Repository navigation
chore(deps): update github-actions - #1041
Closed
renovate[bot] wants to merge 1 commit into
Closed
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/github-actions
branch
3 times, most recently
from
September 4, 2026 21:46
deea868 to
eddee7d
Compare
renovate
Bot
force-pushed
the
renovate/github-actions
branch
2 times, most recently
from
September 16, 2026 00:24
6e26ea4 to
5190996
Compare
renovate
Bot
force-pushed
the
renovate/github-actions
branch
2 times, most recently
from
September 18, 2026 21:36
b055888 to
df7ea87
Compare
renovate
Bot
force-pushed
the
renovate/github-actions
branch
from
September 24, 2026 18:59
df7ea87 to
ee7fce1
Compare
renovate
Bot
force-pushed
the
renovate/github-actions
branch
8 times, most recently
from
October 13, 2026 02:49
c737aaf to
61bccdf
Compare
renovate
Bot
force-pushed
the
renovate/github-actions
branch
3 times, most recently
from
October 15, 2026 14:06
3b29b58 to
3f544d2
Compare
renovate
Bot
force-pushed
the
renovate/github-actions
branch
3 times, most recently
from
October 22, 2026 21:34
385787a to
05f36b8
Compare
renovate
Bot
force-pushed
the
renovate/github-actions
branch
from
October 23, 2026 03:20
05f36b8 to
c016827
Compare
Collaborator
|
Superseded by #1049, which updates all dependencies at once. |
cpcloud
added a commit
that referenced
this pull request
Oct 23, 2026
## Summary - Brings every pinned dependency to its latest release in one PR and supersedes the nine open Renovate PRs (#1046, #1045, #1041, #1038, #1036, #1030, #1029, #1028, #1027). Merging those one at a time would mean nine rounds of `vendorHash` and lockfile conflicts. - **Go:** every module in `go.mod`, direct and indirect, is at its latest version. `mcp-go` stays on v1.3.0. v2.0.0 is on the Go proxy, but upstream tagged it by mistake, deleted the tag, and reverted the path change before releasing v1.3.0. - **Nix:** nixpkgs moves to the Oct 23 `nixos-unstable-small`. - **CI:** action SHAs match the tags in #1041. The inline osv-scanner, trufflehog, and goreleaser pins, which Renovate doesn't track, also move. - **Release tooling:** semantic-release 25.0.9, `@semantic-release/git` 11, and the `conventionalcommits` preset 9.3.1. Preset 10 is out, but it needs conventional-changelog-writer 9, and the stable release-notes-generator bundled with semantic-release still uses writer 8. With preset 10, every release fails at the notes step, so the preset stays on 9.x for now. - **Docs site:** Mermaid 12.2.0, set to the dagre layout and classic look. The two pages with diagrams render the same as on 11 (a pixel diff found under 0.01% changed). - Docker image digests were already current after #1047. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
v3.2.0→v3.3.0v5.0.0→v5.0.1v7.0.0→v7.1.0v31.11.0→31.11.3v4.38.3→v4.39.1v2.13.3→v2.19.0v7.2.3→v7.3.0v2.20.1→v2.22.2v2.1.0→v2.2.0Release Notes
actions/create-github-app-token
v3.3.0Compare Source
Features
Bug Fixes
actions/deploy-pages
v5.0.1Compare Source
Changelog
See details of all code changes since previous release.
actions/setup-node
v7.1.0Compare Source
What's Changed
Enhancements:
Bug fixes:
Documentation updates:
Dependency updates:
New Contributors
Full Changelog: actions/setup-node@v7.0.0...v7.1.0
cachix/install-nix-action
v31.11.3Compare Source
What's Changed
Security: Updates the bundled certificates shipped with the installer to remove the compromised eMudhra certificates.
Full Changelog: cachix/install-nix-action@v31.11.2...31.11.3
v31.11.2Compare Source
What's Changed
Security: Fixes a number of vulnerabilities that could be combined to achieve root priviledge escalation.
See https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
Full Changelog: cachix/install-nix-action@v31.11.1...v31.11.2
v31.11.1Compare Source
What's Changed
Fixes a crash (
Assertion '!awake.empty()' failed) that could abort builds.Full Changelog: cachix/install-nix-action@v31.11.0...v31.11.1
github/codeql-action
v4.39.1Compare Source
v4.39.0Compare Source
codeql-action/analyzestep now validates that a correct argument for thecheckout_pathinput has been provided. Thecheckout_pathinput must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used bycodeql-action/init, then the CodeQL Action now produces a warning. #4148codeql-action/start-proxystep that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic ascodeql-action/init. This primarily benefits customers who are using GitHub instances other thangithub.comwhere thecodeql-action/start-proxystep may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198goreleaser/goreleaser
v2.19.0Compare Source
Announcement
Read the official announcement: Announcing GoReleaser v2.19.
