Skip to content

chore(deps): update all non-major dependencies #206

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
chgl merged 2 commits into from
Dec 13, 2025
Merged

chore(deps): update all non-major dependencies #206

chgl merged 2 commits into from
Dec 13, 2025

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Oct 27, 2025 •
edited
Loading

This PR contains the following updates:

Package Type Update Change Age Confidence
actions/create-github-app-token action minor v2.1.4 -> v2.2.1 age confidence
actions/dependency-review-action action patch v4.8.1 -> v4.8.2 age confidence
actions/setup-dotnet action patch v5.0.0 -> v5.0.1 age confidence
actions/setup-java action minor v5.0.0 -> v5.1.0 age confidence
actions/setup-node action minor v6.0.0 -> v6.1.0 age confidence
aquasecurity/trivy minor 0.67.2 -> 0.68.1 age confidence
astral-sh/setup-uv action patch v7.1.1 -> v7.1.6 age confidence
docker.io/library/python final patch 3.14.0-slim -> 3.14.2-slim age confidence
docker/metadata-action action minor v5.8.0 -> v5.10.0 age confidence
docker/setup-qemu-action action minor v3.6.0 -> v3.7.0 age confidence
github/codeql-action action minor v4.30.9 -> v4.31.8 age confidence
oxsecurity/megalinter action minor v9.1.0 -> v9.2.0 age confidence
softprops/action-gh-release action minor v2.4.1 -> v2.5.0 age confidence
step-security/harden-runner action minor v2.13.1 -> v2.14.0 age confidence
zizmor (source) minor 1.15.2 -> 1.18.0 age confidence

Release Notes

actions/create-github-app-token (actions/create-github-app-token)

v2.2.1

Compare Source

Bug Fixes
  • deps: bump the production-dependencies group with 2 updates (#​311) (b212e6a)

v2.2.0

Compare Source

Bug Fixes
Features
actions/dependency-review-action (actions/dependency-review-action)

v4.8.2

Compare Source

Minor fixes:

actions/setup-dotnet (actions/setup-dotnet)

v5.0.1

Compare Source

What's Changed

Full Changelog: actions/setup-dotnet@v5...v5.0.1

actions/setup-java (actions/setup-java)

v5.1.0

Compare Source

What's Changed
New Features
Bug Fixes & Improvements
Documentation changes
Dependency updates
New Contributors

Full Changelog: actions/setup-java@v5...v5.1.0

actions/setup-node (actions/setup-node)

v6.1.0

Compare Source

What's Changed

Enhancement:
Dependency updates:
Documentation update:

Full Changelog: actions/setup-node@v6...v6.1.0

aquasecurity/trivy (aquasecurity/trivy)

v0.68.1

Compare Source

👉 Trivy v0.68.1 release notes (click here)

[!NOTE]
v0.68.0 was skipped due to issues with the release.

⬇️ Download Trivy

🐳 Docker Install

  • docker pull get.trivy.dev/image/trivy:0.68.1

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0680-2025-12-02

astral-sh/setup-uv (astral-sh/setup-uv)

v7.1.6

Compare Source

v7.1.5: 🌈 allow setting cache-local-path without enable-cache: true

Compare Source

Changes

#​612 fixed a faulty behavior where this action set UV_CACHE_DIR even though enable-cache was false. It also fixed the cases were the cache dir is already configured in a settings file like pyproject.toml or UV_CACHE_DIR was already set. Here the action shouldn't overwrite or set UV_CACHE_DIR.

These fixes introduced an unwanted behavior: You can still set cache-local-path but this action didn't do anything. This release fixes that.

You can now use cache-local-path to automatically set UV_CACHE_DIR even when enable-cache is false (or gets set to false by default e.g. on self-hosted runners)

- name: This is now possible
  uses: astral-sh/setup-uv@v7
  with:
    enable-cache: false
    cache-local-path: "/path/to/cache"
🐛 Bug fixes
🧰 Maintenance
⬆️ Dependency updates

v7.1.4: 🌈 Fix libuv closing bug on Windows

Compare Source

Changes

This release fixes the bug Assertion failed: !(handle->flags & UV_HANDLE_CLOSING) on Windows runners

🐛 Bug fixes
🧰 Maintenance

v7.1.3: 🌈 Support act

Compare Source

Changes

This bug fix release adds support for https://github.com/nektos/act
It was previously broken because of a too new undici version and TS transpilation target.

