Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Config Migration Needed

• Select this checkbox to let Renovate create an automated Config Migration PR.

Pending Approval

The following branches are pending approval. To create them, click on a checkbox below.

• Renovate: Update External dependencies (github.com/hashicorp/vault/api, github.com/segmentio/kafka-go, go)
• Renovate: Update External dependencies (major) (actions/checkout, actions/setup-go, github/codeql-action, golangci/golangci-lint-action, gopkg.in/yaml.v2)
• 🔐 Create all pending approval PRs at once 🔐

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• Renovate: Update module github.com/redis/go-redis/v9 to v9.6.3 [SECURITY]

Vulnerabilities

Important

48/48 CVEs have Renovate fixes.

gomod

go.mod

github.com/redis/go-redis/v9

• GHSA-92cp-5422-2mw7 (fixed in >= 9.5.5)
• GO-2025-3540 (fixed in >= 9.5.5)
• GO-2025-3540 (fixed in >= 9.6.3)

github.com/cyphar/filepath-securejoin

• GHSA-6xv5-86q9-7xr8 (fixed in >= 0.2.4)
• GO-2023-2048 (fixed in >= 0.2.4)

github.com/go-jose/go-jose/v4

• GHSA-78h2-9frx-2jm8 (fixed in >= 4.1.4)
• GHSA-c6gw-w398-hv78 (fixed in >= 4.0.5)
• GO-2025-3485 (fixed in >= 4.0.5)
• GO-2026-4945 (fixed in >= 4.1.4)

github.com/hashicorp/go-retryablehttp

• GHSA-v6v8-xj6m-xwqh (fixed in >= 0.7.7)
• GO-2024-2947 (fixed in >= 0.7.7)

golang.org/x/crypto

• GHSA-f6x5-jh6r-wrfv (fixed in >= 0.45.0)
• GHSA-hcg3-q754-cr77 (fixed in >= 0.35.0)
• GHSA-j5w8-q4qc-rx2x (fixed in >= 0.45.0)
• GHSA-v778-237x-gjrc (fixed in >= 0.31.0)
• GO-2024-3321 (fixed in >= 0.31.0)
• GO-2025-3487 (fixed in >= 0.35.0)
• GO-2025-4116 (fixed in >= 0.43.0)
• GO-2025-4134 (fixed in >= 0.45.0)
• GO-2025-4135 (fixed in >= 0.45.0)
• GO-2026-5005 (fixed in >= 0.52.0)
• GO-2026-5006 (fixed in >= 0.52.0)
• GO-2026-5013 (fixed in >= 0.52.0)
• GO-2026-5014 (fixed in >= 0.52.0)
• GO-2026-5015 (fixed in >= 0.52.0)
• GO-2026-5016 (fixed in >= 0.52.0)
• GO-2026-5017 (fixed in >= 0.52.0)
• GO-2026-5018 (fixed in >= 0.52.0)
• GO-2026-5019 (fixed in >= 0.52.0)
• GO-2026-5020 (fixed in >= 0.52.0)
• GO-2026-5021 (fixed in >= 0.52.0)
• GO-2026-5023 (fixed in >= 0.52.0)
• GO-2026-5033 (fixed in >= 0.52.0)

golang.org/x/net

• GHSA-5cv4-jp36-h3mw (fixed in >= 0.55.0)
• GHSA-qxp5-gwg8-xv66 (fixed in >= 0.36.0)
• GHSA-vvgc-356p-c3xw (fixed in >= 0.38.0)
• GO-2024-3333 (fixed in >= 0.33.0)
• GO-2025-3503 (fixed in >= 0.36.0)
• GO-2025-3595 (fixed in >= 0.38.0)
• GO-2026-4440 (fixed in >= 0.45.0)
• GO-2026-4441 (fixed in >= 0.45.0)
• GO-2026-4918 (fixed in >= 0.53.0)
• GO-2026-5025 (fixed in >= 0.55.0)
• GO-2026-5026 (fixed in >= 0.55.0)
• GO-2026-5027 (fixed in >= 0.55.0)
• GO-2026-5028 (fixed in >= 0.55.0)
• GO-2026-5029 (fixed in >= 0.55.0)
• GO-2026-5030 (fixed in >= 0.55.0)

Detected Dependencies

github-actions (3)

.github/workflows/checks.yaml (4)

• actions/checkout v4 → [Updates: v7]
• actions/setup-go v5 → [Updates: v6]
• golang/govulncheck-action v1
• go 1.22.3 → [Updates: 1.26.4]

.github/workflows/ci.yaml (7)

• actions/checkout v4 → [Updates: v7]
• actions/setup-go v5 → [Updates: v6]
• golangci/golangci-lint-action v6 → [Updates: v9]
• actions/checkout v4 → [Updates: v7]
• actions/setup-go v5 → [Updates: v6]
• go 1.22.3 → [Updates: 1.26.4]
• go 1.22.3 → [Updates: 1.26.4]

.github/workflows/codeql.yaml (6)

• actions/checkout v4 → [Updates: v7]
• actions/setup-go v5 → [Updates: v6]
• github/codeql-action v3 → [Updates: v4]
• github/codeql-action v3 → [Updates: v4]
• github/codeql-action v3 → [Updates: v4]
• go 1.22.3 → [Updates: 1.26.4]

gomod (1)

go.mod (6)

• go 1.22
• github.com/cbrewster/slog-env v0.1.1
• github.com/hashicorp/vault/api v1.13.0 → [Updates: v1.23.0]
• github.com/redis/go-redis/v9 v9.5.1 → [Updates: v9.6.3]
• github.com/segmentio/kafka-go v0.4.47 → [Updates: v0.4.51]
• gopkg.in/yaml.v2 v2.4.0 → [Updates: v3.0.1]

renovate-config (1)

.github/renovate.json

---

• Check this box to trigger a request for Renovate to run again on this repository