fix: consolidate dependabot and renovate dependency updates (#1481)

marcos-leal-cit · web-flow · commit ed07500ef63b · 2026-07-01T21:57:44.000Z
diff --git a/.github/workflows/go-lint.yaml b/.github/workflows/go-lint.yaml
@@ -36,7 +36,7 @@ jobs:
       matrix:
         folder: [helpers/foundation-deployer]
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: ${{ matrix.folder }}/go.mod
diff --git a/.github/workflows/go-test.yaml b/.github/workflows/go-test.yaml
@@ -38,7 +38,7 @@ jobs:
       matrix:
         folder: [helpers/foundation-deployer]
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
     - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version-file: ${{ matrix.folder }}/go.mod
diff --git a/1-org/modules/cai-monitoring/function-source/package-lock.json b/1-org/modules/cai-monitoring/function-source/package-lock.json
diff --git a/1-org/modules/cai-monitoring/function-source/package.json b/1-org/modules/cai-monitoring/function-source/package.json
@@ -9,8 +9,16 @@
   "author": "",
   "license": "ISC",
   "dependencies": {
-    "@google-cloud/security-center": "8.12.0",
-    "uuid4": "2.0.3",
-    "moment": "2.30.1"
+    "@google-cloud/security-center": "^9.4.0",
+    "moment": "2.30.1",
+    "uuid4": "2.0.3"
+  },
+  "overrides": {
+    "@grpc/grpc-js": "^1.14.4",
+    "@protobufjs/utf8": "^1.1.1",
+    "@tootallnate/once": "^2.0.1",
+    "form-data": "^2.5.6",
+    "jws": "^4.0.1",
+    "protobufjs": "^7.6.1"
   }
 }
diff --git a/4-projects/business_unit_1/shared/Dockerfile b/4-projects/business_unit_1/shared/Dockerfile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM alpine:3.18
+FROM alpine:3.24
 WORKDIR /confidential
 COPY confidential_data /confidential
 ENTRYPOINT ["/confidential/confidential_data"]
diff --git a/build/int.cloudbuild.yaml b/build/int.cloudbuild.yaml
@@ -175,4 +175,4 @@ options:
   - 'TF_IN_AUTOMATION=true'
 substitutions:
   _DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
-  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.23'
+  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.26'
diff --git a/build/lint.cloudbuild.yaml b/build/lint.cloudbuild.yaml
@@ -24,7 +24,7 @@ tags:
 - 'lint'
 substitutions:
   _DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
-  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.23'
+  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.26'
 options:
   machineType: 'N1_HIGHCPU_8'
   env:
diff --git a/go.work b/go.work
@@ -1,6 +1,6 @@
-go 1.23.0
+go 1.25.0
 
 use (
-  ./test/integration
-  ./helpers/foundation-deployer
+	./test/integration
+	./helpers/foundation-deployer
 )
diff --git a/helpers/foundation-deployer/go.mod b/helpers/foundation-deployer/go.mod
@@ -1,62 +1,62 @@
 module github.com/terraform-google-modules/terraform-example-foundation/helpers/foundation-deployer
 
-go 1.23.0
+go 1.25.0
 
 require (
-	cloud.google.com/go/billing v1.19.2
-	cloud.google.com/go/iam v1.2.2
-	cloud.google.com/go/resourcemanager v1.10.2
-	github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test v0.17.3
-	github.com/gruntwork-io/terratest v0.48.1
-	github.com/hashicorp/hcl/v2 v2.23.0
+	cloud.google.com/go/billing v1.20.1
+	cloud.google.com/go/iam v1.5.0
+	cloud.google.com/go/resourcemanager v1.10.6
+	github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test v0.17.9
+	github.com/gruntwork-io/terratest v0.50.0
+	github.com/hashicorp/hcl/v2 v2.24.0
 	github.com/mitchellh/go-testing-interface v1.14.2-0.20210821155943-2d9075ca8770
 	github.com/stretchr/testify v1.11.1
-	github.com/terraform-google-modules/terraform-example-foundation/test/integration v0.0.0-20240808135927-5f1fd0f4104a
-	github.com/tidwall/gjson v1.18.0
+	github.com/terraform-google-modules/terraform-example-foundation/test/integration v0.0.0-20260622134113-34af7b6f8505
+	github.com/tidwall/gjson v1.19.0
 	gitlab.com/gitlab-org/api/client-go v0.158.0
-	google.golang.org/api v0.206.0
+	google.golang.org/api v0.229.0
 )
 