Compatibility with act is now automatically tested.

🐛 Bug fixes
🧰 Maintenance
📚 Documentation

v7.1.2: 🌈 Speed up extraction on Windows

Compare Source

Changes

@​lazka fixed a bug that caused extracting uv to take up to 30s. Thank you!

🐛 Bug fixes

🧰 Maintenance

⬆️ Dependency updates

docker/metadata-action (docker/metadata-action)

v5.10.0

Compare Source

Full Changelog: docker/metadata-action@v5.9.0...v5.10.0

v5.9.0

Compare Source

Full Changelog: docker/metadata-action@v5.8.0...v5.9.0

docker/setup-qemu-action (docker/setup-qemu-action)

v3.7.0

Compare Source

Full Changelog: docker/setup-qemu-action@v3.6.0...v3.7.0

github/codeql-action (github/codeql-action)

v4.31.8

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.8 - 11 Dec 2025
  • Update default CodeQL bundle version to 2.23.8. #​3354

See the full CHANGELOG.md for more information.

v4.31.7

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.7 - 05 Dec 2025
  • Update default CodeQL bundle version to 2.23.7. #​3343

See the full CHANGELOG.md for more information.

v4.31.6

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.6 - 01 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.31.5

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.5 - 24 Nov 2025
  • Update default CodeQL bundle version to 2.23.6. #​3321

See the full CHANGELOG.md for more information.

v4.31.4

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.4 - 18 Nov 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.31.3

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.3 - 13 Nov 2025
  • CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see Upcoming deprecation of CodeQL Action v3.
  • Update default CodeQL bundle version to 2.23.5. #​3288

See the full CHANGELOG.md for more information.

v4.31.2

Compare Source

v4.31.1

Compare Source

v4.31.0

Compare Source

oxsecurity/megalinter (oxsecurity/megalinter)

v9.2.0

Compare Source

softprops/action-gh-release (softprops/action-gh-release)

v2.5.0

Compare Source

What's Changed

Exciting New Features 🎉
Other Changes 🔄
  • chore(deps): bump the npm group across 1 directory with 5 updates by @​dependabot[bot] in #​697
  • chore(deps): bump actions/checkout from 5.0.0 to 5.0.1 in the github-actions group by @​dependabot[bot] in #​689

New Contributors

Full Changelog: softprops/action-gh-release@v2.4.2...v2.5.0

v2.4.2

Compare Source

What's Changed

Exciting New Features 🎉
  • feat: Ensure generated release notes cannot be over 125000 characters by @​BeryJu in #​684
Other Changes 🔄
  • dependency updates

New Contributors

Full Changelog: softprops/action-gh-release@v2.4.1...v2.4.2

step-security/harden-runner (step-security/harden-runner)

v2.14.0

Compare Source

What's Changed
  • Selective installation: Harden-Runner now skips installation on GitHub-hosted runners when the repository has a custom property skip_harden_runner, allowing organizations to opt out specific repos.
  • Avoid double install: The action no longer installs Harden-Runner if it’s already present on a GitHub-hosted runner, which could happen when a composite action also installs it.

Full Changelog: step-security/harden-runner@v2.13.3...v2.14.0

v2.13.3

Compare Source

What's Changed
  • Fixed an issue where process events were not uploaded in certain edge cases.

Full Changelog: step-security/harden-runner@v2.13.2...v2.13.3

v2.13.2

Compare Source

What's Changed
  • Fixed an issue where there was a limit of 512 allowed endpoints when using block egress policy. This restriction has been removed, allowing for an unlimited number of endpoints to be configured.
  • Harden Runner now automatically detects if the agent is already pre-installed on a custom VM image used by a GitHub-hosted runner. When detected, the action will skip reinstallation and use the existing agent.

