Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Config Migration Needed

• Select this checkbox to let Renovate create an automated Config Migration PR.

Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

• Pin anthropics/claude-code-base-action action to e8132bc
• Update anthropics/claude-code-action digest to 1b422b3
• Update module github.com/google/go-containerregistry to v0.21.3
• Update module github.com/testcontainers/testcontainers-go to v0.41.0
• Update module golang.org/x/mod to v0.34.0
• Update module golang.org/x/time to v0.15.0
• Update module modernc.org/sqlite to v1.47.0
• Update opentelemetry and observability (go.opentelemetry.io/otel, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/prometheus, go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/sdk, go.opentelemetry.io/otel/sdk/metric, go.opentelemetry.io/otel/trace)
• Update cli and ui libraries to v2 (major) (github.com/charmbracelet/bubbletea, github.com/charmbracelet/lipgloss)
• Update container build actions (major) (docker/build-push-action, docker/login-action, docker/metadata-action, docker/setup-buildx-action)
• Update core workflow actions (major) (actions/download-artifact, actions/upload-artifact)
• Update sigstore/cosign-installer action to v4
• Update slackapi/slack-github-action action to v3
• 🔐 Create all awaiting schedule PRs at once 🔐

---

Warning

Renovate failed to look up the following dependencies: Could not determine new digest for update (github-tags package arduino/setup-task).

Files affected: .github/workflows/e2e-tests.yml

---

PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

• Update module github.com/1password/onepassword-sdk-go to v0.4.0
• Update module github.com/go-jose/go-jose/v3 to v4

Detected Dependencies

dockerfile (1)

containers/egress-proxy/Dockerfile (1)

• alpine 3.23.3

github-actions (22)

.github/workflows/claude.yml (3)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• anthropics/claude-code-action v1@cd77b50d2b0808657f8e6774085c8bf54484351c → [Updates: v1]

.github/workflows/create-release-pr.yml (3)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• stacklok/releaseo v0.0.3@b7022753f832cac36a9e07769a679a7c1ca72fe2

.github/workflows/create-release-tag.yml (1)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd

.github/workflows/e2e-tests.yml (8)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• arduino/setup-task v2@b91d5d2c96a56797b48ac1e0e89220bf64044611
• actions/upload-artifact v6@b7c566a772e6b6bfb58ed0dc250532a479d7789f → [Updates: v7]
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• actions/download-artifact v7@37930b1c2abaa49bbe596cd826c3c89aef350131 → [Updates: v8]
• actions/upload-artifact v6@b7c566a772e6b6bfb58ed0dc250532a479d7789f → [Updates: v7]

.github/workflows/helm-charts-test.yml (7)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• ko-build/setup-ko v0.9@d006021bd0c28d1ce33a07e7943d48b079944c8d
• azure/setup-helm v4.3.1@1a275c3b69536ee54be43f2070a358922e12c8d4
• helm/chart-testing-action v2.8.0@6ec842c01de15ebb84c8627d2744a0c2f2755c9f
• arduino/setup-task v2
• helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc

.github/workflows/helm-publish.yml (4)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• azure/setup-helm v4@1a275c3b69536ee54be43f2070a358922e12c8d4
• sigstore/cosign-installer v3.10.1@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 → [Updates: v4.1.0]

