[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
cloud.google.com/go/storage	v1.69.0 → v1.70.0			require	minor
github.com/andybalholm/brotli	v1.2.6 → v1.2.7			require	patch	v1.2.8
github.com/creativeprojects/go-selfupdate	v1.6.0 → v1.7.0			require	minor
github.com/klauspost/pgzip	v1.2.7 → v1.3.0			require	minor
github.com/minio/minlz	v1.2.2 → v1.2.3			require	patch
github.com/securego/gosec/v2/cmd/gosec	v2.29.0 → v2.30.0				minor
google.golang.org/api	v0.304.0 → v0.310.0			require	minor	v0.311.0
python-jsonschema/check-jsonschema	0.38.2 → 0.39.0			repository	minor
securego/gosec	v2.29.0 → v2.30.0			action	minor

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

googleapis/google-cloud-go (cloud.google.com/go/storage)

v1.70.0: storage: v1.70.0

Features

• storage: Add gcp.client.service attribute to trace spans (#​20686) (7b77906)
• storage: Honor ChunkTransferTimeout in the gRPC Writer (#​20634) (df47d64)
• storage: Plumb ChunkTransferTimeout and stall timeout error into gRPC Writer (#​20613) (82bb5c9)
• storage: Support DirectPath over Interconnect in GCS gRPC (#​20561) (c0d53be)
• Update API sources and regenerate (#​20728) (ab1da9d)

Bug Fixes

• storage: Allow mid-stream retries once gRPC upload session is established (#​20612) (c74aee1)
• storage: Correct remaining bytes for gRPC bidi range reads (#​20619) (f9eec5d)
• storage: Surface the last transport error from the gRPC Writer's ChunkRetryDeadline error (#​20637) (8f964fb)

Performance Improvements

• storage: Rotate slow resumable BidiWriteObject streams using dynamicDelay (#​20662) (e366326)

andybalholm/brotli (github.com/andybalholm/brotli)

v1.2.7

Compare Source

creativeprojects/go-selfupdate (github.com/creativeprojects/go-selfupdate)

v1.7.0

Compare Source

klauspost/pgzip (github.com/klauspost/pgzip)

v1.3.0

Compare Source

What's Changed

• feat: Parallel zlib writer implementation by @​AdamMagued in #​75
• fix: reset read offset when Read drains the current block by @​stefanfrede in #​76
• Return unexpected EOF if the stream misses its CRC trailer by @​apostasie in #​78
• Upgrade compress by @​klauspost in #​79

New Contributors

• @​stefanfrede made their first contribution in #​76
• @​apostasie made their first contribution in #​78
• @​AdamMagued made their first contribution in #​75

Full Changelog: klauspost/pgzip@v1.2.7...v1.3.0

minio/minlz (github.com/minio/minlz)

v1.2.3

Compare Source

What's Changed

• _generate: keep the encoders' frame locals in registers on arm64 by @​lizthegrey in #​74
• _generate: use the 3-byte literal header in the 64K encoders by @​RaduBerinde in #​81
• asm: Eliminate dead code by @​klauspost in #​80
• stream: fix compressed-data CRC validation by @​Uzer007-admin in #​85
• amd64: accelerate overlapping decoder tail copies by @​Uzer007-admin in #​84

New Contributors

• @​RaduBerinde made their first contribution in #​81
• @​Uzer007-admin made their first contribution in #​85

Full Changelog: minio/minlz@v1.2.2...v1.2.3

securego/gosec (github.com/securego/gosec/v2/cmd/gosec)

