Skip to content

fix(deps): update dependencies (minor) - #147

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-updates
Open

fix(deps): update dependencies (minor)#147
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-updates

Conversation

@renovate

@renovate renovate Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence Type Update
github.com/ironcore-dev/controller-utils v0.14.0 → v0.15.1 age confidence require minor
github/codeql-action v4.38.3 → v4.39.1 age confidence action minor
golangci-lint v2.14.0 → v2.15.0 age confidence minor
ossf/scorecard-action v2.4.4 → v2.5.0 age confidence action minor
osv-scanner v2.6.0 → v2.7.0 age confidence minor

Release Notes

ironcore-dev/controller-utils (github.com/ironcore-dev/controller-utils)

v0.15.1

Compare Source

Changes

🚀 Features

v0.15.0

Compare Source

Changes

🚀 Features

🧰 Maintenance

github/codeql-action

v4.39.1

Compare Source

v4.39.0

Compare Source

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198
golangci/golangci-lint (golangci-lint)

v2.15.0

Compare Source

Released on 2026-10-16

  1. Linters new features or changes
    • errcheck: from 1.20.0 to 1.30.0
    • exhaustive: from 0.13.0 to 0.15.0 (⚠️ changes)
    • gocognit: from 1.2.1 to 1.3.0
    • golines: from 0.15.0 to 0.16.0
    • govet-modernize: from 0.50.0 to 0.52.0
    • loggercheck: from 0.12.0 to 0.13.0
    • predeclared: from 0.2.2 to 0.3.0
    • wrapcheck: from 2.12.0 to 2.13.0
  2. Linters bug fixes
    • bidichk: from 0.3.3 to 0.3.4
    • canonicalheader: from a25c71c to e18e5c5
    • gofumpt: improve deprecation logs
    • gosec: improve concurrency default value
    • iface: from 1.5.1 to 1.5.3
    • paralleltest: from 1.0.15 to 1.0.16
    • revive: from 1.17.0 to 1.17.1
    • revive: the rules context-keys-type, errorf, modifies-value-receiver, range-val-address, string-of-int, time-equal, time-naming, unexported-return, unhandled-error, var-declaration are working (less randomly).
    • rowserrcheck: from c5f79b8 to e0740d5
    • staticcheck: from 0.8.1 to 0.8.2
  3. Bug fixes
    • fix: compute custom version hash with module versions
    • fix: env vars loading (related to revive)

⚠️ Changes of the exhaustive linter:

  • The replaced options still exists, and partially works, but they are deprecated.
  • The options explicit-exhaustive-switch and explicit-exhaustive-map have been replaced by explicit-exhaustive.
  • The check the value map has been replaced by mapliteral.
  • The option ignore-enum-members (string) has been replaced by ignore-constants (slice).
  • The option ignore-enum-types (string) has been replaced by ignore-types (slice).
  • New report messages.
  • The linter is a now a "slow" linter.
ossf/scorecard-action

v2.5.0

Compare Source

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.

  • The action's container image is built with Go 1.27.2 on a refreshed distroless base. by
    @​justaugustus in #​1716
  • The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still
    recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in #​1716
  • The Scorecard version in results now always matches the Scorecard release the action is built
    with. by @​justaugustus in #​1718
  • The action no longer prints the GitHub token variable while validating its options. by
    @​arpitjain099 in #​1709
  • results_format accepts intoto, which wraps the JSON results in an in-toto attestation
    statement. by @​puerco in #​1702
Other

New Contributors

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

google/osv-scanner (osv-scanner)

