chore(deps): update all non-major dependencies#219
Open
renovate[bot] wants to merge 1 commit intomasterfrom
Open
chore(deps): update all non-major dependencies#219renovate[bot] wants to merge 1 commit intomasterfrom
renovate[bot] wants to merge 1 commit intomasterfrom
Conversation
![renovate-approve-2[bot]](https://avatars.githubusercontent.com/in/62175?s=60&v=4){kind=small}
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
Contributor
❌MegaLinter analysis: Error
Detailed Issues❌ REPOSITORY / kingfisher - 1 errorSee detailed reports in MegaLinter artifacts Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining
|
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
eabc94b to
d4a268e
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
69234c6 to
2d86663
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
0629740 to
e0f79ae
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
7 times, most recently
from
c722b5f to
ae34964
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
6 times, most recently
from
38e6c61 to
2cfbebd
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
2cfbebd to
64b1cba
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
64b1cba to
0883937
Compare
Contributor
Trivy image scan report
|
| Package | ID | Severity | Installed Version | Fixed Version |
|---|---|---|---|---|
pip |
CVE-2026-1703 | LOW | 25.3 | 26.0 |
No Misconfigurations found
Contributor
Trivy image scan report
|
| Package | ID | Severity | Installed Version | Fixed Version |
|---|---|---|---|---|
pip |
CVE-2026-1703 | LOW | 25.3 | 26.0 |
No Misconfigurations found
Contributor
Trivy image scan report
|
| Package | ID | Severity | Installed Version | Fixed Version |
|---|---|---|---|---|
pip |
CVE-2026-1703 | LOW | 25.3 | 26.0 |
No Misconfigurations found
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v6.0.1→v6.0.2v5.0.1→v5.1.0v5.1.0→v5.2.0v6.1.0→v6.2.00.68.2→0.69.1v7.1.6→v7.3.03.14.2-slim→3.14.3-slimv3.6.0→v3.7.0v4.31.9→v4.32.2v5.0.0→v5.0.1v9.2.0→v9.3.0v2.14.0→v2.14.21.19.0→1.22.0Release Notes
actions/checkout (actions/checkout)
v6.0.2Compare Source
actions/setup-dotnet (actions/setup-dotnet)
v5.1.0Compare Source
What's Changed
Documentation
Dependency updates
New Contributors
Full Changelog: actions/setup-dotnet@v5...v5.1.0
actions/setup-java (actions/setup-java)
v5.2.0Compare Source
What's Changed
Enhancement
Documentation Changes
Dependency Updates
New Contributors
Full Changelog: actions/setup-java@v5...v5.2.0
actions/setup-node (actions/setup-node)
v6.2.0Compare Source
aquasecurity/trivy (aquasecurity/trivy)
v0.69.1Compare Source
Changelog
123888brelease: v0.69.1 [release/v0.69] (#10145)29d3b06ci: add composite action for Go setup [backport: release/v0.69] (#10150)3b30cc7fix(misconf): apply check aliases when filtering results via .trivyignore [backport: release/v0.69] (#10143)a8e279bchore(deps): bump to alpine:3.23.3 and go-1.25.6 to fix CVEs [backport: release/v0.69] (#10135)v0.69.0Compare Source
👉 Trivy v0.69.0 release notes (click here)
⬇️ Download Trivy
🐳 New Docker Install option
docker pull get.trivy.dev/image/trivy:0.69.0Changelog
https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0690-2026-01-30
astral-sh/setup-uv (astral-sh/setup-uv)
v7.3.0: 🌈 New features and bug fixes for activate-environmentCompare Source
Changes
This release contains a few bug fixes and a new feature for the activate-environment functionality.
🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v7.2.1: 🌈 update known checksums up to 0.9.28Compare Source
Changes
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v7.2.0: 🌈 add outputs python-version and python-cache-hitCompare Source
Changes
Among some minor typo fixes and quality of life features for developers of actions the main feature of this release are new outputs:
UV_PYTHON)While implementing this it became clear, that it is easier to handle the Python binaries in a separate cache entry. The added benefit for users is that the "normal" cache containing the dependencies can be used in all runs no matter if these cache the Python binaries or not.
🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
⬆️ Dependency updates
docker/login-action (docker/login-action)
v3.7.0Compare Source
scopeinput to set scopes for the authentication token by @crazy-max in #912registry-authinput by @crazy-max in #911Full Changelog: docker/login-action@v3.6.0...v3.7.0
github/codeql-action (github/codeql-action)
v4.32.2Compare Source
v4.32.1Compare Source
v4.32.0Compare Source
v4.31.11Compare Source
v4.31.10Compare Source
CodeQL Action Changelog
See the releases page for the relevant changes to the CodeQL CLI and language packs.
4.31.10 - 12 Jan 2026
See the full CHANGELOG.md for more information.
gradle/actions (gradle/actions)
v5.0.1Compare Source
What's Changed
npmcode dependency versionsFull Changelog: gradle/actions@v5.0.0...v5.0.1
oxsecurity/megalinter (oxsecurity/megalinter)
v9.3.0Compare Source
Core
New linters
Linters enhancements
Reporters
Doc
CI
Linter versions upgrades (54)
step-security/harden-runner (step-security/harden-runner)
v2.14.2Compare Source
What's Changed
Security fix: Fixed a medium severity vulnerability where outbound network connections using sendto, sendmsg, and sendmmsg socket system calls could bypass audit logging when using egress-policy: audit. This issue only affects the Community Tier in audit mode; block mode and Enterprise Tier were not affected. See GHSA-cpmj-h4f6-r6pq for details.
Full Changelog: step-security/harden-runner@v2.14.1...v2.14.2
v2.14.1Compare Source
What's Changed
In some self-hosted environments, the agent could briefly fall back to public DNS resolvers during startup if the system DNS was not yet available. This behavior was unintended for GitHub-hosted runners and has now been fixed to prevent any use of public DNS resolvers.
Fixed npm audit vulnerabilities
Full Changelog: step-security/harden-runner@v2.14.0...v2.14.1
zizmorcore/zizmor (zizmor)
v1.22.0Compare Source
Changes⚠️ 🔗
shell:findings when running with the "auditor" persona (#1532)Bug Fixes 🐛🔗
v1.21.0Compare Source
New Features 🌈🔗
Enhancements 🌱🔗
zizmor now uses exit code 3 to signal an audit that has failed because no input files were collected. See the exit code documentation for details (#1515)
The unpinned-uses audit now supports auto-fixes for many findings (#1525)
Changes⚠️ 🔗
Bug Fixes 🐛🔗
The unpinned-uses audit now flags reusable workflows that are unpinned, in addition to actions (#1509)
Many thanks to @johnbillion for implementing this fix!
v1.20.0Compare Source
Enhancements 🌱🔗
The excessive-permissions audit is now aware of the artifact-metadata and models permissions (#1461)
The cache-poisoning audit is now aware of the ramsey/composer-install action (#1489)
The unpinned-images audit is now significantly more precise in the presence of matrix references, e.g. image: ${{ matrix.image }} (#1482)
Changes⚠️ 🔗
The default policy for the unpinned-uses audit has changed from allowing ref-pinning for first-party actions (those under actions/* and similar) to requiring hash-pinning. This makes the default policy more strict, as well as more consistent across the actions ecosystem.
Users who with to retain the old (permissive policy) for first-party actions may configure it explicitly in their zizmor.yml:
Bug Fixes 🐛🔗
The dependabot-cooldown audit no longer flags missing cooldowns on ecosystems that don't (yet) support cooldowns, such as opentofu (#1480)
Fixed a false positive in the cache-poisoning audit where zizmor would treat empty strings (e.g. cache: '') as enabling rather than disabling caching (#1482)
Fixed two gaps in the use-trusted-publishing audit's detection of common yarn publishing commands (#1495)
Miscellaneous 🛠🔗
zizmor's configuration now has an official JSON schema that will be available via SchemaStore soon!
Many thanks to @kiwamizamurai for implementing this improvement!
Configuration
📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.