Changelog
New Features
35f2281: feat(archive): configure zstd compression level and window size (#7206) (@caarlos0)4ebadf5: feat(cask): add hooks install_steps, deprecate raw Ruby hooks (#6873) (@caarlos0)f1e16bf: feat(ko): support linux_capabilities (#7225) (@mrueg and @caarlos0)9926cef: feat(nix): drop the nix-hash dependency (#6824) (@caarlos0)6386def: feat: graduate stable features out of experimental (#7126) (@caarlos0)Security updates
6ade066: sec(deps): bump golang.org/x/ (#7201) (@caarlos0)b690fd8: sec: update to Go 1.27.3 (#7220) (@shaanmajid)Bug fixes
09301ea: fix(archive): propagate tar read errors in Copy (#7194) (@Lzcwbcgs)68e5e34: fix(cask): emit brew-valid casks when builds.ignore drops os/arch combos (#7218) (@Mihir-Rabari)e6c4afc: fix(deps): bump moby/sys/user to v0.4.1 (#7202) (@caarlos0)713c236: fix(docker): select baseline CPU variants for Docker v2 platforms (#7189) (@zachary-satterly and @caarlos0)26ffaba: fix(docker/v2): expand global ARG references when resolving the base image (#7203) (@LemonCondor and @caarlos0)1b7b6a4: fix(git): redact credentials from http remote URLs too (#7191) (@Mihir-Rabari)2d708ed: fix(ko): use actual ko version in SPDX SBOM creator (#7226) (@mrueg)2279d65: fix: share HTTP client per upload config (#6919) (#7212) (@manish-9245 and @caarlos0)0c3be49: fix: write cask completion stanzas in Homebrew's order (#7198) (@mustafaakcakaya)Documentation updates
d84a697: docs: fix broken cosign link in rust-zig blog post (#7228) (@jvS0uzx)Other work
ccaac66: chore: auto-update generated files (#7190) (@goreleaserbot)c96c314: chore: auto-update generated files (#7200) (@goreleaserbot)4a71e1e: chore: auto-update generated files (#7204) (@goreleaserbot)b58a061: chore: auto-update generated files (#7223) (@goreleaserbot)a9fb415: chore: auto-update generated files (#7230) (@goreleaserbot)Full Changelog: goreleaser/goreleaser@v2.18.3...v2.19.0
Helping out
This release is only possible thanks to all the support of some awesome people!
Want to be one of them?
You can sponsor, get a Pro License or contribute with code.
Where to go next?
v2.18.3Compare Source
Announcement
Read the official announcement: Announcing GoReleaser v2.18.
Changelog
Bug fixes
6f22aef: fix(announce): let webhook headers override the default headers (#7174) (@NitinKumar004)16edc75: fix(aur,aursources): reject duplicate package names (#7171) (@hktitof)d396fca: fix(brew,cask): sort dependencies case-insensitively (#7186) (@caarlos0)b091543: fix(ci): restore linux build (#7175) (@caarlos0)1942d44: fix(docker): preserve buildx metadata key in lint checks (#7187) (@caarlos0)1a1adec: fix(docs): point nightly links to the current nightly release (#7155) (@caarlos0)01e1d6f: fix(git): handle remote URLs with a trailing slash (#7170) (@00200200)ede6721: fix(github): explain upload redirects caused by a moved repository (#7179) (@MrBeldum)3205096: fix: dockers_v2 reports the image config digest (#7181) (@Zak4sad)Other work
048a586: chore: auto-update generated files (#7152) (@goreleaserbot)827aa03: chore: auto-update generated files (#7159) (@goreleaserbot)ff8de3d: chore: auto-update generated files (#7165) (@goreleaserbot)27ef66d: chore: auto-update generated files (#7166) (@goreleaserbot)a9d676f: chore: auto-update generated files (#7172) (@goreleaserbot)38962f0: chore: auto-update generated files (#7183) (@goreleaserbot)Full Changelog: goreleaser/goreleaser@v2.18.2...v2.18.3
Helping out
This release is only possible thanks to all the support of some awesome people!
Want to be one of them?
You can sponsor, get a Pro License or contribute with code.
Where to go next?
v2.18.2Compare Source
Announcement
Read the official announcement: Announcing GoReleaser v2.18.
