fix(deps): update dependencies (minor) by renovate[bot] · Pull Request #99 · opendefensecloud/ocm-kit

renovate · 2026-10-12T02:11:17Z

This PR contains the following updates:

Package	Change	Type	Update
golangci-lint	`v2.14.0` → `v2.15.0`		minor
google/osv-scanner-action	`v2.6.0` → `v2.7.0`	workflow	minor
ocm	`v0.51.0` → `v0.53.0`		minor
ocm.software/ocm	`v0.51.0` → `v0.53.0`	require	minor
osv-scanner	`v2.6.0` → `v2.7.0`		minor

Release Notes

golangci/golangci-lint (golangci-lint)

`v2.15.0`

Compare Source

Released on 2026-10-16

Linters new features or changes
- errcheck: from 1.20.0 to 1.30.0
- exhaustive: from 0.13.0 to 0.15.0 (⚠️ changes)
- gocognit: from 1.2.1 to 1.3.0
- golines: from 0.15.0 to 0.16.0
- govet-modernize: from 0.50.0 to 0.52.0
- loggercheck: from 0.12.0 to 0.13.0
- predeclared: from 0.2.2 to 0.3.0
- wrapcheck: from 2.12.0 to 2.13.0
Linters bug fixes
- bidichk: from 0.3.3 to 0.3.4
- canonicalheader: from a25c71c to e18e5c5
- gofumpt: improve deprecation logs
- gosec: improve concurrency default value
- iface: from 1.5.1 to 1.5.3
- paralleltest: from 1.0.15 to 1.0.16
- revive: from 1.17.0 to 1.17.1
- revive: the rules context-keys-type, errorf, modifies-value-receiver, range-val-address, string-of-int, time-equal, time-naming, unexported-return, unhandled-error, var-declaration are working (less randomly).
- rowserrcheck: from c5f79b8 to e0740d5
- staticcheck: from 0.8.1 to 0.8.2
Bug fixes
- fix: compute custom version hash with module versions
- fix: env vars loading (related to revive)

⚠️ Changes of the exhaustive linter:

The replaced options still exists, and partially works, but they are deprecated.
The options explicit-exhaustive-switch and explicit-exhaustive-map have been replaced by explicit-exhaustive.
The check the value map has been replaced by mapliteral.
The option ignore-enum-members (string) has been replaced by ignore-constants (slice).
The option ignore-enum-types (string) has been replaced by ignore-types (slice).
New report messages.
The linter is a now a "slow" linter.

google/osv-scanner-action

`v2.7.0`

Compare Source

What's Changed

Update github/codeql-action action to v4.38.0 by @renovate-bot in #143
Update to v2.7.0 by @michaelkedar in #146

Full Changelog: google/osv-scanner-action@v2.6.0...v2.7.0

open-component-model/ocm (ocm)

`v0.53.0`

Compare Source

What's Changed

🐛 Bug Fixes

fix(git): normalize tar headers of git archives by @matthiasbruns in #2124

⬆️ Dependencies

chore(deps): bump github.com/containerd/containerd/v2 from 2.4.0 to 2.4.1 by @dependabot[bot] in #2125
chore(deps): bump the go group across 1 directory with 17 updates (fix 2129) by @frewilhelm in #2130
chore(deps): bump the go group across 1 directory with 8 updates by @dependabot[bot] in #2135

🧰 Maintenance

chore: bump VERSION to 0.53.0-dev by @ocmbot[bot] in #2121
chore: Add alias for access type by @jneisener in #2123
chore: Add alias for input type by @jneisener in #2128

New Contributors

@jneisener made their first contribution in #2123

Full Changelog: open-component-model/ocm@v0.52...v0.53.0

`v0.52.0`

Compare Source

What's Changed

⬆️ Dependencies

7 changes

chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot[bot] in #2105
chore(deps): bump github.com/containerd/containerd/v2 from 2.3.4 to 2.3.5 by @dependabot[bot] in #2106
chore(deps): bump the go group with 27 updates (fix 2108) by @frewilhelm in #2110
chore(deps): bump golang from 1.26.8-alpine3.24 to 1.27.1-alpine3.24 by @dependabot[bot] in #2107
chore(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 by @dependabot[bot] in #2113
chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.45.0 by @dependabot[bot] in #2115
chore(deps): bump the go group with 11 updates (fix #2118) by @frewilhelm in #2120

🧰 Maintenance

chore: bump VERSION to 0.52.0-dev by @ocmbot[bohttps://github.com/open-component-model/ocm/pull/2104l/2104

Full Changelog: open-component-model/ocm@v0.51...v0.52.0

google/osv-scanner (osv-scanner)

