Skip to content

chore(deps): update all dependencies - #100

Open
renovate[bot] wants to merge 1 commit into
developfrom
renovate/all
Open

chore(deps): update all dependencies#100
renovate[bot] wants to merge 1 commit into
developfrom
renovate/all

Conversation

@renovate

@renovate renovate Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Confidence
act patch 0.2.89 → 0.2.95 age confidence
argocd minor 3.4.5 → 3.5.7 age confidence
argoproj/argo-workflows minor 4.0.8 → 4.1.6 age confidence
carvel-dev/vendir patch 0.46.0 → 0.46.3 age confidence
direnv minor 2.37.1 → 2.38.2 age confidence
errata-ai/vale minor 3.15.2 → 3.26.0 age confidence
github-cli minor 2.96.0 → 2.103.3 age confidence
go-task/task minor 3.52.0 → 3.54.0 age confidence
golang minor 1.26.5 → 1.27.3 age confidence
gopasspw/gopass minor 1.16.1 → 1.17.4 age confidence
hadolint minor 2.14.0 → 2.15.1 age confidence
helm minor 4.2.3 → 4.3.1 age confidence
hugo minor 0.164.0 → 0.169.0 age confidence
kind minor 0.32.0 → 0.33.0 age confidence
kubectl minor 1.36.3 → 1.37.2 age confidence
kustomize patch 5.8.1 → 5.8.3 age confidence
mkdocs-material (changelog) minor ==9.7.7 → ==9.8.0 age confidence
nolte/gh-plumbing major v1.1.26 → v2.2.0 age confidence
nolte/gh-plumbing workflow major v1.1.26 → v2.2.0 age confidence
packer patch 1.16.0 → 1.16.2 age confidence
pre-commit minor ==4.6.1 → ==4.7.0 age confidence
pymdown-extensions major ==11.0.1 → ==12.3 age confidence
python minor 3.14.6 → 3.15.2 age confidence
shfmt minor 3.13.1 → 3.14.1 age confidence
skaffold minor 2.24.0 → 2.25.0 age confidence
talhelper patch 3.1.15 → 3.1.17 age confidence
talosctl minor 1.13.7 → 1.14.5 age confidence
terraform minor 1.15.8 → 1.17.1 age confidence
twpayne/chezmoi minor 2.71.1 → 2.74.0 age confidence
yq minor 4.53.3 → 4.54.1 age confidence

Release Notes

nektos/act (act)

v0.2.95

Compare Source

Changelog

Bug fixes

v0.2.94

Compare Source

Changelog

Bug fixes
  • 3fde8e6 fix(runner): check docker context against the executor workspace
Other
  • ec4776c chore(runner): fix lint in action path containment

v0.2.93

Compare Source

Changelog

Bug fixes
  • 66cee43 fix(runner): keep local action paths and docker build contexts inside the workspace
  • cf5130c fix(git): keep brackets on IPv6 enterprise SSH hosts
  • cb08f14 fix(git): keep userinfo out of query/fragment and drop HTTPS port for GHE SSH
  • 3311ed9 fix(git): match GitHub remotes with ports and git:// URLs again
Other
  • 2b8b3d6 chore(testdata): drop vulnerable npm deps from fixture actions
  • c365046 test(git): silence secretlint on fake credential fixture

v0.2.92

Compare Source

Changelog

Bug fixes
  • 0dca768 fix(artifacts): quote rejected request fields in the debug log
  • 6646c2e fix(cmd): do not follow project file symlinks out of the workdir
  • a97c016 fix(git): anchor and escape hostnames in remote URL patterns
  • 703e9d4 fix(cmd): treat ./.actrc as untrusted project config
  • 0c0446b fix(runner): strip terminal control sequences from step output
  • 63b3922 fix(runner): refuse NODE_OPTIONS from GITHUB_ENV and set-env
  • 8fc492b fix(artifactcache): serve cache blobs through os.Root
  • 3d37545 fix(artifacts): contain storage, bound signed URLs, drop empty-key parsing
  • 53ab38f fix(container): restrict workflow container options and host volumes
  • 4105885 fix(runner): keep remote action paths inside the action repository
  • 8ec74ee fix(container): keep host-mode file writes inside the destination
  • 1dc092d fix: report module pseudo and dirty versions instead of the VERSION fallback
Documentation updates
  • b962e1e docs: add security audit findings and triage
  • 770ad71 docs: host the act logo and repair broken README images
  • 020ca09 docs: pin attestation verification to the release workflow and tag
  • d68ab16 docs: add security policy
Other
  • cba121f refactor(runner): split action reading and volume checks out of long functions
  • ec60045 ci: publish the release only after provenance is attested
  • fe5c98b ci: run the host-test skip message under bash on every OS
  • c5f5a42 ci: release by pushing only the tag
  • 37c5aa9 chore(deps): bump golang.org/x/net to v0.62.0
  • e1f4d7a ci: add Dependabot cooldown and Docker updates
  • 54bdd4e ci: pin Dockerfile base images by digest
  • 27f467a ci: verify Chocolatey build inputs
  • 2e7e440 ci: attest release provenance and pin GoReleaser
  • 8859a7e ci: drop unused write scopes from checks
  • d9255cf ci: scope workflow token permissions to jobs

