Repository navigation
chore(deps): update github-actions - #161
Conversation
|
33 lines added across 7 files — none are instrumentable. |
3a5866f to
62ccc41
Compare
micschr0-renovate
Bot
changed the title
450a94c to
d59369f
Compare
0d613a2 to
4cda838
Compare
4cda838 to
87a4d78
Compare
87a4d78 to
8b6afc7
Compare
|
Reviewed the diff and upstream tag mappings (including peeled rust-cache tags); Semgrep 1.182.0 OCI digest matches Docker Hub. Current-head Rust, Security and Release-plan CI all pass. Main merged into this branch without rewriting history. Do not merge yet: owner explicitly requested waiting for Renovate minimum-release-age clearance; the earlier head has a pending renovate/stability-days status, and a new merge commit no longer displays that status. Do not treat its disappearance as clearance. |
|
Owner explicitly approved proceeding with merge despite the previously pending minimum-release-age status ("ok dann gebe ich es jetzt frei"). Rechecked current head: all actual CI checks passed, no required GitHub checks/review approvals configured. Merged as b29c6ac without changing repository settings or age policy. |
This PR contains the following updates:
v2.9.2→v2.9.3bcd2ba4→64ab7293e5f45b→9000827v7.0.0→v7.1.0043fb46→cf430e0v46.3.6→v46.3.91.178.0→1.182.01.182.1v2.21.1→v2.22.2v2.87.22→v2.87.29v2.87.31(+1)v0.6.4→v0.7.1v0.8.0Release Notes
Swatinem/rust-cache
v2.9.3Compare Source
What's Changed
New Contributors
Full Changelog: Swatinem/rust-cache@v2.9.2...v2.9.3
actions/setup-node
v7.1.0Compare Source
What's Changed
Enhancements:
Bug fixes:
Documentation updates:
Dependency updates:
New Contributors
Full Changelog: actions/setup-node@v7.0.0...v7.1.0
renovatebot/github-action
v46.3.9Compare Source
Documentation
Miscellaneous Chores
Build System
Continuous Integration
v46.3.8Compare Source
Documentation
Miscellaneous Chores
Build System
Continuous Integration
v46.3.7Compare Source
Documentation
Miscellaneous Chores
Build System
Continuous Integration
step-security/harden-runner
v2.22.2Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.22.1...v2.22.2
v2.22.1Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.22.0...v2.22.1
v2.22.0Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0
taiki-e/install-action
v2.87.29: 2.87.29Compare Source
Update
zizmor@latestto 1.31.0.Update
wasmtime@latestto 49.0.3.Update
wasm-tools@latestto 1.262.0.Update
uv@latestto 0.13.1.Update
trivy@latestto 0.76.0.Update
tombi@latestto 1.8.4.Update
release-plz@latestto 0.3.172.Update
osv-scanner@latestto 2.7.0.Update
mise@latestto 2026.10.11.Update
mdbook-d2@latestto 0.3.9.Update
kingfisher@latestto 2.13.0.Update
kache@latestto 1.2.1.Update
just@latestto 1.59.0.Update
dprint@latestto 0.63.0.Update
cargo-crap@latestto 0.8.0.Update
bpf-linker@latestto 0.12.0.v2.87.28: 2.87.28Compare Source
Update
dprint@latestto 0.62.0.Update
vacuum@latestto 0.33.0.Update
uv@latestto 0.13.0.Update
tombi@latestto 1.8.1.Update
release-plz@latestto 0.3.171.Update
rclone@latestto 1.75.2.Update
mise@latestto 2026.10.7.Update
cargo-binstall@latestto 1.25.3.v2.87.27: 2.87.27Compare Source
Update
vacuum@latestto 0.32.0.Update
uv@latestto 0.12.24.Update
typos@latestto 1.51.1.Update
tombi@latestto 1.7.3.Update
syft@latestto 1.54.1.Update
release-plz@latestto 0.3.170.Update
mise@latestto 2026.10.4.Update
kingfisher@latestto 2.11.1.Update
hyperfine@latestto 2.0.0.Update
dprint@latestto 0.61.1.Update
cargo-nextest@latestto 0.9.148.Update
cargo-neat@latestto 0.6.0.Update
cargo-binstall@latestto 1.25.2.v2.87.26: 2.87.26Compare Source
Update
tombi@latestto 1.7.2.Update
prek@latestto 0.5.5.Update
mise@latestto 2026.10.3.Update
kache@latestto 1.0.0.Update
hyperfine@latestto 1.21.0.v2.87.25: 2.87.25Compare Source
Update
uv@latestto 0.12.23.Update
mise@latestto 2026.10.2.Update
kingfisher@latestto 2.10.0.Update
dprint@latestto 0.60.1.Update
cargo-semver-checks@latestto 0.51.0.Update
cargo-binstall@latestto 1.25.1.v2.87.24: 2.87.24Compare Source
Update
wasmtime@latestto 49.0.2.Update
dprint@latestto 0.59.0.Update
cargo-leptos@latestto 0.3.11.Update
cargo-insta@latestto 1.49.0.Update
cargo-binstall@latestto 1.25.0.v2.87.23: 2.87.23Compare Source
Update
wasm-tools@latestto 1.261.0.Update
uv@latestto 0.12.22.Update
trivy@latestto 0.75.0.Update
tombi@latestto 1.7.1.Update
protoc-gen-connect-openapi@latestto 0.28.0.Update
mise@latestto 2026.10.0.Update
kingfisher@latestto 2.9.1.Update
kache@latestto 0.28.1.Update
espup@latestto 0.18.0.Update
dprint@latestto 0.58.0.Update
cargo-crap@latestto 0.6.1.Update
cargo-auditable@latestto 0.7.7.Update
biome@latestto 2.5.15.Update
syft@latestto 1.54.0.zizmorcore/zizmor-action
v0.7.1Compare Source
zizmor changes
Bug Fixes 🐛🔗
action changes
The default version of zizmor is now 1.31.1.
What's Changed
Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1
v0.7.0Compare Source
Sponsorship is appreciated!
zizmor notes
Enhancements 🌱🔗
The typosquat-uses audit now supports pre-commit config inputs (#2437)
The self-hosted-runner audit is now significantly more precise (#2350)
Many thanks to @ubiratansoares for proposing and implementing this enhancement!
The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)
zizmor is now aware of the image_version workflow trigger (#2397)
The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)
The cache-poisoning audit is now aware of pnpm/setup (#2409)
The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)
Many thanks to @ubiratansoares for proposing and implementing this enhancement!
The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)
The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)
zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)
Bug Fixes 🐛🔗
Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#2386)
Many thanks to @marcalexiei for implementing this improvement!
Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#2390)
Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#2394)
Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#2413)
Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#2444)
action notes
What's Changed
New Contributors
Full Changelog: zizmorcore/zizmor-action@v0.6.4...v0.7.0
Configuration
📅 Schedule: (in timezone Europe/Berlin)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.