fix(deps): update osv-scanner minor

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
deps.dev/api/v3	v3.0.0-20250114022823-c1ebdca3d00a -> v3.0.0-20250129021108-7b38e5d02c19					require	patch
deps.dev/util/maven	c1ebdca -> 7b38e5d					require	digest
deps.dev/util/resolve	c1ebdca -> 7b38e5d					require	digest
deps.dev/util/semver	c1ebdca -> 7b38e5d					require	digest
github.com/gkampitakis/go-snaps	v0.5.8 -> v0.5.9					require	patch
github.com/go-git/go-git/v5	v5.13.1 -> v5.13.2					require	patch
github.com/google/osv-scalibr	34aef7c -> 358fcf5					require	digest
github.com/ossf/osv-schema/bindings/go	8059be3 -> d868137					require	digest
golang.org/x/exp	7588d65 -> e0ece0d					require	digest
google.golang.org/grpc	v1.69.4 -> v1.70.0					require	minor
google.golang.org/protobuf	v1.36.3 -> v1.36.4					require	patch

---

Release Notes

gkampitakis/go-snaps (github.com/gkampitakis/go-snaps)

v0.5.9

Compare Source

What's Changed

• fix: snaps.Update should apply and on snapshot create by @​gkampitakis in https://github.com/gkampitakis/go-snaps/pull/119

Full Changelog: gkampitakis/go-snaps@v0.5.8...v0.5.9

Kudos to @​orloffv for this issue https://github.com/gkampitakis/go-snaps/pull/116

go-git/go-git (github.com/go-git/go-git/v5)

v5.13.2

Compare Source

What's Changed

• plumbing: use the correct user agent string. Fixes #​883 by @​uragirii in https://github.com/go-git/go-git/pull/1364
• build: bump golang.org/x/sys from 0.28.0 to 0.29.0 in the golang-org group by @​dependabot in https://github.com/go-git/go-git/pull/1365
• build: bump the golang-org group with 2 updates by @​dependabot in https://github.com/go-git/go-git/pull/1367
• build: bump github.com/ProtonMail/go-crypto from 1.1.3 to 1.1.4 by @​dependabot in https://github.com/go-git/go-git/pull/1368
• build: bump github.com/go-git/go-billy/v5 from 5.6.1 to 5.6.2 by @​dependabot in https://github.com/go-git/go-git/pull/1378
• build: bump github/codeql-action from 3.28.0 to 3.28.1 by @​dependabot in https://github.com/go-git/go-git/pull/1376
• build: bump github.com/elazarl/goproxy from 1.2.3 to 1.4.0 by @​dependabot in https://github.com/go-git/go-git/pull/1377
• git: worktree, fix restoring dot slash files (backported to v5). Fixes #​1176 by @​BeChris in https://github.com/go-git/go-git/pull/1361
• build: bump github.com/pjbgf/sha1cd from 0.3.0 to 0.3.2 by @​dependabot in https://github.com/go-git/go-git/pull/1392
• git: worktree_status, fix adding dot slash files to working tree (backported to v5). Fixes #​1150 by @​BeChris in https://github.com/go-git/go-git/pull/1359
• build: bump github.com/ProtonMail/go-crypto from 1.1.4 to 1.1.5 by @​dependabot in https://github.com/go-git/go-git/pull/1383

Full Changelog: go-git/go-git@v5.13.1...v5.13.2

grpc/grpc-go (google.golang.org/grpc)

v1.70.0: Release 1.70.0

Compare Source

Behavior Changes

• client: reject service configs containing an invalid retryPolicy in accordance with gRFCs A21 and A6. (#​7905)
  • Note that this is a potential breaking change for some users using an invalid configuration, but continuing to allow this behavior would violate our cross-language compatibility requirements.

New Features

• xdsclient: fallback to a secondary management server (if specified in the bootstrap configuration) when the primary is down is enabled by default. Can be disabled by setting the environment variable GRPC_EXPERIMENTAL_XDS_FALLBACK to false. (#​7949)
• experimental/credentials: experimental transport credentials are added which don't enforce ALPN. (#​7980)
  • These credentials will be removed in an upcoming grpc-go release. Users must not rely on these credentials directly. Instead, they should either vendor a specific version of gRPC or copy the relevant credentials into their own codebase if absolutely necessary.

Bug Fixes

• xds: fix a possible deadlock that happens when both the client application and the xDS management server (responsible for configuring the client) are using the xds:/// scheme in their target URIs. (#​8011)

Performance

• server: for unary requests, free raw request message data as soon as parsing is finished instead of waiting until the method handler returns. (#​7998)
  • Special Thanks: @​lqs

Documentation

• examples/features/gracefulstop: add example to demonstrate server graceful stop. (#​7865)

protocolbuffers/protobuf-go (google.golang.org/protobuf)

v1.36.4

Compare Source

Full Changelog: protocolbuffers/protobuf-go@v1.36.3...v1.36.4

Bug fixes:
CL/642975: reflect/protodesc: fix panic when working with dynamicpb

Maintenance:
CL/643276: internal_gengo: avoid allocations in rawDescGZIP() accessors
CL/642857: internal_gengo: switch back from string literal to hex byte slice
CL/642055: internal_gengo: use unsafe.StringData() to avoid a descriptor copy
CL/638135: internal_gengo: store raw descriptor in .rodata section

---

Configuration

📅 Schedule: Branch creation - "before 6am on monday" in timezone Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[forking-renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 7 additional dependencies were updated

Details:

Package	Change
github.com/ProtonMail/go-crypto	v1.1.3 -> v1.1.5
github.com/pjbgf/sha1cd	v0.3.0 -> v0.3.2
go.opentelemetry.io/otel	v1.31.0 -> v1.32.0
go.opentelemetry.io/otel/metric	v1.31.0 -> v1.32.0
go.opentelemetry.io/otel/trace	v1.31.0 -> v1.32.0
google.golang.org/genproto/googleapis/api	v0.0.0-20241015192408-796eee8c2d53 -> v0.0.0-20241202173237-19429a94021a
google.golang.org/genproto/googleapis/rpc	v0.0.0-20241015192408-796eee8c2d53 -> v0.0.0-20241202173237-19429a94021a

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 69.29%. Comparing base (cd7cc8a) to head (3a0d3ac).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1532      +/-   ##
==========================================
- Coverage   69.31%   69.29%   -0.02%     
==========================================
  Files         200      200              
  Lines       19038    19038              
==========================================
- Hits        13196    13193       -3     
- Misses       5135     5137       +2     
- Partials      707      708       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[cuixq]

google/osv-scalibr@358fcf5 should fix the go.mod issue