.github/workflows/image-build-and-publish.yml (29)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• docker/login-action v3.7.0@c94ce9fb468520275223c153574b00df6fe4bcc9 → [Updates: v4.0.0]
• ko-build/setup-ko v0.9@d006021bd0c28d1ce33a07e7943d48b079944c8d
• sigstore/cosign-installer v4.1.0@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• docker/login-action v3.7.0@c94ce9fb468520275223c153574b00df6fe4bcc9 → [Updates: v4.0.0]
• docker/setup-buildx-action v3.12.0@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f → [Updates: v4.0.0]
• docker/metadata-action v5.10.0@c299e40c65443455700f0fdfc63efafe5b349051 → [Updates: v6.0.0]
• docker/build-push-action v6.19.2@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 → [Updates: v7.0.0]
• sigstore/cosign-installer v4.1.0@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• arduino/setup-task v2
• docker/login-action v3.7.0@c94ce9fb468520275223c153574b00df6fe4bcc9 → [Updates: v4.0.0]
• ko-build/setup-ko v0.9@d006021bd0c28d1ce33a07e7943d48b079944c8d
• docker/setup-buildx-action v3.12.0@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f → [Updates: v4.0.0]
• sigstore/cosign-installer v4.1.0@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• docker/login-action v3.7.0@c94ce9fb468520275223c153574b00df6fe4bcc9 → [Updates: v4.0.0]
• ko-build/setup-ko v0.9@d006021bd0c28d1ce33a07e7943d48b079944c8d
• docker/setup-buildx-action v3.12.0@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f → [Updates: v4.0.0]
• sigstore/cosign-installer v3.10.1@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 → [Updates: v4.1.0]
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• docker/login-action v3.7.0@c94ce9fb468520275223c153574b00df6fe4bcc9 → [Updates: v4.0.0]
• ko-build/setup-ko v0.9@d006021bd0c28d1ce33a07e7943d48b079944c8d
• sigstore/cosign-installer v4.1.0@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22

.github/workflows/issue-triage.yml (2)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• anthropics/claude-code-base-action beta → [Updates: beta]

.github/workflows/license-headers.yml (2)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417

.github/workflows/lint.yml (4)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• actions/cache v5@cdf6c1fa76f9f475f3d7449005a359c84ca0f306
• golangci/golangci-lint-action v9.2.0@1e7e51e771db61008b38414a730f564565cf7c20

.github/workflows/operator-ci.yml (22)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• arduino/setup-task v2
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• arduino/setup-task v2
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• arduino/setup-task v2
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• arduino/setup-task v2
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• arduino/setup-task v2
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• azure/setup-helm v4.3.1@1a275c3b69536ee54be43f2070a358922e12c8d4
• ko-build/setup-ko v0.9@d006021bd0c28d1ce33a07e7943d48b079944c8d
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• arduino/setup-task v2
• kyverno/action-install-chainsaw v0.2.14@06560d18422209e9c1e08e931d477d04bf2674c1
• helm/kind-action ef37e7f390d99f746eb8b610417061a60e82a6cc

.github/workflows/pr-size-label-apply.yml (8)

• actions/download-artifact v7@37930b1c2abaa49bbe596cd826c3c89aef350131 → [Updates: v8]
• actions/github-script v8@ed597411d8f924073f98dfc5c65a23a2325f34cd
• actions/github-script v8@ed597411d8f924073f98dfc5c65a23a2325f34cd
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/download-artifact v7@37930b1c2abaa49bbe596cd826c3c89aef350131 → [Updates: v8]
• actions/github-script v8@ed597411d8f924073f98dfc5c65a23a2325f34cd
• actions/github-script v8@ed597411d8f924073f98dfc5c65a23a2325f34cd
• actions/github-script v8@ed597411d8f924073f98dfc5c65a23a2325f34cd

.github/workflows/pr-size-labeler.yml (3)

• actions/github-script v8@ed597411d8f924073f98dfc5c65a23a2325f34cd
• actions/github-script v8@ed597411d8f924073f98dfc5c65a23a2325f34cd
• actions/upload-artifact v6@b7c566a772e6b6bfb58ed0dc250532a479d7789f → [Updates: v7]

.github/workflows/releaser.yml (8)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• anchore/sbom-action v0.23.1@57aae528053a48a3f6235f2d9461b05fbcb7366d
• sigstore/cosign-installer v4.1.0@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22
• goreleaser/goreleaser-action v7@ec59f474b9834571250b370d4735c50f8e2d1e29
• slackapi/slack-github-action v2.1.1@91efab103c0de0a537f72a35f6b8cda0ee76bf0a → [Updates: v3.0.1]

.github/workflows/renovate-config-validation.yml (1)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd

.github/workflows/security-scan.yml (8)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• aquasecurity/trivy-action 0.35.0@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
• github/codeql-action v4@b1bff81932f5cdfc8695c7752dcee935dcd061c8
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• aquasecurity/trivy-action 0.35.0@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
• github/codeql-action v4@b1bff81932f5cdfc8695c7752dcee935dcd061c8
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• golang/govulncheck-action v1@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee

.github/workflows/skills-build-and-publish.yml (3)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• docker/login-action v3.7.0@c94ce9fb468520275223c153574b00df6fe4bcc9 → [Updates: v4.0.0]

.github/workflows/spellcheck.yml (2)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• codespell-project/actions-codespell v2@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630

.github/workflows/test-e2e-lifecycle.yml (6)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• azure/setup-helm v4.3.1@1a275c3b69536ee54be43f2070a358922e12c8d4
• ko-build/setup-ko v0.9@d006021bd0c28d1ce33a07e7943d48b079944c8d
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• arduino/setup-task v2
• helm/kind-action ef37e7f390d99f746eb8b610417061a60e82a6cc

.github/workflows/test.yml (7)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• actions/cache v5@cdf6c1fa76f9f475f3d7449005a359c84ca0f306
• actions/cache v5@cdf6c1fa76f9f475f3d7449005a359c84ca0f306
• arduino/setup-task v2
• codecov/codecov-action v5@671740ac38dd9b0130fbe1cec585b89eea48d3de
• coverallsapp/github-action v2@5cbfd81b66ca5d10c19b062c04de0199c215fb6e

.github/workflows/verify-docgen.yml (2)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417

.github/workflows/verify-gen.yml (4)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd
• actions/setup-go v6@4b73464bb391d4059bd26b0524d20df3927bd417
• actions/cache v5@cdf6c1fa76f9f475f3d7449005a359c84ca0f306
• arduino/setup-task v2

gomod (1)

go.mod (85)

• go 1.26.1
• dario.cat/mergo v1.0.2
• github.com/1password/onepassword-sdk-go v0.3.1 → [Updates: v0.4.0]
• github.com/alicebob/miniredis/v2 v2.37.0
• github.com/aws/aws-sdk-go-v2 v1.41.4
• github.com/aws/aws-sdk-go-v2/config v1.32.12
• github.com/aws/aws-sdk-go-v2/service/sts v1.41.9
• github.com/cedar-policy/cedar-go v1.5.2
• github.com/cenkalti/backoff/v5 v5.0.3
• github.com/charmbracelet/bubbletea v1.3.10 → [Updates: v2.0.2]
• github.com/charmbracelet/lipgloss v1.1.0 → [Updates: v2.0.2]
• github.com/containerd/errdefs v1.0.0
• github.com/coreos/go-oidc/v3 v3.17.0
• github.com/docker/docker v28.5.2+incompatible
• github.com/docker/go-connections v0.6.0
• github.com/go-chi/chi/v5 v5.2.5
• github.com/go-git/go-billy/v5 v5.8.0
• github.com/go-git/go-git/v5 v5.17.0
• github.com/go-jose/go-jose/v3 v3.0.4 → [Updates: v4.1.3]
• github.com/go-jose/go-jose/v4 v4.1.3
• github.com/gofrs/flock v0.13.0
• github.com/google/cel-go v0.27.0
• github.com/google/go-cmp v0.7.0
• github.com/google/go-containerregistry v0.21.2 → [Updates: v0.21.3]
• github.com/google/uuid v1.6.0
• github.com/lestrrat-go/httprc/v3 v3.0.4
• github.com/lestrrat-go/jwx/v3 v3.0.13
• github.com/mark3labs/mcp-go v0.45.0
• github.com/modelcontextprotocol/registry v1.5.0
• github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25@caebfff84d25
• github.com/olekukonko/tablewriter v1.1.4
• github.com/onsi/ginkgo/v2 v2.28.1
• github.com/onsi/gomega v1.39.1
• github.com/ory/fosite v0.49.0
• github.com/pelletier/go-toml/v2 v2.2.4
• github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c@5ac0b6a4141c
• github.com/pressly/goose/v3 v3.27.0
• github.com/prometheus/client_golang v1.23.2
• github.com/redis/go-redis/v9 v9.18.0
• github.com/shirou/gopsutil/v4 v4.26.2
• github.com/spf13/viper v1.21.0
• github.com/stacklok/toolhive-catalog v0.20260317.0
• github.com/stacklok/toolhive-core v0.0.12
• github.com/stretchr/testify v1.11.1
• github.com/swaggo/swag/v2 v2.0.0-rc5
• github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd@ecc657c15afd
• github.com/testcontainers/testcontainers-go v0.40.0 → [Updates: v0.41.0]
• github.com/tidwall/gjson v1.18.0
• github.com/xeipuuv/gojsonschema v1.2.0
• github.com/zalando/go-keyring v0.2.6
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.40.0 → [Updates: v1.42.0]
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.40.0 → [Updates: v1.42.0]
• go.opentelemetry.io/otel/exporters/prometheus v0.63.0 → [Updates: v0.64.0]
• go.opentelemetry.io/otel/sdk v1.41.0 → [Updates: v1.42.0]
• go.opentelemetry.io/otel/sdk/metric v1.41.0 → [Updates: v1.42.0]
• go.uber.org/mock v0.6.0
• go.uber.org/zap v1.27.1
• golang.ngrok.com/ngrok/v2 v2.1.1
• golang.org/x/exp/jsonrpc2 v0.0.0-20260312153236-7ab1446f8b90@7ab1446f8b90
• golang.org/x/mod v0.33.0 → [Updates: v0.34.0]
• golang.org/x/oauth2 v0.36.0
• golang.org/x/sync v0.20.0
• golang.org/x/term v0.41.0
• golang.org/x/time v0.14.0 → [Updates: v0.15.0]
• gopkg.in/yaml.v3 v3.0.1
• k8s.io/api v0.35.2
• k8s.io/apimachinery v0.35.2
• k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2@b8788abfbbc2
• modernc.org/sqlite v1.46.2 → [Updates: v1.47.0]
• sigs.k8s.io/controller-runtime v0.23.3
• sigs.k8s.io/yaml v1.6.0
• github.com/Microsoft/go-winio v0.6.2
• github.com/adrg/xdg v0.5.3
• github.com/go-logr/logr v1.4.3
• github.com/golang-jwt/jwt/v5 v5.3.1
• github.com/opencontainers/go-digest v1.0.0
• github.com/opencontainers/image-spec v1.1.1
• github.com/spf13/cobra v1.10.2
• github.com/spf13/pflag v1.0.10
• go.opentelemetry.io/otel v1.41.0 → [Updates: v1.42.0]
• go.opentelemetry.io/otel/metric v1.41.0 → [Updates: v1.42.0]
• go.opentelemetry.io/otel/trace v1.41.0 → [Updates: v1.42.0]
• golang.org/x/crypto v0.49.0
• golang.org/x/sys v0.42.0
• k8s.io/client-go v0.35.2

