update(deps): update endbug/add-and-commit action to v11

[codesphere-renovate]

This PR contains the following updates:

Package	Type	Update	Change
EndBug/add-and-commit	action	major	v9 → v11

---

Release Notes

EndBug/add-and-commit (EndBug/add-and-commit)

v11.1.1

Compare Source

What's Changed

• docs: highlight untrusted git-arg interpolation as a warning callout by @​EndBug in #​781
• fix: Remove GH var interpolation in action.yml docstring by @​dzcode in #​783
• fix: validate denylisted git args on every token by @​EndBug in #​784

New Contributors

• @​dzcode made their first contribution in #​783

Full Changelog: EndBug/add-and-commit@v11.1.0...v11.1.1

v11.1.0

Compare Source

What's Changed

• feat: add push_attempts to retry failed pushes by @​EndBug in #​764
• test: add integration tests for the shipped action by @​EndBug in #​766
• feat: add dry_run input by @​EndBug in #​765
• docs: add nmattia as a contributor for ideas by @​allcontributors[bot] in #​767
• docs: add jcbhmr as a contributor for ideas by @​allcontributors[bot] in #​768
• fix: reject remote-helper overrides skipped by -u by @​EndBug in #​770
• fix: block scheme:: remote helpers and restrict git transports by @​EndBug in #​771
• fix: resolve absolute cwd without dumping the minified bundle (#​495) by @​EndBug in #​772
• feat: treat pull: true as a default git pull by @​EndBug in #​773
• docs: add ross-spencer as a contributor for bug by @​allcontributors[bot] in #​774
• docs: add louisabraham as a contributor for ideas by @​allcontributors[bot] in #​775
• fix: reject --pathspec-from-file to prevent log disclosure by @​EndBug in #​777
• fix: neutralize workflow-command injection in info logs by @​EndBug in #​776
• fix: reject glued quotes that string-argv would split into extra git flags by @​EndBug in #​778
• chore(deps): bump js-yaml from 5.2.3 to 5.3.0 by @​dependabot[bot] in #​780
• chore(deps-dev): bump @​vercel/ncc from 0.44.1 to 0.45.0 by @​dependabot[bot] in #​779

Full Changelog: EndBug/add-and-commit@v11.0.0...v11.1.0

v11.0.0

Compare Source

What's Changed

• chore(deps): bump picomatch by @​dependabot[bot] in #​724
• chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by @​dependabot[bot] in #​725
• chore(deps): bump lodash from 4.17.23 to 4.18.1 by @​dependabot[bot] in #​728
• chore(deps-dev): bump ts-jest from 29.4.6 to 29.4.9 by @​dependabot[bot] in #​727
• chore(deps): bump @​actions/github from 9.0.0 to 9.1.0 by @​dependabot[bot] in #​729
• chore(deps): bump @​actions/github from 9.1.0 to 9.1.1 by @​dependabot[bot] in #​732
• chore(deps): bump @​actions/core from 3.0.0 to 3.0.1 by @​dependabot[bot] in #​733
• ci(deps): bump actions/dependency-review-action from 4 to 5 by @​dependabot[bot] in #​734
• chore(deps-dev): bump ts-jest from 29.4.9 to 29.4.11 by @​dependabot[bot] in #​736
• chore(deps-dev): bump jest from 30.3.0 to 30.4.2 by @​dependabot[bot] in #​735
• chore(deps-dev): bump eslint-plugin-prettier from 5.5.5 to 5.5.6 by @​dependabot[bot] in #​738
• chore(deps): bump js-yaml from 4.1.1 to 4.2.0 by @​dependabot[bot] in #​739
• ci(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​741
• chore(deps): bump undici from 6.24.1 to 6.27.0 by @​dependabot[bot] in #​744
• ci(deps): bump actions/setup-node from 6 to 7 by @​dependabot[bot] in #​749
• chore(deps-dev): bump @​vercel/ncc from 0.38.4 to 0.44.1 by @​dependabot[bot] in #​746
• chore(deps): bump js-yaml from 4.2.0 to 5.2.1 by @​dependabot[bot] in #​747
• chore(deps-dev): bump ts-jest from 29.4.11 to 29.4.12 by @​dependabot[bot] in #​750
• chore(deps): bump js-yaml from 5.2.1 to 5.2.2 by @​dependabot[bot] in #​751
• chore(deps): bump undici from 6.27.0 to 6.28.0 by @​dependabot[bot] in #​753
• fix: reject remote-helper git flags that enable RCE by @​EndBug in #​754
• fix: prevent git option injection via new_branch by @​EndBug in #​755
• fix: verify committed lib/ matches source in CI by @​EndBug in #​756
• fix: stop logging full git config (credential leak) by @​EndBug in #​758
• fix: reject -F/--file git args that can exfiltrate runner files by @​EndBug in #​759
• fix: reject unmatched quotes in matchGitArgs to prevent flag injection by @​EndBug in #​760
• fix: refuse unexpected gitlinks staged by git add by @​EndBug in #​761
• fix: do not report committed=true for empty commit SHA by @​EndBug in #​757
• ci: pin actions-tagger and restrict release workflow permissions by @​EndBug in #​762
• fix: neutralize bidi and control chars in action logs by @​EndBug in #​763

