[renovate]

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.

📚 See our Reading List for relevant documentation you may be interested in reading.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch. Renovate will update the Pull Request description the next time it runs.

---

Detected Package Files

• Cargo.toml (cargo)
• crates/conda-monitor/Cargo.toml (cargo)
• docker/docker-compose.yml (docker-compose)
• docker/Dockerfile.local (dockerfile)
• docker/Dockerfile.server (dockerfile)
• docker/Dockerfile.witness (dockerfile)
• .github/workflows/ci.yml (github-actions)
• .github/workflows/docker.yml (github-actions)
• rekor-conformance/go.mod (gomod)
• witness-conformance/pyproject.toml (pep621)
• explorer/pyproject.toml (poetry)
• rust-toolchain.toml (rust-toolchain)

Configuration Summary

Based on the default config's presets, Renovate will:

• Start dependency updates only once this onboarding PR is merged
• Hopefully safe environment variables to allow users to configure.
• Show all Merge Confidence badges for pull requests.
• Enable Renovate Dependency Dashboard creation.
• Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
• Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
• Group known monorepo packages together.
• Use curated list of recommended non-monorepo package groupings.
• Show only the Age and Confidence Merge Confidence badges for pull requests.
• Apply crowd-sourced package replacement rules.
• Apply crowd-sourced workarounds for known problems with packages.
• Update vulnerable PHP runtime pins for CVE-2026-109618 and CVE-2026-109619.
• Ensure that every dependency pinned by digest and sourced from Forgejo contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from Gitea contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from GitHub.com and Github enterprise contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from GitLab.com contains a link to the commit-to-commit diff
• Correctly link to the source code for golang.org/x packages
• Link to pkg.go.dev/... for golang.org/x packages' title
• Provide a link to octochangelog's improved breakdown for Renovate's changelogs

---

What to Expect

With your current configuration, Renovate will create 10 Pull Requests, up to a maximum of 19 over time (see docs for prConcurrentLimit):

Update Rust crate crc32fast to v1.5.4

• Schedule: ["at any time"]
• Branch name: renovate/crc32fast-1.x-lockfile
• Merge into: main
• Upgrade crc32fast to 1.5.4

Update Rust crate opendal to v0.59.5

• Schedule: ["at any time"]
• Branch name: renovate/opendal-0.x-lockfile
• Merge into: main
• Upgrade opendal to 0.59.5

Update Rust crate rand to v0.10.3

• Schedule: ["at any time"]
• Branch name: renovate/rand-0.x-lockfile
• Merge into: main
• Upgrade rand to 0.10.3

Update Rust crate serde_json to v1.0.154

• Schedule: ["at any time"]
• Branch name: renovate/serde_json-1.x-lockfile
• Merge into: main
• Upgrade serde_json to 1.0.154

Update Rust crate sha2 to v0.11.1

• Schedule: ["at any time"]
• Branch name: renovate/sha2-0.x-lockfile
• Merge into: main
• Upgrade sha2 to 0.11.1

Update Rust crate smallvec to v1.16.4

• Schedule: ["at any time"]
• Branch name: renovate/smallvec-1.x-lockfile
• Merge into: main
• Upgrade smallvec to 1.16.4

Update Rust crate thiserror to v2.0.21

• Schedule: ["at any time"]
• Branch name: renovate/thiserror-2.x-lockfile
• Merge into: main
• Upgrade thiserror to 2.0.21

Update sea-orm monorepo to v2.0.4

• Schedule: ["at any time"]
• Branch name: renovate/sea-orm-monorepo
• Merge into: main
• Upgrade sea-orm to 2.0.4
• Upgrade sea-orm-migration to 2.0.4

Update astral-sh/setup-uv action to v10.3.3

• Schedule: ["at any time"]
• Branch name: renovate/astral-sh-setup-uv-10.x
• Merge into: main
• Upgrade astral-sh/setup-uv to v10.3.3

Update module github.com/sigstore/rekor-tiles/v2 to v2.4.1

• Schedule: ["at any time"]
• Branch name: renovate/github.com-sigstore-rekor-tiles-v2-2.x
• Merge into: main
• Upgrade github.com/sigstore/rekor-tiles/v2 to v2.4.1

Update module golang.org/x/mod to v0.42.0

• Schedule: ["at any time"]
• Branch name: renovate/golang.org-x-mod-0.x
• Merge into: main
• Upgrade golang.org/x/mod to v0.42.0

Update Rust

• Schedule: ["at any time"]
• Branch name: renovate/rust-1.x
• Merge into: main
• Upgrade rust to 1.99.1
• Upgrade rust to 1.99-bookworm

Update Rust crate async-recursion to v1.2.0

• Schedule: ["at any time"]
• Branch name: renovate/async-recursion-1.x-lockfile
• Merge into: main
• Upgrade async-recursion to 1.2.0

Update Rust crate aws-lc-rs to v1.19.0

• Schedule: ["at any time"]
• Branch name: renovate/aws-lc-rs-1.x-lockfile
• Merge into: main
• Upgrade aws-lc-rs to 1.19.0

Update Rust crate sigstore-crypto to 0.15

• Schedule: ["at any time"]
• Branch name: renovate/sigstore-crypto-0.x
• Merge into: main
• Upgrade sigstore-crypto to 0.15

Update Rust crate sigstore-merkle to 0.15

• Schedule: ["at any time"]
• Branch name: renovate/sigstore-merkle-0.x
• Merge into: main
• Upgrade sigstore-merkle to 0.15

Update Rust crate sigstore-types to 0.15

• Schedule: ["at any time"]
• Branch name: renovate/sigstore-types-0.x
• Merge into: main
• Upgrade sigstore-types to 0.15

Update Rust crate tokio to v1.54.1

• Schedule: ["at any time"]
• Branch name: renovate/tokio-1.x-lockfile
• Merge into: main
• Upgrade tokio to 1.54.1

Update postgres Docker tag to v18

• Schedule: ["at any time"]
• Branch name: renovate/postgres-18.x
• Merge into: main
• Upgrade postgres to 18

🚸 PR creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prHourlyLimit for details.

---

❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.

---

This PR was generated by Mend Renovate. View the repository job log.