chore(deps): update workflows by renovate-bot · Pull Request #2869 · google/osv-scanner

renovate-bot · 2026-06-07T17:35:20Z

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/checkout	action	patch	`v6.0.2` → `v6.0.3`
actions/setup-go	action	minor	`v6.3.0` → `v6.5.0`
actions/setup-go	action	minor	`v6.4.0` → `v6.5.0`
actions/upload-artifact	action	patch	`v7.0.0` → `v7.0.1`
docker/setup-buildx-action	action	minor	`v4.0.0` → `v4.1.0`	`v4.2.0`
docker/setup-qemu-action	action	minor	`v4.0.0` → `v4.1.0`	`v4.2.0`
github/codeql-action	action	patch	`v4.36.0` → `v4.36.2`	`v4.36.3`
goreleaser/goreleaser-action	action	minor	`v7.0.0` → `v7.2.2`	`v7.2.3`
ruby/setup-ruby	action	minor	`v1.310.0` → `v1.314.0`	`v1.316.0` (+1)
zizmorcore/zizmor-action	action	patch	`v0.5.6` → `v0.5.7`

Release Notes

actions/checkout (actions/checkout)

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

actions/setup-go (actions/setup-go)

`v6.5.0`

Compare Source

`v6.4.0`

Compare Source

What's Changed

Enhancement

Add go-download-base-url input for custom Go distributions by @gdams in #721

Dependency update

Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in #727

Documentation update

Rearrange README.md, add advanced-usage.md by @priyagupta108 in #724
Fix Microsoft build of Go link by @gdams in #734

New Contributors

@gdams made their first contribution in #721

Full Changelog: actions/setup-go@v6...v6.4.0

actions/upload-artifact (actions/upload-artifact)

`v7.0.1`

Compare Source

What's Changed

Update the readme with direct upload details by @danwkennedy in #795
Readme: bump all the example versions to v7 by @danwkennedy in #796
Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in #797

Full Changelog: actions/upload-artifact@v7...v7.0.1

docker/setup-buildx-action (docker/setup-buildx-action)

`v4.1.0`

Compare Source

Bump @docker/actions-toolkit from 0.79.0 to 0.90.0 in #489
Bump brace-expansion from 1.1.12 to 5.0.6 in #547 #508
Bump fast-xml-builder from 1.0.0 to 1.2.0 in #540
Bump fast-xml-parser from 5.4.2 to 5.8.0 in #496
Bump flatted from 3.3.3 to 3.4.2 in #499
Bump glob from 10.3.12 to 13.0.6 in #495
Bump handlebars from 4.7.8 to 4.7.9 in #504
Bump lodash from 4.17.23 to 4.18.1 in #523
Bump picomatch from 4.0.3 to 4.0.4 in #503
Bump postcss from 8.5.6 to 8.5.10 in #537
Bump tar from 6.2.1 to 7.5.15 in #545
Bump undici from 6.23.0 to 6.25.0 in #492
Bump vite from 7.3.1 to 7.3.2 in #520

Full Changelog: docker/setup-buildx-action@v4.0.0...v4.1.0

docker/setup-qemu-action (docker/setup-qemu-action)

`v4.1.0`

Compare Source

Add reset input to uninstall current emulators by @crazy-max in #21
Bump @docker/actions-toolkit from 0.77.0 to 0.91.0 in #250 #247
Bump brace-expansion from 1.1.12 to 1.1.15 in #265
Bump fast-xml-builder from 1.0.0 to 1.2.0 in #286
Bump fast-xml-parser from 5.4.2 to 5.8.0 in #255
Bump flatted from 3.3.3 to 3.4.2 in #257
Bump glob from 10.3.15 to 10.5.0 in #254
Bump handlebars from 4.7.8 to 4.7.9 in #262
Bump lodash from 4.17.23 to 4.18.1 in #273
Bump postcss from 8.5.6 to 8.5.10 in #285
Bump tar from 6.2.1 to 7.5.15 in #287
Bump tmp from 0.2.5 to 0.2.6 in #291
Bump undici from 6.23.0 to 6.26.0 in #251
Bump vite from 7.3.1 to 7.3.2 in #271

Full Changelog: docker/setup-qemu-action@v4.0.0...v4.1.0

github/codeql-action (github/codeql-action)

`v4.36.2`

Compare Source

Cache CodeQL CLI version information across Actions steps. #3943
Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
Update default CodeQL bundle version to 2.25.6. #3948

`v4.36.1`

Compare Source

No user facing changes.

goreleaser/goreleaser-action (goreleaser/goreleaser-action)

`v7.2.2`

Compare Source

What's Changed

ci(deps): bump the actions group with 3 updates by @dependabot[bot] in #560
fix: nightly resolution to select newest published release by @Copilot in #562

New Contributors

@Copilot made their first contribution in #562

Full Changelog: goreleaser/goreleaser-action@v7...v7.2.2

`v7.2.1`

Compare Source

This fully removes the usage of the old nightly moving tag.

