Dependency Dashboard

[renovate-sh-app]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Abandoned Dependencies

The following dependencies have not received updates for an extended period and may be unmaintained.

View abandoned dependencies (41)

[!NOTE]
Packages are marked as abandoned when they exceed the abandonmentThreshold since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity.

Datasource	Package	Last Updated
gomod	github.com/DmitriyVTitov/size	2022-04-11
gomod	github.com/bboreham/go-loser	2023-09-20
gomod	github.com/beorn7/perks	2019-07-31
gomod	github.com/cespare/xxhash/v2	2024-04-04
gomod	github.com/colega/go-yaml-yaml	2022-05-27
gomod	github.com/davecgh/go-spew	2018-02-21
gomod	github.com/dennwc/varint	2019-06-16
gomod	github.com/dustin/go-humanize	2023-01-10
gomod	github.com/facette/natsort	2018-12-10
gomod	github.com/go-graphite/go-whisper	2023-05-26
gomod	github.com/go-kit/log	2022-04-27
gomod	github.com/go-logr/stdr	2021-12-14
gomod	github.com/gogo/googleapis	2021-03-10
gomod	github.com/gogo/protobuf	2021-01-10
gomod	github.com/gogo/status	2022-04-23
gomod	github.com/golang/protobuf	2024-03-06
gomod	github.com/golang/snappy	2023-12-25
gomod	github.com/google/uuid	2024-01-23
gomod	github.com/grafana/mimir	2021-10-11
gomod	github.com/jmespath/go-jmespath	2020-09-18
gomod	github.com/jpillora/backoff	2019-10-03
gomod	github.com/json-iterator/go	2021-09-11
gomod	github.com/kisielk/whisper-go	2014-01-12
gomod	github.com/kylelemons/godebug	2019-05-05
gomod	github.com/modern-go/concurrent	2018-03-06
gomod	github.com/modern-go/reflect2	2021-09-11
gomod	github.com/munnerz/goautoneg	2019-10-10
gomod	github.com/mwitkow/go-conntrack	2019-07-16
gomod	github.com/opentracing/opentracing-go	2020-07-01
gomod	github.com/pkg/browser	2024-01-02
gomod	github.com/pkg/errors	2020-01-14
gomod	github.com/pmezard/go-difflib	2016-01-10
gomod	github.com/sercand/kuberesolver	2020-02-05
gomod	github.com/thanos-community/galaxycache	2022-07-11
gomod	github.com/themihai/gomemcache	2018-09-02
gomod	github.com/uber/jaeger-client-go	2021-12-07
gomod	github.com/uber/jaeger-lib	2021-03-29
gomod	go.uber.org/atomic	2023-05-03
gomod	go.uber.org/goleak	2023-10-24
gomod	gopkg.in/yaml.v2	2022-05-27
gomod	gopkg.in/yaml.v3	2022-05-27

Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

• chore(deps): pin dependencies (golangci/golangci-lint, grafana/security-github-actions)
• chore(deps): update github.com/grafana/regexp digest to f7b3be9
• chore(deps): update module github.com/aws/aws-sdk-go to v1.55.8
• chore(deps): update module github.com/go-logfmt/logfmt to v0.6.1
• chore(deps): update module github.com/go-logr/logr to v1.4.4
• chore(deps): update module github.com/googleapis/enterprise-certificate-proxy to v0.3.19
• chore(deps): update module github.com/opencontainers/image-spec to v1.1.1
• fix(deps): update module github.com/oklog/ulid/v2 to v2.1.2
• chore(deps): update azure-sdk-for-go monorepo (github.com/Azure/azure-sdk-for-go/sdk/azcore, github.com/Azure/azure-sdk-for-go/sdk/azidentity, github.com/Azure/azure-sdk-for-go/sdk/internal)
• chore(deps): update kubernetes monorepo to v0.36.3 (k8s.io/apimachinery, k8s.io/client-go)
• chore(deps): update module cloud.google.com/go/auth to v0.22.0
• chore(deps): update module github.com/azuread/microsoft-authentication-library-for-go to v1.8.0
• chore(deps): update module github.com/dgraph-io/ristretto to v0.2.0
• chore(deps): update module github.com/felixge/httpsnoop to v1.1.0
• chore(deps): update module github.com/go-viper/mapstructure/v2 to v2.5.0
• chore(deps): update module github.com/googleapis/gax-go/v2 to v2.23.0
• chore(deps): update module github.com/prometheus/client_golang to v1.24.1
• chore(deps): update module github.com/prometheus/procfs to v0.21.1
• chore(deps): update module github.com/prometheus/sigv4 to v0.4.1
• chore(deps): update module github.com/tjhop/slog-gokit to v0.2.2
• chore(deps): update module go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.69.0
• chore(deps): update module golang.org/x/crypto to v0.54.0
• chore(deps): update module golang.org/x/sync to v0.22.0
• chore(deps): update module golang.org/x/sys to v0.47.0
• chore(deps): update module golang.org/x/time to v0.15.0
• chore(deps): update module google.golang.org/api to v0.290.0
• chore(deps): update module k8s.io/klog/v2 to v2.140.0
• chore(deps): update opentelemetry-go monorepo to v1.44.0 (go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/sdk, go.opentelemetry.io/otel/sdk/metric, go.opentelemetry.io/otel/trace)
• fix(deps): update module github.com/prometheus/common to v0.70.1
• chore(deps): update actions/setup-go action to v7
• chore(deps): update module github.com/dgraph-io/ristretto to v2
• chore(deps): update module go.yaml.in/yaml/v2 to v3
• chore(deps): update module gopkg.in/yaml.v2 to v3
• 🔐 Create all rate-limited PRs at once 🔐

