chore(deps): update all non-major dependencies#237
Merged
renovate[bot] merged 1 commit intomasterfrom Apr 13, 2026
Merged
Conversation
![renovate-approve-2[bot]](https://avatars.githubusercontent.com/in/62175?s=60&v=4){kind=small}
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
Contributor
✅MegaLinter analysis: Success
See detailed reports in MegaLinter artifacts Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining
|
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
b006e12 to
7dbb446
Compare
Contributor
Trivy image scan report
|
Contributor
Trivy image scan report
|
Contributor
Trivy image scan report
|
Contributor
|
🎉 This PR is included in version 1.11.25 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v3.0.0→v3.1.1v7.0.0→v7.0.13.14.3-slim→3.14.4-slimv7.0.0→v7.1.0v3.0.3→v3.0.4v2.6.1→v2.6.2v2.16.1→v2.17.01.23.1→1.24.0Release Notes
actions/create-github-app-token (actions/create-github-app-token)
v3.1.1Compare Source
Bug Fixes
v3.1.0Compare Source
Bug Fixes
Features
client-idinput and deprecateapp-id(#353) (e6bd4e6)actions/upload-artifact (actions/upload-artifact)
v7.0.1Compare Source
docker/build-push-action (docker/build-push-action)
v7.1.0Compare Source
Full Changelog: docker/build-push-action@v7.0.0...v7.1.0
marocchino/sticky-pull-request-comment (marocchino/sticky-pull-request-comment)
v3.0.4Compare Source
What's Changed
Full Changelog: marocchino/sticky-pull-request-comment@v3.0.3...v3.0.4
softprops/action-gh-release (softprops/action-gh-release)
v2.6.2Compare Source
What's Changed
Other Changes 🔄
Full Changelog: softprops/action-gh-release@v2...v2.6.2
step-security/harden-runner (step-security/harden-runner)
v2.17.0Compare Source
What's Changed
Policy Store Support
Added
use-policy-storeandapi-keyinputs to fetch security policies directly from the StepSecurity Policy Store. Policies can be defined and attached at the workflow, repo, org, or cluster (ARC) level, with the most granular policy taking precedence. This is the preferred method over the existingpolicyinput which requiresid-token: writepermission. If no policy is found in the store, the action defaults to audit mode.Full Changelog: step-security/harden-runner@v2.16.1...v2.17.0
zizmorcore/zizmor (zizmor)
v1.24.0Compare Source
New Features 🌈🔗
Enhancements 🌱🔗
The use-trusted-publishing audit now detects bun publish and bunx npm publish patterns (#1737)
Many thanks to @shaanmajid for proposing and implementing this improvement!
zizmor's CLI help and usage output now uses a custom color scheme for improved readability (#1747)
The secrets-outside-env audit is now configurable with an allowlist of secret names that should not be flagged, even when referenced outside of an environment (#1759)
Many thanks to @rmuir for proposing and implementing this improvement!
The dependabot-cooldown audit now emits a pedantic finding whenever it encounters a cooldown used with a multi-ecosystem-group, as the two do not interact well (#1780)
Recommend gh release upload as a replacement for svenstaro/upload-release-action in superfluous-actions (#1801)
Recommend gh issue create as a replacement for dacbd/create-issue-action in superfluous-actions (#1873)
The obfuscation audit now emits a finding for with: ${{ expr }} clauses cannot be analyzed (#1772)
zizmor --help is now rendered with option groups for improved readability (#1831)
Many thanks to @deckstose for implementing this improvement!
zizmor's SARIF output now uses codeflows instead of related locations, improving its rendering behavior on GitHub Advanced Security (#1843)
The ref-version-mismatch audit now uses a more useful audit description for its findings (#1843)
The unpinned-images audit now produces more precise findings for image references that are computed through expressions (#1756)
Many thanks to @miketheman for implementing this improvement!
The ref-version-mismatch audit now detects missing version comments as well (#1849)
Many thanks to @shaanmajid for proposing and implementing this improvement!
Bug Fixes 🐛🔗
Fixed a bug where the concurrency-limits audit reported findings at the job level instead of the workflow level (#1627)
Fixed a bug where with: ${{ expr }} clauses would cause a crash. artipacked audit emits a pedantic finding on such clauses. (#1772)
Fixed a bug where auto-fixes for the template-injection audit would fail to preserve an environment variable's casing (#1766)
Fixed a bug where the secrets-outside-env audit would incorrectly flag reusable workflows (#1777)
Fixed a bug where expressions containing Infinity or NaN would fail to parse (#1778)
Fixed several bugs where some parenthetical forms in expressions would fail to parse (#1779, #1856)
Fixed a bug where expressions with invalid identifiers (such as -Inf) would be incorrectly accepted (#1794)
Fixed a bug where the known-vulnerable-actions audit would fail to handle multiple discrete packages in a single advisory (#1810)
Fixed a bug where the template-injection audit would incorrectly flag needs.*.result as an injection risk in the default persona (#1814)
Fixed a bug where the unpinned-uses audit would product incorrect auto-fixes for actions with subpaths (#1841)
Fixed a bug where the ref-version-mismatch audit would fail to produce findings for comments containing nonexistent refs (#1853)
Fixed a bug where expressions containing NaN would be constant-evaluated incorrectly (#1858)
Fixed a bug where nix would not be recognized as a package-ecosystem in dependabot.yml (#1867)
Fixed a bug where the ref-version-mismatch audit would incorrectly parse prerelease version comments (such as # v6-beta), causing some findings to appear unresolvable (#1870)
Fixed a bug where various string comparisons in expressions did not perfectly match GitHub's own special uppercasing semantics (#1879)
Fixed a bug where zizmor would incorrectly contact github.com instead of the user's requested --gh-hostname for some online requests (#1874)
Fixed a bug where the artipacked audit would fail to honor the --no-online-audits flag (#1874)
Changes⚠️ 🔗
The secrets-outside-env audit now only flags findings with the 'auditor' persona, due to numerous false positives and negatives caused by GitHub's platform limitations (primarily around interactions between environment secrets and reusable workflows) (#1777)
zizmor's handling of GitHub Actions expressions has been made stricter, and now rejects unknown functions and function calls with incorrect arities (#1823, #1826)
The superfluous-actions audit now uses the "pedantic" persona for some findings along with a medium or low confidence marker to signal when a action may not be easily replaced with built-in functionality (#1822, #1859)
The unpinned-uses audit no longer suggests auto-fixes for Git references that don't look like version tags, such as main (#1860)
The template-injection audit now considers more "URL-shaped" contexts to be fully attacker-controllable, rather than partially controllable (#1868)
Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.