Changelog
Security updates
8ec05d6: sec(builds): redact secrets from builder subprocess output (@caarlos0)Bug fixes
f285d13: fix(archive,sourcearchive,gio): backups, ZIP metadata, mtime and CPU variants (#7089) (@caarlos0)d4e9f25: fix(aur): several PKGBUILD and SRCINFO generation bugs (#7100) (@caarlos0)b428c4c: fix(aur): tell users how to fix a duplicate architecture (#7141) (@caarlos0)2e991d2: fix(blob): KMS encryption limits and bucket lifetime on error (#7101) (@caarlos0)7ba40dc: fix(blob): stream unencrypted uploads instead of buffering files (#7134) (@raviayadav and @caarlos0)924f5eb: fix(brew,cask): formula escaping, token matching and binary stanzas (#7086) (@caarlos0)7c77e11: fix(build): resolve dependent hook environment entries and hook dir templates (#7078) (@caarlos0)d22c274: fix(builder/go): give a single ellipsis main an exact output path (#7114) (@caarlos0)be63647: fix(builder/go): keep override env entries in a stable order (#7112) (@caarlos0)4a635ab: fix(builder/go): register the generated C header after compiling (#7113) (@caarlos0)34619ef: fix(builder/node,builder/bun): per-target SEA config, prebuild templates and target aliases (#7088) (@caarlos0)c87158e: fix(builder/rust,builder/zig): toolchain context and wrapped binary copying (#7080) (@caarlos0)566bc69: fix(builder/uv,builder/poetry): match built artifact filenames (#7084) (@caarlos0)13ebd4d: fix(builders,partial): canonical artifact architectures and target matching (#7083) (@caarlos0)e1d9f7f: fix(cmd): auto-snapshot ordering, schema error reporting and --output selection (#7103) (@caarlos0)591a0b8: fix(cmd): correct check counting and init gitignore and failure handling (#7081) (@caarlos0)4f4febf: fix(docker): a bare platform means the baseline CPU variant (#7148) (@caarlos0)000ae78: fix(docker): keep arm64 minor variants above the v8 baseline (#7149) (@caarlos0)d2f775e: fix(docker): quote entrypoint paths and forward arguments verbatim (#7073) (@caarlos0)f2b3611: fix(docker): v1 wheel build IDs, push flags and empty manifests (#7077) (@caarlos0)ea7bc7a: fix(docker): v2 build context, annotations and ARM64 handling (#7095) (@caarlos0)a1f860f: fix(env,log): redact secrets across writes and honour force_token (#7104) (@caarlos0)0d4fe16: fix(exec,publish): cancellation, empty commands, SRPM artifacts and upload URLs (#7093) (@caarlos0)eba5886: fix(flatpak,docker): quote install paths and respect project environment (#7085) (@caarlos0)a95c9a0: fix(git): force column.ui=never so tag output is not columnized (#7127) (@KR-Ravindra)2d7ecb2: fix(git): tag not in the local repository is not an error (#7124) (@caarlos0)aebed26: fix(git,changelog): metadata quoting, dirty detection, key cleanup and mailmap (#7102) (@caarlos0)dce409c: fix(gitea,gitlab): pagination, subpath URLs, default branch, links and cancellation (#7097) (@caarlos0)0348bfb: fix(github): UTF-8 safe truncation, draft reuse, asset replacement and token override (#7094) (@caarlos0)0087e68: fix(github): honor short Retry-After delays (#7110) (@0jaspahwa)f45f629: fix(gomod): scope proxying to Go builds and validate the right module (#7096) (@caarlos0)cf292ef: fix(healthcheck): handle blank and space-containing signer commands (#7076) (@caarlos0)edd3fd0: fix(healthcheck): panic on dependency commands that are only shell syntax (#7106) (@caarlos0)43c0c94: fix(ko): repository image names, digest ordering and signing references (#7079) (@caarlos0)6ceb354: fix(mcp): support package transport URLs (#7090) (@caarlos0)acbfcf5: fix(nfpm): per-format Lintian overrides and colliding filenames (#7099) (@caarlos0)752baca: fix(nix): formatter output, string escaping and post_install (#7082) (@caarlos0)05ee35f: fix(nix): template the description only once (#7146) (@caarlos0)a3a8903: fix(project): evaluate name candidates lazily (#7111) (@0jaspahwa)25a52e5: fix(sbom,sign): disambiguate every target variant in default names (#7144) (@caarlos0)c62e59f: fix(scripts): correct pre-commit hook exit status, quoting and restaging (#7074) (@caarlos0)e0418e8: fix(sign,sbom,universalbinary): universal binary signing, per-variant names and duplicate slices (#7091) (@caarlos0)06bf150: fix(slack,smtp,config): cancellation, message escaping and block round-trips (#7092) (@caarlos0)cb8a445: fix(tmpl): deduplicate aggregate errors and stop mutating input (#7075) (@caarlos0)e99a557: fix(winget): do not allow multiple wingets with the same name (#7147) (@caarlos0)52e4c58: fix(winget,krew): manifest validation and executable paths (#7087) (@caarlos0)b15ccce: fix: address regressions since v2.18.1 (#7107) (@caarlos0)ac548c1: refactor: simplify internal code and test setup (#7068) (@caarlos0)Documentation updates
385916d: docs(builder/go): explain that ellipsis discovery uses the host context (#7115) (@caarlos0)e6d5fc5: docs: Add Kronk in USERS.md (#7151) (@gandarez)4faacf5: docs: fix configuration examples and reference mismatches (#7066) (@caarlos0)Other work
7d055fd: chore: auto-update generated files (#7070) (@goreleaserbot)7748fa7: chore: auto-update generated files (#7123) (@goreleaserbot)2ab3100: chore: auto-update generated files (#7129) (@goreleaserbot)46d055b: chore: cc maintainer on winget pull requests (#7071) (@caarlos0)c3afaa0: chore: fix lint on main (#7105) (@caarlos0)7c44449: chore: lint fixes (@caarlos0)Full Changelog: goreleaser/goreleaser@v2.18.1...v2.18.2
Helping out
This release is only possible thanks to all the support of some awesome people!
