Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Config Migration Needed

• Select this checkbox to let Renovate create an automated Config Migration PR.

Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

• chore(deps): update github-actions (actions/checkout, actions/setup-node, cachix/install-nix-action, docker/login-action, github/codeql-action, golangci/golangci-lint-action, goreleaser/goreleaser-action, step-security/harden-runner, step-security/trufflehog-action, useblacksmith/setup-docker-builder)
• chore(deps): update charmbracelet (charm.land/bubbles/v2, charm.land/bubbletea/v2, charm.land/lipgloss/v2)
• chore(deps): update module github.com/oklog/ulid/v2 to v2.1.2
• chore(deps): update module gorm.io/driver/postgres to v1.6.2
• chore(deps): update go-indirect (cloud.google.com/go/auth, github.com/anthropics/anthropic-sdk-go, github.com/buger/jsonparser, github.com/charmbracelet/ultraviolet, github.com/charmbracelet/x/exp/charmtone, github.com/charmbracelet/x/exp/slice, github.com/dlclark/regexp2/v2, github.com/gabriel-vasile/mimetype, github.com/go-logr/logr, github.com/googleapis/enterprise-certificate-proxy, github.com/googleapis/gax-go/v2, github.com/leodido/go-urn, github.com/lucasb-eyer/go-colorful, github.com/mattn/go-isatty, github.com/mattn/go-runewidth, github.com/ollama/ollama, github.com/yuin/goldmark, go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp, go.opentelemetry.io/otel, go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/trace, golang.org/x/exp, golang.org/x/net, golang.org/x/sync, golang.org/x/tools, google.golang.org/api, google.golang.org/genai, google.golang.org/genproto/googleapis/rpc, google.golang.org/grpc)
• chore(deps): update module github.com/nyaruka/phonenumbers to v2
• 🔐 Create all rate-limited PRs at once 🔐

PR Edited (Blocked)

The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below.

• chore(deps): update module github.com/go-playground/validator/v10 to v10.30.3
• chore(deps): update golang-x (golang.org/x/crypto, golang.org/x/sys, golang.org/x/term, golang.org/x/text)
• chore(deps): update module github.com/mark3labs/mcp-go to v0.57.0
• chore(deps): update module github.com/nyaruka/phonenumbers to v1.8.1
• chore(deps): update module modernc.org/sqlite to v1.56.0

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): update docker-images (caddy, gcr.io/distroless/static-debian12, golang, postgres)
• chore(deps): update github-actions (major) (actions/checkout, actions/setup-go, actions/setup-node, useblacksmith/setup-docker-builder)
• Click on this checkbox to rebase all open PRs at once

Detected Dependencies

docker-compose (3)

deploy/docker-compose.caddy.yml (1)

• caddy sha256:af5fdcd76f2db5e4e974ee92f96ee8c0fc3edb55bd4ba5032547cbf3f65e486d → [Updates: undefined]

deploy/docker-compose.test.yml

deploy/docker-compose.yml (1)

• postgres sha256:4aabea78cf39b90e834caf3af7d602a18565f6fe2508705c8d01aa63245c2e20 → [Updates: undefined]

dockerfile (1)

deploy/relay/Dockerfile (2)

• golang sha256:32c0e6e5c4f6707717051091b4d0b077464a679eaab563e11474efc5328e2aa5 → [Updates: undefined]
• gcr.io/distroless/static-debian12 sha256:9c346e4be81b5ca7ff31a0d89eaeade58b0f95cfd3baed1f36083ddb47ca3160 → [Updates: undefined]

github-actions (7)

.github/workflows/ci.yml (28)

• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• cachix/install-nix-action v31.10.6@8aa03977d8d733052d78f4e008a241fd1dbf36b3 → [Updates: v31.11.0]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• cachix/install-nix-action v31.10.6@8aa03977d8d733052d78f4e008a241fd1dbf36b3 → [Updates: v31.11.0]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e → [Updates: v6.5.0, v7.0.0]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• useblacksmith/setup-docker-builder v1@ab5c1da94f53f5cd75c1038092aa276dddfccbba → [Updates: v2, v1]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• go 1.26
• go 1.26
• go 1.26
• node lts/*