Full Changelog: EndBug/add-and-commit@v10.0.0...v11.0.0

v11

Compare Source

v10.0.0

Compare Source

What's Changed

• chore(deps-dev): bump husky from 8.0.3 to 9.0.6 by @​dependabot[bot] in #​617
• chore(deps-dev): bump @​typescript-eslint/parser from 6.19.0 to 6.19.1 by @​dependabot[bot] in #​618
• chore(deps-dev): bump prettier from 3.2.4 to 3.2.5 by @​dependabot[bot] in #​619
• chore(deps-dev): bump @​typescript-eslint/eslint-plugin from 6.19.1 to 6.21.0 by @​dependabot[bot] in #​623
• chore(deps-dev): bump @​typescript-eslint/parser from 6.19.1 to 6.21.0 by @​dependabot[bot] in #​624
• chore(deps-dev): bump husky from 9.0.6 to 9.0.11 by @​dependabot[bot] in #​626
• chore: switch to GTS for linting by @​EndBug in #​636
• chore(deps-dev): bump gts from 5.2.0 to 5.3.0 by @​dependabot[bot] in #​637
• chore(deps-dev): bump typescript from 5.2.2 to 5.4.5 by @​dependabot[bot] in #​639
• chore(deps-dev): bump gts from 5.3.0 to 5.3.1 by @​dependabot[bot] in #​642
• chore(deps-dev): bump braces from 3.0.2 to 3.0.3 by @​dependabot[bot] in #​641
• chore(deps-dev): bump typescript from 5.4.5 to 5.5.2 by @​dependabot[bot] in #​644
• Adds examples of input arrays. by @​tommie in #​645
• chore(deps-dev): bump typescript from 5.5.2 to 5.5.3 by @​dependabot[bot] in #​649
• docs: add tommie as a contributor for doc by @​allcontributors[bot] in #​647
• chore(deps-dev): bump husky from 9.0.11 to 9.1.1 by @​dependabot[bot] in #​650
• chore(deps-dev): bump typescript from 5.5.3 to 5.5.4 by @​dependabot[bot] in #​653
• chore(deps-dev): bump husky from 9.1.1 to 9.1.4 by @​dependabot[bot] in #​655
• chore(deps-dev): bump husky from 9.1.4 to 9.1.5 by @​dependabot[bot] in #​659
• chore(deps-dev): bump husky from 9.1.5 to 9.1.6 by @​dependabot[bot] in #​660
• chore(deps-dev): bump typescript from 5.5.4 to 5.6.2 by @​dependabot[bot] in #​661
• chore(deps-dev): bump @​vercel/ncc from 0.38.1 to 0.38.2 by @​dependabot[bot] in #​662
• chore(deps): bump @​actions/core from 1.10.1 to 1.11.1 by @​dependabot[bot] in #​663
• chore(deps-dev): bump typescript from 5.6.2 to 5.6.3 by @​dependabot[bot] in #​664
• chore(deps-dev): bump gts from 5.3.1 to 6.0.0 by @​dependabot[bot] in #​665
• chore(deps-dev): bump gts from 6.0.0 to 6.0.2 by @​dependabot[bot] in #​666
• chore(deps-dev): bump @​vercel/ncc from 0.38.2 to 0.38.3 by @​dependabot[bot] in #​669
• chore(deps): bump cross-spawn by @​dependabot[bot] in #​670
• docs: add icemac as a contributor for doc by @​allcontributors[bot] in #​674
• chore(deps-dev): bump husky from 9.1.6 to 9.1.7 by @​dependabot[bot] in #​672
• chore(deps-dev): bump typescript from 5.6.3 to 5.7.2 by @​dependabot[bot] in #​671
• chore(deps-dev): bump typescript from 5.7.2 to 5.7.3 by @​dependabot[bot] in #​676
• chore(deps-dev): bump eslint-config-prettier from 9.1.0 to 10.0.1 by @​dependabot[bot] in #​677
• chore(deps-dev): bump eslint-config-prettier from 10.0.1 to 10.0.2 by @​dependabot[bot] in #​678