Full Changelog: step-security/harden-runner@v2.13.1...v2.13.2

zizmorcore/zizmor (zizmor)

v1.18.0

Compare Source

Enhancements 🌱🔗
Bug Fixes 🐛🔗
  • Fixed additional edge cases where auto-fixed would fail to preserve a document's final newline (#​1372)

v1.17.0

Compare Source

Enhancements 🌱🔗

  • zizmor now produces a more useful error message when asked to collect only workflows from a remote input that contains no workflows (#​1324)

  • zizmor now produces more precise severities on actions/checkout versions that have more misuse-resistant credentials persistence behavior (#​1353)

    Many thanks to @​ManuelLerchnerQC for proposing and implementing this improvement!

  • The use-trusted-publishing audit now correctly detecting more "dry-run" patterns, making it significantly more accurate (#​1357)

  • The obfuscation audit now detects usages of shell: cmd and similar, as the Windows CMD shell lacks a formal grammar and limits analysis of run: blocks in other audits (#​1361)

Performance Improvements 🚄🔗

  • zizmor's core has been refactored to be asynchronous, making online and I/O-heavy audits significantly faster. Typical user workloads should see speedups of 40% to 70% (#​1314)

Bug Fixes 🐛🔗

  • Fixed a bug where auto-fixes would fail to preserve a document's final newline (#​1323)

  • zizmor now uses the native (OS) TLS roots when performing HTTPS requests, improving compatibility with user environments that perform TLS interception (#​1328)

  • The github-env audit now falls back to assuming bash-like shell syntax in run: blocks if it can't infer the shell being used (#​1336)

  • The concurrency-limits audit now correctly detects job-level concurrency settings, in addition to workflow-level settings (#​1338)

  • Fixed a bug where zizmor would fail to collect workflows with names that overlapped with other input types (e.g. action.yml and dependabot.yml) when passed explicitly by path (#​1345)

v1.16.3

Compare Source

Bug Fixes 🐛🔗

  • Fixed a bug where zizmor would crash on an unexpected caching middleware state. zizmor will now exit with a controlled error instead (#​1319)

v1.16.2

Compare Source

Enhancements 🌱🔗

  • The concurrency-limits audit no longer flags explicit user concurrency overrides, e.g. cancel-in-progress: false (#​1302)
  • zizmor now detects CI environments and specializes its panic handling accordingly, improving the quality of panic reports when running in CI (#​1307)

Bug Fixes 🐛🔗

  • Fixed a bug where zizmor would reject some Dependabot configuration files with logically unsound schedules (but that are accepted by GitHub regardless) (#​1308)

v1.16.1

Compare Source

Enhancements 🌱🔗

  • zizmor now produces a more useful error message when asked to indirectly access a nonexistent or private repository via a uses: clause (without a sufficiently privileged GitHub token) (#​1293)

v1.16.0

Compare Source

New Features 🌈🔗

Performance Improvements 🚄🔗

  • zizmor's online mode is now significantly (40% to over 95%) faster on common workloads, thanks to a combination of caching improvements and conversion of GitHub API requests into Git remote lookups (#​1257)

    Many thanks to @​Bo98 for implementing these improvements!

Enhancements 🌱🔗

  • When running in --fix mode and all fixes are successfully applied, zizmor now has similar exit code behavior as the --no-exit-codes and --format=sarif flags (#​1242)

    Many thanks to @​cnaples79 for implementing this improvement!

  • The dependabot-cooldown audit now supports auto-fixes for many findings (#​1229)

    Many thanks to @​mostafa for implementing this improvement!

  • The dependabot-execution audit now supports auto-fixes for many findings (#​1229)

    Many thanks to @​mostafa for implementing this improvement!