.github/workflows/lint.yml (19)

• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• golangci/golangci-lint-action v9.2.1@82606bf257cbaff209d206a39f5134f0cfbfd2ee → [Updates: v9.3.0]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• cachix/install-nix-action v31.10.6@8aa03977d8d733052d78f4e008a241fd1dbf36b3 → [Updates: v31.11.0]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• go 1.26
• go 1.26
• go 1.26

.github/workflows/pages.yml (6)

• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• actions/configure-pages v6.0.0@45bfe0192ca1faeb007ade9deae92b16b8254a0d
• cachix/install-nix-action v31.10.6@8aa03977d8d733052d78f4e008a241fd1dbf36b3 → [Updates: v31.11.0]
• actions/upload-pages-artifact v5@fc324d3547104276b827a68afc52ff2a11cc49c9
• actions/deploy-pages v5.0.0@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128

.github/workflows/release.yml (7)

• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• useblacksmith/setup-docker-builder v1@ab5c1da94f53f5cd75c1038092aa276dddfccbba → [Updates: v2, v1]
• docker/login-action v4.2.0@650006c6eb7dba73a995cc03b0b2d7f5ca915bee → [Updates: v4.6.0]
• goreleaser/goreleaser-action v7.2.2@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 → [Updates: v7.2.3]
• go 1.26

.github/workflows/scheduled-release.yml (5)

• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• actions/setup-node v6.4.0@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e → [Updates: v6.5.0, v7.0.0]
• node lts/*

.github/workflows/security.yml (19)

• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• cachix/install-nix-action v31.10.6@8aa03977d8d733052d78f4e008a241fd1dbf36b3 → [Updates: v31.11.0]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• step-security/trufflehog-action v3.95.5@8560b0deaa854dfe432084eaefa1dffbc1647a6b → [Updates: v3.95.9]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• actions/setup-go v6.5.0@924ae3a1cded613372ab5595356fb5720e22ba16 → [Updates: v7.0.0]
• github/codeql-action v4.36.2@8aad20d150bbac5944a9f9d289da16a4b0d87c1e → [Updates: v4.37.6]
• github/codeql-action v4.36.2@8aad20d150bbac5944a9f9d289da16a4b0d87c1e → [Updates: v4.37.6]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• go 1.26
• go 1.26

.github/workflows/update-vendor-hash.yml (6)

• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• step-security/harden-runner v2.19.4@9af89fc71515a100421586dfdb3dc9c984fbf411 → [Updates: v2.20.0]
• actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1
• actions/checkout v6@df4cb1c069e1874edd31b4311f1884172cec0e10 → [Updates: v7, v6]
• cachix/install-nix-action v31.10.6@8aa03977d8d733052d78f4e008a241fd1dbf36b3 → [Updates: v31.11.0]

gomod (1)

go.mod (131)

• go 1.26.4
• charm.land/fang/v2 v2.0.1
• github.com/BurntSushi/toml v1.6.0
• github.com/adrg/xdg v0.5.3
• github.com/brianvoe/gofakeit/v7 v7.15.0
• github.com/dustin/go-humanize v1.0.1
• github.com/go-playground/validator/v10 v10.30.2 → [Updates: v10.30.3]
• github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510@e7afc7fbc510
• github.com/iancoleman/strcase v0.3.0
• github.com/itchyny/gojq v0.12.19
• github.com/mark3labs/mcp-go v0.52.0 → [Updates: v0.57.0]
• github.com/mozilla-ai/any-llm-go v0.9.0
• github.com/nyaruka/phonenumbers v1.7.4 → [Updates: v1.8.1, v2.0.6]
• github.com/oklog/ulid/v2 v2.1.1 → [Updates: v2.1.2]
• github.com/spf13/cobra v1.10.2
• github.com/spf13/pflag v1.0.10
• github.com/stretchr/testify v1.11.1
• github.com/tj/go-naturaldate v1.3.0
• golang.org/x/crypto v0.53.0 → [Updates: v0.54.0]
• golang.org/x/sys v0.46.0 → [Updates: v0.47.0]
• golang.org/x/term v0.44.0 → [Updates: v0.45.0]
• golang.org/x/text v0.38.0 → [Updates: v0.40.0]
• gorm.io/driver/postgres v1.6.0 → [Updates: v1.6.2]
• gorm.io/gorm v1.31.2
• modernc.org/sqlite v1.50.1 → [Updates: v1.56.0]
• github.com/charmbracelet/ultraviolet v0.0.0-20260622092850-f39628c8a989@f39628c8a989 → [Updates: v0.0.0-20260803092147-8b693049ce2a]
• github.com/charmbracelet/x/exp/charmtone v0.0.0-20260628005914-6eb80f72a239@6eb80f72a239 → [Updates: v0.0.0-20260803091719-3755ebad01b1]
• github.com/charmbracelet/x/exp/ordered v0.1.0
• github.com/charmbracelet/x/termios v0.1.1
• github.com/charmbracelet/x/windows v0.2.2
• github.com/dlclark/regexp2/v2 v2.2.2 → [Updates: v2.5.2]
• github.com/google/jsonschema-go v0.4.3
• github.com/invopop/jsonschema v0.14.0
• github.com/jackc/pgpassfile v1.0.0
• github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761@5a60cdf6a761
• github.com/jackc/pgx/v5 v5.10.0
• github.com/jackc/puddle/v2 v2.2.2
• github.com/muesli/mango v0.2.0
• github.com/muesli/mango-cobra v1.3.0
• github.com/muesli/mango-pflag v0.2.0
• github.com/muesli/roff v0.1.0
• github.com/pb33f/ordered-map/v2 v2.3.1
• github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
• github.com/spf13/cast v1.10.0
• github.com/standard-webhooks/standard-webhooks/libraries v0.0.1
• github.com/yosida95/uritemplate/v3 v3.0.2
• go.yaml.in/yaml/v4 v4.0.0-rc.6
• golang.org/x/tools v0.47.0 → [Updates: v0.48.0]
• google.golang.org/api v0.286.0 → [Updates: v0.292.0]
• charm.land/bubbles/v2 v2.1.0 → [Updates: v2.1.1]
• charm.land/bubbletea/v2 v2.0.7 → [Updates: v2.0.8]
• charm.land/glamour/v2 v2.0.1
• charm.land/huh/v2 v2.0.3
• charm.land/lipgloss/v2 v2.0.4 → [Updates: v2.0.5]
• cloud.google.com/go v0.123.0
• cloud.google.com/go/auth v0.20.0 → [Updates: v0.22.0]
• cloud.google.com/go/compute/metadata v0.9.0
• github.com/alecthomas/chroma/v2 v2.27.0
• github.com/anthropics/anthropic-sdk-go v1.52.0 → [Updates: v1.61.0]
• github.com/atotto/clipboard v0.1.4
• github.com/aymerick/douceur v0.2.0
• github.com/bahlo/generic-list-go v0.2.0
• github.com/buger/jsonparser v1.2.0 → [Updates: v1.6.1]
• github.com/catppuccin/go v0.3.0
• github.com/cespare/xxhash/v2 v2.3.0
• github.com/charmbracelet/colorprofile v0.4.3
• github.com/charmbracelet/harmonica v0.2.0
• github.com/charmbracelet/x/ansi v0.11.7
• github.com/charmbracelet/x/exp/slice v0.0.0-20260628005914-6eb80f72a239@6eb80f72a239 → [Updates: v0.0.0-20260803091719-3755ebad01b1]
• github.com/charmbracelet/x/exp/strings v0.1.0
