SIGN IN SIGN UP

fix(deps): update osv-scanner minor (#2427)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) | Type |
Update |
|---|---|---|---|---|---|
| [deps.dev/api/v3](https://redirect.github.com/google/deps.dev) |
`v3.0.0-20251127011616-f763ce91ff53` →
`v3.0.0-20251219105704-58e32bc05c71` |
![age](https://developer.mend.io/api/mc/badges/age/go/deps.dev%2fapi%2fv3/v3.0.0-20251219105704-58e32bc05c71?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/deps.dev%2fapi%2fv3/v3.0.0-20251127011616-f763ce91ff53/v3.0.0-20251219105704-58e32bc05c71?slim=true)
| require | patch |
| [deps.dev/api/v3alpha](https://redirect.github.com/google/deps.dev) |
`f763ce9` → `58e32bc` |
![age](https://developer.mend.io/api/mc/badges/age/go/deps.dev%2fapi%2fv3alpha/v0.0.0-20251219105704-58e32bc05c71?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/deps.dev%2fapi%2fv3alpha/v0.0.0-20251127011616-f763ce91ff53/v0.0.0-20251219105704-58e32bc05c71?slim=true)
| require | digest |
| [deps.dev/util/maven](https://redirect.github.com/google/deps.dev) |
`f763ce9` → `58e32bc` |
![age](https://developer.mend.io/api/mc/badges/age/go/deps.dev%2futil%2fmaven/v0.0.0-20251219105704-58e32bc05c71?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/deps.dev%2futil%2fmaven/v0.0.0-20251127011616-f763ce91ff53/v0.0.0-20251219105704-58e32bc05c71?slim=true)
| require | digest |
| [deps.dev/util/resolve](https://redirect.github.com/google/deps.dev) |
`f763ce9` → `58e32bc` |
![age](https://developer.mend.io/api/mc/badges/age/go/deps.dev%2futil%2fresolve/v0.0.0-20251219105704-58e32bc05c71?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/deps.dev%2futil%2fresolve/v0.0.0-20251127011616-f763ce91ff53/v0.0.0-20251219105704-58e32bc05c71?slim=true)
| require | digest |
| [deps.dev/util/semver](https://redirect.github.com/google/deps.dev) |
`f763ce9` → `58e32bc` |
![age](https://developer.mend.io/api/mc/badges/age/go/deps.dev%2futil%2fsemver/v0.0.0-20251219105704-58e32bc05c71?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/deps.dev%2futil%2fsemver/v0.0.0-20251127011616-f763ce91ff53/v0.0.0-20251219105704-58e32bc05c71?slim=true)
| require | digest |
|
[github.com/BurntSushi/toml](https://redirect.github.com/BurntSushi/toml)
| `v1.5.0` → `v1.6.0` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fBurntSushi%2ftoml/v1.6.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fBurntSushi%2ftoml/v1.5.0/v1.6.0?slim=true)
| require | minor |
|
[github.com/gkampitakis/go-snaps](https://redirect.github.com/gkampitakis/go-snaps)
| `v0.5.18` → `v0.5.19` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgkampitakis%2fgo-snaps/v0.5.19?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgkampitakis%2fgo-snaps/v0.5.18/v0.5.19?slim=true)
| require | patch |
| [github.com/goccy/go-yaml](https://redirect.github.com/goccy/go-yaml)
| `v1.19.0` → `v1.19.1` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgoccy%2fgo-yaml/v1.19.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgoccy%2fgo-yaml/v1.19.0/v1.19.1?slim=true)
| require | patch |
|
[github.com/jedib0t/go-pretty/v6](https://redirect.github.com/jedib0t/go-pretty)
| `v6.7.7` → `v6.7.8` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fjedib0t%2fgo-pretty%2fv6/v6.7.8?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fjedib0t%2fgo-pretty%2fv6/v6.7.7/v6.7.8?slim=true)
| require | patch |
|
[github.com/modelcontextprotocol/go-sdk](https://redirect.github.com/modelcontextprotocol/go-sdk)
| `v1.1.0` → `v1.2.0` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fmodelcontextprotocol%2fgo-sdk/v1.2.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fmodelcontextprotocol%2fgo-sdk/v1.1.0/v1.2.0?slim=true)
| require | minor |
|
[github.com/ossf/osv-schema/bindings/go](https://redirect.github.com/ossf/osv-schema)
| `c18cb69` → `88c4875` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fossf%2fosv-schema%2fbindings%2fgo/v0.0.0-20251230224438-88c48750ddae?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fossf%2fosv-schema%2fbindings%2fgo/v0.0.0-20251209024518-c18cb6974477/v0.0.0-20251230224438-88c48750ddae?slim=true)
| require | digest |
| [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) |
`v1.77.0` → `v1.78.0` |
![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fgrpc/v1.78.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fgrpc/v1.77.0/v1.78.0?slim=true)
| require | minor |
| [osv.dev/bindings/go](https://redirect.github.com/google/osv.dev) |
`bdb4de0` → `f5c9699` |
![age](https://developer.mend.io/api/mc/badges/age/go/osv.dev%2fbindings%2fgo/v0.0.0-20260107022749-f5c969937129?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/osv.dev%2fbindings%2fgo/v0.0.0-20251215025150-bdb4de01a57f/v0.0.0-20260107022749-f5c969937129?slim=true)
| require | digest |