  • zizmor now has limited, experimental support for handling inputs that contain YAML anchors (#​1266)

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions
Copy link
Contributor

github-actions bot commented Oct 27, 2025 •
edited
Loading

✅MegaLinter analysis: Success

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ ACTION actionlint 4 0 0 0.14s
✅ COPYPASTE jscpd yes no no 1.36s
✅ DOCKERFILE hadolint 1 0 0 0.13s
✅ JSON jsonlint 3 0 0 0.17s
✅ JSON prettier 3 0 0 0.51s
✅ JSON v8r 3 0 0 3.58s
✅ MARKDOWN markdownlint 1 0 0 0.52s
✅ MARKDOWN markdown-table-formatter 1 0 0 0.24s
✅ PYTHON bandit 1 0 0 1.83s
✅ PYTHON black 1 0 0 1.08s
✅ PYTHON flake8 1 0 0 0.57s
✅ PYTHON isort 1 0 0 0.23s
✅ PYTHON mypy 1 0 0 3.41s
✅ PYTHON pylint 1 0 0 3.31s
✅ PYTHON pyright 1 0 0 1.83s
✅ PYTHON ruff 1 0 0 0.05s
✅ REPOSITORY checkov yes no no 24.5s
✅ REPOSITORY dustilock yes no no 0.02s
✅ REPOSITORY gitleaks yes no no 0.94s
✅ REPOSITORY git_diff yes no no 0.01s
✅ REPOSITORY grype yes no no 37.09s
✅ REPOSITORY kics yes no no 3.97s
✅ REPOSITORY secretlint yes no no 1.61s
✅ REPOSITORY syft yes no no 2.92s
✅ REPOSITORY trivy yes no no 8.79s
✅ REPOSITORY trivy-sbom yes no no 0.16s
✅ REPOSITORY trufflehog yes no no 4.68s
✅ YAML prettier 6 0 0 0.85s
✅ YAML v8r 6 0 0 7.11s
✅ YAML yamllint 6 0 0 0.65s

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx [email protected] --custom-flavor-setup --custom-flavor-linters PYTHON_PYLINT,PYTHON_BLACK,PYTHON_FLAKE8,PYTHON_ISORT,PYTHON_BANDIT,PYTHON_MYPY,PYTHON_PYRIGHT,PYTHON_RUFF,ACTION_ACTIONLINT,COPYPASTE_JSCPD,DOCKERFILE_HADOLINT,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_DUSTILOCK,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_KICS,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is graciously provided by OX Security

@renovate renovate bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 39e4f16 to 1e70166 Compare November 2, 2025 01:57
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from a8953c8 to aa76830 Compare November 11, 2025 00:13
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 9a1511a to df55ff7 Compare November 19, 2025 00:52
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from 571809d to 9d45ca8 Compare November 27, 2025 13:10
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 77486a4 to 16e27ea Compare November 29, 2025 23:54
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 10 times, most recently from c3135ec to 72a063c Compare December 7, 2025 21:57
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from 23c6a05 to 934dc3a Compare December 13, 2025 21:00
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from 934dc3a to 1d09661 Compare December 13, 2025 21:02
@renovate
Copy link
Contributor Author

renovate bot commented Dec 13, 2025

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@github-actions
Copy link
Contributor

github-actions bot commented Dec 13, 2025

Trivy image scan report

ghcr.io/chgl/github-reusable-workflow-with-fixed-image-tags:v1.2.3-beta.123 (debian 13.2)

No Vulnerabilities found

No Misconfigurations found

Python

No Vulnerabilities found

No Misconfigurations found

@github-actions
Copy link
Contributor

github-actions bot commented Dec 13, 2025

Trivy image scan report

ghcr.io/chgl/github-reusable-workflow:pr-206 (debian 13.2)

No Vulnerabilities found

No Misconfigurations found

Python

No Vulnerabilities found

No Misconfigurations found

@github-actions
Copy link
Contributor

github-actions bot commented Dec 13, 2025

Trivy image scan report

ghcr.io/chgl/github-reusable-workflow-without-test-image:pr-206 (debian 13.2)

No Vulnerabilities found

No Misconfigurations found

Python

No Vulnerabilities found

No Misconfigurations found

@chgl chgl merged commit 7ab607b into master Dec 13, 2025
40 checks passed
@github-actions
Copy link
Contributor

github-actions bot commented Dec 13, 2025

🎉 This PR is included in version 1.11.10 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes

@renovate-approve-2 renovate-approve-2[bot] renovate-approve-2[bot] approved these changes

Assignees

No one assigned

Labels

released

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@chgl