chore(deps): lock file maintenance vulnfeeds

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
		lockFileMaintenance	All locks refreshed
github.com/google/osv-scanner	require	minor	v1.8.5 -> v1.9.0
golang.org/x/exp	require	digest	701f63a -> 225e2ab

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Release Notes

google/osv-scanner (github.com/google/osv-scanner)

v1.9.0

Compare Source

Features:

• Feature #​1243 Allow explicitly ignoring the license of a package in config with license.ignore = true.
• Feature #​1249 Error if configuration file has unknown properties.
• Feature #​1271 Assume .txt files with "requirements" in their name are requirements.txt files

Fixes:

• Bug #​1242 Announce when a config file is invalid and exit with a non-zero code.
• Bug #​1241 Display (no reason given) when there is no reason in the override config.
• Bug #​1252 Don't allow LoadPath to be set via config file.
• Bug #​1279 Report all ecosystems without local databases in one single line.
• Bug #​1283 Output invalid PURLs when scanning SBOMs.
• Bug #​1278 Apply go version override to all instances of the stdlib.

Misc:

• #​1253 Deprecate ParseX() functions in pkg/lockfile in favor of their Extract equivalents.
• #​1290 Bump maximum number of concurrent requests to the OSV.dev API.

---

Configuration

📅 Schedule: Branch creation - "before 6am on wednesday" in timezone Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[forking-renovate]

ℹ Artifact update notice

File name: vulnfeeds/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 6 additional dependencies were updated

Details:

Package	Change
golang.org/x/crypto	v0.27.0 -> v0.28.0
golang.org/x/net	v0.29.0 -> v0.30.0
golang.org/x/sys	v0.25.0 -> v0.26.0
golang.org/x/text	v0.18.0 -> v0.19.0
golang.org/x/tools	v0.25.0 -> v0.26.0
google.golang.org/grpc	v1.66.0 -> v1.67.0