• chore(deps-dev): bump typescript from 5.7.3 to 5.8.2 by @​dependabot[bot] in #​679
• chore(deps-dev): bump eslint-config-prettier from 10.0.2 to 10.1.1 by @​dependabot[bot] in #​680
• chore(deps-dev): bump typescript from 5.8.2 to 5.8.3 by @​dependabot[bot] in #​681
• chore(deps-dev): bump eslint-config-prettier from 10.1.1 to 10.1.2 by @​dependabot[bot] in #​682
• chore(deps-dev): bump eslint-config-prettier from 10.1.2 to 10.1.5 by @​dependabot[bot] in #​683
• chore(deps-dev): bump eslint-config-prettier from 10.1.5 to 10.1.8 by @​dependabot[bot] in #​686
• ci(deps): bump actions/checkout from 4 to 5 by @​dependabot[bot] in #​688
• ci(deps): bump actions/setup-node from 4 to 5 by @​dependabot[bot] in #​690
• chore(deps-dev): bump @​vercel/ncc from 0.38.3 to 0.38.4 by @​dependabot[bot] in #​691
• chore(deps-dev): bump typescript from 5.8.3 to 5.9.3 by @​dependabot[bot] in #​694
• ci(deps): bump actions/setup-node from 5 to 6 by @​dependabot[bot] in #​697
• ci(deps): bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​696
• Removes the redundant JSON array parsing. by @​tommie in #​652
• docs: add tommie as a contributor for code, and test by @​allcontributors[bot] in #​699
• chore(deps): bump js-yaml from 4.1.0 to 4.1.1 by @​dependabot[bot] in #​700
• ci(deps): bump actions/checkout from 4 to 5 by @​dependabot[bot] in #​703
• chore(deps-dev): bump jest and @​types/jest by @​dependabot[bot] in #​701
• ci(deps): bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​702
• ci(deps): bump actions/checkout from 5 to 6 by @​dependabot[bot] in #​704
• Improve documentation around pathspec error behavior by @​tomas-kovanda in #​706
• docs: add tomas-kovanda as a contributor for doc by @​allcontributors[bot] in #​707
• chore(deps-dev): bump ts-jest from 29.4.5 to 29.4.6 by @​dependabot[bot] in #​708
• chore(deps): bump @​actions/core from 1.11.1 to 2.0.1 by @​dependabot[bot] in #​709
• chore(deps): bump @​actions/core from 2.0.1 to 2.0.2 by @​dependabot[bot] in #​711
• chore(deps): bump lodash from 4.17.21 to 4.17.23 by @​dependabot[bot] in #​715
• chore(deps-dev): bump eslint-plugin-prettier from 5.5.4 to 5.5.5 by @​dependabot[bot] in #​712
• chore(deps): bump minimatch by @​dependabot[bot] in #​718
• chore(deps): bump @​actions/core from 2.0.2 to 3.0.0 by @​dependabot[bot] in #​716
• chore(deps-dev): bump jest from 30.2.0 to 30.3.0 by @​dependabot[bot] in #​721
• feat!: use node version 24 by @​CodeReaper in #​720
• chore(deps-dev): bump flatted from 3.3.3 to 3.4.2 by @​dependabot[bot] in #​722
• docs: add CodeReaper as a contributor for maintenance by @​allcontributors[bot] in #​723

New Contributors

• @​tommie made their first contribution in #​645
• @​tomas-kovanda made their first contribution in #​706
• @​CodeReaper made their first contribution in #​720

Full Changelog: EndBug/add-and-commit@v9.1.4...v10.0.0

v10

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.