Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• Renovate: Update module oras.land/oras-go/v2 to v2.6.2 [SECURITY]
• Pin gcr.io/distroless/static Docker tag to e2e927e
• Pin golang Docker tag to cf6fca6
• Renovate: Update k8s.io/utils digest to cf1189d
• Renovate: Update External dependencies (github.com/gardener/gardener-extension-provider-openstack, github.com/gardener/gardener/pkg/apis, github.com/go-logr/logr, github.com/gophercloud/gophercloud/v2, github.com/ironcore-dev/gardener-extension-provider-ironcore-metal, github.com/onsi/ginkgo/v2, github.com/onsi/gomega, go.yaml.in/yaml/v3, golang.org/x/sync, k8s.io/api, k8s.io/apiextensions-apiserver, k8s.io/apimachinery, k8s.io/client-go, sigs.k8s.io/controller-runtime)
• Click on this checkbox to rebase all open PRs at once

Vulnerabilities

Important

14/15 CVEs have Renovate fixes.

gomod

go.mod

oras.land/oras-go/v2

• GHSA-fxhp-mv3v-67qp (fixed in >= 2.6.2)
• GO-2026-5880 (fixed in >= 2.6.2)

github.com/klauspost/compress

• GO-2026-5841 (fixed in >= 1.18.7)

golang.org/x/crypto

• GO-2026-5932
• GO-2026-6303 (fixed in >= 0.55.0)
• GO-2026-6354 (fixed in >= 0.56.0)
• GO-2026-6355 (fixed in >= 0.56.0)

golang.org/x/mod

• GO-2026-6179 (fixed in >= 0.40.0)
• GO-2026-6180 (fixed in >= 0.40.0)

golang.org/x/text

• GO-2026-5970 (fixed in >= 0.39.0)

google.golang.org/grpc

• GHSA-2v4p-qf9q-27wj (fixed in >= 1.82.2)
• GHSA-hrxh-6v49-42gf (fixed in >= 1.82.1)
• GHSA-qc2q-p7wx-3px3 (fixed in >= 1.83.1)
• GHSA-vp52-pcj8-j9qc (fixed in >= 1.83.1)
• GO-2026-6061 (fixed in >= 1.82.1)

Detected Dependencies

dockerfile (1)

Dockerfile (2)

• golang 1.27-alpine → [Updates: 1.27-alpine]
• gcr.io/distroless/static nonroot → [Updates: nonroot]

github-actions (4)

.github/workflows/checks.yaml

.github/workflows/ci.yaml

.github/workflows/codeql.yaml

.github/workflows/container-registry-ghcr.yaml

gomod (1)

go.mod (22)

• go 1.27
• github.com/blang/semver/v4 v4.0.0
• github.com/distribution/distribution/v3 v3.1.1
• github.com/gardener/gardener/pkg/apis v1.145.0 → [Updates: v1.151.0]
• github.com/go-logr/logr v1.4.3 → [Updates: v1.4.4]
• github.com/gophercloud/gophercloud/v2 v2.13.0 → [Updates: v2.14.0]
• github.com/ironcore-dev/gardener-extension-provider-ironcore-metal v0.1.1-0.20260624151759-9166baa81e86@9166baa81e86 → [Updates: v0.2.0]
• github.com/onsi/ginkgo/v2 v2.32.0 → [Updates: v2.32.2]
• github.com/onsi/gomega v1.42.1 → [Updates: v1.43.0]
• github.com/opencontainers/go-digest v1.0.0
• github.com/opencontainers/image-spec v1.1.1
• go.uber.org/zap v1.28.0
• go.yaml.in/yaml/v3 v3.0.4 → [Updates: v3.0.5]
• golang.org/x/sync v0.21.0 → [Updates: v0.23.0]
• k8s.io/api v0.36.0 → [Updates: v0.37.0]
• k8s.io/apiextensions-apiserver v0.36.0 → [Updates: v0.37.0]
• k8s.io/apimachinery v0.36.0 → [Updates: v0.37.0]
• k8s.io/client-go v0.36.0 → [Updates: v0.37.0]
• k8s.io/utils v0.0.0-20260507154919-ff6756f316d2@ff6756f316d2 → [Updates: v0.0.0-20260707023825-cf1189d6abe3]
• oras.land/oras-go/v2 v2.6.1 → [Updates: v2.6.2]
• sigs.k8s.io/controller-runtime v0.24.1 → [Updates: v0.25.1]
• github.com/gardener/gardener-extension-provider-openstack v1.54.0 → [Updates: v1.58.0]

renovate-config (1)

.github/renovate.json5

---

• Check this box to trigger a request for Renovate to run again on this repository