Full Changelog: goreleaser/goreleaser-action@v7.2.0...v7.2.1

`v7.2.0`

Compare Source

What's Changed

test: cover install across release eras by @caarlos0 in #555
feat: add version-file input by @caarlos0 in #556
feat: resolve nightly to latest vX.Y.Z--nightly release by @caarlos0 in #558

Full Changelog: goreleaser/goreleaser-action@v7...v7.2.0

`v7.1.0`

Compare Source

What's Changed

feat: verify release checksum and cosign signature by @caarlos0 in #550
docs: document cosign verification in README by @caarlos0 in #553
docs: Upgrade import GPG action version by @flecno in #547
ci: drop docker-bake in favor of plain npm by @caarlos0 in #551
ci: add release-major-tag workflow by @caarlos0 in #552
ci: drop pre-cosign-v3 goreleaser versions from tests by @caarlos0 in #554
ci(deps): bump the actions group with 2 updates by @dependabot[bot] in #543
ci(deps): bump the actions group with 5 updates by @dependabot[bot] in #546
chore(deps): bump undici from 6.23.0 to 6.24.1 by @dependabot[bot] in #545

New Contributors

@flecno made their first contribution in #547

Full Changelog: goreleaser/goreleaser-action@v7...v7.1.0

ruby/setup-ruby (ruby/setup-ruby)

`v1.314.0`

Compare Source

What's Changed

Add support for ubuntu-26.04 and ubuntu-26.04-arm by @eregon in #923

Full Changelog: ruby/setup-ruby@v1.313.0...v1.314.0

`v1.313.0`

Compare Source

What's Changed

Add jruby-10.0.6.0 by @ruby-builder-bot in #921

Full Changelog: ruby/setup-ruby@v1.312.0...v1.313.0

`v1.312.0`

Compare Source

What's Changed

Use BUNDLE_LOCKFILE when detecting the lockfile by @Thomascountz in #919

New Contributors

@Thomascountz made their first contribution in #919

Full Changelog: ruby/setup-ruby@v1.311.0...v1.312.0

`v1.311.0`

Compare Source

What's Changed

Add jruby-9.4.15.0 by @ruby-builder-bot in #920

Full Changelog: ruby/setup-ruby@v1.310.0...v1.311.0

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

`v0.5.7`

Compare Source

1.26.1 is now available via the action
1.26.1 is now the default version of zizmor used by the action

Configuration

📅 Schedule: (in timezone Australia/Sydney)

Branch creation
- "before 6am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

codecov-commenter · 2026-06-18T19:54:35Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.26%. Comparing base (b56b519) to head (7cc90df).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2869   +/-   ##
=======================================
  Coverage   79.26%   79.26%           
=======================================
  Files         122      122           
  Lines        8279     8279           
=======================================
  Hits         6562     6562           
  Misses       1335     1335           
  Partials      382      382

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

forking-renovate Bot added the dependencies Pull requests that update a dependency file label Jun 7, 2026

renovate-bot force-pushed the renovate/workflows branch 6 times, most recently from 5c66504 to 765a2cb Compare June 16, 2026 01:08

renovate-bot force-pushed the renovate/workflows branch from 765a2cb to 7cc90df Compare June 18, 2026 19:39

renovate-bot force-pushed the renovate/workflows branch 2 times, most recently from f2f3a63 to 9b42967 Compare June 29, 2026 00:36

chore(deps): update workflows

dbd571e

renovate-bot force-pushed the renovate/workflows branch from 9b42967 to dbd571e Compare July 1, 2026 22:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update workflows#2869

chore(deps): update workflows#2869
renovate-bot wants to merge 1 commit into
google:mainfrom
renovate-bot:renovate/workflows

renovate-bot commented Jun 7, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Jun 18, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

renovate-bot commented Jun 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

Enhancement

Dependency update

Documentation update

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

Configuration

Uh oh!

codecov-commenter commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

renovate-bot commented Jun 7, 2026 •

edited

Loading

codecov-commenter commented Jun 18, 2026 •

edited

Loading