---

### Release Notes

<details>
<summary>BurntSushi/toml (github.com/BurntSushi/toml)</summary>

###
[`v1.6.0`](https://redirect.github.com/BurntSushi/toml/releases/tag/v1.6.0)

[Compare
Source](https://redirect.github.com/BurntSushi/toml/compare/v1.5.0...v1.6.0)

TOML 1.1 is now enabled by default. The TOML changelog has an overview
of changes: <https://github.com/toml-lang/toml/blob/main/CHANGELOG.md>

Also two small fixes:

- Encode large floats as exponent syntax so that round-tripping things
like `5e+22` is correct.

- Using duplicate array keys would not give an error:

  ```
  arr = [1]
  arr = [2]
  ```

This will now correctly give a "Key 'arr' has already been defined"
error.

</details>

<details>
<summary>gkampitakis/go-snaps
(github.com/gkampitakis/go-snaps)</summary>

###
[`v0.5.19`](https://redirect.github.com/gkampitakis/go-snaps/releases/tag/v0.5.19)

[Compare
Source](https://redirect.github.com/gkampitakis/go-snaps/compare/0.5.18...v0.5.19)

##### What's Changed

- fix: use backticks for inline snaps when appropriate by
[@&#8203;gkampitakis](https://redirect.github.com/gkampitakis) in
[#&#8203;149](https://redirect.github.com/gkampitakis/go-snaps/pull/149)

**Full Changelog**:
<https://github.com/gkampitakis/go-snaps/compare/0.5.18...v0.5.19>

</details>

<details>
<summary>goccy/go-yaml (github.com/goccy/go-yaml)</summary>

###
[`v1.19.1`](https://redirect.github.com/goccy/go-yaml/releases/tag/v1.19.1):
1.19.1

[Compare
Source](https://redirect.github.com/goccy/go-yaml/compare/v1.19.0...v1.19.1)

#### What's Changed

- Fix decoding of integer keys of map type by
[@&#8203;goccy](https://redirect.github.com/goccy) in
[#&#8203;829](https://redirect.github.com/goccy/go-yaml/pull/829)
- Support line comment for flow sequence or flow map by
[@&#8203;goccy](https://redirect.github.com/goccy) in
[#&#8203;834](https://redirect.github.com/goccy/go-yaml/pull/834)

**Full Changelog**:
<https://github.com/goccy/go-yaml/compare/v1.19.0...v1.19.1>

</details>

<details>
<summary>jedib0t/go-pretty (github.com/jedib0t/go-pretty/v6)</summary>

###
[`v6.7.8`](https://redirect.github.com/jedib0t/go-pretty/releases/tag/v6.7.8)

[Compare
Source](https://redirect.github.com/jedib0t/go-pretty/compare/v6.7.7...v6.7.8)

#### What's Changed

- progress: SortByIndex for better control of sorting by
[@&#8203;jedib0t](https://redirect.github.com/jedib0t) in
[#&#8203;398](https://redirect.github.com/jedib0t/go-pretty/pull/398)
- progress: address race conditions in render/stop/trackers; fixes 399
by [@&#8203;jedib0t](https://redirect.github.com/jedib0t) in
[#&#8203;401](https://redirect.github.com/jedib0t/go-pretty/pull/401)

**Full Changelog**:
<https://github.com/jedib0t/go-pretty/compare/v6.7.7...v6.7.8>

</details>

<details>
<summary>modelcontextprotocol/go-sdk
(github.com/modelcontextprotocol/go-sdk)</summary>

###
[`v1.2.0`](https://redirect.github.com/modelcontextprotocol/go-sdk/releases/tag/v1.2.0)

[Compare
Source](https://redirect.github.com/modelcontextprotocol/go-sdk/compare/v1.1.0...v1.2.0)

***This release is equivalent to v1.2.0-pre.2. Thank you to those who
tested the prerelease.***

This release adds partial support for the [2025-11-25
version](https://modelcontextprotocol.io/specification/2025-11-25/changelog)
of the MCP spec and fixes some bugs in the streamable transports. It
also includes some minor new APIs, changes to contributing flows, and
small bugfixes.