v2.7.0

Compare Source

Features:
  • Feature #​2885 Include package URLs (purl) in JSON output when available.
  • Feature #​2589 Add shorter --x- flag aliases and deprecate --experimental- flags.
  • Feature #​3113 Include vulnerability severity and rating in CycloneDX output when available.
  • Feature #​3102 Enable Dart package_config.json (dart/packageconfig) extractor by default for lockfile scans (google/osv-scalibr#2295).
  • Dependency scanning & lockfile improvements via osv-scalibr:
    • Add best-effort Maven property pre-interpolation for dependency versions and in-memory caching for Maven resolution.
    • Support scanning Bitnami container SPDX SBOMs (sbom/spdx) (google/osv-scalibr#2156).
    • Add MinimOS ecosystem mapping to the APK extractor (os/apk) (google/osv-scalibr#2406).
    • Apply --max-file-size limit to container image contents and tag container image layers with Buildpacks lifecycle metadata.
  • New extractors and plugin support via osv-scalibr:
Fixes:
  • Bug #​3137 Delegate package normalization to osv-scalibr's osvutil to preserve Maven group IDs in CycloneDX SBOMs so fixed versions are properly reported (fixes #​3099).
  • Bug #​3135 Prevent network-requiring plugins (such as base image enrichment) from running when --offline is combined with --download-offline-databases.
  • Bug #​3134 Preserve call analysis information when diffing vulnerability results.
  • Bug #​3121 Wrap [[PackageOverrides]] ecosystem suffix alternatives in a non-capturing group so Ecosystem regex matching applies correctly to all variants (fixes #​3120).
  • Bug #​3103 Sort packages by location before applying config annotations for deterministic log output order during recursive scans.
  • Bug #​3087 Group output packages by exact ecosystem name to prevent duplicate entries when ecosystems share a prefix (e.g. Alpine and Alpine:v3.18) (fixes #​3086).
  • Fixes via osv-scalibr:
    • Skip OSV queries for local npm packages (file:, workspace, and local tarballs) and avoid extracting bogus versions or commits for file: and URL-based dependencies in bun.lock (google/osv-scalibr#2443, google/osv-scalibr#2444).
    • Restrict #commit fragment extraction in JS lockfiles to Git-based dependency resolutions (google/osv-scalibr#2448).
    • Prevent slice-bounds panic in javascript/pnpmlock on malformed scoped dependency paths (google/osv-scalibr#2263).
    • Emit valid Hackage PURLs (pkg:hackage/...) and add Hackage OSV ecosystem mapping for Haskell (cabal and stack.yaml.lock) extractors (google/osv-scalibr#2419).
    • Match Python setup.py package names containing -, ., and _ (google/osv-scalibr#2162).
    • Reject invalid ZIP64 sizes and bound metadata reads in python/wheelegg (google/osv-scalibr#2012).
    • Confine Maven registry disk cache writes with os.Root to prevent path traversal (google/osv-scalibr#2398).
    • Compare PURL namespaces case-insensitively during OSV vulnerability matching (e.g. for Go modules with uppercase characters) (google/osv-scalibr#2456).
    • Skip advisory affected entries with unrecognized ecosystems in local OSV matcher instead of aborting matching for the advisory (google/osv-scalibr#2429).
    • Fix WordPress plugin name extraction from directory name and restrict scanning to immediate subdirectories of wp-content/plugins (google/osv-scalibr#2424, google/osv-scalibr#2445).
    • Fix 32-bit statfs block size overflow when checking filesystem types on 32-bit architectures (google/osv-scalibr#2439).
Misc:

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 5am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added ok-to-e2e ok-to-helm PR is allowed to build an publish helm chart ok-to-image PR is allowed to run container build labels Oct 19, 2026
@coderabbitai

coderabbitai Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: b2c4f5ff-0386-4026-b81b-1f329ed9b78c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch 4 times, most recently from d80b3bc to d255458 Compare October 24, 2026 17:45
@renovate renovate Bot changed the title chore(deps): update dependencies (minor) fix(deps): update dependencies (minor) Oct 24, 2026
@coveralls

coveralls commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Coverage Report for CI Build 41308292099

Coverage remained the same at 42.178%

Details

  • Coverage remained the same as the base build.
  • Patch coverage: No coverable lines changed in this PR.
  • No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

Coverage Stats

Coverage Status
Relevant Lines: 505
Covered Lines: 213
Line Coverage: 42.18%
Coverage Strength: 1.32 hits per line
💛 - Coveralls

@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch from d255458 to d67f198 Compare October 29, 2026 09:51
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch from d67f198 to baed942 Compare November 1, 2026 12:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

ok-to-e2e ok-to-helm PR is allowed to build an publish helm chart ok-to-image PR is allowed to run container build

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@coveralls