[procoduck]

Post-v0.14.0 dependency round: every patch/minor bump of an existing direct dependency, tool and pin. No new dependencies. Container image pins are left to Renovate's grouped Monday PR (see the dashboard, #87).

Upgrades

Area	Package / pin	From	To
Go	go directive (go.mod; CI go-version-file)	1.26.7	1.26.8
Go	github.com/prometheus/common	v0.71.0	v0.72.0
Go	github.com/grafana/loki/pkg/push	20251125 pseudo	20261001 pseudo
Go	k8s.io/utils	20260626 pseudo	20260707 pseudo
Go (indirect, tidy)	go-openapi/swag/*, jsonpointer, jsonreference	v0.28.0 / v1.0.0	v0.29.2 / v1.0.1
Go (indirect, tidy)	golang.org/x/tools	v0.49.0	v0.50.0
Go (indirect, tidy)	genproto googleapis/api + rpc	202609-04/08-25	20260928
npm	@bufbuild/protobuf, @bufbuild/protoc-gen-es	2.15.0	2.16.0
npm	@tanstack/react-router	1.170.39	1.170.40
npm	@lezer/highlight	1.2.4	1.2.5
npm	lucide-react	1.48.0	1.49.0
npm	vitest	5.0.2	5.0.3
tool	pnpm (packageManager, versions.env PNPM_VERSION, Dockerfile ARGs, web/AGENTS.md)	11.22.0	11.28.3
tool	buf (Makefile tools, ci.yml)	v1.72.0	v1.73.0
tool	golangci-lint (ci.yml lint + guards, release.yml)	v2.12.2	v2.14.0
tool	goreleaser (release.yml)	v2.18.1	v2.18.2
tool	helm (release.yml)	v3.16.3	v3.22.0
action	github/codeql-action	SHA already v4.38.2	comment fixed from a stale # v3

Already at latest: sqlc v1.31.1, govulncheck v1.8.0, ginkgo / protobuf / connect (follow go.mod), and every other SHA-pinned action.

Codegen: make generate with buf 1.73.0 + protoc-gen-es 2.16.0 changes only the // @generated by protoc-gen-es v2.16.0 header in the 16 web/src/gen files. Go generated code is unchanged.

Held back

Item	Why
google.golang.org/grpc 1.83.2 → 1.84.0	GO-2026-6443 is reachable in 1.84.x (dependabot.yml ignore). Wait for a stable 1.85
go.opentelemetry.io/proto/otlp 1.11.0 → 1.11.1	requires grpc 1.84, so it is blocked by the row above

Majors left out (separate decision)

Major	Risk
Go 1.27 (go.mod, GO_IMAGE 1.27-alpine)	A toolchain decision, and renovate.json disables it. It moves together with go.mod, GO_IMAGE and the Dockerfiles; new vet/lint findings are possible
@types/node 24 → 26	Must follow the Node runtime (NODE_IMAGE node:24, ci.yml node-version 24), and dependabot ignores it
pnpm 11 → 12	A package-manager major. Lockfile format/settings may change, and the move touches versions.env, the Dockerfiles and CI's pnpm-version step
helm 3 → 4 (release.yml)	The chart publish path (helm push to OCI) needs re-verification under Helm 4's CLI changes
gitea/gitea 1-rootless → 28-rootless	Pending in Renovate as its own major PR. Tag scheme changed, and the dev/e2e GitOps fixtures need a check

Not touched (listed for a human)

• Alloy v1.20.1 is the latest release, so no schema bump is pending.
• kind node image v1.31.4 (kind v0.33.0 is current), Calico v3.28.2 → v3.32.2 / v3.31.7 available, NGF chart 2.6.0 → 2.7.2, Gateway API v1.4.1 → v1.6.2, CNPG chart 0.29.0 → 0.29.1, external-secrets chart 2.9.0 → 2.11.0. All are reviewed pins, so none were bumped.
• Waiting in the Renovate group PR for Monday's schedule: gitleaks v8.30.1, mock-oauth2-server 6.0.4, alpine 3.24, plus golang/node/postgres/gitea digest refreshes.

Vulnerability scans

• make vulncheck (govulncheck v1.8.0) found 0 reachable vulnerabilities, before and after, on both go1.26.7 and go1.26.8. One module-level finding is unreachable: GO-2026-5932 (golang.org/x/crypto/openpgp is deprecated; there is no fix, and nothing calls it).
• pnpm audit found no known vulnerabilities.

Verification

• go mod tidy, make generate (headers only), make lint (all guards + golangci-lint 2.14.0: 0 issues)
• make test (all Go tests, under GOTOOLCHAIN=go1.26.8): pass
• make web-ci: pass
• Mocked Playwright suite: 345 passed
• go test ./scripts/repocheck/: pass
• pnpm install --frozen-lockfile under pnpm 11.28.3: lockfile already up to date

🤖 Generated with Claude Code

https://claude.ai/code/session_01BPMsuQQBnedAsJ8tJMH3rw