Update dependency nginx/agent to v3.6.0 (#4425)

[sjberman]

This PR contains the following updates:

Package	Update	Change
nginx/agent	minor	v3.5.1 -> v3.6.0

---

Release Notes

nginx/agent (nginx/agent)

v3.6.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ❌ 12 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

License Issues

go.mod

Package	Version	License	Issue Type
golang.org/x/mod	0.30.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License
golang.org/x/net	0.47.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License
golang.org/x/sync	0.18.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License
golang.org/x/sys	0.38.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License
golang.org/x/term	0.37.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License
golang.org/x/text	0.31.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License

tests/go.mod

Package	Version	License	Issue Type
golang.org/x/mod	0.30.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License
golang.org/x/net	0.47.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License
golang.org/x/sync	0.18.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License
golang.org/x/sys	0.38.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License
golang.org/x/term	0.37.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License
golang.org/x/text	0.31.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License

Allowed Licenses:

Apache-1.1, Apache-2.0, BSD-2-Clause, BSD-3-Clause, BSL-1.0, ISC, MIT, NCSA, OpenSSL, Python-2.0, X11, CC0-1.0, CC-BY-4.0

Excluded from license check:

pkg:githubactions/fossas/fossa-action, pkg:githubactions/opentofu/setup-opentofu, pkg:golang/github.com/shoenig/go-m1cpu, pkg:pypi/pytest-metadata

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
gomod/github.com/nginx/agent/v3	3.6.0	🟢 7.5	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Dependency-Update-Tool 🟢 10 update tool detected Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9 License 🟢 10 license file detected Packaging 🟢 10 packaging workflow detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 4 contributing companies or organizations
gomod/golang.org/x/mod	0.30.0	Unknown	Unknown
gomod/golang.org/x/net	0.47.0	Unknown	Unknown
gomod/golang.org/x/sync	0.18.0	Unknown	Unknown
gomod/golang.org/x/sys	0.38.0	Unknown	Unknown
gomod/golang.org/x/term	0.37.0	Unknown	Unknown
gomod/golang.org/x/text	0.31.0	Unknown	Unknown
gomod/golang.org/x/mod	0.30.0	Unknown	Unknown
gomod/golang.org/x/net	0.47.0	Unknown	Unknown
gomod/golang.org/x/sync	0.18.0	Unknown	Unknown
gomod/golang.org/x/sys	0.38.0	Unknown	Unknown
gomod/golang.org/x/term	0.37.0	Unknown	Unknown
gomod/golang.org/x/text	0.31.0	Unknown	Unknown

Scanned Files

• go.mod
• tests/go.mod

[sjberman]

@salonichf5 How does that PR relate to this?

[salonichf5]

@salonichf5 How does that PR relate to this?

I thought the dependency update were correlated but i am wrong. They do not relate. Delete the first comment to remove reference