fix(deps): update module github.com/moov-io/base to v0.64.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/moov-io/base	v0.63.3 → v0.64.0

---

Release Notes

moov-io/base (github.com/moov-io/base)

v0.64.0

Compare Source

What's Changed

Admin — pprof (#​548)

Control /debug/pprof through admin.Opts.Pprof

• Existing callers that omit Pprof keep historical behavior: all pprof routes registered, no authentication, block and mutex sampling on.
• Set Pprof.Enabled to false to omit /debug/pprof, including index and cmdline. /live, /ready, and /metrics are unchanged.
• A non-empty Pprof.Secret requires Authorization: Bearer <secret> or X-Pprof-Token: <secret>.
• Pprof.Block and Pprof.Mutex opt into SetBlockProfileRate / SetMutexProfileFraction and their handlers. When Pprof is set, those default off.

admin.New(admin.Opts{
    Addr: ":9090",
    Pprof: &admin.Pprof{Enabled: false},
})

Test images

• MySQL Docker tags moved to Oracle calendar versioning: mysql:26-oracle / mysql:26.7-oracle (#​528)

CI

• Skip code-owner reviews on lockfiles and GitHub Actions workflows (#​523, #​527, #​529)
• Automerge Renovate dependency PRs; drop Dependabot (#​527)
• Run CodeQL on master and PRs to master; skip when GitHub cannot accept SARIF (#​524, #​525)

Dependencies

• Go modules: Spanner, AlloyDB, pgx/migrate, OpenTelemetry, gax-go, mysql, cal/v2, testcerts, and other routine bumps
• github/codeql-action to v4.38.x

Full Changelog: moov-io/base@v0.63.3...v0.64.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 55 additional dependencies were updated

Details:

Package	Change
cel.dev/expr	v0.25.2 -> v0.25.3
cloud.google.com/go/alloydb	v1.26.0 -> v1.31.0
cloud.google.com/go/alloydbconn	v1.18.6 -> v1.19.1
cloud.google.com/go/auth	v0.20.0 -> v0.24.1-0.20261001053825-dbc26066f70a
cloud.google.com/go/auth/oauth2adapt	v0.2.8 -> v0.3.0
cloud.google.com/go/compute/metadata	v0.9.0 -> v0.10.0
cloud.google.com/go/iam	v1.11.0 -> v1.14.0
cloud.google.com/go/longrunning	v1.2.0 -> v1.3.0
cloud.google.com/go/monitoring	v1.29.0 -> v1.31.0
cloud.google.com/go/spanner	v1.94.0 -> v1.96.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp	v1.33.0 -> v1.34.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric	v0.56.0 -> v0.62.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping	v0.56.0 -> v0.62.0
github.com/envoyproxy/go-control-plane/envoy	v1.37.0 -> v1.39.0
github.com/felixge/httpsnoop	v1.0.4 -> v1.1.0
github.com/go-jose/go-jose/v4	v4.1.4 -> v4.1.5
github.com/go-sql-driver/mysql	v1.10.0 -> v1.10.1
github.com/golang-migrate/migrate/v4	v4.19.1 -> v4.20.1
github.com/google/s2a-go	v0.1.9 -> v0.1.11
github.com/googleapis/enterprise-certificate-proxy	v0.3.17 -> v0.3.23
github.com/googleapis/gax-go/v2	v2.23.0 -> v2.26.2
github.com/grpc-ecosystem/grpc-gateway/v2	v2.29.0 -> v2.31.0
github.com/jackc/pgerrcode	v0.0.0-20220416144525-469b46aa5efa -> v0.0.0-20250907135507-afb5586c32a6
github.com/jackc/pgx/v5	v5.10.0 -> v5.11.0
github.com/jackc/puddle/v2	v2.2.2 -> v2.2.3
github.com/pelletier/go-toml/v2	v2.3.1 -> v2.4.3
github.com/prometheus/client_golang	v1.24.1 -> v1.25.0
github.com/prometheus/client_model	v0.6.2 -> v0.6.3
github.com/prometheus/common	v0.70.1 -> v0.72.0
github.com/prometheus/procfs	v0.21.1 -> v0.22.0
github.com/spiffe/go-spiffe/v2	v2.7.0 -> v2.9.0
go.opentelemetry.io/contrib/detectors/gcp	v1.44.0 -> v1.47.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	v0.68.0 -> v0.72.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.68.0 -> v0.72.0
go.opentelemetry.io/otel	v1.45.0 -> v1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace	v1.45.0 -> v1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	v1.45.0 -> v1.47.0
go.opentelemetry.io/otel/exporters/stdout/stdouttrace	v1.45.0 -> v1.47.0
go.opentelemetry.io/otel/metric	v1.45.0 -> v1.47.0
go.opentelemetry.io/otel/sdk	v1.45.0 -> v1.47.0
go.opentelemetry.io/otel/sdk/metric	v1.45.0 -> v1.47.0
go.opentelemetry.io/otel/trace	v1.45.0 -> v1.47.0
go.opentelemetry.io/proto/otlp	v1.11.0 -> v1.11.1
golang.org/x/crypto	v0.55.0 -> v0.57.0
golang.org/x/net	v0.58.0 -> v0.59.0
golang.org/x/sync	v0.22.0 -> v0.23.0
golang.org/x/sys	v0.47.0 -> v0.48.0
golang.org/x/text	v0.41.0 -> v0.42.0
golang.org/x/time	v0.15.0 -> v0.16.0
google.golang.org/api	v0.287.1 -> v0.301.0
google.golang.org/genproto	v0.0.0-20260504160031-60b97b32f348 -> v0.0.0-20261005182115-fad411399dd8
google.golang.org/genproto/googleapis/api	v0.0.0-20260803160001-6ac0973c030d -> v0.0.0-20261005182115-fad411399dd8
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260803160001-6ac0973c030d -> v0.0.0-20261005182115-fad411399dd8
google.golang.org/grpc	v1.83.2 -> v1.84.0
google.golang.org/protobuf	v1.36.11 -> v1.36.12