v0.2.91

Compare Source

Changelog

Other
  • 7d8044a chore: bump VERSION to 0.2.91
  • d2f81f0 ci: point default-branch references at main
  • 8b2f210 ci: publish Winget and Chocolatey apart from GoReleaser

v0.2.90

Compare Source

Changelog

Bug fixes
  • 1f4b48f fix: close cache upload and container attach leaks
  • 2bfe1c1 fix(artifacts): make v4 URL signatures unambiguous and parse the workflow
  • b9d3535 fix(artifacts): harden the artifact server
  • eae8221 fix: overwrite read-only files when copying an action
  • 1ef687e fix: dispatch the gh-act tag run by id
  • b961a56 fix: exempt backlog issues from the stale workflow
  • 5d34ab3 fix: address triage review comments
  • a34fa0c fix: bump golang.org/x/crypto to v0.56.0 to fix SSH deadlock DoS advisories (supersedes v0.52.0) (#​6133)
Other
  • 58317c0 chore: bump VERSION to 0.2.90
  • 62994da ci: keep sharded test-linux and correct the golangci pin comment
  • b3534b0 ci: address review notes and scan with Go 1.26.10
  • c2bf3f4 ci: acknowledge intentional zizmor trigger exceptions
  • 9916e4f chore: remove local action cache captured during tests
  • eb59aa8 ci: harden workflows and move fixtures off EOL Debian
  • fcf3ffa test: clear ACT_TEST_LINUX_SHARD when asserting sharding is off
  • c060d21 ci: let Dockerfile suffixes use spaces
  • 79cd048 ci: keep the Actions artifact URL out of test-linux
  • 0dafad1 ci: expose Actions cache credentials and skip fixture builds off Linux
  • 617c662 ci: shard test-linux and cache fixture images
  • e1cd3ee build(deps): clear open Go Dependabot alerts
  • 0301b13 ci: tighten approval auto-merge permissions and concurrency
  • 3a74ece ci: resolve fork pull requests for approval auto-merge
  • 8536521 ci: tag gh-act from master so promote environment secrets are reachable
  • 9a46b94 ci: authenticate promote and gh-act tags with the release app
  • fe22388 ci: auto-merge after an approval from a writer
  • 2506039 ci: rerun Dependabot auto-merge when drafts are ready
  • b59d01a ci: replace Mergify with native GitHub automation
  • 64f3e1d chore: add CodeRabbit review configuration
  • f9563e8 chore: tighten issue and pull request triage
  • 29d3714 build(deps): bump github.com/moby/sys/user from 0.4.0 to 0.4.1 (#​6210)
  • fb52a49 chore: fast tests, no-op promote, and cheaper CI (#​6214)
argoproj/argo-cd (argocd)

v3.5.7

Compare Source

Quick Start

Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.7/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.7/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes
Documentation
Dependency updates
Other work

Full Changelog: argoproj/argo-cd@v3.5.6...v3.5.7

v3.5.6

Compare Source

Quick Start

Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.6/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.6/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes
Dependency updates
Other work

Full Changelog: argoproj/argo-cd@v3.5.5...v3.5.6

v3.5.5

Compare Source

Quick Start

Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.5/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.5/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes
Dependency updates

Full Changelog: argoproj/argo-cd@v3.5.4...v3.5.5

v3.5.4

Compare Source

Quick Start

Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.4/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.4/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Security fixes
  • CRITICAL: A Kustomize remote ref can run commands in the repo-server (GHSA-9v9p-x54c-58gc)
  • CRITICAL: A Kustomize Helm config home can run commands in the repo-server (GHSA-fw5c-w8rc-j7fx)
  • CRITICAL: A Jso

[!IMPORTANT]
✂ PR body was truncated to here.

@renovate renovate Bot added chore Maintenance dependencies Pull requests that update a dependency file. labels Jul 29, 2026
@renovate
renovate Bot force-pushed the renovate/all branch 5 times, most recently from 66a6f92 to 1e62653 Compare July 30, 2026 17:31
@renovate renovate Bot changed the title chore(deps): update dependency errata-ai/vale to v3.16.0 chore(deps): update all dependencies Jul 30, 2026
@renovate
renovate Bot force-pushed the renovate/all branch 14 times, most recently from ebef06f to 5284ca2 Compare August 2, 2026 10:59
@boring-cyborg boring-cyborg Bot added the cicd ci/cd process functionality. label Aug 2, 2026
@renovate
renovate Bot force-pushed the renovate/all branch 5 times, most recently from c1ecfc1 to b7d56ad Compare August 3, 2026 06:38
@renovate
renovate Bot force-pushed the renovate/all branch 29 times, most recently from 5cb3059 to ddad122 Compare August 10, 2026 11:09

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

chore Maintenance cicd ci/cd process functionality. dependencies Pull requests that update a dependency file. documentation Update documentation.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants