Update Actions (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
EndBug/add-and-commit	action	major	v10 → v11
actions/checkout	action	major	v6 → v7

---

Release Notes

EndBug/add-and-commit (EndBug/add-and-commit)

v11.1.1

Compare Source

What's Changed

• docs: highlight untrusted git-arg interpolation as a warning callout by @​EndBug in #​781
• fix: Remove GH var interpolation in action.yml docstring by @​dzcode in #​783
• fix: validate denylisted git args on every token by @​EndBug in #​784

New Contributors

• @​dzcode made their first contribution in #​783

Full Changelog: EndBug/add-and-commit@v11.1.0...v11.1.1

v11.1.0

Compare Source

What's Changed

• feat: add push_attempts to retry failed pushes by @​EndBug in #​764
• test: add integration tests for the shipped action by @​EndBug in #​766
• feat: add dry_run input by @​EndBug in #​765
• docs: add nmattia as a contributor for ideas by @​allcontributors[bot] in #​767
• docs: add jcbhmr as a contributor for ideas by @​allcontributors[bot] in #​768
• fix: reject remote-helper overrides skipped by -u by @​EndBug in #​770
• fix: block scheme:: remote helpers and restrict git transports by @​EndBug in #​771
• fix: resolve absolute cwd without dumping the minified bundle (#​495) by @​EndBug in #​772
• feat: treat pull: true as a default git pull by @​EndBug in #​773
• docs: add ross-spencer as a contributor for bug by @​allcontributors[bot] in #​774
• docs: add louisabraham as a contributor for ideas by @​allcontributors[bot] in #​775
• fix: reject --pathspec-from-file to prevent log disclosure by @​EndBug in #​777
• fix: neutralize workflow-command injection in info logs by @​EndBug in #​776
• fix: reject glued quotes that string-argv would split into extra git flags by @​EndBug in #​778
• chore(deps): bump js-yaml from 5.2.3 to 5.3.0 by @​dependabot[bot] in #​780
• chore(deps-dev): bump @​vercel/ncc from 0.44.1 to 0.45.0 by @​dependabot[bot] in #​779

Full Changelog: EndBug/add-and-commit@v11.0.0...v11.1.0

v11.0.0

Compare Source

What's Changed

• chore(deps): bump picomatch by @​dependabot[bot] in #​724
• chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by @​dependabot[bot] in #​725
• chore(deps): bump lodash from 4.17.23 to 4.18.1 by @​dependabot[bot] in #​728
• chore(deps-dev): bump ts-jest from 29.4.6 to 29.4.9 by @​dependabot[bot] in #​727
• chore(deps): bump @​actions/github from 9.0.0 to 9.1.0 by @​dependabot[bot] in #​729
• chore(deps): bump @​actions/github from 9.1.0 to 9.1.1 by @​dependabot[bot] in #​732
• chore(deps): bump @​actions/core from 3.0.0 to 3.0.1 by @​dependabot[bot] in #​733
• ci(deps): bump actions/dependency-review-action from 4 to 5 by @​dependabot[bot] in #​734
• chore(deps-dev): bump ts-jest from 29.4.9 to 29.4.11 by @​dependabot[bot] in #​736
• chore(deps-dev): bump jest from 30.3.0 to 30.4.2 by @​dependabot[bot] in #​735
• chore(deps-dev): bump eslint-plugin-prettier from 5.5.5 to 5.5.6 by @​dependabot[bot] in #​738
• chore(deps): bump js-yaml from 4.1.1 to 4.2.0 by @​dependabot[bot] in #​739
• ci(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​741
• chore(deps): bump undici from 6.24.1 to 6.27.0 by @​dependabot[bot] in #​744
• ci(deps): bump actions/setup-node from 6 to 7 by @​dependabot[bot] in #​749
• chore(deps-dev): bump @​vercel/ncc from 0.38.4 to 0.44.1 by @​dependabot[bot] in #​746
• chore(deps): bump js-yaml from 4.2.0 to 5.2.1 by @​dependabot[bot] in #​747
• chore(deps-dev): bump ts-jest from 29.4.11 to 29.4.12 by @​dependabot[bot] in #​750
• chore(deps): bump js-yaml from 5.2.1 to 5.2.2 by @​dependabot[bot] in #​751
• chore(deps): bump undici from 6.27.0 to 6.28.0 by @​dependabot[bot] in #​753
• fix: reject remote-helper git flags that enable RCE by @​EndBug in #​754
• fix: prevent git option injection via new_branch by @​EndBug in #​755
• fix: verify committed lib/ matches source in CI by @​EndBug in #​756
• fix: stop logging full git config (credential leak) by @​EndBug in #​758
• fix: reject -F/--file git args that can exfiltrate runner files by @​EndBug in #​759
• fix: reject unmatched quotes in matchGitArgs to prevent flag injection by @​EndBug in #​760
• fix: refuse unexpected gitlinks staged by git add by @​EndBug in #​761
• fix: do not report committed=true for empty commit SHA by @​EndBug in #​757
• ci: pin actions-tagger and restrict release workflow permissions by @​EndBug in #​762
• fix: neutralize bidi and control chars in action logs by @​EndBug in #​763

Full Changelog: EndBug/add-and-commit@v10.0.0...v11.0.0

v11

Compare Source

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v7

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.