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

• chore(deps): update google.golang.org/genproto/googleapis/rpc digest to 8efbd57

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• fix(security/unknown/): update module github.com/klauspost/compress to v1.18.7 [security]
• fix(security/unknown/): update module go.opentelemetry.io/otel to v1.44.0 [security]
• fix(security/unknown/): update module golang.org/x/net to v0.56.0 [security]
• fix(security/unknown/): update module golang.org/x/text to v0.39.0 [security]
• fix(security/unknown/): update module google.golang.org/grpc to v1.82.1 [security]
• chore(deps): update actions/checkout digest to d23441a
• chore(deps): update actions/setup-go digest to 924ae3a
• chore(deps): update golang.org/x/exp digest to b88d891
• chore(deps): update golangci/golangci-lint-action digest to ba0d7d2
• chore(deps): update k8s.io/utils digest to cf1189d
• fix(deps): update github.com/grafana/dskit digest to 6542948
• chore(deps): update grafana/shared-workflows/lint-pr-title action to v1.2.4
• fix(deps): update module github.com/grafana/mimir to v0.7.0
• chore(deps): update actions/checkout action to v7
• fix(deps): update module github.com/grafana/mimir to v1
• Click on this checkbox to rebase all open PRs at once

PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

• chore(deps): update module github.com/colega/go-yaml-yaml to v3
• chore(deps): update module github.com/grafana/mimir-prometheus to v3

Vulnerabilities

Important

7/11 CVEs have Renovate fixes.

gomod

go.mod

github.com/prometheus/prometheus

• GHSA-8rm2-7qqf-34qm (fixed in > 2.5.0)
• GO-2026-5264

go.opentelemetry.io/otel

• GO-2026-5158 (fixed in >= 1.44.0)

golang.org/x/net

• GO-2026-5942 (fixed in >= 0.56.0)

google.golang.org/grpc

• GHSA-hrxh-6v49-42gf (fixed in >= 1.82.1)
• GO-2026-6061 (fixed in >= 1.82.1)

github.com/aws/aws-sdk-go

• GO-2022-0635
• GO-2022-0646

github.com/klauspost/compress

• GO-2026-5841 (fixed in >= 1.18.7)

golang.org/x/crypto

• GO-2026-5932

golang.org/x/text

• GO-2026-5970 (fixed in >= 0.39.0)

Detected Dependencies

dockerfile (1)

cmd/mimir-whisper-converter/Dockerfile (2)

• python 3.13-bullseye@sha256:f58f33e0563f2ba81c7afe6259cd912f0c33413da93c75cc3a70a941c17afa8c
• python 3.13-bullseye@sha256:f58f33e0563f2ba81c7afe6259cd912f0c33413da93c75cc3a70a941c17afa8c

github-actions (3)

.github/workflows/checks.yml (11)

• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v7, v6]
• actions/setup-go v6@4a3601121dd01d1626a1e23e37211e3254c1c06c → [Updates: v7, v6]
• golangci/golangci-lint-action v9@1e7e51e771db61008b38414a730f564565cf7c20 → [Updates: v9]
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v7, v6]
• actions/setup-go v6@4a3601121dd01d1626a1e23e37211e3254c1c06c → [Updates: v7, v6]
• actions/checkout v6@de0fac2e4500dabe0009e67214ff5f5447ce83dd → [Updates: v7, v6]
• actions/setup-go v6@4a3601121dd01d1626a1e23e37211e3254c1c06c → [Updates: v7, v6]
• go ${{ env.GO_VERSION }}
• golangci/golangci-lint v2.12.2 → [Updates: v2.12.2]
• go ${{ env.GO_VERSION }}
• go ${{ env.GO_VERSION }}

.github/workflows/conventional-pr.yml (1)

• grafana/shared-workflows lint-pr-title/v1.2.2@0239db2665246f3b078d8d9166e4d8f09c071cae → [Updates: lint-pr-title/v1.2.4]

.github/workflows/dependabot-reviewer.yml (1)

• grafana/security-github-actions main → [Updates: main]

gomod (1)

go.mod (103)

• go 1.25.0
• github.com/go-graphite/go-whisper v0.0.0-20230526115116-e3110f57c01c@e3110f57c01c
• github.com/go-kit/log v0.2.1
• github.com/gogo/protobuf v1.3.2
• github.com/golang/snappy v1.0.0
• github.com/grafana/dskit v0.0.0-20250422145853-90fa6b9a2b76@90fa6b9a2b76 → [Updates: v0.0.0-20250422145853-90fa6b9a2b76]
• github.com/grafana/mimir v0.0.0-20250501105506-4584085047c0@4584085047c0 → [Updates: v0.7.0, v1.11.0-rc.0]
• github.com/kisielk/whisper-go v0.0.0-20140112135752-82e8091afdea@82e8091afdea
• github.com/oklog/ulid/v2 v2.1.1 → [Updates: v2.1.2]
• github.com/pkg/errors v0.9.1
• github.com/prometheus/common v0.68.0 → [Updates: v0.70.1]
• github.com/prometheus/prometheus v1.99.0
• github.com/stretchr/testify v1.11.1
• cloud.google.com/go/auth v0.16.0 → [Updates: v0.22.0]
• cloud.google.com/go/auth/oauth2adapt v0.2.8
• cloud.google.com/go/compute/metadata v0.9.0
• github.com/felixge/httpsnoop v1.0.4 → [Updates: v1.1.0]
• github.com/go-viper/mapstructure/v2 v2.4.0 → [Updates: v2.5.0]
• github.com/golang/protobuf v1.5.4
• github.com/google/s2a-go v0.1.9
• github.com/googleapis/enterprise-certificate-proxy v0.3.6 → [Updates: v0.3.19]
• github.com/googleapis/gax-go/v2 v2.14.1 → [Updates: v2.23.0]
• github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f@2f068394615f
• github.com/opencontainers/image-spec v1.1.0-rc2 → [Updates: v1.1.1]
• github.com/opentracing-contrib/go-stdlib v1.1.1
• github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b@10b1cf09e00b
• github.com/prometheus/client_golang v1.23.2 → [Updates: v1.24.1]
• github.com/prometheus/sigv4 v0.1.2 → [Updates: v0.4.1]
• github.com/tjhop/slog-gokit v0.1.4 → [Updates: v0.2.2]
• github.com/uber/jaeger-client-go v2.30.0+incompatible
• github.com/uber/jaeger-lib v2.4.1+incompatible
• go.opentelemetry.io/otel v1.43.0 → [Updates: v1.44.0]
• go.opentelemetry.io/otel/sdk v1.43.0 → [Updates: v1.44.0]
• go.opentelemetry.io/otel/sdk/metric v1.43.0 → [Updates: v1.44.0]
• go.opentelemetry.io/otel/trace v1.43.0 → [Updates: v1.44.0]
• go.yaml.in/yaml/v2 v2.4.4 → [Updates: v3.0.5]
• golang.org/x/net v0.55.0 → [Updates: v0.56.0]
• google.golang.org/grpc v1.80.0 → [Updates: v1.82.1]
• google.golang.org/protobuf v1.36.11
• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.1 → [Updates: v1.22.0]
• github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.2 → [Updates: v1.14.0]
• github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 → [Updates: v1.12.0]
• github.com/AzureAD/microsoft-authentication-library-for-go v1.3.3 → [Updates: v1.8.0]
