[self-hosted-renovatebot]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/oauth2	v0.27.0 → v0.37.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[gitops-autobot-reviewer-cresta]

Auto-approved: PR created by known bot user @self-hosted-renovatebot[bot]

[self-hosted-renovatebot]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.23.0 -> 1.24.0

[self-hosted-renovatebot]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• The go directive was updated for compatibility reasons

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=5 days

Details:

Package	Change
go	1.23.0 -> 1.26.0

[cursor]

PR Summary

Medium Risk
Touches the oauth2 library used for token HTTP clients (auth path), but only via version pins; verify CI/build on Go 1.25.0.

Overview
Renovate bumps golang.org/x/oauth2 from v0.27.0 to v0.36.0 and refreshes go.sum checksums. The module go directive moves from 1.23.0 to 1.25.0, and the explicit toolchain go1.24.6 line is removed.

There are no application code changes; PAT-based GitHub clients still use oauth2.StaticTokenSource and oauth2.NewClient in clientFromToken.

^{Reviewed by Cursor Bugbot for commit 5704f11. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 38124bf4-37a9-47b0-a612-b61342d11243

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch renovate/golang.org-x-oauth2-0.x

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gitops-autobot-reviewer-cresta]

Codeowner Check

Status: ❌ Missing codeowner approvals

The following rules are missing approval. Request a review from the listed codeowners:

Pattern	# Files	Owners to approve
*	2	@cresta/infrastructure-squad

Please request a review from the listed codeowners to satisfy this check.