`v2.7.0`

Compare Source

Features:

Feature #2885 Include package URLs (purl) in JSON output when available.
Feature #2589 Add shorter --x- flag aliases and deprecate --experimental- flags.
Feature #3113 Include vulnerability severity and rating in CycloneDX output when available.
Feature #3102 Enable Dart package_config.json (dart/packageconfig) extractor by default for lockfile scans (google/osv-scalibr#2295).
Dependency scanning & lockfile improvements via osv-scalibr:
- Add best-effort Maven property pre-interpolation for dependency versions and in-memory caching for Maven resolution.
- Support scanning Bitnami container SPDX SBOMs (sbom/spdx) (google/osv-scalibr#2156).
- Add MinimOS ecosystem mapping to the APK extractor (os/apk) (google/osv-scalibr#2406).
- Apply --max-file-size limit to container image contents and tag container image layers with Buildpacks lifecycle metadata.
New extractors and plugin support via osv-scalibr:
- Added zig/buildzigzon (build.zig.zon, google/osv-scalibr#1841), available via --x-plugins (--experimental-plugins). See "Supported Inventory Types" for the extractor name.

Fixes:

Bug #3137 Delegate package normalization to osv-scalibr's osvutil to preserve Maven group IDs in CycloneDX SBOMs so fixed versions are properly reported (fixes #3099).
Bug #3135 Prevent network-requiring plugins (such as base image enrichment) from running when --offline is combined with --download-offline-databases.
Bug #3134 Preserve call analysis information when diffing vulnerability results.
Bug #3121 Wrap [[PackageOverrides]] ecosystem suffix alternatives in a non-capturing group so Ecosystem regex matching applies correctly to all variants (fixes #3120).
Bug #3103 Sort packages by location before applying config annotations for deterministic log output order during recursive scans.
Bug #3087 Group output packages by exact ecosystem name to prevent duplicate entries when ecosystems share a prefix (e.g. Alpine and Alpine:v3.18) (fixes #3086).
Fixes via osv-scalibr:
- Skip OSV queries for local npm packages (file:, workspace, and local tarballs) and avoid extracting bogus versions or commits for file: and URL-based dependencies in bun.lock (google/osv-scalibr#2443, google/osv-scalibr#2444).
- Restrict #commit fragment extraction in JS lockfiles to Git-based dependency resolutions (google/osv-scalibr#2448).
- Prevent slice-bounds panic in javascript/pnpmlock on malformed scoped dependency paths (google/osv-scalibr#2263).
- Emit valid Hackage PURLs (pkg:hackage/...) and add Hackage OSV ecosystem mapping for Haskell (cabal and stack.yaml.lock) extractors (google/osv-scalibr#2419).
- Match Python setup.py package names containing -, ., and _ (google/osv-scalibr#2162).
- Reject invalid ZIP64 sizes and bound metadata reads in python/wheelegg (google/osv-scalibr#2012).
- Confine Maven registry disk cache writes with os.Root to prevent path traversal (google/osv-scalibr#2398).
- Compare PURL namespaces case-insensitively during OSV vulnerability matching (e.g. for Go modules with uppercase characters) (google/osv-scalibr#2456).
- Skip advisory affected entries with unrecognized ecosystems in local OSV matcher instead of aborting matching for the advisory (google/osv-scalibr#2429).
- Fix WordPress plugin name extraction from directory name and restrict scanning to immediate subdirectories of wp-content/plugins (google/osv-scalibr#2424, google/osv-scalibr#2445).
- Fix 32-bit statfs block size overflow when checking filesystem types on 32-bit architectures (google/osv-scalibr#2439).

Misc:

Update osv-scalibr to v0.5.4-0.20261009010329-5be78a00e3c2 (#3123, #3089, #3137).
Remove unused root Dockerfile (#3130).

Configuration

📅 Schedule: (UTC)

Branch creation
- "before 5am on Monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-10-12T02:11:19Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

75 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=3 days

Details:

Package	Change
`github.com/aws/aws-sdk-go-v2`	`v1.45.1` -> `v1.47.1`
`github.com/aws/aws-sdk-go-v2/config`	`v1.33.2` -> `v1.33.6`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.20.2` -> `v1.20.6`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.19.1` -> `v1.20.1`
`github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager`	`v0.4.2` -> `v0.4.13`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.5.1` -> `v1.5.4`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.8.1` -> `v2.8.4`
`github.com/aws/aws-sdk-go-v2/internal/v4a`	`v1.5.1` -> `v1.5.4`
`github.com/aws/aws-sdk-go-v2/service/ecr`	`v1.63.0` -> `v1.66.1`
`github.com/aws/aws-sdk-go-v2/service/internal/checksum`	`v1.11.1` -> `v1.11.5`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.14.1` -> `v1.14.4`
`github.com/aws/aws-sdk-go-v2/service/internal/s3shared`	`v1.20.1` -> `v1.20.4`
`github.com/aws/aws-sdk-go-v2/service/s3`	`v1.110.0` -> `v1.114.0`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.8.0` -> `v1.10.1`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.36.0` -> `v1.38.1`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.41.0` -> `v1.43.1`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.48.0` -> `v1.51.1`
`github.com/aws/smithy-go`	`v1.28.1` -> `v1.28.2`
`github.com/containerd/containerd/v2`	`v2.3.6` -> `v2.4.1`
`github.com/containerd/log`	`v0.1.0` -> `v0.2.0`
`github.com/containerd/typeurl/v2`	`v2.2.3` -> `v2.3.0`
`github.com/docker/cli`	`v29.7.2+incompatible` -> `v29.8.2+incompatible`
`github.com/fvbommel/sortorder`	`v1.1.0` -> `v1.2.0`
`github.com/fxamacker/cbor/v2`	`v2.9.0` -> `v2.9.4`
`github.com/go-git/go-billy/v5`	`v5.9.1` -> `v5.9.2`
`github.com/go-openapi/jsonreference`	`v1.0.0` -> `v1.0.1`
`github.com/go-openapi/runtime`	`v0.32.5` -> `v0.33.0`
`github.com/go-openapi/strfmt`	`v0.27.0` -> `v0.27.2`
`github.com/go-openapi/swag`	`v0.26.1` -> `v0.29.1`
`github.com/go-openapi/swag/cmdutils`	`v0.26.1` -> `v0.29.1`
`github.com/go-openapi/swag/conv`	`v0.29.1` -> `v0.29.2`
`github.com/go-openapi/swag/fileutils`	`v0.28.0` -> `v0.29.1`
`github.com/go-openapi/swag/jsonutils`	`v0.28.0` -> `v0.29.1`
`github.com/go-openapi/swag/loading`	`v0.28.0` -> `v0.29.1`
`github.com/go-openapi/swag/mangling`	`v0.28.0` -> `v0.29.1`
`github.com/go-openapi/swag/netutils`	`v0.26.1` -> `v0.29.1`
`github.com/go-openapi/swag/pools`	`v0.28.0` -> `v0.29.1`
`github.com/go-openapi/swag/stringutils`	`v0.28.0` -> `v0.29.1`
`github.com/go-openapi/swag/typeutils`	`v0.29.1` -> `v0.29.2`
`github.com/go-openapi/swag/yamlutils`	`v0.28.0` -> `v0.29.1`
`github.com/google/go-containerregistry`	`v0.21.7` -> `v0.22.1`
`github.com/grpc-ecosystem/grpc-gateway/v2`	`v2.29.0` -> `v2.30.0`
`github.com/klauspost/compress`	`v1.20.0` -> `v1.20.1`
`github.com/klauspost/pgzip`	`v1.2.6` -> `v1.2.7`
`github.com/moby/moby/api`	`v1.55.0` -> `v1.56.1`
`github.com/moby/moby/client`	`v0.5.1` -> `v0.6.1`
`github.com/oklog/ulid/v2`	`v2.1.1` -> `v2.1.2`
`github.com/pelletier/go-toml/v2`	`v2.3.0` -> `v2.4.3`
`github.com/santhosh-tekuri/jsonschema/v6`	`v6.0.2` -> `v6.0.3`
`github.com/secure-systems-lab/go-securesystemslib`	`v0.11.0` -> `v0.11.1`
`github.com/sigstore/protobuf-specs`	`v0.5.1` -> `v0.5.2`
`github.com/ulikunitz/xz`	`v0.5.16` -> `v0.5.17`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.69.0` -> `v0.71.0`
`go.opentelemetry.io/otel`	`v1.45.0` -> `v1.46.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace`	`v1.45.0` -> `v1.46.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`	`v1.45.0` -> `v1.46.0`
`go.opentelemetry.io/otel/metric`	`v1.45.0` -> `v1.46.0`
`go.opentelemetry.io/otel/sdk`	`v1.45.0` -> `v1.46.0`
`go.opentelemetry.io/otel/sdk/metric`	`v1.45.0` -> `v1.46.0`
`go.opentelemetry.io/otel/trace`	`v1.45.0` -> `v1.46.0`
`go.podman.io/image/v5`	`v5.41.1` -> `v5.41.2`
`go.podman.io/storage`	`v1.64.0` -> `v1.64.1`
`golang.org/x/oauth2`	`v0.36.0` -> `v0.37.0`
`golang.org/x/time`	`v0.15.0` -> `v0.16.0`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260803160001-6ac0973c030d` -> `v0.0.0-20260825221802-da73d73af1c5`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260803160001-6ac0973c030d` -> `v0.0.0-20260825221802-da73d73af1c5`
`helm.sh/helm/v4`	`v4.2.4` -> `v4.3.0`
`k8s.io/api`	`v0.36.4` -> `v0.37.1`
`k8s.io/apiextensions-apiserver`	`v0.36.4` -> `v0.37.1`
`k8s.io/apimachinery`	`v0.36.4` -> `v0.37.1`
`k8s.io/cli-runtime`	`v0.36.4` -> `v0.37.1`
`k8s.io/client-go`	`v0.36.4` -> `v0.37.1`
`k8s.io/kube-openapi`	`v0.0.0-20260319004828-5883c5ee87b9` -> `v0.0.0-20260821135717-be32def86098`
`k8s.io/utils`	`v0.0.0-20260507154919-ff6756f316d2` -> `v0.0.0-20260707023825-cf1189d6abe3`
`sigs.k8s.io/structured-merge-diff/v6`	`v6.3.3` -> `v6.4.2`