• github.com/charmbracelet/x/term v0.2.2
• github.com/clipperhouse/displaywidth v0.11.0
• github.com/clipperhouse/uax29/v2 v2.7.0
• github.com/davecgh/go-spew v1.1.1
• github.com/dlclark/regexp2 v1.12.0 → [Updates: v2.5.2]
• github.com/felixge/httpsnoop v1.1.0
• github.com/gabriel-vasile/mimetype v1.4.13 → [Updates: v1.4.15]
• github.com/go-logr/logr v1.4.3 → [Updates: v1.4.4]
• github.com/go-logr/stdr v1.2.2
• github.com/go-playground/locales v0.14.1
• github.com/go-playground/universal-translator v0.18.1
• github.com/google/go-cmp v0.7.0
• github.com/google/s2a-go v0.1.9
• github.com/google/uuid v1.6.0
• github.com/googleapis/enterprise-certificate-proxy v0.3.17 → [Updates: v0.3.20]
• github.com/googleapis/gax-go/v2 v2.22.0 → [Updates: v2.23.0]
• github.com/gorilla/css v1.0.1
• github.com/gorilla/websocket v1.5.3
• github.com/inconshreveable/mousetrap v1.1.0
• github.com/itchyny/timefmt-go v0.1.8
• github.com/jinzhu/inflection v1.0.0
• github.com/jinzhu/now v1.1.5
• github.com/leodido/go-urn v1.4.0 → [Updates: v1.5.0]
• github.com/lrstanley/bubblezone/v2 v2.0.0
• github.com/lucasb-eyer/go-colorful v1.4.0 → [Updates: v1.4.1]
• github.com/mailru/easyjson v0.9.2
• github.com/mattn/go-isatty v0.0.22 → [Updates: v0.0.24]
• github.com/mattn/go-runewidth v0.0.24 → [Updates: v0.0.27]
• github.com/microcosm-cc/bluemonday v1.0.27
• github.com/mitchellh/hashstructure/v2 v2.0.2
• github.com/muesli/cancelreader v0.2.2
• github.com/ncruces/go-strftime v1.0.0
• github.com/ollama/ollama v0.30.11 → [Updates: v0.32.5]
• github.com/openai/openai-go v1.12.0 → [Updates: v3.50.0]
• github.com/pmezard/go-difflib v1.0.0
• github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec@24d4a6f8daec
• github.com/rivo/uniseg v0.4.7
• github.com/tidwall/gjson v1.19.0
• github.com/tidwall/match v1.2.0
• github.com/tidwall/pretty v1.2.1
• github.com/tidwall/sjson v1.2.5
• github.com/wk8/go-ordered-map/v2 v2.1.8
• github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e@abceb7e1c41e
• github.com/yuin/goldmark v1.8.2 → [Updates: v1.8.5]
• github.com/yuin/goldmark-emoji v1.0.6 → [Updates: v2.0.0]
• go.opentelemetry.io/auto/sdk v1.2.1
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 → [Updates: v0.70.0]
• go.opentelemetry.io/otel v1.44.0 → [Updates: v1.45.0]
• go.opentelemetry.io/otel/metric v1.44.0 → [Updates: v1.45.0]
• go.opentelemetry.io/otel/trace v1.44.0 → [Updates: v1.45.0]
• golang.org/x/exp v0.0.0-20260611194520-c48552f49976@c48552f49976 → [Updates: v0.0.0-20260727155853-b88d891fe743]
• golang.org/x/net v0.56.0 → [Updates: v0.57.0]
• golang.org/x/sync v0.21.0 → [Updates: v0.22.0]
• google.golang.org/genai v1.62.0 → [Updates: v1.66.0]
• google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d@b703f567277d → [Updates: v0.0.0-20260803160001-6ac0973c030d]
• google.golang.org/grpc v1.81.1 → [Updates: v1.83.0]
• google.golang.org/protobuf v1.36.11
• gopkg.in/yaml.v3 v3.0.1
• modernc.org/libc v1.72.3 → [Updates: v2.1.30]
• modernc.org/mathutil v1.7.1
• modernc.org/memory v1.11.0

nix (1)

flake.nix (4)

• flake-utils lock file @ 11707dc2f618dd54ca8739b309ec4fc024de578b
• git-hooks lock file @ 9c4469b68b62e122c3b3d2ab0ed3caeb04ff1ac4
• gitignore lock file @ 637db329424fd7e46cf4185293b9cc8c88c95394
• nixpkgs nixos-unstable-small

---

• Check this box to trigger a request for Renovate to run again on this repository