc041643406d
• github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a@091c0ba34f0a
• github.com/jackc/pgtype v1.14.0
• github.com/jmespath/go-jmespath v0.4.0
• github.com/josharian/intern v1.0.0
• github.com/json-iterator/go v1.1.12
• github.com/klauspost/compress v1.18.0
• github.com/lib/pq v1.10.9
• github.com/magiconair/properties v1.8.7
• github.com/mailru/easyjson v0.9.0
• github.com/mattn/go-runewidth v0.0.9
• github.com/mitchellh/go-homedir v1.1.0
• github.com/mitchellh/mapstructure v1.5.0
• github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd@bacd9c7ef1dd
• github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee@35a7c28c31ee
• github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822@a7dc8b61c822
• github.com/oklog/ulid v1.3.1
• github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b@10b1cf09e00b
• github.com/pelletier/go-toml/v2 v2.2.2
• github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2@5d4384ee4fb2
• github.com/prometheus/common v0.66.1
• github.com/prometheus/procfs v0.16.1
• github.com/robfig/cron v1.0.0
• github.com/sagikazarmark/locafero v0.4.0
• github.com/sagikazarmark/slog-shim v0.1.0
• github.com/satori/go.uuid v1.2.0
• github.com/shiena/ansicolor v0.0.0-20200904210342-c7312218db18@c7312218db18
• github.com/sirupsen/logrus v1.9.3
• github.com/smartystreets/goconvey v1.8.1
• github.com/sourcegraph/conc v0.3.0
• github.com/spf13/afero v1.11.0
• github.com/spf13/cast v1.7.0
• github.com/spf13/pflag v1.0.10
• github.com/stretchr/objx v0.5.2
• github.com/subosito/gotenv v1.6.0
• github.com/valyala/bytebufferpool v1.0.0
• github.com/vbatts/tar-split v0.11.3
• github.com/vmihailenco/tagparser/v2 v2.0.0
• github.com/volcengine/volc-sdk-golang v1.0.23
• github.com/x448/float16 v0.8.4
• go.mongodb.org/mongo-driver v1.14.0
• go.opentelemetry.io/auto/sdk v1.2.1
• go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0
• go.opentelemetry.io/otel/metric v1.43.0
• go.opentelemetry.io/proto/otlp v1.10.0
• go.uber.org/atomic v1.9.0
• go.uber.org/multierr v1.11.0
• go.uber.org/zap v1.27.0
• go.yaml.in/yaml/v2 v2.4.3
• golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56@8a7402abbf56
• golang.org/x/sys v0.42.0
• golang.org/x/term v0.41.0
• google.golang.org/api v0.171.0
• google.golang.org/cloud v0.0.0-20151119220103-975617b05ea8@975617b05ea8
• google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9@9d38bb4040a9
• google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9@9d38bb4040a9
• google.golang.org/grpc v1.80.0
• google.golang.org/protobuf v1.36.11
• gopkg.in/inf.v0 v0.9.1
• gopkg.in/ini.v1 v1.67.0
• gopkg.in/yaml.v3 v3.0.1
• k8s.io/klog/v2 v2.130.1
• k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912@589584f1c912
• k8s.io/utils v0.0.0-20251002143259-bc988d571ff4@bc988d571ff4
• sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730@2d320260d730
• sigs.k8s.io/randfill v1.0.0
• sigs.k8s.io/structured-merge-diff/v6 v6.3.0
• github.com/Azure/go-autorest v14.2.0+incompatible
• github.com/AlaudaDevops/distribution v2.8.3-alauda.3+incompatible
• github.com/goharbor/work v0.5.1-patch
• github.com/gomodule/redigo v1.9.2
• google.golang.org/api v0.0.0-20160322025152-9bf6e6e569ff@9bf6e6e569ff

regex

Containerfile

• golang 1.26.1-bookworm

.tekton/all-in-one.yaml

• trivy v0.68.3-alauda-7
• harbor-scanner-trivy v0.34.3-alauda-2
• go 1.26.3
• goharbor-distribution v2.8.4-alauda-7

subtree/harbor/make/patches/patch-amd64.sh

• go 1.26.3

---

• Check this box to trigger a request for Renovate to run again on this repository