#### Contributing changes

- CONTRIBUTING.md is updated to remove the ad-hoc antitrust policy
([#&#8203;651](https://redirect.github.com/modelcontextprotocol/go-sdk/issues/651)),
and add a dependency update policy
([#&#8203;635](https://redirect.github.com/modelcontextprotocol/go-sdk/issues/635)).
- An example server (`examples/server/conformance`) is added for the new
conformance tests at modelcontextprotocol/conformance. Test can be run
with `scripts/conformance.sh`
([#&#8203;650](https://redirect.github.com/modelcontextprotocol/go-sdk/issues/650)).

#### Partial support for the 2025-11-25 spec

The following SEPs from the 2025-11-25 spec are now supported. Please
see
[#&#8203;725](https://redirect.github.com/modelcontextprotocol/go-sdk/issues/725)
for the proposed API additions included to support these SEPs.

- SEP-973: icons and metadata
([#&#8203;570](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/570))
- SEP-986: tool name validation
([#&#8203;640](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/640))
- SEP-1024: elicitation defaults
([#&#8203;644](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/644))
- SEP-1036: URL mode elicitation
([#&#8203;646](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/646))
- SEP-1699: SSE polling
([#&#8203;663](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/663))
- SEP-1330: elicitation enum improvements
([#&#8203;676](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/676))

#### Other API additions

- Common error codes are now available through the sentinel
`jsonrpc.Error`
([#&#8203;452](https://redirect.github.com/modelcontextprotocol/go-sdk/issues/452))
- OAuth 2.0 Protected Resource Metadata support
([#&#8203;643](https://redirect.github.com/modelcontextprotocol/go-sdk/issues/643))
- `ClientCapabilities.RootsV2` and RootCapabilities are added to work
around an API bug
([#&#8203;607](https://redirect.github.com/modelcontextprotocol/go-sdk/issues/607))
- `Capabilities` fields are added to `ServerOptions` and
`ClientOptions`, to simplify capability configuration
([#&#8203;706](https://redirect.github.com/modelcontextprotocol/go-sdk/issues/706))

#### Streamable fixes

Several bug fixes are included for the streamable transports:

- mcp: relax SSE connection response handling in non-strict mode by
[@&#8203;zhxie](https://redirect.github.com/zhxie) in
[#&#8203;611](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/611)
- Fix: Skip non-message SSE events in processStream by
[@&#8203;raphaelmansuy](https://redirect.github.com/raphaelmansuy) in
[#&#8203;637](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/637)
- mcp: better handling for streamable context cancellation by
[@&#8203;findleyr](https://redirect.github.com/findleyr) in
[#&#8203;677](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/677)
- mcp: don't break the streamable client connection for transient errors
by [@&#8203;findleyr](https://redirect.github.com/findleyr) in
[#&#8203;723](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/723)

#### Other notable bugfixes

- fix: handle Windows CRLF in MCP client by
[@&#8203;isfzhang](https://redirect.github.com/isfzhang) in
[#&#8203;665](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/665)
- auth, mcp: add UserID to TokenInfo for session hijacking prevention by
[@&#8203;findleyr](https://redirect.github.com/findleyr) in
[#&#8203;695](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/695)
- internal/docs: document UserID for session hijacking prevention by
[@&#8203;findleyr](https://redirect.github.com/findleyr) in
[#&#8203;697](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/697)
- mcp: allow re-using connections in more cases by
[@&#8203;howardjohn](https://redirect.github.com/howardjohn) in
[#&#8203;709](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/709)
- oauthex: validate URL schemes in auth server metadata and DCR by
[@&#8203;findleyr](https://redirect.github.com/findleyr) in
[#&#8203;712](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/712)
- mcp: debounce server change notifications by
[@&#8203;findleyr](https://redirect.github.com/findleyr) in
[#&#8203;717](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/717)
- oauthex: fix content type check in getJSON by
[@&#8203;nikolavp](https://redirect.github.com/nikolavp) in
[#&#8203;721](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/721)