Want to be one of them?
You can sponsor, get a Pro License or contribute with code.
Where to go next?
v2.18.1Compare Source
Announcement
Read the official announcement: Announcing GoReleaser v2.18.
Changelog
Security updates
628c889: sec(deps): bump golang.org/x/crypto and golang.org/x/mod (#6872) (@caarlos0)Bug fixes
e38e2fd: fix(archive): report stripped binary paths (#6820) (@davicbtoliveira)315a4fd: fix(aursources): clarify error and document source.enabled requirement (#6816) (@0jaspahwa)b7f1239: fix(cask): deprecate url.verified (#6871) (@caarlos0)2c613de: fix(chocolatey): a skipped chocolatey entry stops the ones after it (#6853) (@hktitof)33cc363: fix(client): apply the commit config per command (#6852) (@caarlos0)db7a1e6: fix(client): stop TestGitLabRateLimitRetryAfter racing the clock (#6846) (@caarlos0)c8126af: fix(cmd): drop setup's unused return value (#6845) (@caarlos0)d951018: fix(docker): only use wheels of the configured ids (#6860) (@caarlos0)0a6f83e: fix(git): report repository detection errors (#6869) (@caarlos0)edcfdec: fix(gitlab): own the retries, and honor replace_existing_artifacts (#6843) (@caarlos0)f5edd73: fix(gomod): don't read the module path from stderr (#6864) (@caarlos0)35051e4: fix(sign): warn when the signer writes no file, fail in v3 (#6842) (@caarlos0)e1a1e9c: fix: map every 32-bit ARM variant to Termux's "arm" (#6857) (@dylanpulver)Documentation updates
e5730eb: docs: fix broken commands, dead links, and inaccurate options (#6841) (@caarlos0)Other work
8afe0bb: chore: auto-update generated files (#6811) (@goreleaserbot)c1493d3: chore: auto-update generated files (#6812) (@goreleaserbot)3294442: chore: auto-update generated files (#6861) (@goreleaserbot)6e40871: chore: update to Go 1.27.1 (#6859) (@caarlos0)4181c4f: perf(git): ask git once (#6850) (@caarlos0)dcbe117: perf(node): faster dist extraction, and stop leaking it into TMPDIR (#6844) (@caarlos0)36e43dd: perf: skip needless docker probes; make the ko registry test hermetic (#6827) (@caarlos0)Full Changelog: goreleaser/goreleaser@v2.18.0...v2.18.1
Helping out
This release is only possible thanks to all the support of some awesome people!
Want to be one of them?
You can sponsor, get a Pro License or contribute with code.
Where to go next?
v2.18.0Compare Source
Announcement
Read the official announcement: Announcing GoReleaser v2.18.
Changelog
New Features
601cd87: feat(ko): support templating for local_domain, base_image, and repositories (#6741) (@mrueg)de88f38: feat(winget): support publishing additional locale manifests (#6733) (@MohammedAnasuddinZaid)cefbc6f: feat: add iru custom apps publisher (#6709) (@wimwenigerkind)1d6e7c0: feat: allow PR creation to use a different auth token (#6717) (@emily-curry)4c41ac0: feat: preflight checks (#6704) (@caarlos0)060260a: feat: release summary (#6810) (@caarlos0)82a5aba: feat: update to Go 1.27 ([#6802](hConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.