v2.30.0

Compare Source

Changelog

• 5eb1d10 fix(g602): recognize equality comparison in minimumLenForBranch (#​1796)
• cc750dd fix(G112): honor read timeouts assigned through a struct field (#​1798)
• 1cbfd7e fix(G112): report read timeouts explicitly set to zero (#​1797)
• 05b9c4c feat(G706): extend log/slog method coverage (#​1795)
• 17ad2dd fix(autofix): read the first text block of a Claude response (#​1794)
• b23171c fix(autofix): give every AI request its own timeout (#​1793)
• 20b9e5b fix(resolve): treat constants from other packages as resolved (#​1792)
• 86d3c26 fix(autofix): return an error when a Gemini candidate has no content (#​1791)
• 14ef84f Update to go version 1.27.3 and 1.26.10 (#​1790)
• 7cbd7a9 fix(autofix): default Gemini model to gemini-3.1-pro-preview (#​1788)
• 1e26bce fix(G102): resolve concatenated and constant listen addresses (#​1787)
• 836dbdb fix: default -concurrency to GOMAXPROCS so container CPU limits apply (#​1786)
• bbd69e2 fix(g602): track statically known lengths for append results in slice bounds check (#​1773)
• 30e2d38 feat(rules): add G125 to detect unescaped url.JoinPath elements (#​1777)
• 57c45b8 fix: load absolute file paths so nested modules are analysed from the parent directory (#​1779)
• 77fa84e fix(G118): treat a cancel sent on a channel as handed off (#​1782)
• ca547ab fix(G112): honor read timeouts assigned after the http.Server literal (#​1781)
• 024084b fix(G303): resolve constant temp file paths (#​1784)
• 782eeb1 fix(deps): update all dependencies (#​1783)
• 707f227 fix(G203): treat constant template arguments as safe (#​1770)
• 8c5daa6 fix(G402): check TLS settings assigned through a *tls.Config (#​1769)
• 7157726 fix(deps): update all dependencies (#​1775)
• 7b1b5ce Update to go version 1.27.2 and 1.26.9 (#​1772)
• d2b649e Keep SARIF driver rules sorted and resolve rule indexes at the end (#​1767)
• 1f52e64 fix(G602): track append() results for slice bounds checking (#​1754)
• ea75d9f fix(deps): update all dependencies (#​1768)
• 65c2c08 fix(G602): trust len(nilSlice) == N guards, matching make()-backed slices (#​1752)
• 6ff893e fix(G407): treat an array IV/nonce as a zeroed buffer (#​1763)
• aaca894 fix(fileperms): resolve constant file and directory permissions (#​1766)
• 826f6f4 fix(G102): detect binding to the IPv6 unspecified address (#​1760)
• 021cc2e fix(G407): stop the nonce source walk on cycles (#​1761)
• ccb369d fix(G407): do not count AEAD.Seal as the read that fills its own nonce (#​1762)
• 9b31806 fix(deps): update all dependencies (#​1764)
• 8c77519 fix(G602): validate inequality len guards (#​1757)
• 027baa2 fix(G121): track request captured by closures (#​1759)
• 9ede89e fix(deps): update all dependencies (#​1756)
• 29a042e fix: make nosec suppression independent of comment order (#​1741)
• 6813471 fix(G403): resolve constant RSA key sizes (#​1751)
• 201d413 fix(G602): validate subslice bounds under equality guards (#​1749)
• accb424 fix(G124): resolve negated constant cookie flags (#​1748)
• 61fa1da fix(G602): report constant index equal to the length asserted by an equality guard (#​1746)
• 78fbcc7 Skip taint call graphs when no sinks match (#​1745)
• 79b4fcd Fix brittle test for html writer (#​1744)
• d70cac3 fix(G404): ignore non-cryptographic Shuffle calls (#​1742)
• 9e8e5d9 fix(deps): update all dependencies (#​1743)
• 8075fd2 fix(taint): remove Result.Source field that is never populated (#​1739)
• 58362d8 Update all dependencies (#​1737)
• d98945a Update go version 1.27.1 and 1.26.8 and phased out 1.25 (#​1738)
• 720c679 fix(report): correct Babel SRI hash (#​1736)
• 598d614 fix(taint): make wide caller traversal deterministic (#​1733)
• 4d447d9 fix(G702): skip the context argument of exec.CommandContext (#​1730)
• be1e315 feat(taint): name the sink in taint finding messages (#​1731)
• a102130 Update all dependencies (#​1734)
• 57f1613 Update action to gosec version 2.29.0 (#​1728)

googleapis/google-api-go-client (google.golang.org/api)

v0.310.0

Compare Source

Features

• all: Auto-regenerate discovery clients (#​3795) (2a636ad)
• all: Auto-regenerate discovery clients (#​3797) (df2d2b0)

v0.309.0

Compare Source

Features

• all: Auto-regenerate discovery clients (#​3789) (e05cb39)
• all: Auto-regenerate discovery clients (#​3791) (0aad672)
• all: Auto-regenerate discovery clients (#​3792) (7a3948f)

v0.308.0

Compare Source

Features

• all: Auto-regenerate discovery clients (#​3787) (527f9a3)

v0.307.0

Compare Source

Features

• all: Auto-regenerate discovery clients (#​3785) (b2487a4)

v0.306.0

Compare Source

Features

• all: Auto-regenerate discovery clients (#​3779) (3b5f058)
• all: Auto-regenerate discovery clients (#​3781) (795219d)

Bug Fixes

• gensupport: Defer chunk context cancellation until response body is closed (#​3782) (ef4e011)

v0.305.0

Compare Source

Features

• all: Auto-regenerate discovery clients (#​3774) (d5374f1)
• all: Auto-regenerate discovery clients (#​3776) (a306b7a)
• all: Auto-regenerate discovery clients (#​3777) (abd2ce1)

python-jsonschema/check-jsonschema

v0.39.0

Compare Source

• Update vendored schemas: bitbucket-pipelines, buildkite, circle-ci,
  citation-file-format, compose-spec, dependabot, gitlab-ci, meltano, mergify, renovate,
  snapcraft, woodpecker-ci (2026-10-25)
• Added support for Python 3.15 .
• Removed support for Python 3.10 .
• The build backend has been updated from setuptools to flit.
• When running with a builtin schema, check-jsonschema will now skip
  the metaschema check as an optimization.

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=7 days

Details:

Package	Change
google.golang.org/genproto/googleapis/rpc	v0.0.0-20261012220534-4341edf3f941 -> v0.0.0-20261019180522-ce908d29299b