coderabbitai · 2026-10-12T02:11:40Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: ca01872e-8a2c-4b2c-b372-e01dc88c1be4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coveralls · 2026-10-12T02:17:13Z

Coverage Report for CI Build 40887901217

Warning

Build has drifted: This PR's base is out of sync with its target branch, so coverage data may include unrelated changes.
Quick fix: rebase this PR. Learn more →

Coverage remained the same at 40.683%

Details

Coverage remained the same as the base build.
Patch coverage: No coverable lines changed in this PR.
No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

Coverage Stats


Relevant Lines:	322
Covered Lines:	131
Line Coverage:	40.68%
Coverage Strength:	0.41 hits per line

💛 - Coveralls

renovate Bot added ok-to-e2e ok-to-image PR is allowed to run container build labels Oct 12, 2026

renovate Bot added the ok-to-e2e label Oct 12, 2026

renovate Bot force-pushed the renovate/all-minor-updates branch from feec9e5 to b1bc0d9 Compare October 15, 2026 05:29

renovate Bot changed the title ~~fix(deps): update dependencies (minor) to v0.52.0~~ fix(deps): update dependencies (minor) Oct 15, 2026

renovate Bot force-pushed the renovate/all-minor-updates branch from b1bc0d9 to 74b9e9d Compare October 20, 2026 09:41

yocaba previously approved these changes Oct 21, 2026

View reviewed changes

renovate Bot dismissed yocaba’s stale review via 994df3c October 21, 2026 11:27

renovate Bot force-pushed the renovate/all-minor-updates branch from 74b9e9d to 994df3c Compare October 21, 2026 11:27

renovate Bot force-pushed the renovate/all-minor-updates branch from 1e8bde2 to 325475a Compare October 29, 2026 14:01

fix(deps): update dependencies (minor)

eb0aafe

renovate Bot force-pushed the renovate/all-minor-updates branch from 325475a to eb0aafe Compare October 29, 2026 14:04

cbrgm approved these changes Oct 29, 2026

View reviewed changes

cbrgm merged commit 5d395e6 into main Oct 29, 2026
11 checks passed

cbrgm deleted the renovate/all-minor-updates branch October 29, 2026 14:08

Navigation Menu

Repository navigation

fix(deps): update dependencies (minor) - #99

fix(deps): update dependencies (minor)#99
cbrgm merged 1 commit into
mainfrom
renovate/all-minor-updates

renovate Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

Review skipped

Uh oh!

coveralls commented Oct 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

renovate Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.15.0

v2.7.0

What's Changed

v0.53.0

What's Changed

🐛 Bug Fixes

⬆️ Dependencies

🧰 Maintenance

New Contributors

v0.52.0

What's Changed

⬆️ Dependencies

🧰 Maintenance

v2.7.0

Features:

Fixes:

Misc:

Configuration

Uh oh!

renovate Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

coderabbitai Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

coveralls commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report for CI Build 40887901217

Coverage remained the same at 40.683%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

renovate Bot commented Oct 12, 2026 •

edited

Loading

`v2.15.0`

`v2.7.0`

`v0.53.0`

`v0.52.0`

`v2.7.0`

renovate Bot commented Oct 12, 2026 •

edited

Loading

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

coveralls commented Oct 12, 2026 •

edited

Loading