#### New Contributors

- [@&#8203;zhxie](https://redirect.github.com/zhxie) made their first
contribution in
[#&#8203;611](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/611)
- [@&#8203;SpringMT](https://redirect.github.com/SpringMT) made their
first contribution in
[#&#8203;614](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/614)
- [@&#8203;raphaelmansuy](https://redirect.github.com/raphaelmansuy)
made their first contribution in
[#&#8203;637](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/637)
- [@&#8203;markus-kusano](https://redirect.github.com/markus-kusano)
made their first contribution in
[#&#8203;644](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/644)
- [@&#8203;isfzhang](https://redirect.github.com/isfzhang) made their
first contribution in
[#&#8203;665](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/665)
- [@&#8203;orius123](https://redirect.github.com/orius123) made their
first contribution in
[#&#8203;643](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/643)
- [@&#8203;howardjohn](https://redirect.github.com/howardjohn) made
their first contribution in
[#&#8203;709](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/709)
- [@&#8203;nikolavp](https://redirect.github.com/nikolavp) made their
first contribution in
[#&#8203;721](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/721)

**Full Changelog**:
<https://github.com/modelcontextprotocol/go-sdk/compare/v1.1.0...v1.2.0>

</details>

<details>
<summary>grpc/grpc-go (google.golang.org/grpc)</summary>

###
[`v1.78.0`](https://redirect.github.com/grpc/grpc-go/releases/tag/v1.78.0):
Release 1.78.0

[Compare
Source](https://redirect.github.com/grpc/grpc-go/compare/v1.77.0...v1.78.0)

##### Behavior Changes

- client: Reject target URLs containing unbracketed colons in the
hostname in Go version 1.26+.
([#&#8203;8716](https://redirect.github.com/grpc/grpc-go/issues/8716))
  - Special Thanks: [@&#8203;neild](https://redirect.github.com/neild)

##### New Features

- stats/otel: Add backend service label to wrr metrics as part of A89.
([#&#8203;8737](https://redirect.github.com/grpc/grpc-go/issues/8737))
- stats/otel: Add subchannel metrics (without the disconnection reason)
to eventually replace the pickfirst metrics.
([#&#8203;8738](https://redirect.github.com/grpc/grpc-go/issues/8738))
- client: Wait for all pending goroutines to complete when closing a
graceful switch balancer.
([#&#8203;8746](https://redirect.github.com/grpc/grpc-go/issues/8746))
  - Special Thanks: [@&#8203;twz123](https://redirect.github.com/twz123)

##### Bug Fixes

- transport/client : Return status code `Unknown` on malformed
grpc-status.
([#&#8203;8735](https://redirect.github.com/grpc/grpc-go/issues/8735))
- client: Add `experimental.AcceptCompressors` so callers can restrict
the `grpc-accept-encoding` header advertised for a call.
([#&#8203;8718](https://redirect.github.com/grpc/grpc-go/issues/8718))
- Special Thanks:
[@&#8203;iblancasa](https://redirect.github.com/iblancasa)
- xds: Fix a bug in `StringMatcher` where regexes would match
incorrectly when ignore\_case is set to true.
([#&#8203;8723](https://redirect.github.com/grpc/grpc-go/issues/8723))
- xds/resolver:
- Drop previous route resources and report an error when no matching
virtual host is found.
- Only log LDS/RDS configuration errors following a successful update
and retain the last valid resource to prevent transient failures.
([#&#8203;8711](https://redirect.github.com/grpc/grpc-go/issues/8711))
- client:
- Change connectivity state to CONNECTING when creating the name
resolver (as part of exiting IDLE).
- Change connectivity state to TRANSIENT\_FAILURE if name resolver
creation fails (as part of exiting IDLE).
- Change connectivity state to IDLE after idle timeout expires even when
current state is TRANSIENT\_FAILURE.
- Fix a bug that resulted in `OnFinish` call option not being invoked
for RPCs where stream creation failed.
([#&#8203;8710](https://redirect.github.com/grpc/grpc-go/issues/8710))
- xdsclient: Fix a race in the xdsClient that could lead to
resource-not-found errors.
([#&#8203;8627](https://redirect.github.com/grpc/grpc-go/issues/8627))

##### Performance Improvements

- mem: Round up to nearest 4KiB for pool allocations larger than 1MiB.
([#&#8203;8705](https://redirect.github.com/grpc/grpc-go/issues/8705))
  - Special Thanks: [@&#8203;cjc25](https://redirect.github.com/cjc25)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 6am on monday" in timezone
Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/google/osv-scanner).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi41OS4wIiwidXBkYXRlZEluVmVyIjoiNDIuNjkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
M
Mend Renovate committed
c8a2deaeb4af786ba4e12c0557df804cfd37d1d8
Parent: cc37ac7
Committed by GitHub <noreply@github.com> on 1/8/2026, 12:29:28 AM