 require (
-	cloud.google.com/go v0.116.0 // indirect
-	cloud.google.com/go/longrunning v0.6.2 // indirect
-	github.com/google/go-querystring v1.1.0 // indirect
+	cloud.google.com/go v0.120.0 // indirect
+	cloud.google.com/go/longrunning v0.6.6 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 // indirect
-	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 // indirect
-	golang.org/x/time v0.12.0 // indirect
-	google.golang.org/genproto v0.0.0-20241113202542-65e8d215514f // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
+	golang.org/x/exp v0.0.0-20260611194520-c48552f49976 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
 )
 
 require (
-	cloud.google.com/go/auth v0.10.2 // indirect
-	cloud.google.com/go/auth/oauth2adapt v0.2.5 // indirect
-	cloud.google.com/go/compute/metadata v0.5.2 // indirect
+	cloud.google.com/go/auth v0.16.0 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
+	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/go-github/v58 v58.0.0
-	github.com/google/s2a-go v0.1.8 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
-	github.com/googleapis/gax-go/v2 v2.14.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
+	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-getter/v2 v2.2.3 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-safetemp v1.0.0 // indirect
 	github.com/hashicorp/go-version v1.7.0 // indirect
-	github.com/hashicorp/terraform-json v0.23.0 // indirect
+	github.com/hashicorp/terraform-json v0.26.0 // indirect
 	github.com/jinzhu/copier v0.4.0 // indirect
 	github.com/klauspost/compress v1.16.7 // indirect
-	github.com/kr/pretty v0.1.0 // indirect
 	github.com/mattn/go-shellwords v1.0.12 // indirect
 	github.com/mattn/go-zglob v0.0.4 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
@@ -66,24 +66,22 @@ require (
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
 	github.com/tmccombs/hcl2json v0.6.4 // indirect
-	github.com/ulikunitz/xz v0.5.11 // indirect
-	github.com/zclconf/go-cty v1.15.0 // indirect
-	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 // indirect
-	go.opentelemetry.io/otel v1.29.0 // indirect
-	go.opentelemetry.io/otel/metric v1.29.0 // indirect
-	go.opentelemetry.io/otel/trace v1.29.0 // indirect
-	golang.org/x/crypto v0.40.0 // indirect
-	golang.org/x/mod v0.26.0 // indirect
-	golang.org/x/net v0.42.0 // indirect
-	golang.org/x/oauth2 v0.30.0
-	golang.org/x/sync v0.16.0 // indirect
-	golang.org/x/sys v0.34.0 // indirect
-	golang.org/x/text v0.28.0 // indirect
-	golang.org/x/tools v0.35.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28 // indirect
-	google.golang.org/grpc v1.67.1 // indirect
-	google.golang.org/protobuf v1.36.10 // indirect
-	gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 // indirect
+	github.com/ulikunitz/xz v0.5.14 // indirect
+	github.com/zclconf/go-cty v1.18.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.39.0 // indirect
+	go.opentelemetry.io/otel/metric v1.39.0 // indirect
+	go.opentelemetry.io/otel/trace v1.39.0 // indirect
+	golang.org/x/crypto v0.53.0 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/oauth2 v0.36.0
+	golang.org/x/sync v0.21.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d // indirect
+	google.golang.org/grpc v1.79.3 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1
 )
diff --git a/helpers/foundation-deployer/go.sum b/helpers/foundation-deployer/go.sum
diff --git a/test/integration/go.mod b/test/integration/go.mod
diff --git a/test/integration/go.sum b/test/integration/go.sum

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`		`-go 1.23.0`
	`1`	`+go 1.25.0`
`2`	`2`
`3`	`3`	`use (`
`4`		`- ./test/integration`
`5`		`- ./helpers/foundation-deployer`
	`4`	`+ ./test/integration`
	`5`	`+ ./helpers/foundation-deployer`
`6`	`6`	`)`