helm-values (1)

deploy/charts/operator/values.yaml (4)

• ghcr.io/stacklok/toolhive/operator v0.12.2
• ghcr.io/stacklok/toolhive/proxyrunner v0.12.2
• ghcr.io/stacklok/toolhive/vmcp v0.12.2
• ghcr.io/stacklok/thv-registry-api v0.6.4

regex (9)

.github/workflows/helm-charts-test.yml (1)

• helm/helm 3.20.1 → [Updates: 4.1.3]

.github/workflows/operator-ci.yml (3)

• kindest/node 1.33.7 → [Updates: 1.35.1]
• kindest/node 1.34.3 → [Updates: 1.35.1]
• kindest/node 1.35.1

.github/workflows/operator-ci.yml (1)

• kubernetes-sigs/kind 0.31.0

.github/workflows/operator-ci.yml (1)

• kyverno/chainsaw 0.2.14

.github/workflows/test-e2e-lifecycle.yml (3)

• kindest/node 1.33.7 → [Updates: 1.35.1]
• kindest/node 1.34.3 → [Updates: 1.35.1]
• kindest/node 1.35.1

.github/workflows/test-e2e-lifecycle.yml (1)

• kubernetes-sigs/kind 0.31.0

cmd/thv/app/inspector/version.go (1)

• ghcr.io/modelcontextprotocol/inspector 0.21.1

go.mod (1)

• golang 1.26.1

pkg/container/templates/go.tmpl (1)

• index.docker.io/library/alpine 3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659

---

• Check this box to trigger a request for Renovate to run again on this repository