Update dependabot.yaml and dependencies

[santoshkal]

Update Go dependencies in go.mod file and update dependabot config to make pre-main branch default for merging dependabot PRs.

[dryrunsecurity]

DryRun Security Summary

The provided code changes in this GitHub pull request focus on updating the project's dependencies and configuration files, including removing the github.com/docker/docker dependency and updating the Dependabot configuration to change the target branch for updates from "main" to "pre-main", which can improve the overall application security and dependency management process.

Expand for full summary

Summary:

The provided code changes in this GitHub pull request are focused on updating the project's dependencies and configuration files. The key changes include:

1. Removing the github.com/docker/docker dependency from the go.mod and go.sum files, which suggests that the project no longer requires this specific Docker-related dependency.
2. Updating the Dependabot configuration in the .github/dependabot.yml file to change the target branch for updates from "main" to "pre-main" for both the gomod and github-actions package ecosystems.

From an application security perspective, these changes are generally positive as they reduce the overall attack surface by removing unused dependencies and improve the dependency management process by introducing a separate branch for testing Dependabot updates before merging them into the main codebase.

However, it is important to ensure that the removal of the github.com/docker/docker dependency does not break any functionality in the application, and the impact of this change should be thoroughly tested. Additionally, the Dependabot configuration changes should be reviewed to ensure that the new "pre-main" target branch is properly managed and integrated into the project's development workflow.

Files Changed:

1. go.mod: The github.com/docker/docker dependency has been removed from the project, which reduces the overall attack surface and potential vulnerabilities associated with unused dependencies.
2. .github/dependabot.yml: The Dependabot configuration has been updated to change the target branch for updates from "main" to "pre-main" for both the gomod and github-actions package ecosystems. This can be a good practice for testing and reviewing Dependabot updates before merging them into the main codebase.
3. go.sum: The github.com/docker/docker dependency has been removed from the go.sum file, which is consistent with the change made in the go.mod file.

Code Analysis

We ran 9 analyzers against 3 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	2 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.