• github.com/DmitriyVTitov/size v1.5.0
• github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b@0f3dac36c52b
• github.com/aws/aws-sdk-go v1.55.6 → [Updates: v1.55.8]
• github.com/bboreham/go-loser v0.0.0-20230920113527-fcc2c21820a3@fcc2c21820a3
• github.com/beorn7/perks v1.0.1
• github.com/cespare/xxhash/v2 v2.3.0
• github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc@d8f796af33cc
• github.com/dennwc/varint v1.0.0
• github.com/dgraph-io/ristretto v0.1.1 → [Updates: v0.2.0, v2.4.2]
• github.com/dustin/go-humanize v1.0.1
• github.com/edsrzf/mmap-go v1.2.0
• github.com/facette/natsort v0.0.0-20181210072756-2cd4dd1e2dcb@2cd4dd1e2dcb
• github.com/go-logfmt/logfmt v0.6.0 → [Updates: v0.6.1]
• github.com/go-logr/logr v1.4.3 → [Updates: v1.4.4]
• github.com/go-logr/stdr v1.2.2
• github.com/gogo/googleapis v1.4.1
• github.com/gogo/status v1.1.1
• github.com/golang-jwt/jwt/v5 v5.3.1
• github.com/golang/glog v1.2.5
• github.com/google/go-cmp v0.7.0
• github.com/google/uuid v1.6.0
• github.com/grafana/regexp v0.0.0-20240607082908-2cb410fa05da@2cb410fa05da → [Updates: v0.0.0-20240607082908-2cb410fa05da]
• github.com/jmespath/go-jmespath v0.4.0
• github.com/jpillora/backoff v1.0.0
• github.com/json-iterator/go v1.1.12
• github.com/klauspost/compress v1.18.0 → [Updates: v1.18.7]
• github.com/kylelemons/godebug v1.1.0
• github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd@bacd9c7ef1dd
• github.com/modern-go/reflect2 v1.0.2
• github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822@a7dc8b61c822
• github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c@5ac0b6a4141c
• github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2@5d4384ee4fb2
• github.com/prometheus/client_model v0.6.2
• github.com/prometheus/procfs v0.16.1 → [Updates: v0.21.1]
• go.opentelemetry.io/auto/sdk v1.2.1
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 → [Updates: v0.69.0]
• go.opentelemetry.io/otel/metric v1.43.0 → [Updates: v1.44.0]
• go.uber.org/atomic v1.11.0
• go.uber.org/goleak v1.3.0
• golang.org/x/crypto v0.52.0 → [Updates: v0.54.0]
• golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8@7588d65b2ba8 → [Updates: v0.0.0-20260727155853-b88d891fe743]
• golang.org/x/oauth2 v0.36.0
• golang.org/x/sync v0.20.0 → [Updates: v0.22.0]
• golang.org/x/sys v0.45.0 → [Updates: v0.47.0]
• golang.org/x/text v0.37.0 → [Updates: v0.39.0]
• golang.org/x/time v0.11.0 → [Updates: v0.15.0]
• google.golang.org/api v0.229.0 → [Updates: v0.290.0]
• google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9@9d38bb4040a9 → [Updates: v0.0.0-20260729162451-8efbd57d26e0]
• gopkg.in/yaml.v2 v2.4.0 → [Updates: v3.0.1]
• gopkg.in/yaml.v3 v3.0.1
• k8s.io/apimachinery v0.32.3 → [Updates: v0.36.3]
• k8s.io/client-go v0.32.3 → [Updates: v0.36.3]
• k8s.io/klog/v2 v2.130.1 → [Updates: v2.140.0]
• k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738@3ea5e8cea738 → [Updates: v0.0.0-20260707023825-cf1189d6abe3]
• github.com/themihai/gomemcache v0.0.0-20180902122335-24332e2d58ab@24332e2d58ab
• github.com/grafana/gocql v0.0.0-20200605141915-ba5dc39ece85@ba5dc39ece85
• github.com/grafana/mimir-prometheus v1.8.2-0.20250423083340-007de9b763aa@007de9b763aa → [Updates: v3.12.0]
• github.com/sercand/kuberesolver v2.4.0+incompatible
• github.com/thanos-community/galaxycache v0.0.0-20220711100658-323e89e130ea@323e89e130ea
• github.com/colega/go-yaml-yaml v0.0.0-20220720105220-255a8d16d094@255a8d16d094 → [Updates: v3.0.1]

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.